FedRAMP in 2026: Certification Classes, 20x and the Rev5 Transition

FedRAMP decides whether a cloud service can be used by US federal agencies. If you sell SaaS, PaaS or IaaS to the federal government, a FedRAMP certification is effectively the entry ticket. It is also one of the most demanding security programs in the world, built on NIST SP 800-53 controls, independent assessment and continuous monitoring.

The program is in the middle of its biggest change since it began. In 2026, FedRAMP adopted Consolidated Rules that rename "authorization" to "certification", replace Low, Moderate and High impact levels with certification classes, and set a timeline to move every provider from the traditional Rev5 process to FedRAMP 20x, which relies on automated, machine-readable evidence. This guide explains what FedRAMP is, who needs it, how the process works now, the transition dates, and how to decide whether to pursue it. Because the program is changing quickly, this guide is reviewed every three months; always check fedramp.gov for the latest rules.

What is FedRAMP?

The Federal Risk and Authorization Management Program is a US government-wide program that provides a standardised approach to security assessment, certification and continuous monitoring for cloud products and services. It is run by a program office within the General Services Administration (GSA), with policy direction from the Office of Management and Budget and a FedRAMP Board of agency representatives.

The core idea is "do once, use many times": instead of every agency assessing every cloud service separately, a provider is assessed against a common set of requirements, and agencies can reuse that assessment for their own authorisation decisions. Under the 2026 Consolidated Rules, FedRAMP issues a FedRAMP Certification for a cloud service offering, and each agency still makes its own risk decision and performs continuous monitoring as required by OMB Circular A-130.

History and why FedRAMP was introduced

FedRAMP was established by an OMB policy memo in December 2011, after the US government adopted a "cloud first" policy and agencies found themselves repeating the same security assessments for the same cloud services. The program used NIST SP 800-53 baselines with FedRAMP-specific parameters, a Joint Authorization Board of DHS, DoD and GSA, and accredited third-party assessment organisations (3PAOs).

The FedRAMP Authorization Act, part of the National Defense Authorization Act for fiscal year 2023, put the program into law. In 2025 the program launched FedRAMP 20x, an effort to replace document-heavy assessments with automated validation of key security indicators. In 2026, FedRAMP published Consolidated Rules for 2026 (CR26), which apply to both the traditional Rev5 path and 20x, and set dates to retire Rev5.

Who needs FedRAMP?

• Cloud service providers offering SaaS, PaaS or IaaS that federal agencies will use to process, store or transmit federal information.
• Non-US companies selling cloud services to US federal agencies, subject to the same requirements.
• Software vendors whose products are delivered as a service rather than installed in an agency's own environment.

FedRAMP is not needed to sell to private companies, which usually ask for SOC 2 or ISO/IEC 27001. State and local governments have their own programs, such as GovRAMP. US defence contractors' own systems follow CMMC and NIST SP 800-171, though cloud services they use for controlled information may need FedRAMP Moderate or equivalent.

The 2026 Consolidated Rules and key dates

According to FedRAMP's own guidance at our last review:

Date	What happens
July 2026	Consolidated Rules for 2026 take effect for offerings seeking or maintaining certification; some Rev5 rulesets become mandatory before 2027
1 January 2027	Enforcement of the full Consolidated Rules begins, including for existing Rev5 certifications
11 June 2027	FedRAMP stops accepting new Rev5 certifications
31 December 2028 (at least)	Existing Rev5 certifications remain active until at least this date unless FedRAMP directs otherwise; providers are told to plan the move to 20x

Changes in terminology and approach

• "FedRAMP authorization" becomes FedRAMP Certification, to distinguish it from an agency's authorisation to operate.
• Low, Moderate and High impact levels become certification classes A to D.
• The system security plan and appendices become a certification package overview and security decision record, delivered in machine-readable form (JSON, or optionally OSCAL) rather than Word and Excel templates.
• "Continuous monitoring" by the provider becomes ongoing certification, while agencies take part in collaborative continuous monitoring.
• Most FedRAMP-defined parameters for SP 800-53 controls are removed so providers define their own, and providers must document their use of FIPS 140 validated encryption.
• Plans of action and milestones are replaced by a list of accepted weaknesses, and vulnerability detection and response requirements go well beyond monthly scanning.

FedRAMP 20x

FedRAMP 20x replaces long narrative documentation with key security indicators that are validated continuously, wherever possible through automation. Providers demonstrate security through machine-readable evidence produced by their platforms, and 3PAOs validate the indicators. The program opened 20x pathways in stages through 2026 and plans further phases for the highest class. Check fedramp.gov/20x for the current status of each class.

