Fedramp

sushegaad/claude-skills-governance-risk-and-compliance

If you're navigating FedRAMP authorization for a cloud service, this walks you through the entire lifecycle from readiness assessments to continuous monitoring. It covers the practical mechanics of writing SSPs, POA&Ms, and SAR documents using current Rev 5 templates, maps NIST 800-53 controls across impact levels (Low, Moderate, High, LI-SaaS), and includes specific guidance on OSCAL migration deadlines and FedRAMP 20x modernization. The skill is organized around user goals with jump tables, so you can go straight to gap assessments, control mapping, or architecture reviews. It's thorough on the paperwork and compliance mechanics that define federal cloud authorization, which is exactly what you need if you're actually doing this work.

skills.sh installs: 283
GitHub stars: 1.1K
last updated: Jun 11, 2026

View on GitHub

Install

$ npx -y skills add sushegaad/claude-skills-governance-risk-and-compliance --skill fedramp --agent claude-code

Installs into .claude/skills of the current project.

Files

FedRAMP Certification Skill

Last verified: 2026-10-03

A comprehensive guide for helping users navigate FedRAMP authorization — from initial readiness through ATO and ongoing continuous monitoring.

Quick Reference: What Does the User Need?

Identify the user's goal and jump to the appropriate section:

User Goal	Go To
"Are we ready for FedRAMP?" / gap assessment	→ Readiness & Gap Assessment
Writing SSP, POA&M, SAR, SAP, or other docs	→ ATO Documentation
"Which controls apply to us?" / control mapping	→ NIST 800-53 Control Mapping
Cloud architecture / AWS/Azure/GCP config	→ Architecture Guidance
Already authorized, ongoing compliance	→ Continuous Monitoring