FedRAMP

The Federal Risk and Authorization Management Program (FedRAMP) is a government-wide program that promotes the adoption of secure cloud services across the federal government by providing a standardized approach to security and risk assessment for cloud technologies and federal agencies. FedRAMP uses the National Institutes of Standards & Technology Special Publication (NIST SP) 800 series and requires cloud service providers to complete an independent security assessment conducted by an accredited third-party assessment organization (3PAO) to ensure that authorizations are compliant with the Federal Information Security Management Act of 2002 (FISMA 2002).

New Relic has met the FedRAMP security control requirements as described in the NIST SP 800-53, Rev. 5 security control baseline for Class C (Moderate) impact levels, has been assessed by an independent 3PAO, has posted its security package in FedRAMP's secure repository, and maintains a FedRAMP Class C (Moderate) certification, see New Relic Attains FedRAMP Moderate Impact for SaaS Services. Federal agencies are responsible for reviewing New Relic's security package, including shared responsibility details, and issuing their own Authority to Operate (ATO) decision.

As a part of achieving a FedRAMP Class C (Moderate) certification, New Relic has produced a FedRAMP Customer Implementation Summary/Customer Responsibility Matrix (CIS/CRM) that delineates the shared security and privacy responsibilities between New Relic and its Customers (for example, federal agencies). Download our New Relic FedRAMP Customer Responsibility Matrix (CRM) as an XLSX file (70 KB) or as a PDF file (176KB) to understand your specific implementation responsibilities. This document outlines the security controls that customers will need to engineer, design, define, and implement in order to be in compliance with the FedRAMP baseline and to help customers achieve and maintain their ATO.  New Relic has also produced a FedRAMP Customer Secure Configuration Guide to provide recommendations for securely configuring the New Relic Observability Platform. Customers are responsible for applying configurations in order to meet their own security and compliance requirements.

For access to the New Relic security package, U.S. government employees and contractors can sign and submit the FedRAMP Package Request Form from the New Relic FedRAMP Marketplace to package-access@fedramp.gov.

Applicable document by service

The following applies to the New Relic Observability Platform:

Services not in scope

The following services are not FedRAMP-authorized: