FedRAMP
ComplianceDefinition
The Federal Risk and Authorization Management Program, a US government standard for security assessment and authorization of cloud services used by federal agencies. Design implication: use authorized cloud environments and controls appropriate to the workload's authorization level for any Claude deployment serving government workloads.
Tested in: CCAR-P
Why It Matters for the CCA-F Exam
CCAR-P governance scenarios mention US federal or public-sector constraints. The tested skill is recognizing that FedRAMP authorization is an environment and data-path choice, not a checkbox in a prompt.
In Depth
FedRAMP (Federal Risk and Authorization Management Program) is the US government standard for authorizing cloud services used by federal agencies. It is not a Claude feature flag. If your system will handle federal data, the Claude path you pick has to run in an authorized environment with the controls that authorization assumed — networking, logging, identity, and data residency included.
Why this appears on the Professional exam
Architect Professional tests whether you can refuse a convenient default. The public Claude API and a developer's local Claude Code session are the wrong answers when the scenario names federal data, FedRAMP, or an agency ATO. The right answer is to use the offering and region that the organisation has authorized, keep data in the approved boundary, and not open a side channel (a personal API key, an unsanctioned MCP server, a laptop paste).
Design implications
- Environment, not prompt wording. You cannot "FedRAMP-comply" a call by adding instructions in CLAUDE.md. Authorization attaches to the service, the stack, and the operator's controls.
- No shadow tools. An MCP server that dumps tickets to a personal SaaS, or a Skill that posts logs to an unauthorized webhook, punches a hole in the boundary even if the model call itself is clean.
- Shared responsibility. FedRAMP authorization of a cloud model does not automatically authorize your retrieval index, your eval warehouse, or your browser extension. Each processor in the path needs a decision.
- When the answer is "don't." If the only available path is an unauthorized public endpoint, the architect's job is to block the use case until an authorized path exists — not to ship a prototype "just for internal demo" on production federal data.
FedRAMP sits next to GDPR and HIPAA on the exam as a regulatory constraint that changes architecture, not as trivia about what the acronym expands to. Pair it with capability-bloat thinking: extra tools are extra processors. See GDPR and Capability bloat.
Frequently Asked Questions
Can I make a Claude app FedRAMP-ready by adding a system prompt about federal data?
No. FedRAMP is about the authorized environment and the data path. Prompt instructions do not change where the bytes go or which service is authorized.
Does an authorized Claude endpoint cover my retrieval database too?
No. Each processor in the path — retrieval index, logs, MCP servers, eval storage — needs its own decision. Authorization of the model endpoint is not authorization of every tool you bolt on.