Industry Roadmap

Not Sure Where to Start? Your Compliance Roadmap Begins Here.

The right compliance path depends on who you are, who your customers are, and which markets you want to enter. Pursuing the wrong authorization first costs time and budget you cannot recover.

Find Your Compliance Path

Diagram connecting regulated cloud workloads and regulated IT systems through a central government building icon on a green

Cloud Service Provider Planning Guide

Federal and State Agencies Cannot Buy Until You’re Authorized.

Federal agencies, state governments, and enterprise buyers each have their own authorization requirements before they can procure cloud services. Choosing the right program in the right order protects your timeline and budget.

Which authorization does a CSP need?

Selling to federal civilian agencies

requires FedRAMP authorization. Without it, federal agencies cannot procure your service regardless of its technical merit. FedRAMP is the entry point to federal cloud revenue.

Selling to Department of Defense

environments requires DoD impact level authorization in addition to or instead of standard FedRAMP, depending on the sensitivity of the data your environment will process.

Selling to state and local governments

requires GovRAMP or StateRAMP authorization depending on your target states and procurement vehicles. Both build on FedRAMP foundations — existing FedRAMP authorization significantly reduces your path to state authorization.

Selling to enterprise commercial buyers

requires SOC 2 at minimum. ISO 27001 is increasingly required by global enterprise customers alongside SOC 2. If your platform handles health data or payment data, HIPAA and PCI DSS apply as well.

System Integrator Planning Guide

Without Contract Eligibility, You Never Make It to the Bid.

SIs face compliance requirements tied to the contracts they pursue, not the products they sell. Missing a certification means losing contract eligibility, not just a single award.

Determine Whether Your Contracts Involve CUI

If your DoD contracts require you to handle controlled unclassified information, CMMC Level 2 certification through a Cyber-AB authorized C3PAO is mandatory. Contractors without certification lose DoD contract eligibility entirely. This is your highest-priority compliance obligation if you pursue defense work.

Assess Whether You Operate Federal Information Systems

SIs that manage agency information systems directly — not through a commercial cloud service — must satisfy FISMA requirements independently. A FedRAMP-authorized cloud vendor your agency client uses does not transfer its authorization to your organization.

Identify Whether Your Work Involves Protected Health Data

SIs working in federal health IT environments carry the full HIPAA obligation regardless of the agency’s own compliance program. If your organization creates, receives, maintains, or transmits protected health information under a federal contract, HIPAA applies to you.

Evaluate Your Cloud Infrastructure Selections

SIs that build on FedRAMP-authorized cloud infrastructure inherit a significant portion of the required federal control stack. Your platform and tooling selections directly affect your inherited control posture and your compliance scope before your first assessment begins.

Get started

The Right Compliance Path Starts Before Your First Assessment.

Talk to a Compliance Expert