<AttestationStatus framework="FedRAMP Moderate" status="in-process" asOf="2026-05-11" detailsHref="https://mattermost.com/trust/" />

<EditionAvailability tiers="enterprise,enterprise-advanced" /> <DeploymentAvailability modes="self-hosted,cloud-government,air-gapped" />

FedRAMP Moderate

This page documents Mattermost's posture against the FedRAMP Moderate baseline (NIST 800-53 Rev. 5 Moderate control set). It is the primary entry surface for Security Architects and Accreditors (docs/_redesign/personas.md §5 in the repo) preparing System Security Plans (SSPs) or evaluating Mattermost for use in FedRAMP-bounded environments.

:::important Status Current authorization status is set by the <AttestationStatus> badge above. Status updates require sign-off from Mattermost's compliance team — do not change in PRs without product + legal approval. See docs/_redesign/proposed-ia.md §5 risk 4 in the repo. :::

Authorization scope

When Mattermost achieves FedRAMP Moderate authorization, the authorization will apply to a specific deployment configuration. Customers using Mattermost in a FedRAMP-bounded environment inherit the authorization only when their deployment matches the authorized configuration. Deviations require customer-managed re-authorization.

Documented in this page:

• The authorized edition (Enterprise / Enterprise Advanced).
• The authorized deployment mode (Cloud Government or Self-Hosted in a FedRAMP-bounded enclave).
• The authorized release version range.
• The shared responsibility model — which controls Mattermost implements, which the customer implements, and which are shared.

NIST 800-53 control mapping

The mapping below is organized by NIST 800-53 control family. Each row identifies the Mattermost feature, plugin, or configuration setting that implements the control. Where multiple controls share an implementation, the implementation is listed once and cross-referenced.

This structure is modeled on Teleport's FedRAMP page, which organizes by NIST control family because that is the abstraction auditors cite in SSPs.

Access Control (AC)

Control	Implementation	Configuration
AC-2 (Account Management)	System Console → Users + SCIM provisioning	Onboard Users
AC-3 (Access Enforcement)	Role-based access control (System / Team / Channel) + Advanced Permissions	Manage Permissions
AC-6 (Least Privilege)	Custom roles + ABAC (Enterprise Advanced)	Manage Permissions
AC-7 (Unsuccessful Login Attempts)	ServiceSettings.MaximumLoginAttempts + account lockout	System Console → Authentication
AC-11 (Session Lock)	ServiceSettings.SessionLengthWebInHours + session expiration	System Console → Session Lengths
AC-17 (Remote Access)	TLS enforcement + MFA	Transport Encryption

Audit and Accountability (AU)

Control	Implementation	Configuration
AU-2 (Event Logging)	Audit log + JSON audit log schema	Comply
AU-3 (Content of Audit Records)	JSON audit log fields	Audit Log Reference (Phase 2)
AU-6 (Audit Review, Analysis, and Reporting)	SIEM integration via audit log export	Audit Log Export to Air-Gapped SIEM (Phase 2)
AU-9 (Protection of Audit Information)	Audit log immutability + offline export	Audit Log Reference (Phase 2)
AU-12 (Audit Record Generation)	Per-action audit emissions	Audit Log Reference (Phase 2)

Identification and Authentication (IA)

Control	Implementation	Configuration
IA-2 (Identification and Authentication)	SAML 2.0, OIDC, AD/LDAP	Onboard Users
IA-2(1) (MFA for Privileged Accounts)	MFA enforcement for system admins	System Console → MFA
IA-2(2) (MFA for Non-Privileged Accounts)	MFA enforcement for all users	System Console → MFA
IA-5 (Authenticator Management)	Password complexity policy + rotation	System Console → Password
IA-8 (Identification and Authentication, Non-Organizational Users)	Guest accounts with separate permission model	Guest Accounts

Configuration Management (CM)

Control	Implementation	Configuration
CM-2 (Baseline Configuration)	config.json version control + Operator CR	Configure
CM-6 (Configuration Settings)	Hardening guide + STIG profile	Hardening Guides
CM-7 (Least Functionality)	Per-feature enable/disable flags + plugin gating	Disable Phone-Home Features
CM-8 (Information System Component Inventory)	mmctl system info + Support Packet	Maintain

System and Communications Protection (SC)

Control	Implementation	Configuration
SC-7 (Boundary Protection)	NGINX reverse proxy + TLS + image proxy	Setup NGINX Proxy
SC-8 (Transmission Confidentiality and Integrity)	TLS 1.2+ enforcement	Setup TLS
SC-13 (Cryptographic Protection)	FIPS 140-3 validated modules (when FIPS mode enabled at install time)	Configure FIPS at Install Time (Phase 1) and Cryptography & FIPS (Phase 2)
SC-28 (Protection of Information at Rest)	Database encryption at rest + file storage encryption	Encryption Options

System and Information Integrity (SI)

Control	Implementation	Configuration
SI-2 (Flaw Remediation)	Security advisory feed + ESR cadence	ESR Support Policy
SI-4 (Information System Monitoring)	Prometheus / Grafana / Loki integration	Monitor & Operate
SI-7 (Software, Firmware, and Information Integrity)	Signed releases + checksum verification	Release verification — Phase 2

Other control families — Phase 2

The following control families will be added in Phase 2 as the Mattermost compliance team completes the authorization package:

• AT — Awareness and Training (operator + user training references)
• CA — Assessment, Authorization, and Monitoring (ATO process documentation)
• CP — Contingency Planning (backup, DR, BCP)
• IR — Incident Response
• MA — Maintenance
• MP — Media Protection
• PE — Physical and Environmental Protection (deployment-context specific)
• PL — Planning
• PS — Personnel Security
• RA — Risk Assessment
• SA — System and Services Acquisition
• SR — Supply Chain Risk Management

Shared responsibility

When Mattermost achieves FedRAMP Moderate authorization for the Cloud Government deployment mode, a formal shared responsibility model will be published here. Self-Hosted deployments operate entirely under the customer's authorization boundary — Mattermost's contribution is the validated configuration guidance on this page.

Required configuration

For a Mattermost deployment to align with FedRAMP Moderate, the following configuration is required:

1. FIPS mode enabled at install time — see Configure FIPS at Install Time (Phase 1). FIPS cannot be enabled post-deploy.
2. TLS 1.2+ for all client and inter-service traffic — see Transport Encryption.
3. Audit log retention ≥ 1 year — configure via LogSettings.FileLevel and external SIEM export.
4. MFA enforced for all users — System Console → MFA.
5. Phone-home features disabled — see Disable Phone-Home Features.
6. Audit log offline export configured — see Audit Log Export to Air-Gapped SIEM (Phase 2).

References

• NIST SP 800-53 Rev. 5 — base control catalog.
• FedRAMP Moderate baseline — the Moderate control selection.
• Mattermost Trust Portal — formal attestation letters and authorization artifacts.
• Teleport FedRAMP documentation — reference model for the NIST-control-family structure used on this page.
• GitLab FedRAMP secure configuration guide — reference model for numbered requirement / recommendation structure.