Azure FedRAMP compliance

Question

Azure FedRAMP compliance

Steven Netsch 1

My company recently became a federal government contractor and all of our systems are deployed on Azure. Government agencies are asking about our FedRAMP compliance. I've seen that Azure commercial has FedRAMP high compliance available and Azure Government does as well.

For our Azure deployed apps, are we automatically FedRAMP compliant? If not, do we need to be on Azure Government? Is the pricing the same on Azure Government? Any help would be appreciated. -Steven

1 answer

Your answer

Answer 1

VipulSparsh-MSFT 16,311 Microsoft Employee

@Steven Netsch Thanks for reaching out.

Azure commercial and Azure Govt, both are FedRAMP compliant and you do not have to on Azure Govt Cloud for this.
Check more about each service status within Azure Commercial/Public which is FedRAMP compliant :

https://learn.microsoft.com/en-us/azure/azure-government/compliance/azure-services-in-fedramp-auditscope#azure-public-services-by-audit-scope

-----------------------------------------------------------------------------------------------------------------

Please remember to "Accept Answer" if any answer/reply helped, so that others in the community facing similar issues can easily find the solution.

Steven Netsch 1 Reputation point

2021-10-08T23:06:51.633+00:00

Vipulsparch,

So for clarity... I can tell public sector employers that all of our systems are FedRAMP compliant on Azure?

If so, is there any documentation I can point to? Is it FedRAMP high compliance?

Any details would be helpful.

-Steven
VipulSparsh-MSFT 16,311 Reputation points Microsoft Employee

2021-10-10T04:46:24.68+00:00

@Steven Netsch You can check further details here :

https://azure.microsoft.com/en-in/blog/all-us-azure-regions-now-approved-for-fedramp-high-impact-level/
https://learn.microsoft.com/en-us/compliance/regulatory/offering-fedramp
Kate Christner 1 Reputation point

2021-12-03T00:30:13.427+00:00

So, to be sure I understand, if we are hosting clients using Azure (public/commercial/global), we are already FedRAMP High compliant? Nothing else needs to be done? How do we prove this to our client?
Also, if we've got clients in Arizona and Virginia, do we need to purchase Azure Government?
Shyam Muthiah 1 Reputation point

2022-05-03T16:44:40.43+00:00

Hey Kate, am not sure if you got an update for your post but as far as i know, Azure as an CSP is FedRAMP compliant, but any CSC is not at all compliant unless the CSC deploy all the 423 High controls for FedRAMP on their respective Azure Portal.

@VipulSparsh-MSFT Please correct me if I am wrong, i have the similar gap in understanding but it would nice to share your thoughts.

Share via

Azure FedRAMP compliance

1 answer

Your answer