.

compliance/frameworks/fedramp-compliance/SKILL.md

@@ -0,0 +1,71 @@
+---
+name: fedramp-compliance
+description: Implement FedRAMP requirements for federal cloud services. Configure NIST 800-53 controls and continuous monitoring. Use when providing cloud services to US federal agencies.
+license: MIT
+metadata:
+  author: devops-skills
+  version: "1.0"
+---
+
+# FedRAMP Compliance
+
+Implement FedRAMP requirements for federal cloud services.
+
+## Impact Levels
+
+```yaml
+levels:
+  low:
+    controls: ~125
+    use_case: Public data
+    
+  moderate:
+    controls: ~325
+    use_case: CUI, most federal systems
+    
+  high:
+    controls: ~425
+    use_case: Law enforcement, emergency services
+```
+
+## NIST 800-53 Families
+
+```yaml
+control_families:
+  AC: Access Control
+  AU: Audit and Accountability
+  AT: Awareness and Training
+  CM: Configuration Management
+  CP: Contingency Planning
+  IA: Identification and Authentication
+  IR: Incident Response
+  MA: Maintenance
+  MP: Media Protection
+  PE: Physical Protection
+  PL: Planning
+  PS: Personnel Security
+  RA: Risk Assessment
+  CA: Assessment and Authorization
+  SC: System and Communications Protection
+  SI: System and Information Integrity
+  SA: System and Services Acquisition
+  PM: Program Management
+```
+
+## Continuous Monitoring
+
+```yaml
+conmon:
+  vulnerability_scans: Monthly
+  penetration_tests: Annual
+  poa_m_updates: Monthly
+  security_assessment: Annual
+```
+
+## Best Practices
+
+- 3PAO assessment
+- SSP documentation
+- POA&M tracking
+- Continuous monitoring
+- Annual authorization