Do FedRAMP requirements apply even if they are not included in a contract?

FedRAMP requirements apply to all federal agencies when federal information is collected, maintained, processed, disseminated, or disposed of by cloud service providers (CSPs). Federal agencies are responsible for ensuring the FedRAMP requirements are met. Contractors are held accountable for performance written into a contract. Program and project managers must include FedRAMP requirements in performance criteria, deliverables, and other appropriate performance outcomes to facilitate inclusion in contract awards.