{ "schema": "aiblocks-page/1", "id": "agency-specialized-fedramp-rmf-compliance", "type": "agent", "name": "FedRAMP and RMF compliance planner", "summary": "Plan FedRAMP or NIST RMF authorization for a cloud system. Get its impact level, scope notes, control gaps and a fix list for your assessor.", "headline": "FedRAMP and RMF compliance planner", "subhead": "Describe the cloud system you want to sell to US government agencies. It sets the impact level from your data, helps draw what is in scope and checks each control for proof. You get the gaps, a fix list and a package checklist.", "job": { "id": "check-contracts", "name": "Check contracts and rules" }, "level": "intermediate", "thinking": "high", "tested": true, "updated": "2026-10-28", "first_published": "2026-10-26", "inputs": [ { "type": "question", "required": true, "label": "Question", "what": "the problem, decision or piece of work you want help with, and what a good outcome looks like" }, { "type": "document", "required": false, "label": "Document", "what": "a finished document, such as a Word file, a PDF or a page of notes" } ], "outputs": [ { "type": "audit_report", "required": true, "label": "Audit report", "what": "findings with evidence, severity, missing inputs and next actions" }, { "type": "plan", "required": true, "label": "Plan", "what": "a dated plan: what to do, in what order, with a decision rule for each step" } ], "you_give": [ "A description of the system, what it does and who uses it", "The kinds of data it holds, and the damage if that data were leaked, changed or lost", "Your cloud host or platform, and the other services the system connects to", "Your security plan, policies or control notes, if you have them (optional)", "Any assessor findings or scan reports (optional)", "The agency you work with, or your target impact level (optional)" ], "you_get": [ "A scope note that compares the paths and says what to confirm with FedRAMP", "An impact level worked out from your data, with the reasons", "Boundary notes that say what is inside, what is outside and what crosses the line", "A control gap table that shows who is responsible, what you can prove and what an assessor will test", "Draft control statements for the controls where you gave facts", "An action list with risk, steps, owner and date left for you to fill" ], "use_when": [ "You run cloud software and an agency or prime contractor asks if you are FedRAMP authorized.", "You are choosing between the traditional path and the newer 20x path and want the trade-offs written down.", "A draft security plan says controls are in place and you want to know which ones you can actually prove.", "Your assessor found weaknesses and you need an action list with risk, owner and dates." ], "skip_when": [ "You need an assessment or an authorization. Only an accredited assessor and an agency can give one.", "You want SOC 2 or ISO 27001 readiness, with no US government customer. Use the Compliance Auditor agent.", "You need valid machine-readable (OSCAL) files. This agent writes text and tables only. It does not make or check those files." ], "output_sample": { "input": [ "A description of the system and the data it holds", "Your cloud host and the services it connects to", "Your security plan, policies or scan reports (optional)", "Assessor findings (optional)" ], "prerequisites": [ "An AI that can read files, if you attach plans or reports" ], "output": [ { "name": "Scope and path", "contains": "The system, the customer, the path chosen and what to confirm on the FedRAMP site." }, { "name": "Impact level", "contains": "Low, moderate or high for confidentiality, integrity and availability, with reasons, and the level that results." }, { "name": "Boundary notes", "contains": "What is inside the line, what is outside, what crosses it and the open questions." }, { "name": "Control gap table", "contains": "Per control family, who is responsible, what you can prove and what an assessor will test." }, { "name": "Draft control statements", "contains": "How this system meets each control you gave facts for. Controls without facts are listed as gaps." }, { "name": "Action list", "contains": "Each weakness with risk, fix steps, and blanks for owner and date." }, { "name": "Package and upkeep", "contains": "The parts of an authorization package with their status, plus monthly and yearly tasks." }, { "name": "Questions for your assessor", "contains": "Points to settle with the assessor or agency before the assessment starts." } ] }, "output_shape": "SCOPE AND PATH\n System | Customer | Path | To confirm with FedRAMP \n\nIMPACT LEVEL\n Confidentiality | Integrity | Availability | System level \n\nBOUNDARY NOTES\n Inside | Outside | Crossing the line | Open questions \n\nCONTROL GAP TABLE\n | | | | | \n\nDRAFT CONTROL STATEMENTS\n | | | \n\nACTION LIST\n | | | | | \n\nPACKAGE AND UPKEEP\n | \n Monthly | Yearly | Before a big change \n\nQUESTIONS FOR YOUR ASSESSOR\n | ", "how_to_use": [ "Download the pack from this page and add it to your AI as a skill. If you cannot, paste SKILL.md into a new chat, then paste references/source-agent.md.", "Describe the system and the data it holds. Name your cloud host and the services it connects to.", "Attach your security plan, policies or scan reports if you have them. The AI reads files only. It cannot look into your systems.", "Type \"Plan this. Describe a control only if I showed you proof. List what an assessor would test.\"", "Read the boundary notes and the gap table first. Fix anything you know is wrong, then ask for a second pass.", "Check the path, the dates and the control list on the FedRAMP website. Give the draft to your assessor or advisor." ], "checks": [ "The result addresses your actual task and cites the evidence used.", "Examples, role-play experience and targets are kept separate from verified results.", "Claims of tests, memory, tool access or completed actions match what actually happened." ], "next": [ { "name": "Trade compliance checklist builder", "url": "https://useaiblocks.com/skills/trade-compliance-checklist", "why": "Trade compliance checklist builder" }, { "name": "Card payment security checker", "url": "https://useaiblocks.com/skills/card-payment-security-checker", "why": "Card payment security checker" }, { "name": "Internal controls testing planner", "url": "https://useaiblocks.com/skills/internal-controls-testing", "why": "Internal controls testing planner" } ], "source": { "by": "Michael Sitarzewski and Agency Agents contributors", "repo": "msitarzewski/agency-agents", "url": "https://github.com/msitarzewski/agency-agents/blob/b37b5bb33b78f2c1d6567d98e25ca818e3259219/specialized/specialized-fedramp-rmf-compliance.md", "licence": "MIT", "original_name": "FedRAMP & RMF Compliance Engineer", "commit": "b37b5bb33b78f2c1d6567d98e25ca818e3259219" }, "credits": [ { "title": "FedRAMP & RMF Compliance Engineer", "by": "Michael Sitarzewski and Agency Agents contributors", "url": "https://github.com/msitarzewski/agency-agents/blob/b37b5bb33b78f2c1d6567d98e25ca818e3259219/specialized/specialized-fedramp-rmf-compliance.md", "used": "Original agent profile, preserved in references/source-agent.md; AI Blocks adds setup and review instructions." } ], "files": [ "LICENSE", "references/source-agent.md", "SETUP.md", "source.json" ], "links": { "page": "https://useaiblocks.com/agents/agency-specialized-fedramp-rmf-compliance", "markdown": "https://useaiblocks.com/agents/agency-specialized-fedramp-rmf-compliance.md", "json": "https://useaiblocks.com/agents/agency-specialized-fedramp-rmf-compliance.json", "instructions": "https://useaiblocks.com/skills/agency-specialized-fedramp-rmf-compliance/SKILL.md", "download": "https://useaiblocks.com/skills/agency-specialized-fedramp-rmf-compliance.zip", "api_item": "https://useaiblocks.com/api/v1/items/agency-specialized-fedramp-rmf-compliance", "api_document": "https://useaiblocks.com/api/v1/documents/agent/agency-specialized-fedramp-rmf-compliance", "mcp": "https://useaiblocks.com/mcp" } }