FedRAMP Moderate Equivalency Explained: What CSPs Need to Know

Looking back, 2024 was a significant year for the Department of Defense (DoD). Not only did they release the 32 CFR Part 170 – Cybersecurity Maturity Model Certification (CMMC) Final Rule, but the DoD also published a pivotal memorandum titled Federal Risk and Authorization Management Program (FedRAMP) Moderate Equivalency for Cloud Service Provider’s (CSP) Cloud Service Offerings (CSOs).  

The latter development clarified requirements for CSOs who are currently or plan to start storing, processing, or transmitting Covered Defense Information (CDI)—more commonly referred to as Controlled Unclassified Information (CUI). However, there are some important nuances that must be understood.  

If your organization handles Security Protection Data (SPD) or provides assets, systems, or functionality to support CUI as a CSP or CSO, it’s critical to understand how this memorandum impacts your FedRAMP responsibilities. For further context, reference our breakdown of the CMMC Final Rule and its implications in What DoD Contractors Need to Know About the 32 CFR CMMC Rule and Its Effect on Vendors. 

Why the DoD Issued FedRAMP Moderate Equivalency Guidance

Notably, this isn’t the first major step toward this determination. Back in 2016, when the DFARS 252.204-7012 clause was revised, the DoD acknowledged the idea that members of the Defense Industrial Base (DIB)—more specifically DoD contractors—might choose to put CUI in the cloud. Considering that the DoD must meet a minimum of FedRAMP Moderate or DoD IL2 requirements to put data in a CSO, there became a related need to require contractors who choose to put CUI in the cloud to also ensure that CUI is stored, processed, or transmitted with the same standard of protection. And so, the clause was revised to state: 

“If the Contractor intends to use an external cloud service provider to store, process, or transmit any covered defense information in performance of this contract, the Contractor shall require and ensure that the cloud service provider meets security requirements equivalent to those established by the Government for the Federal Risk and Authorization Management Program (FedRAMP) Moderate baseline.” 

Ever since, there’s been friendly debate in the IT audit community and among the DIB on what would be necessary or acceptable to meet what was laid out in the above statement—particularly regarding the term “equivalent.” 

But now, the DoD’s memorandum has finally clarified expectations as it relates to FedRAMP Moderate Equivalency, and as the #1 3PAO provider of FedRAMP assessments, we’re here to help you better understand. In this article, we’ll summarize the memo, including what documentation is required to demonstrate equivalency, how equivalency is validated, and why simply getting FedRAMP Authorized may not be the best alternate solution. 

We hope this information will assist DIB contractors in determining what their CSPs must do to comply with DFARS clause 252.204-7012—as will the additional context provided by the 32 CFR CMMC Final Rule—including how DIB contractors determine which CSPs to do business with as it pertains to the handling of CUI by the CSP. 

How to Achieve FedRAMP Moderate Equivalency

In short, the memorandum dictates that CSOs can obtain FedRAMP Moderate equivalency by: 

• Achieving 100% compliance—i.e., zero findings—with the latest FedRAMP Moderate security control baseline 
• Having that compliance assessed by a FedRAMP-recognized and accredited Third-Party Assessment Organization (3PAO) 
• Presenting the body of evidence (BoE)—i.e., supporting documentation—to the contractor (i.e., member of the DIB) 

As simple as these requirements may seem, achieving 100% compliance with the FedRAMP Moderate baseline to demonstrate equivalency will be extremely challenging because the DoD is serious about that 100%— CSPs must fully implement all 323 controls within the FedRAMP Moderate baseline and your 3PAO assessment must yield zero control findings.* 

*While DoD requirements for FedRAMP Moderate Equivalency do not allow for POA&Ms resulting from a 3PAO assessment, CSPs are allowed to have operational POA&Ms. Additionally, terms that have historically been important in DoD contractor compliance discussions such as “temporary deficiency" and “enduring exception" have no bearing on FedRAMP or FedRAMP Equivalency discussions.  

Why Not Just Get FedRAMP Authorized?

And, if that’s the case, you may be thinking, “Why not just go ahead and pursue a FedRAMP Authorization to Operate (ATO)? Why consider the equivalency path at all?” After all, CSOs seeking a FedRAMP Authorization—a process that involves finding a sponsor and federal agency/FedRAMP PMO reviews—do not require 100% compliance as the equivalency option does. 

And while the small leniency concerning findings may seem attractive, CSPs should also consider that the FedRAMP ATO process—including the effort to find an agency sponsorship* and the subsequent steps in the process—is time-consuming, rigorous, and requires additional review from the FedRAMP PMO. 

