When Federal Programs Require or Recommend a FedRAMP 3PAO

FedRAMP exists to authorize cloud services for use by federal agencies. But several federal programs borrow parts of FedRAMP for their own purposes. Some require the FedRAMP authorization itself. Others draw on the pool of FedRAMP-recognized Third Party Assessment Organizations (3PAOs) to assess a different set of controls.

The wording matters. “Must be FedRAMP authorized,” “must be attested by a 3PAO,” and “CMS strongly recommends a FedRAMP 3PAO” create three different obligations. This guide explains how three programs use that language and what it does and does not require. It does not mean every federal program requires a FedRAMP assessment; most federal contractors and grant recipients never need one.

Three ways a program can reference FedRAMP

When a federal program mentions FedRAMP, it is usually doing one of three things:

1. Requiring a FedRAMP-authorized cloud service. The cloud service offering itself must hold a FedRAMP authorization at a stated impact level.
2. Requiring a 3PAO attestation against named controls. The organization does not obtain a FedRAMP authorization, but a FedRAMP-recognized 3PAO must attest to specific controls.
3. Recommending a FedRAMP 3PAO as the independent auditor. Any qualified independent auditor can perform the assessment, but the program prefers one with FedRAMP 3PAO credentials. The assessment is against the program's own baseline.

IRS Federal Tax Information (FTI) in the cloud

Agencies that receive, transmit, store or process Federal Tax Information (FTI) must follow IRS Publication 1075. For cloud environments, the IRS states that the agency must use a cloud service offering that is FedRAMP authorized at the moderate impact level. The IRS also states that the cloud solution must undergo a complete assessment under the FedRAMP authorization framework by an authorized 3PAO. The agency must also notify the IRS Office of Safeguards at least 45 days before transmitting FTI into a cloud environment.

This is the strictest of the three examples, but it has a second half that is easy to miss. The IRS says plainly that FedRAMP authorization alone, or a 3PAO attestation, does not satisfy Publication 1075's cloud requirements. The agency still owns the Publication 1075 controls: encryption that prevents disclosure to cloud provider staff, restrictions on commingling, required contract language, notification content and ongoing safeguards. A FedRAMP-authorized provider is the entry ticket, not the finish line.

Who this affects in practice: state and local agencies that receive FTI, their contractors, and the cloud and SaaS providers that serve them.

CMS Enhanced Direct Enrollment and Non-Exchange Entities

CMS's Enhanced Direct Enrollment (EDE) program lets approved entities enroll consumers in Marketplace coverage through their own websites. The EDE audit guidelines for Year 9 (Plan Years 2026 and 2027, published April 10, 2026) require prospective primary EDE entities to engage one or more independent auditors for two audits: a business requirements audit and a privacy and security audit. Existing entities complete an annual assessment of security and privacy controls by an auditor as part of continuous monitoring.

On auditor selection, CMS says it strongly recommends that the auditor for the privacy and security audit be listed as a FedRAMP-certified 3PAO, and that it also recommends prior FISMA experience. The auditor must be capable of performing penetration testing and vulnerability scans. CMS's earlier Non-Exchange Entity framework for independent assessment uses the same “strongly recommends” language for Non-Exchange Entities that connect to the CMS Data Services Hub.

The control baseline is not FedRAMP. The Year 9 guidelines point to ARC-AMPE (Acceptable Risk Controls for ACA, Medicaid, and Partner Entities), which is built on NIST SP 800-53 Rev. 5. So a FedRAMP 3PAO is the preferred assessor, but it assesses ARC-AMPE controls, and the outcome is a CMS audit result, not a FedRAMP authorization.

Who this affects: EDE entities such as web-brokers and issuers, their technology providers, and other Non-Exchange Entities in scope for CMS privacy and security requirements.

BIS Data Center Validated End User (VEU)

The Bureau of Industry and Security (BIS) runs the Validated End User program under 15 CFR 748.15. Data centers that apply for Data Center VEU authorization to receive certain advanced computing items must follow the guidelines in Supplement No. 10 to Part 748.

Paragraph 14 of Supplement No. 10 requires data center security consistent with NIST SP 800-53 and the security requirements associated with FedRAMP High, and it names specific controls. It then requires that compliance be attested annually by a 3PAO that is accredited and recognized by the FedRAMP Program Management Office and has completed the certification of a FedRAMP High cloud service provider. The attestation must be available to BIS.

This is a narrow requirement. It applies only to data centers seeking this specific export authorization, not to cloud providers or federal contractors generally. BIS export rules for advanced computing have changed several times, so confirm the current text in the eCFR before relying on any specific paragraph.

Side-by-side comparison

A 3PAO assessment is not a FedRAMP authorization

A program can use a 3PAO to assess additional controls without requiring the organization to obtain a FedRAMP authorization. A CMS privacy and security audit or a BIS attestation performed by a FedRAMP-recognized 3PAO does not put the organization on the FedRAMP Marketplace, does not create an agency Authorization to Operate, and does not transfer to other programs.

The reverse is also true. Hosting on a FedRAMP-authorized cloud provider helps, because many infrastructure controls can be inherited. But the provider's authorization covers the provider's service, not the application, data handling and operations you build on top of it. Programs such as Publication 1075 and ARC-AMPE expect you to show your own layer.

How to read a federal requirement that mentions FedRAMP

Before you budget for a 3PAO or a FedRAMP effort, read the source text and answer these questions:

• Does it say “must,” or “recommends”?
• Whose system is in scope: the cloud provider's service, or your organization's system?
• Which baseline is assessed: FedRAMP, ARC-AMPE, Publication 1075, or a named list of NIST SP 800-53 controls?
• How often: once before go-live, annually, or continuously?
• Who receives the result: an agency, a program office such as CMS or BIS, or the FedRAMP PMO?
• Does the assessor need specific credentials, such as FedRAMP High experience?

Where ControlSolid fits

ControlSolid helps organizations prepare for these assessments. Engagements typically cover scoping the system boundary, mapping controls across the applicable baseline (FedRAMP, ARC-AMPE, Publication 1075 or NIST SP 800-53), automating evidence collection, tracking remediation, and preparing for the auditor. When an independent assessment is required, it is performed by a qualified 3PAO partner. ControlSolid is not a 3PAO and does not issue FedRAMP authorizations, program approvals or Authorizations to Operate.

See our FedRAMP Readiness Assessment & Gap Analysis service, FedRAMP 20x Readiness & GRC Engineering, and the guide to FedRAMP evidence and reporting.

Frequently asked questions

Primary sources

• IRS, Cloud computing environment (Publication 1075 cloud requirements)
• CMS, Guidelines for Enhanced Direct Enrollment audits, Year 9
• CMS, Non-Exchange Entity framework for independent assessment
• BIS, EAR Part 748, including § 748.15 (Validated End User)
• eCFR, Supplement No. 10 to Part 748 (Data Center VEU guidelines)

This article is general guidance, not legal advice. Program requirements change; confirm the current official text and your specific obligations with the responsible agency or program office.