Q: Can cloud service providers use non-FedRAMP services within their certified cloud service offering?
A: Yes. The traditional process of creating a static boundary and ensuring all components within the boundary are FedRAMP Certified at the same level regardless what data they process is no longer valid. The focus should be around identifying where federal data lies and transits within your cloud service and ensuring that data is protected at the proper levels.