*On March 24, 2025, FedRAMP made a public announcement outlining its vision for the program's future – known as FedRAMP 20x. This vision includes significant changes to the existing process with the goal of making FedRAMP more accessible to a wider range of cloud service providers (CSPs). For more information on the vision, read our breakdown.

What Documentation is Necessary for FedRAMP Equivalency in CMMC? 

So then, if you, as a CSP, instead decide to move forward with obtaining FedRAMP equivalency for your CSO through 100% compliance with the Moderate baseline, you’ll need to make the comprehensive control implementations, have those assessed by a 3PAO applying standard FedRAMP assessment methodology, undergo a penetration test of the CSO, and provide a BoE to your DIB contractor. But what comprises that BoE? 

As it relates to FedRAMP Moderate Equivalency, the following documentation must be included or obtained as part of your FedRAMP assessment and provided to DIB contractors to demonstrate equivalency with the Moderate baseline: 

While the DIB contractor must validate that the BoE the CSP provides meets the FedRAMP Moderate Equivalent standards, the DIB contractor must also ensure the following obligations are (or will be) met: 

• Endorse the use of the CSO by their organization and confirm that the selected CSP has an incident response plan. 
• Ensure the CSP follows the incident response plan, including notifying the contractor in the event of an issue. 
• Report any compromise of the CSO in accordance with the applicable contract terms and conditions, as the memorandum dictates that the contractor—not the CSP’s CSO—will be held responsible. 

FedRAMP Equivalency Validation - Who is Responsible for What? 

Once the CSP has fully implemented the 323 controls FedRAMP Moderate in their CSO, has achieved 100% compliance with the baseline per the 3PAO’s assessment, and has provided their BoE to their DIB contractor, the DIB contractor must provide the BoE to their C3PAO during a CMMC Level 2 Certification Assessment. 

As FedRAMP Moderate Equivalency is heavily tied to the 32 CFR CMMC Final Rule, the C3PAO must review the BoE from the CSO's FedRAMP equivalency assessment to ensure that the BoE is comprehensive, timely, and the results are accepted as equivalent by the DIB contractor. 

What’s Still Unclear About FedRAMP Moderate Equivalency 

As much clarification as this memorandum provided about the opportunity for CSPs to demonstrate their CSO’s FedRAMP Moderate Equivalency to the DIB, some things have yet to be fully and clearly incorporated into this avenue: 

• While the memorandum did outline an initial process for demonstrating equivalency, it did not clearly indicate how often a CSP’s CSO would need to undergo subsequent assessments by a FedRAMP-recognized 3PAO and whether the full Moderate baseline would need to be assessed again or if following the traditional FedRAMP process for Authorization by undergoing annual assessments and ensuring that all controls from the Moderate baseline are tested over a 3 year period is sufficient. 
• Though the CA-8(2) control for Red Teaming exercises* was added to the requisite controls in the Moderate Baseline as part of FedRAMP’s transition to Revision 5, the memorandum made no indication of the deliverables associated with these exercises whether they’re performed internally by the CSP or the 3PAO or another third-party. 

*Red Team exercises simulate attempts by real attackers to compromise the system and extend farther than the traditional penetration test. 

• As mentioned previously, the memorandum indicated that operational POA&Ms are allowed; however, it does not fully define “operational POAMs” and the types of findings that may fall into the category, nor does the memo go into detail about thresholds for the number of operational POA&Ms at a given time. 

What’s Next for CSPs, DIB Contractors, and CMMC? 

All in all, this new memorandum from the DoD—together with the 32 CFR CMMC Final Rule—has provided much-needed clarification regarding the compliance of DIB contractors with DFARS clause 252.204-7012 and that of the third-party solutions you’re using to store, process, or transmit CUI. Per this memorandum, CSPs working with contractors must formally demonstrate FedRAMP Moderate Equivalency, and now you understand a little more of what that will entail. 

These developments will surely keep the experts talking about the details and nuances in the coming years, and in the meantime, if you’re looking for more information regarding CMMC, check out our other content for helpful insights: 

• Determining Your Level of CMMC Compliance: The Importance of CUI 
• How To Get CMMC Certified 
• What To Expect During a CMMC Assessment 
• Ask the Assessors – CMMC Edition! 

And if you still have questions about these new complexities, as it’s likely you do, our experiences as a leading FedRAMP 3PAO and CMMC C3PAO could be of further assistance—for a more