FedRAMP became a statute, not just a policy memo, in 2022

The record

H.R.7776, the James M. Inhofe National Defense Authorization Act for Fiscal Year 2023, became Public Law No. 117-263 on 23 December 2022, and Congress's own list of short titles enacted within that law includes the “FedRAMP Authorization Act” as its own named provision. The bill's own summary, prepared for the congressional record, describes that provision as “providing statutory authority for FedRAMP, a government-wide program that provides a standardized approach to security assessment, authorization, and continuous monitoring for cloud products and services.” Before this law, FedRAMP operated under a 2011 Office of Management and Budget policy memorandum rather than an act of Congress. The program's own current site shows it operating today as a marketplace of authorized cloud offerings with periodically updated program rules.

What the documents establish

Congress's bill page and titles page are the legislative record: they establish the enactment date, the public law number, and the fact that “FedRAMP Authorization Act” is one of many short titles bundled inside a single, much larger defense authorization act rather than a standalone statute Congress passed on its own. The bill summary is Congress's own description of what the provision does, written for members and the public rather than the statute's operative text, but it directly answers the question of what changed: FedRAMP moved from a policy memorandum to a codified, government-wide statutory program covering assessment, authorization and continuous monitoring together, not authorization as a one-time event.

The operating read

A vendor treating FedRAMP authorization as a certificate earned once and then held indefinitely is reading the wrong half of the statute's own description: continuous monitoring is named alongside assessment and authorization as part of what the Act gave standing to, not as a separate afterthought. This is editorial: because FedRAMP's own current site shows an actively evolving rules process, a cloud vendor selling to federal agencies should treat an authorization as a standing obligation with ongoing monitoring and reporting duties, not a static credential to list once on a sales page, and should confirm which version of FedRAMP's current requirements applies to its authorization path before assuming an older description still holds.

What to check before you decide

Before treating a FedRAMP authorization as settled or planning toward one, check the following:

• Which current FedRAMP rules and continuous-monitoring obligations apply to the specific authorization path being pursued, per FedRAMP's own current site?
• Does the sales or compliance claim describe FedRAMP authorization as ongoing, with monitoring duties, rather than as a one-time achievement?
• Is the authorization sought an agency authorization or a Joint Authorization Board authorization, since each carries different sponsoring and review requirements?

This describes the FedRAMP Authorization Act's enactment and FedRAMP's current program status as retrieved on 16 September 2026, not compliance advice; FedRAMP's own current rules govern any specific authorization.