Government and public statistics
M-24-15: Modernizing the Federal Risk and Authorization Management Program
Office of Management and Budget, Executive Office of the President, 2024
Read the originalRead on October 17, 2026
- What it is
- The OMB memorandum that sets the scope of FedRAMP and tells federal agencies when they must hold a FedRAMP authorization for a cloud product or service. It replaced the 2011 FedRAMP memorandum.
- How much weight it carries
- Official government memorandum, the primary text for federal cloud authorization rules. It applies to federal agencies, not to private companies, and the scope for any particular product is set by the agency and the FedRAMP program, so check it case by case.
Facts taken from this source
- OMB memorandum M-24-15 says federal agencies must obtain and maintain a FedRAMP authorization when a cloud product or service falls within the scope of FedRAMP.
“Agencies must obtain and maintain a FedRAMP authorization when the cloud product or service falls within the scope of this section.” (III. Scope of FedRAMP)
- OMB says a FedRAMP authorization is not an endorsement of a product or service. It records that the security assessment is complete and presumed adequate.
“A FedRAMP authorization is not an endorsement of a product or service.” (III. Scope of FedRAMP)