The FedRAMP assessment includes:

• Manual security controls assessment against NIST SP 800-53 Revision 4 (scope dependent on system impact level and control inheritance)
• Vulnerability scanning (of all operating systems, network devices, databases and web applications)
• Penetration testing

Each of these are documented in the security assessment report (SAR), which is provided to the FedRAMP Joint Authorization Board (JAB) or sponsoring agency to make a decision regarding issuance of an ATO.

If you want to serve Department of Defense (DoD) clients, you must meet the DoD Cloud Security Requirements Guide (SRG) for the designated impact level. This is an additional service that can be done in parallel with a FedRAMP assessment for a moderate impact level system or higher.

A FedRAMP assessment is more rigorous than a FISMA assessment as illustrated by the additional control and control enhancements that must be implemented and assessed.