FISMA and RMF
System packages, ongoing authorization, reporting
Explore FISMA →Continuous assurance for your agency
Agencies own the Authorization to Operate for every system, whether it runs on premises or on a FedRAMP Certified cloud service. NISTcompliance.ai keeps each system's package, POA&M and continuous monitoring evidence current, and generates machine-readable output in JSON and OSCAL.
Runs inside Quzara Cybertorch: FedRAMP Certified, Rev5 Class D (High)SOC 2 Type 2
Your frameworks
Frameworks agencies run
NIST CSF 2.0
Six functions, profiles and evidence
Explore CSF 2.0 →NIST AI RMF
AI risk, the GenAI profile and OMB AI policy
Explore AI RMF →FedRAMP 20x
KSI validation, VDR and VER, Classes A to C
Explore 20x →Agency Use rules
What agencies must and should do
AGU-USE-ABUMUST
Complete the ATO
Complete the Authorization to Operate process for systems that use FedRAMP Certified cloud offerings.
AGU-USE-RSGMUST
Configure securely
Review providers' Secure Configuration Guides and configure the relevant security settings.
AGU-USE-RORSHOULD
Review every OCR
Review each Ongoing Certification Report for changes that affect the risk tolerance in your ATO.
AGU-USE-NFCMUST
Escalate real concerns
Notify FedRAMP when an Ongoing Certification Report, Quarterly Review or other certification data raises concerns likely to lead to ATO rescission.
AGU-AGC-NAAMUST
Tell FedRAMP you authorized
Notify FedRAMP upon authorizing a cloud service and supply a copy of the ATO letter.
AGU-AGC-GRCMUST
Ingest machine-readable data
Ensure GRC and inventory tools can produce and ingest machine-readable artifacts, including OSCAL and JSON.
Sources: Agency Use rules. FedRAMP Consolidated Rules for 2026, checked Oct 23, 2026. Not a substitute for the official rules.
The platform
Built for agency programs
System packages, kept current
SSP, assessment results and POA&M for each system.
FISMA and RMF →Ongoing authorization
Evidence that supports ongoing authorization decisions.
Ongoing authorization →Assessor workspace
Evidence your control assessors and IG can trace.
Assessor workspace →Go deeper
Related guides
Federal Agency FedRAMP Obligations in 2026
What ISSOs, ISSMs and CISOs must do under the new rules.
Read the guide →Questions
Common questions
Do agencies still issue an ATO under FedRAMP 20x?
Yes. AGU-USE-ABU requires agencies to complete the Authorization to Operate process for systems that use FedRAMP Certified cloud offerings.
How long can an agency rely on a Class A offering?
AGU-USE-CLA says agencies should not authorize Class A offerings for more than 12 months unless the provider is actively seeking Class B, C or D.
Can agencies ask providers for more information?
Only with a demonstrable need. AGU-AGC-NAR says agencies must not require extra information beyond FedRAMP requirements unless the agency head or a delegate shows a demonstrable need and notifies FedRAMP.
Book a demo
See the agency view
We will walk through continuous assurance for the services your agency already uses.