Hire an AI FedRAMP and RMF compliance planner

Everything it can hand back

Your task sets the actual outputs. The specialist picks the methods that cover them.

• A scope note that compares the paths and says what to confirm with FedRAMP
• An impact level worked out from your data, with the reasons
• Boundary notes that say what is inside, what is outside and what crosses the line
• A control gap table that shows who is responsible, what you can prove and what an assessor will test
• Draft control statements for the controls where you gave facts
• An action list with risk, steps, owner and date left for you to fill

How it does the job well

• Never describe a control as in place unless the user showed proof. If a statement cannot be proved, say so and put it on the action list.
• Rate impact honestly from the data and mission. The highest of confidentiality, integrity and availability sets the level. Do not suggest a lower rating to avoid controls.
• Boundary first. Do not write control statements until the inside, the outside and the data flows are written down.
• Keep inherited, shared and customer-responsibility controls apart. Never claim a control the host provides as the user's own, and never leave a shared one unowned.
• Tailoring a control out needs a written reason that an authorizing official could accept. Say so when the user wants to drop one.
• Define the authorization boundary before writing the SSP — everything depends on it. The boundary diagram establishes what's in scope, the data flows, and the external connections. An imprecise or wrong boundary means the SSP describes the wrong system, controls get mis-scoped, and the assessment unravels.
• Tailoring requires documented justification — you don't drop a control because it's inconvenient. Baseline controls are mandatory unless tailored out with a rationale the AO will accept, and compensating controls must genuinely cover the risk. Undocumented or unjustified tailoring is the same as a missing control.

Mistakes it avoids

• Copying control text and calling it a statement.
• Claiming a control that the cloud host provides.
• Hiding a weakness off the action list.
• Treating dates, program status or revision numbers from the profile as current.
• Long lists of generic issues with no evidence they apply.
• Testing or scanning systems without permission.

What a good result looks like

An example, not your task: You run cloud software and an agency or prime contractor asks if you are FedRAMP authorized.

• Scope and path. The system, the customer, the path chosen and what to confirm on the FedRAMP site.
• Impact level. Low, moderate or high for confidentiality, integrity and availability, with reasons, and the level that results.
• Boundary notes. What is inside the line, what is outside, what crosses it and the open questions.
• Control gap table. Per control family, who is responsible, what you can prove and what an assessor will test.
• Draft control statements. How this system meets each control you gave facts for. Controls without facts are listed as gaps.
• Action list. Each weakness with risk, fix steps, and blanks for owner and date.

How the work is checked

• Each finding has a location, evidence, severity and a specific fix.
• Likely false positives are checked and removed.
• Items that need a lawyer or auditor are clearly marked.
• States which checks passed, failed or could not run, and names missing inputs.

These checks have not been run against a model yet. Your AI uses them to check its own work.

Capabilities

• Set the scope. It confirms the system, the data, the customer agency and the path, then marks what to confirm with FedRAMP.
• Set the impact level. It rates confidentiality, integrity and availability from your data and mission. The highest sets the level, and it will not rate lower to avoid work.
• Define the boundary. It lists what is inside the line, what is outside, and what crosses it. The boundary comes before any control writing.
• Split responsibility. For each control family it says if the control is yours, inherited from your host, shared or the customer's.
• Check for proof. It marks each control provable now, not provable yet, planned or unknown, and says what proof an assessor will test.
• Draft statements. For controls where you gave facts, it drafts a statement that says how this system meets the control, who owns it and what proof backs it.
• Build the action list. Each gap gets a risk level, fix steps and a blank for owner and date. It also lists the package parts and the monthly upkeep.

How the role works

1. Checks your task, context and available tools.
2. Picks the methods needed and prepares a work plan.
3. Carries out supported tasks, with each method's limits and review gates.
4. Checks the real deliverables and corrects supported faults.
5. Hands back files, evidence and unresolved gaps.

Your specialist's working setup

Download the base specialist without a task form or account. README.md and SETUP.md explain how to use the folder. SOUL.md defines its scope. INTAKE.md asks missing questions inside your AI. PLAYBOOK.md, SKILLS.md, BEST_PRACTICES.md, CHECKS.md and HANDOFF.md guide the work and its checked deliverables.

Complete associated skills, supporting files and licences are included. Choose only the methods needed for the actual task. Keep context, working files and accepted feedback in your AI project.

Use this specialist through MCP or the API

Call prepare_specialist with role_id specialized-fedramp-rmf-compliance only. No task is required to load it. Your AI asks what job you need done, what you want back and which relevant context it can use.

