Selling technology to the US government brings its own compliance layer. Cloud services used by federal agencies need FedRAMP. Contractors holding controlled unclassified information follow NIST SP 800-171, and defense contractors must now prove it through CMMC. These are contract requirements: they apply because the contract says so, and you cannot bid without them.
6 items in this category
1 related from other categories
Oct 30, 2026 statuses last checked
At a glance
US government and defense compliance compared
How the items in this category differ on the question that matters first: do you have to, or do you choose to?
Name
Type
Mandatory or voluntary
Where it applies
Current version
FedRAMP
Contract requirement
Mandatory once a contract, card brand or government buyer requires it
United States (federal government)
FedRAMP 20x is the new path, with Class B and C certifications open to all providers since August 2026. Legacy Rev5 applications are accepted until 11 June 2027.
FISMA
Law
Mandatory by law for organizations in scope
United States (federal agencies and their contractors)
FISMA 2014, implemented through OMB guidance and NIST standards.
NIST SP 800-53
Framework
Voluntary framework, no official certificate
United States, reused worldwide
Revision 5, release 5.2.0 (August 2025). Baselines are in SP 800-53B.
NIST SP 800-171
Contract requirement
Mandatory once a contract, card brand or government buyer requires it
United States (federal contractors)
Revision 3 (May 2024) is current at NIST; DoD contracts and CMMC Level 2 still assess against Revision 2 under a class deviation.
CMMC
Contract requirement
Mandatory once a contract, card brand or government buyer requires it
United States (Department of Defense supply chain)
Program rule effective December 2024; the DFARS contract rule took effect 10 November 2025 (phase 1). Phase 2, requiring C3PAO Level 2 assessments where specified, starts 10 November 2026.
CJIS
Contract requirement
Mandatory once a contract, card brand or government buyer requires it
United States (criminal justice agencies and their vendors)
Version 6.0 (December 2024), realigned to NIST SP 800-53 with phased requirements.
Directory
What each one covers and who needs it
Contract requirement United States (federal government)
FedRAMP
Federal Risk and Authorization Management Program
FedRAMP is the US government program that assesses and authorizes cloud services for federal agency use. Traditionally, a provider implemented NIST SP 800-53 controls at a Low, Moderate or High baseline, was assessed by a 3PAO and gained an agency authorization. FedRAMP 20x, introduced in 2025, moves to automated, outcome-based validation with certification classes and faster reviews, and legacy Rev5 processing is winding down. Without FedRAMP, agencies generally cannot use your cloud service.
What it covers, who needs it and why
What it covers
Cloud services (SaaS, PaaS, IaaS) that process federal information, their security controls, assessment and continuous monitoring.
Who needs it
Cloud and SaaS providers selling to US federal agencies, directly or through resellers.
Why it matters
It is the entry ticket to the federal cloud market, and the program is changing fast.
Key objectives
Standard security assessment for federal cloud
Reuse of authorizations across agencies
Continuous monitoring
Mandatory or voluntary
Mandatory once a contract, card brand or government buyer requires it.
Owner
US General Services Administration (FedRAMP PMO), under the FedRAMP Authorization Act
Current version
FedRAMP 20x is the new path, with Class B and C certifications open to all providers since August 2026. Legacy Rev5 applications are accepted until 11 June 2027.
Law United States (federal agencies and their contractors)
FISMA
Federal Information Security Modernization Act of 2014
FISMA requires every US federal agency to run an agency-wide information security program and report on it each year. In practice it is implemented through the NIST Risk Management Framework (SP 800-37) and the SP 800-53 controls, with systems authorized to operate before use. Contractors that operate federal systems or handle federal information on an agency's behalf are bound through their contracts, which is why federal IT contracts carry FISMA language.
What it covers, who needs it and why
What it covers
Federal information and information systems, including those run by contractors for agencies.
Who needs it
Federal agencies and the IT contractors and service providers that run systems for them.
Why it matters
An authority to operate is needed before a federal system goes live.
Key objectives
Agency-wide security programs
Risk-based authorization of systems
Annual reporting and oversight
Mandatory or voluntary
Mandatory by law for organizations in scope.
Owner
US Congress; OMB, CISA and NIST
Current version
FISMA 2014, implemented through OMB guidance and NIST standards.
Security and Privacy Controls for Information Systems and Organizations
NIST SP 800-53 is the catalog of security and privacy controls used for US federal information systems and, through FedRAMP and FISMA, for their contractors. Revision 5 contains 20 control families, from access control and audit to supply chain risk management, with baselines (low, moderate, high and privacy) set in SP 800-53B. It is mandatory for federal systems and widely reused by states, regulators and companies as a detailed control library. Release 5.2.0 updated controls on software updates and patching.
What it covers, who needs it and why
What it covers
Technical, operational and management controls across 20 families, plus privacy controls and control enhancements.
Who needs it
Federal agencies, FedRAMP cloud providers, federal contractors, and organizations that want a detailed control catalog.
Why it matters
It is the control language of US government security and the basis of FedRAMP baselines.
Key objectives
Protect federal systems and information
Give a common control catalog
Support risk-based tailoring
Mandatory or voluntary
Voluntary framework, no official certificate.
Owner
NIST
Current version
Revision 5, release 5.2.0 (August 2025). Baselines are in SP 800-53B.
Contract requirement United States (federal contractors)
NIST SP 800-171
Protecting Controlled Unclassified Information in Nonfederal Systems and Organizations
NIST SP 800-171 sets security requirements for protecting controlled unclassified information (CUI) in contractor systems. Revision 2 has 110 requirements in 14 families; Revision 3 reorganizes them into 97 requirements in 17 families with organization-defined parameters. Defense contractors are required to implement it by DFARS clause 252.204-7012, report a self-assessment score in SPRS, and, under CMMC, prove it through assessment. Other agencies are moving toward similar requirements.
