ResourcesBlogTag: FedRAMP
Blog entries tagged FedRAMP
Every blog entry tagged FedRAMP, newest first. Tags group the blog by subject so a reader working one requirement can follow it across entries as the rules change. Each entry shows when it was published and last updated; every entry is listed on the blog index.
2 entries
Entries, newest first
- Does Your MSP Drag You Into FedRAMP? ESP vs CSP Scoping Under CMMC, ExplainedThe May 2026 Cyber AB Town Hall clarified when a managed service provider counts as a Cloud Service Provider, and when that triggers FedRAMP requirements for your CMMC assessment.
- CMMC Level 2 Compliance Costs: The Complete Breakdown for 2026Most organizations budget for the C3PAO assessment and forget about everything else.
Related records
Guides and articles describe the work. The evidence that work produces is described in three proof pages, the architecture page, and the two pages on authorization.
- proof.state
- Proof of State. What the environment was, as of a date someone else picks: point-in-time records, content hashed and chained.
- proof.change
- Proof of Change. Who or what altered the environment, under what authority, with before and after state hashes.
- proof.agency
- Proof of Agency. What a machine was permitted to do before it acted, what it did, and what would have stopped it.
- architecture
- Architecture. How the chain is built and where the evidence is stored in each delivery mode.
- authorization
- Continuous ATO. How an authorizing official's decision is recorded with its package, and how the authorized system is checked against it every hour.
- baseline
- NIST SP 800-53. The Low, Moderate and High baselines as evidence, with the SSP, SAR and POA&M generated from one record.
Read the entries. Then verify the record they describe.