I'm a Little Bit (FedRAMP) Country, I'm a Little Bit SOC2 'n Roll

The talk opens with a primer on SOC 2, covering the Trust Services criteria, how a company sets its own audit scope, and the gap between a Type 1 point-in-time review and a Type 2 review that needs evidence across an audit period. The presenters then explain FedRAMP: its origins in the NIST 800-53 control catalog, the Joint Authorization Board and agency authorization paths, the low, moderate and high impact levels, and the heavy documentation load, which for a moderate system can run to roughly a thousand pages.

The middle section compares the two programs. FedRAMP is far more prescriptive, relies on accredited third-party assessors, and adds incident response testing and continuous monitoring after authorization, with monthly reporting and periodic reassessment. The speakers note that a SOC 2 program can serve as a foundation, that a cloud provider's existing FedRAMP authorization can be inherited to cut the control workload, and that FedRAMP Ready listing helps when no agency is yet lined up. They also touch on related regimes such as CMMC, FedRAMP+ for DoD work and StateRAMP.

The closing advice is to start with the low impact level and to reach FedRAMP only after SOC 2 work is mature: automated evidence collection, real incident response, and a thorough penetration test. Expect about a year for a moderate authorization and live, assessor-observed evidence collection rather than self-uploaded screenshots. The Q&A covered timelines, how open findings limit remediation, and whether non-federal customers need authorization.