FedRAMP 20x, cloud impact levels, and authorization boundaries
Check which exact services a cloud assessment covers.
Reviewed: 2026-10-03
Source-based teaching example · Fictional data
Narration: Microsoft Mark · locally synthesized

00:00:00.000 — What you will learn

Check which exact services a cloud assessment covers.

Visual description:
Check which exact services a cloud assessment covers.

00:00:06.292 — The idea

Review the offered service and its boundary, not only the provider or region. Separate reused provider evidence from customer responsibilities. Unresolved connected services remain unresolved.

Visual description:
Review the offered service and its boundary, not only the provider or region. Separate reused provider evidence from customer responsibilities. Unresolved connected services remain unresolved.

00:00:21.958 — One useful term

Service boundary. The components and data flows included in a particular service assessment.

Visual description:
The components and data flows included in a particular service assessment.

00:00:30.875 — A worked example

Cloud A has hosting evidence, but ORION sends traces to dashboard B outside that boundary. Cloud C has a suitable-looking region but no service evidence. Neither situation proves approval of the full system.

Visual description:
Cloud A has hosting evidence, but ORION sends traces to dashboard B outside that boundary. Cloud C has a suitable-looking region but no service evidence. Neither situation proves approval of the full system.

00:00:47.333 — Your turn to think

Does hosting evidence automatically cover a separate log collector? Pause and decide before continuing.

Visual description:
Does hosting evidence automatically cover a separate log collector?
Pause the video if you need more time.

00:01:04.875 — Why this answer works

No. Review that service and the customer controls separately. Use current official evidence for any actual authorization decision.

Visual description:
No. Review that service and the customer controls separately. Use current official evidence for any actual authorization decision.

00:01:16.458 — Check 1

Name the exact service and configuration.

Visual description:
Name the exact service and configuration.

00:01:22.042 — Check 2

Include separate collectors and data flows.

Visual description:
Include separate collectors and data flows.

00:01:27.750 — Check 3

Keep gaps and responsible decision owners visible.

Visual description:
Keep gaps and responsible decision owners visible.

00:01:33.750 — Now try a different case

Open the lesson and try its different practice case. Use every check in the full task. Watching alone does not mark the lesson complete.

Visual description:
Open the lesson
Try the new case
Check and revise
The full task and its requirements are in the linked lesson.