What it covers, who needs it and why
What it covers
Contractor information systems that process, store or transmit CUI, including cloud services they use for CUI.
Who needs it
Defense and federal contractors and subcontractors handling CUI, including IT and software providers in the supply chain.
Why it matters
False compliance claims have led to False Claims Act settlements, and CMMC makes it a condition of award.
Key objectives
Protect CUI outside federal systems
Give contractors one requirement set
Enable verification through assessment
Mandatory or voluntary
Mandatory once a contract, card brand or government buyer requires it.
Owner
NIST; required through DFARS 252.204-7012 and other contract clauses
Current version
Revision 3 (May 2024) is current at NIST; DoD contracts and CMMC Level 2 still assess against Revision 2 under a class deviation.
Contract requirement United States (Department of Defense supply chain)
CMMC 2.0
Cybersecurity Maturity Model Certification program (32 CFR Part 170)
CMMC verifies that defense contractors protect federal contract information and CUI. Level 1 covers 15 basic safeguarding requirements with an annual self-assessment. Level 2 covers the 110 NIST SP 800-171 Rev. 2 requirements, assessed every three years either by the contractor or by an authorized third-party assessor (C3PAO), as the contract specifies. Level 3 adds requirements from SP 800-172, assessed by the government. Since November 2025, contracts can make a CMMC status a condition of award, phased in over three years.
What it covers, who needs it and why
What it covers
Contractor systems that handle federal contract information or CUI, and flow-down to subcontractors.
Who needs it
Every company in the US defense industrial base supply chain, including software, IT and managed service providers.
Why it matters
Without the required CMMC status, a contractor cannot win or keep covered DoD contracts.
Key objectives
Verify contractor cybersecurity
Protect FCI and CUI
Hold the supply chain to one standard
Mandatory or voluntary
Mandatory once a contract, card brand or government buyer requires it.
Owner
US Department of Defense (DoD CIO); assessments by C3PAOs and DIBCAC
Current version
Program rule effective December 2024; the DFARS contract rule took effect 10 November 2025 (phase 1). Phase 2, requiring C3PAO Level 2 assessments where specified, starts 10 November 2026.
Contract requirement United States (criminal justice agencies and their vendors)
CJIS Security Policy
FBI Criminal Justice Information Services Security Policy
The CJIS Security Policy sets the minimum security requirements for accessing, storing and transmitting criminal justice information, such as fingerprints and criminal history. It applies to law enforcement agencies and every vendor whose systems or staff touch that data, through a security addendum signed by the vendor's personnel. Version 6.0 restructured the policy around NIST SP 800-53 controls, including multi-factor authentication, audit logging, incident response and security awareness training.
What it covers, who needs it and why
What it covers
Systems, cloud services and personnel with access to criminal justice information.
Who needs it
SaaS, cloud and IT vendors selling to police, courts, corrections and other criminal justice agencies.
Why it matters
Agencies cannot share CJI with a vendor that does not meet the policy, and state CJIS officers audit it.
Key objectives
Protect criminal justice information
Set common minimum controls
Vet and train personnel with access
Mandatory or voluntary
Mandatory once a contract, card brand or government buyer requires it.
Owner
FBI CJIS Division
Current version
Version 6.0 (December 2024), realigned to NIST SP 800-53 with phased requirements.
NIST SP 800-218, Secure Software Development Framework (SSDF)
The SSDF is a set of secure software development practices organized into four groups: prepare the organization, protect the software, produce well-secured software, and respond to vulnerabilities. It is outcome-based and works with any development method. US federal agencies require software producers to attest that they follow key SSDF practices, using CISA's secure software development attestation form, so it has become a real requirement for vendors selling software to the US government.
What it covers, who needs it and why
What it covers
Development environment security, code integrity, secure design and coding, testing, third-party components, vulnerability disclosure and remediation.
Who needs it
Software producers, especially those selling to US federal agencies or their prime contractors.
Why it matters
Federal buyers ask for the attestation, and it lines up well with the EU Cyber Resilience Act's vulnerability handling duties.
Key objectives
Reduce vulnerabilities in released software
Limit the impact of vulnerabilities that remain
Address root causes to prevent recurrence
Mandatory or voluntary
Voluntary framework, no official certificate.
Owner
NIST
Current version
SP 800-218 version 1.1, with an update in progress; re-checked at every review.
Train your team on us government and defense requirements
Most of these frameworks expect trained staff and records to prove it. LMS Advisor assigns the right courses by role, sends reminders, renews certificates on schedule and keeps an audit trail you can export.
Due dates, reminders and overdue reports for mandatory courses
Certificates that expire and renew on your retraining cycle
CSV, Excel and PDF exports of who completed what, and when
LMS Advisor is our product. It runs your training and keeps the records. It does not certify you against any standard.
Book a demo before Dec 1, 2026 and your quote comes with 30% off your first year of LMS Advisor: courses, proctored exams, certificates and AI authoring in one platform, in our cloud or on your own server.
Offer ends Dec 1, 2026, 11:59 PM ET
Cloud or self-hosted, proctoring included
The discount is applied in your written quote
We use cookies to see how visitors use this site and to measure our ads. Choose Continue to allow them, or Reject to browse without them. Privacy policy
LMS Advisor AI
AI product consultant
You're chatting with an AI. Answers can be wrong, so please don't type personal data here. Privacy ·