For task-led hiring, call find_specialist, explain the suggested specialists and let the user accept or change the team.

Complete ZIP: Download base specialist. API: GET /api/v1/specialists/specialized-fedramp-rmf-compliance/pack. The host AI supplies its own model, tools and execution; a pack does not connect accounts or run a task.

Inputs and helpful context

The specialist starts from the task brief. Only active methods require their inputs.

For the primary method, when used

• A description of the system, what it does and who uses it
• The kinds of data it holds, and the damage if that data were leaked, changed or lost
• Your cloud host or platform, and the other services the system connects to
• Your security plan, policies or control notes, if you have them (optional)
• Any assessor findings or scan reports (optional)
• The agency you work with, or your target impact level (optional)

Helpful context (optional)

• A diagram or list of how data moves in and out of the system.
• Your cloud host's own FedRAMP documents on what it covers.
• Your account lists, patch reports and log settings.

Tools and access

• Claude, ChatGPT or Gemini with file upload: It can read your security plan and scan reports together, then tie each control to a line of proof.

Functions and deliverables

• FedRAMP and RMF compliance planner: Plan FedRAMP or NIST RMF authorization for a cloud system. Get its impact level, scope notes, control gaps and a fix list for your assessor.
  • A scope note that compares the paths and says what to confirm with FedRAMP
  • An impact level worked out from your data, with the reasons
  • Boundary notes that say what is inside, what is outside and what crosses the line
  • A control gap table that shows who is responsible, what you can prove and what an assessor will test
  • Draft control statements for the controls where you gave facts
  • An action list with risk, steps, owner and date left for you to fill
  Source: Michael Sitarzewski and Agency Agents contributors.
• Federal security controls planner: Describe your system and security needs. Get a NIST control baseline, tailoring notes and draft control write-ups.
  • A baseline recommendation with the impact rating behind it
  • Tailoring choices with reasons
  • Draft control narratives you can edit
  • A gap table with fixes
  Source: Hemant Naik.
• FedRAMP readiness planner: Describe your cloud service. Get a likely path, required documents and gaps to review.
  • A recommended approval path and target class
  • A gap table with priority and owner for each gap
  • A checklist of the documents to write
  • A map of the NIST 800-53 controls that apply to you
  • Monthly and yearly monitoring steps after approval
  Source: Hemant Naik.
• IT controls audit planner: Plan an IT controls audit for SOX. Give it your finance systems and get a risk and control matrix, test steps and a rating for any gaps.
  • A risk and control matrix
  • Narratives and test scripts
  • A deficiency rating for gaps
  • A note on which SOX rules apply to you
  • A fix plan
  Source: Hemant Naik.
• me.md builder: Answer a few questions, or let your AI use what it remembers. Get one private file that tells any AI who you are.
  • One me.md file with up to ten dated sections
  • A list of facts taken from memory, for you to check
  • A short note of what it removed for privacy
  • The two next steps, to save it and set it up

Tasks you can use it for

• You run cloud software and an agency or prime contractor asks if you are FedRAMP authorized.
• You are choosing between the traditional path and the newer 20x path and want the trade-offs written down.
• A draft security plan says controls are in place and you want to know which ones you can actually prove.
• Your assessor found weaknesses and you need an action list with risk, owner and dates.

Limits to check before starting

• You need an assessment or an authorization. Only an accredited assessor and an agency can give one.
• You want SOC 2 or ISO 27001 readiness, with no US government customer. Use the Compliance Auditor agent.
• You need valid machine-readable (OSCAL) files. This agent writes text and tables only. It does not make or check those files.

Best way to use this role

Give it one clear outcome, the actual files and a definition of done. Keep the work in one AI project so it can reuse checked context and earlier files.

• Download the pack from this page and add it to your AI as a skill. If you cannot, paste SKILL.md into a new chat, then paste references/source-agent.md.
• Describe the system and the data it holds. Name your cloud host and the services it connects to.
• Attach your security plan, policies or scan reports if you have them. The AI reads files only. It cannot look into your systems.
• Type "Plan this. Describe a control only if I showed you proof. List what an assessor would test."
• Read the boundary notes and the gap table first. Fix anything you know is wrong, then ask for a second pass.
• Check the path, the dates and the control list on the FedRAMP website. Give the draft to your assessor or advisor.

Read it as data

Read the complete role setup as JSON. Connect your AI to the AI Blocks MCP library and read aiblocks://roles/specialized-fedramp-rmf-compliance for its role instructions and pinned sources.

This is a prepared AI role. No task has run. Your AI carries out authorized work using its available tools and reports the actual deliverables and checks.