FedRAMP accelerated authorizes first provider in 15 weeks

Microsoft Customer Relationship Manager Online has crossed the Federal Risk and Authorization Management Program authorization finish line, becoming the first cloud service provider to do so under the program’s new accelerated process.

Microsoft’s Customer Relationship Manager Online last week became the first cloud service provider to receive Federal Risk and Authorization Management Program authorization through its new “accelerated” program, doing so in just a fraction of the time the program used to take.

[Read more: Exclusive: FedRAMP embraces the need for speed]

FedRAMP Director Matt Goodrich said the cloud service provider received a provisional authority to operate on Sept. 22. after only 15 weeks. Before moving to the accelerated process, getting authorized took anywhere from nine months to two years, Goodrich told FedScoop.

The goal for the new accelerated process was to get companies authorized in less than six months, he said. 


Getting authorized in less than four months is an “aggressive and fast” timeline, Goodrich said, given the number of security controls that need to be examined.

A big driver in the reduced timeline, Goodrich said, was moving from an initial documentation-based assessment before assessing capabilities to the program’s new FedRAMP readiness assessment that focuses initially on capabilities validated by a third-party assessment organization.

The last provider authorized before Microsoft took 40 weeks to move from documentation reviews to capability reviews, whereas it took Microsoft only 10 weeks, according to a blog post by Goodrich.

Goodrich also noted that moving from a waterfall approach — first looking at documentation, then testing and reviewing risks — to a more agile, iterative review process cut down on time to authorization.

Two other organizations are currently going through the accelerated process: Unisys with its Secure Private Cloud for Government and Edge for Government products, and 18F with its service. 


Goodrich told FedScoop he expects both to be authorized by the end of the calendar year.

Samantha Ehlinger

Written by Samantha Ehlinger

Samantha Ehlinger is a technology reporter for FedScoop. Her work has appeared in the Houston Chronicle, Fort Worth Star-Telegram, and several McClatchy papers, including Miami Herald and The State. She was a part of a McClatchy investigative team for the “Irradiated” project on nuclear worker conditions, which won a McClatchy President’s Award. She is a graduate of Texas Christian University. Contact Samantha via email at, or follow her on Twitter at @samehlinger. Subscribe to the Daily Scoop for stories like this in your inbox every morning by signing up here:

Latest Podcasts