What is FedRAMP 20x, and how is it different from FedRAMP Rev5?
+
FedRAMP 20x is the new cloud-native security certification standard introduced by GSA.
Where the older Rev5 framework relied on point-in-time documentation and annual assessments,
20x uses continuous, automated security validation through Key Security Indicators — making
it better suited to modern SaaS platforms. Halo is certified under 20x. ServiceNow is
still authorized under Rev5 and will need to migrate to 20x over time.
Note that 20x and Rev5 are certification standards (how security is assessed),
separate from impact levels (how sensitive the data is). ServiceNow holds a High
impact authorization; Halo holds Moderate. These are different things, and both matter when
evaluating fit for your specific agency and use case.
Can my agency use Halo's existing FedRAMP authorisation, or do we need our own ATO?
+
In most cases, yes. Your agency can use Halo's existing FedRAMP authorisation rather
than running its own ATO process from scratch. This is one of the core benefits of FedRAMP:
once a platform is certified, that authorisation can be reused across agencies. Allied ESM
will walk you through the reuse path, confirm it fits your specific use case, and provide
the security package your compliance team needs to proceed.
What impact level does Halo's FedRAMP certification cover, and is Moderate enough?
+
Halo is certified at Moderate impact (Class C) under FedRAMP 20x. For the
vast majority of IT service management use cases — help desk, asset management, HR workflows,
facilities, citizen-facing portals — Moderate is the appropriate and sufficient level.
ServiceNow holds a High impact authorization, which covers systems handling certain categories
of particularly sensitive data, such as law enforcement, classified information, or national
security systems. If your agency has a confirmed High impact requirement for a system
specifically handling that type of data, Halo's current authorization would not cover it.
We will always tell you that upfront. For standard government IT service management,
Moderate is the right fit.
Does this apply to state and local government, or only federal agencies?
+
Both. FedRAMP certification is primarily designed for federal agencies, but state and local
governments frequently use FedRAMP-certified platforms as part of their own risk and
compliance frameworks. Some state programmes (such as StateRAMP) explicitly recognise
FedRAMP authorisations. Halo is a strong fit for state CIOs, county IT departments, and
municipal governments looking to modernise service management on a secure, verified platform.
How long does a Halo ITSM implementation take?
+
Allied ESM typically completes Halo ITSM implementations in weeks, not months. The exact
timeline depends on the number of modules, integration complexity, and how much data migration
is involved. Halo's out-of-the-box configuration means significantly less custom
development than ServiceNow requires. We'll give you a precise timeline after an initial scoping call.
Does Halo support CMMC for DoD contractors?
+
Yes. Halo's GRC module supports CMMC compliance programs alongside FedRAMP and
FISMA requirements. Defense contractors can use Halo to manage their CMMC controls,
track vulnerabilities, and maintain the audit trails required for certification —
all within the same platform running their IT service desk. Allied ESM can scope
and deliver a Halo implementation tailored to CMMC Level 2 or Level 3 requirements.
What does Allied ESM do, and how do you work with Halo?
+
Allied ESM is an official Halo partner. We handle implementation, configuration, data
migration, training, and ongoing managed services. Halo is the platform vendor; we are
the implementation and support partner. Think of it like the relationship between a
software vendor and a systems integrator, except we only do Halo. No competing platforms,
no divided expertise.