Myself and a coworker are struggling to find an answer to this. He believes FedRAMP is intended to apply to any/all federal information that is processed/stored/transmitted in a CSP.

However, if I'm sticking strictly to government sources, the only mandated FedRAMP requirement is in DFARS 7012, and the CMMC FAQ, which applies to CDI and CUI respectively. My understanding of CDI is that it is a subset of CUI, and CUI is a subset of FCI.

In my logic, that means that the FCI that CMMC Level 1 deals with is not subject to requiring a CSP (that is processing/storing/transmitting it for a contractor) to meet any FedRAMP levels.

If anyone has any knowledge or answers for this and can back it up with a source, I'd really appreciate it. Thank you.