Which program provides a cost-effective, risk-based approach for cloud service adoption by the Federal Government?

Which program provides a cost-effective, risk-based approach for cloud service adoption by the Federal Government?

• A. Federal Risk and Authorization Management Program (FedRAMP)
• B. Zero Trust Network Access Principles
• C. Intelligence Law and Policy Regulation
• D. Cyberspace Parity

Answer: (A)

This item tests understanding of a government-wide approach that enables cloud adoption in a cost-effective, risk-based way. The program is FedRAMP, which standardizes the security assessment, authorization, and continuous monitoring of cloud services so federal agencies can reuse a single security approval across multiple departments. By basing security controls on NIST SP 800-53 and tailoring them to the service’s impact level (low, moderate, high), it ensures the level of rigor matches the actual risk—so resources aren’t wasted on over- or under-protecting a given service. The cost savings come from a shared, government-wide authorization that agencies can rely on, reducing duplicative assessments and speeding procurement. Continuous monitoring keeps a cloud service’s authorization current, maintaining ongoing risk management. In contrast, the other options refer to security concepts or policies that do not provide this standardized, reusable path for federal cloud adoption.

This item tests understanding of a government-wide approach that enables cloud adoption in a cost-effective, risk-based way. The program is FedRAMP, which standardizes the security assessment, authorization, and continuous monitoring of cloud services so federal agencies can reuse a single security approval across multiple departments. By basing security controls on NIST SP 800-53 and tailoring them to the service’s impact level (low, moderate, high), it ensures the level of rigor matches the actual risk—so resources aren’t wasted on over- or under-protecting a given service. The cost savings come from a shared, government-wide authorization that agencies can rely on, reducing duplicative assessments and speeding procurement. Continuous monitoring keeps a cloud service’s authorization current, maintaining ongoing risk management. In contrast, the other options refer to security concepts or policies that do not provide this standardized, reusable path for federal cloud adoption.