Getting Support¶
FedRAMP is a government program with a strictly limited ability to provide support for private companies. In general, FedRAMP must provide the same information in the same way to all cloud service providers and other public stakeholders to ensure no vendor receives an unfair advantage; otherwise public stakeholders must navigate the FedRAMP process on their own.
Keep in mind that FedRAMP has limited resources, based on appropriations determined by Congress, and is not able to scale customer service or provide additional services beyond those we are mandated and funded to perform. In 2025, FedRAMP was restructured to focus on ensuring a consistent and high quality review process by retaining only highly technical staff.
Advisory services can provide additional support
There are many advisory services that specialize in helping companies navigate the FedRAMP process. The best of these can provide detailed business advice to help you understand the latest requirements and align your goals to meeting those requirements. Private companies that rely on trusted advisory services frequently outperform those that try to do this on their own. Remember, FedRAMP is just one step in complex world of establishing a contract with a federal agency to use a cloud service.
Documentation¶
Documentation is the primary mechanism that FedRAMP uses to provide public support. The production of rules, best practices, technical assistance, and other materials is part of FedRAMP's responsibility and we take it seriously. Private companies will need to review FedRAMP materials in depth as the first line of support.
You are here!
You are in the right place to learn about FedRAMP - keep going!
The Consolidated Rules for 2026 are designed to be a complete source of truth for FedRAMP rules and requirements. If it is not written down in these rules or on fedramp.gov then it is not real. Stakeholders should refer to this documentation early and often.
Source material is available for AI services
We strongly encourage the use of AI services to understand, navigate, and process all of these rules. Just make sure they are configured to rely only on these materials, as there's a glut of incorrect historical material about FedRAMP that no longer applies.
Our Source Data page explains how to point agents at the underlying source data directly for an optimal experience.
The FedRAMP Community¶
Public discussions provide a secondary mechanism that allows FedRAMP to provide public support that is available to everyone in a fair, consistent manner. We strongly prefer and prioritize responding to questions asked in public so that everyone can benefit.
The links below will take you away from the Consolidated Rules for 2026 and over to the primary FedRAMP website, where general community information is shared about our FedRAMP Community on GitHub and monthly Community Updates (and other events).
-
GitHub Discussions
Post any question about FedRAMP in our Community GitHub discussions and get answers and feedback directly from FedRAMP leadership or senior staff. This is typically the fastest way to get a high level response from FedRAMP.
-
Monthly Webinars
We host monthly Community Updates for both FedRAMP Rev5 and FedRAMP 20x communities, and often attend or host other events to interact with the community. Q&A is typically a priority for these events, and you can review past events on our YouTube channel.
Updates on FedRAMP.gov¶
The Consolidated Rules for 2026 are intended to be quite fixed in time, while our primary website at FedRAMP.gov has all of the latest changes and updates. These links go outside the Consolidated Rules, but there are a few sections of FedRAMP.gov that you should be familiar with.
-
Tracking Changes
The Changelog is updated any time something significant changes on FedRAMP.gov - and there's an RSS feed to make sure you get a quick notification!
-
Big Updates on the Blog
Our blog is updated around every month with big updates about the program and our progress on various initiatives.
-
Public Notices
Public notices are critical announcements that don't fit well as a blog post but require a dedicated update that everyone can reference.
-
Requests for Comment
FedRAMP is required by law to seek public comment before publishing guidance that can affect stakeholders, and our Requests for Comment (RFC) process ensures everyone has an opportunity to provide formal feedback.
Direct Help¶
In the event that all of these resources don't provide the help you need, you can ask for help directly from FedRAMP via our customer service portal. Requests sent through our help desk are typically routed to senior staff and addressed routinely via the course of daily operations. FedRAMP does not provide an SLA or other guarantee on response times, and may ignore help requests that are inappropriate or otherwise publicly addressed.
Cloud service providers should ask for help directly, not through an intermediary!
If FedRAMP receives a request for help on behalf of a specific cloud service provider in a specific scenario from a different party, we will typically advise that party that they should tell the provider to contact us directly.
All communications with FedRAMP are federal records that may be made public!
Members of the public who communicate with FedRAMP have no right to privacy in their communications with the U.S. federal government. Any request for help, email, document, or other communication sent to FedRAMP is a federal record and subject to disclosure to other parts of the government or the public.
-
Direct Help
It's not your typical corporate inbox with a thousand agents who don't know the subject - ours is monitored primarily by senior technical staff and leadership.
Transition from info@fedramp.gov in progress
FedRAMP plans to transition to web-based forms for help and support soon, but this page currently does not have this capability. This content is here only as a preview - please reach out to info@fedramp.gov in the interim.
FedRAMP plans to transition away from providing support via info@fedramp.gov to private entities in the near term.
Things FedRAMP Won't Do¶
Many of our stakeholders are used to working with private companies where casual communication and competitive service is an expectation; this is not the case when working with FedRAMP. We are strictly limited by the law, government policy, and GSA policy in our ability to interact with the public or provide support to the public. Each employee is subject to ethics rules, financial disclosures, and other limitations on our ability to act independently.
The nature of our work frequently exposes us to investigation from Congress, Inspectors General, or the public. We work diligently to follow all necessary rules to avoid even the appearance of impropriety while acting strictly within our own authority and responsibilities set for the program.
Things that FedRAMP will not do for stakeholders include:
-
Meet with individual companies or their representatives to discuss FedRAMP. We must decline any meeting request from a private company or individual to discuss FedRAMP, especially if they are seeking advice or other special advantage. We only meet with companies in strictly limited mission-critical scenarios following procedures that are vetted by the GSA Office of General Counsel.
-
Provide advice, recommendations, or other guidance that may be construed as such. We can't appear in any way to be guiding private companies and must remain impartial in communications. This is especially critical when folks explicitly say they are seeking advice from FedRAMP as it sets up a dangerous situation for FedRAMP staff; we may be forced to entirely ignore messages that solicit advice for critical business decisions.
-
Mediate disagreements between private stakeholders. This is especially true between cloud service providers and their assessor or advisor; FedRAMP will not enter any disagreements or other relationship issues between private companies, it's up to the private companies to sort them out. Parties may consult with FedRAMP for clarity in different situations but FedRAMP will only provide information.