A federal agency contractor is designing a Claude-based document analysis system for data categorized at the Moderate impact level. The proposed architecture uses a model endpoint, a managed vector database, a SaaS logging tool and a CI/CD service. What should the architect do regarding FedRAMP?

Answer: A — Verify each component handling federal data sits in a boundary authorized at a suitable impact level

FedRAMP authorizations are scoped to a specific service offering, boundary and impact level, so each component in the data path has to be checked, and the agency then grants its own authority to operate. (b) ignores the other components. (c) treats one control as if it replaced authorization. (d) wrongly assumes vendor-wide coverage.