Procurement workflow surface
A procurement officer evaluating a vendor against FedRAMP AI Cloud Procurement Guidance can use this page to walk the operative articles + paragraphs the instrument touches, anchored to the primary source. Each row groups every coverage cell that names that article so the reader sees WHICH governance topic each clause speaks to. Use it as a checklist scaffold, not as legal advice (see charter §7.4).
FedRAMP authorisation requires System Security Plan + control documentation; GenAI guidance extends to vendor disclosure of training-data provenance, evaluation results, model documentation
Verbatim text:
“Faithful summary: FedRAMP authorisation requires a System Security Plan documenting NIST SP 800-53 controls; GenAI guidance extends disclosure to training-data provenance, evaluation results, and model documentation.”
GenAI-specific control tailoring guidance addresses model-specific risks (training-data exposure, prompt-injection, output disclosure) within SSP + NIST SP 800-53 control overlay selection
Editor rationale: FedRAMP guidance distinguishes GenAI services from non-GenAI cloud services for control-tailoring purposes; foundation-model-specific obligations flow through the agency authorising official's discretion rather than from a FedRAMP baseline rule.
Verbatim text:
Verbatim text not yet transcribed — see primary source.
FedRAMP authorisation enables ATO; agency-AI-use disclosure flows through OMB M-24-10 inventory + quarterly procurement reporting rather than through FedRAMP itself
Editor rationale: FedRAMP is the cloud-security authorisation layer; M-24-10 is the AI-use-disclosure layer. Cell marked implicit because FedRAMP enables agency use but the disclosure obligation lives elsewhere in the federal-AI procurement stack.
Verbatim text:
Verbatim text not yet transcribed — see primary source.
Guidance cross-walks to OMB M-24-10 minimum practices including human-consideration + remedy for rights-impacting AI
Verbatim text:
Verbatim text not yet transcribed — see primary source.
Supply-chain risk-management considerations include training-data + model-weight provenance disclosure within the SSP
Verbatim text:
Verbatim text not yet transcribed — see primary source.
National Security Carveouts in AI Regulation
FedRAMP High baseline + JAB authorisation route exists for higher-sensitivity use cases; classified systems are outside FedRAMP scope and governed by separate ICD-503 / NIST SP 800-53 IC overlay frameworks
Verbatim text:
Verbatim text not yet transcribed — see primary source.