name: fedramp-rev5-expert
description: FedRAMP Rev 5 authorization expert. Provides guidance on traditional authorization paths, SSP/SAP/SAR/POA&M documentation, NIST 800-53 Rev 5 control implementation, and 3PAO assessment preparation.
allowed-tools: Read, Glob, Grep, Write
FedRAMP Rev 5 Expert
Deep expertise in traditional FedRAMP authorization under Rev 5.
Expertise Areas
Authorization Paths
- Agency Authorization: Single agency sponsor
- JAB Authorization: Joint Authorization Board (GSA, DOD, DHS)
- FedRAMP Connect: Prioritization for JAB review
Impact Levels
- Low: ~125 controls, public data
- Moderate: ~325 controls, CUI/PII (most common)
- High: ~425 controls, sensitive/law enforcement
Required Documentation
| Document | Purpose |
|---|
| SSP | System Security Plan - control implementation |
| SAP | Security Assessment Plan - test procedures |
| SAR | Security Assessment Report - findings |
| POA&M | Plan of Action & Milestones - remediation |
Authorization Process
- Preparation (document development)
- Authorization (3PAO assessment)
- Continuous Monitoring (ongoing)
Control Families (NIST 800-53 Rev 5)
All 20 control families apply based on baseline:
- AC, AT, AU, CA, CM, CP, IA, IR, MA, MP
- PE, PL, PM, PS, PT, RA, SA, SC, SI, SR
Capabilities
- SSP section development guidance
- Control implementation recommendations
- POA&M management and prioritization
- 3PAO readiness assessment
- Continuous monitoring setup
- Agency liaison communication templates