FedRAMP authorization is the federal government’s standardized, reusable security assessment for cloud services. A provider is assessed once and agencies reuse the result. Under the newer FedRAMP 20x model, services earn a Class A, B or C certification.
What FedRAMP is and why it exists
FedRAMP, the Federal Risk and Authorization Management Program, sits within the General Services Administration, whose Technology Transformation Services operates fedramp.gov. The program’s timeline says the law established FedRAMP as a government-wide, standardized, reusable approach to cloud security assessment and authorization. The idea is simple: instead of every agency separately vetting the same email platform or storage service, one assessment is documented and shared.
That law is the FedRAMP Authorization Act of December 2022. In July 2024 the Office of Management and Budget issued memorandum M-24-15, which replaced the earlier policy with a vision built around new authorization paths, automation and government-wide cloud adoption. In March 2025 the program announced FedRAMP 20x, a new path built with industry and delivered in increments.
What counts as in scope
FedRAMP covers cloud computing products and services, including infrastructure, platform and software as a service, that create, collect, process, store or maintain federal information on behalf of an agency. Its scope guidance lists exclusions, such as information systems used only for a single agency’s operations that are not offered as a shared service, social media platforms, and search engines. Each agency decides for itself whether a given use case falls inside the scope.
The classes: how impact levels map to 20x
Federal systems are sorted by how much damage a failure would cause, traditionally as low, moderate or high impact. FedRAMP 20x keeps that idea but labels certifications by class. The program says a public website might need high availability, moderate integrity and low confidentiality, while a medical records application might need moderate availability and high integrity and confidentiality, so the right expectations depend on the agency’s use case.
| Class | Impact level | Intended for | Status on the 20x page |
|---|---|---|---|
| Class A | Pilot | Services with mature security and compliance programs entering the federal marketplace | Available now |
| Class B | Low | Common small-scale or light-use services | Available now |
| Class C | Moderate | Common enterprise services likely to be used across an entire agency or for important government services | Available now |
| Class D | High | High-impact services; path to be piloted in Phase 4 | Class D pilot estimated for fiscal 2027, first and second quarters |
Source: FedRAMP 20x page on fedramp.gov, which states future dates are estimates and will shift.
How a cloud service gets certified
The earlier model is called Rev5. The 20x page says independent assessment must move beyond traditional control-by-control, minimum-bar audits, and that Key Security Indicators can show security posture in near real time, replacing static yearly manual assessments. The 2025 plan also proposed removing the agency sponsorship barrier, per the program’s FedRAMP blog.
The program ran in phases. Phase 1, a Low pilot from April through September 2025, received 26 complete packages. Phase 2, the Moderate pilot, ran from November 18, 2025 through March 2026 and received 14 qualifying submissions. Phase 3, the wide-scale adoption phase, is the current one on the 20x page.
The same November 2, 2026 post records the milestones since. The Consolidated Rules for 2026 were published in June 2026. They introduced Class A, for companies with a high-quality security program and an external SOC 2 Type II or GovRAMP assessment, and set final rules for Class B and Class C. The 20x pipeline opened in August 2026, FedRAMP granted the first Class A certification on August 25, 2026, and the first Class C certification that meets the 2026 rules on October 29, 2026.
Existing Rev5 certifications do not disappear overnight. The 20x timeline says FedRAMP will stop accepting new Rev5 certifications on June 11, 2027, and will set out a transition path for existing offerings; the page marks that phase as an estimate.
FedRAMP and the Department of Defense
FedRAMP is government-wide, and DoD layers its own requirements on top. DISA, the Defense Information Systems Agency, issues DoD Provisional Authorizations for cloud services at Impact Levels 4, 5 and 6. According to DISA’s DoD Cloud Authorization Process brief (June 2024), a DoD authorization is based on FedRAMP plus additional DoD security requirements, and there are two paths to obtaining one: uplift or leverage a FedRAMP agency authorization, or complete a third-party assessment plus DISA validation against 10 general readiness requirements in the Cloud Computing Security Requirements Guide. The same brief notes that DoD typically leverages an existing FedRAMP authorization when possible.
Defense contractors meet FedRAMP from another direction. The CMMC program rule, published in the Federal Register on October 15, 2024, notes that DFARS clause 252.204-7012 requires contractors to confirm that any cloud service providers they use to handle CUI meet the FedRAMP Moderate baseline or equivalent requirements. If the offering does not process, store or transmit CUI, FedRAMP certification is not required. The CMMC levels themselves are covered in the CMMC explainer, and the security model behind DoD network policy is in the guide to zero trust for defense networks.
Where to follow cloud security policy in person
The Department of the Air Force’s annual IT and cyberpower event in Montgomery, Alabama, brings Air Force and private sector technology leaders together. The AFITC conference guide covers who attends and where to find the official schedule. The defense cybersecurity overview places FedRAMP alongside CMMC, NIST SP 800-171 and the offices that set cyber policy. This site is an independent resource and is not affiliated with the Air Force or any event organiser.
Frequently asked questions
Is FedRAMP authorization the same as FedRAMP certification?
Under FedRAMP 20x the program uses the word certification, with Class A to D labels. Older material and the DoD brief still use authorization.
Does every government cloud service need FedRAMP?
No. Per FedRAMP’s scope guidance, categories such as single-agency systems that are not shared services, search engines and social media platforms are outside FedRAMP, and each agency decides its own use case.
When does FedRAMP stop accepting new Rev5 certifications?
The 20x page gives June 11, 2027, within a phase it lists as estimated.
Is a FedRAMP authorization enough for DoD use?
Not for the higher impact levels. DISA issues its own provisional authorization for Impact Levels 4, 5 and 6, built on FedRAMP and extra DoD requirements.
Photo credits: panumas nikhomkhai (Pexels License); Brett Sayles (Pexels License).
