FedRAMP CMMC anchors

Stefan Coetzeecreated 2026-05-12updated 2026-05-121 min readanchors
Vault note, not reviewed against the source. Written in the knowledge vault on 2026-05-12 by models working with Stefan Coetzee and published as it stands, with private addresses, e-mail addresses and an employer name redacted. Check claims against the primary source before relying on them.

FedRAMP and CMMC Anchors

FedRAMP

Operating bodies

  • OMB — policy.
  • GSA FedRAMP PMO — program management.
  • JAB — Joint Authorization Board (DoD, DHS, GSA).
  • DHS — continuous monitoring.

Reference documents

  • FedRAMP baselines (Low, Moderate, High) — NIST 800-53 tailored.
  • FedRAMP Marketplace — authorized services list.
  • 3PAO accreditation program.

Cloud providers (illustrative)

AWS (GovCloud), Azure (Government), Google Cloud (Government), Oracle (Government), Salesforce, ServiceNow, and many others FedRAMP-authorized.

CMMC

Operating bodies

  • DoD CIO — policy.
  • DIBCAC (Defense Industrial Base Cybersecurity Assessment Center) — DoD assessor for Level 3.
  • CyberAB — Accreditation Body administering CMMC ecosystem.
  • C3PAO — Certified Third Party Assessor Organizations for Level 2.

Reference documents

  • CMMC 2.0 model.
  • NIST SP 800-171 Rev. 3 — base controls for Level 2.
  • NIST SP 800-172 — additional controls for Level 3.
  • DFARS 252.204-7012 / 7019 / 7020 / 7021 — DoD acquisition clauses.

Reference resources

  • fedramp.gov
  • cyberab.org — CMMC Accreditation Body.
  • NIST publications portal for 800-53, 800-171, 800-172.

Adjacent

  • StateRAMP — US state-level analog to FedRAMP.
  • NIST CSF — related framework.
  • ISO 27001 — international counterpart.

See also