FedRAMP

In 2022, the FedRAMP Authorization Act was signed into law as part of the FY23 National Defense Authorization Act ("NDAA"). Cloud Service Providers ("CSPs") can be a part of the FedRAMP Marketplace by working with an Agency to obtain an Authority to Operate ("ATO"). A full security assessment is conducted by a Third Party Assessment Organization ("3PAO") which includes control testing, validation, and a complete review of a CSP's FedRAMP Authorization Package. After a CSP is authorized and is part of the FedRAMP Marketplace, CSPs participate in a continuous monitoring phase (58 controls) based on NIST SP 800-137. In order to maintain an ATO, CSPs must go through an assessment with a 3PAO for a subset of controls every year.

For more information, visit the FedRAMP resources page.

Cloudflare maintains FedRAMP Moderate authorization, allowing federal agencies to adopt Cloudflare's performance, security and Zero Trust solutions. Cloudflare for Government has been FedRAMP Moderate Authorized since 2022.

• Cloudflare's FedRAMP Moderate authorized services are defined by over 325 NIST 800-53 controls; a standardized security framework. (Note: it is not a 100% 1-1 mapping of all NIST 800-53 controls).
• Cloudflare is subject to rigorous continuous monitoring that increases transparency, identification and mitigation of security vulnerabilities promptly.
• Using Cloudflare's FedRAMP Moderate authorization package, customers can meet federal compliance requirements.
• FedRAMP uses a shared responsibility model therefore customers can inherit specific controls which can lead to efficiency and reduce complexity.

Application Services: API Shield, Bot Management, DDoS Protection, Rate Limiting, SSL/TLS, Turnstile, WAF, SSL/TLS for SaaS, CDN, DNS, Load Balancing, Tiered Cache, Waiting Room

Zero Trust Services: Access, Argo Tunnel, Browser Isolation, CASB, Cloudflare Tunnel, Cloudflare Zero Trust, Gateway, Zero Trust WARP Client

Network Services: Magic WAN, Magic Transit, Magic Firewall, Network Interconnect, Spectrum

Developer Platform: Cache Reserve, Cloudflare Images, Cloudflare for SaaS, Durable Objects, R2, Stream, Workers, Workers KV, Hyperdrive

Analytics and Insights: Analytics, Cloudflare Web Analytics, Logs

Privacy and Compliance: Data Localization

Cloudflare continuously introduces new features/functions across our platform throughout the year. We introduce those to our FedRAMP Moderate scope depending on the annual assessment cycle.

Customers must review the Control Implementation Summary ("CIS") and Customer Responsibility Matrix ("CRM") Workbook. The workbook describes customer (Agency) and Cloudflare's responsibilities. The workbook will outline what controls can be inherited from Cloudflare's FedRAMP Moderate offering (Cloudflare for Government). Agencies will be responsible for controls labeled as "Partial" and "No."

Requests can be made using the "Package Access Request Form" from the Cloudflare for Government listing in the FedRAMP Marketplace.

Contact your account executive or a member of the sales team for additional questions.

Visit Cloudflare's Trust Hub to learn about additional compliance resources.

Learn more about how Cloudflare's connectivity cloud capabilities help enterprises streamline and map to compliance requirements across multiple standards by visiting our data compliance and protection page.