Who does what in FedRAMP

Role	Responsibility
Cloud service provider	Implements the requirements, produces the certification package and evidence, fixes weaknesses and maintains ongoing certification
Federal agency	Decides whether to use the service, makes its own authorisation decision based on the security decision record, configures its own use securely and takes part in collaborative continuous monitoring
Third-party assessment organisation (3PAO)	Independently assesses and validates the provider's implementation and evidence
FedRAMP program office (GSA)	Sets the rules and processes, reviews packages, issues certifications and runs the Marketplace
FedRAMP Board	Agency representatives who provide oversight and approve program policies
OMB and CISA	Set federal policy and provide cybersecurity guidance and threat information

One point that surprises many first-time providers: FedRAMP certification does not end the agency's responsibilities. Agencies must still configure the service correctly, manage their own users and data, and decide whether the residual risk is acceptable for their mission. Your package should make it easy for them, with a clear description of what the customer is responsible for.

Is FedRAMP right for your company?

Before committing, answer these questions honestly:

• Is there a named federal buyer? An agency that wants to use your service is the strongest signal. Speculative certifications are expensive to maintain.
• Is the federal opportunity large enough to fund certification and the ongoing work, including a possible separate environment?
• Can your platform meet federal cryptography and data location expectations without a rebuild?
• Is your evidence already automated? Teams with infrastructure as code, central logging and automated vulnerability management are much better placed for 20x.
• Do you have people to own ongoing certification, including vulnerability response and reporting to agencies?
• Would a reseller or partner route work first? Some vendors reach federal customers through a partner whose certified platform hosts their software, which may change what you need.

If most answers are no, investing first in SOC 2 or ISO/IEC 27001 and in automation will make a later FedRAMP effort faster.

Typical engineering work

For a SaaS product moving toward FedRAMP, the engineering backlog usually includes: moving workloads onto a certified infrastructure platform and region; switching to FIPS-validated cryptographic modules for data in transit and at rest; enforcing phishing-resistant multi-factor authentication for administrators; centralising logs from every component with tamper protection; automating vulnerability scanning of hosts, containers and dependencies with tracked remediation; codifying configuration and enforcing it with policy checks; tightening the system boundary by removing or replacing external services that cannot meet requirements; and building reports that turn this data into evidence the program and agencies can consume. Much of this also reduces day-to-day operational risk, which is the point of the program.

How the process works

1. Decide the class your offering needs, based on the federal information it will handle and what agency customers require.
2. Find agency demand: most providers enter FedRAMP with a sponsoring agency that intends to use the service.
3. Define the boundary of the cloud service offering, including underlying cloud platforms (which should themselves be FedRAMP certified) and external services.
4. Implement the requirements: SP 800-53 based controls for Rev5, or the key security indicators for 20x, with automated evidence.
5. Engage an accredited 3PAO to assess and validate.
6. Submit the certification package in the required machine-readable format for FedRAMP review.
7. Obtain FedRAMP Certification; agencies then make their own authorisation decisions using your security decision record.
8. Maintain ongoing certification: vulnerability detection and response, change notification, annual assessment and collaboration with agency customers.

Documentation and evidence required

• Certification package overview and security decision record (formerly the system security plan).
• Boundary description and data flow diagrams.
• Control implementation or key security indicator evidence, preferably machine-generated.
• Policies and procedures for the relevant control families.
• Incident response, contingency and configuration management plans.
• Vulnerability scan results and remediation evidence.
• Third-party assessment reports.
• Accepted weaknesses list and ongoing certification records.
• Documentation of FIPS 140 validated cryptography use.

Timeline and cost considerations

Traditional FedRAMP Rev5 authorisations were known for long timelines and high cost, driven by documentation, remediation, assessor fees and agency review. FedRAMP 20x aims to shorten this through automation, but the engineering work to produce reliable, automated evidence is significant. Cost factors include: engineering to meet controls or indicators; FIPS-validated cryptography; logging, monitoring and vulnerability management at federal standards; a 3PAO; potentially a separate government-only environment; staff for ongoing certification; and legal and contracting support. Because FedRAMP certification is tied to agency use, the business case should rest on a realistic federal sales pipeline.

Benefits and consequences of not having it

FedRAMP certification opens the US federal market and is reusable by many agencies. It is also respected by state governments, regulated industries and some private buyers as evidence of strong security. The discipline of automated evidence under 20x also benefits SOC 2 and ISO programmes.

There are indirect benefits too. Preparing for FedRAMP forces a precise system boundary, an honest inventory of external dependencies, and evidence that comes from systems rather than people. Those habits make every later audit cheaper and make incident investigations faster, because the logs, configuration history and vulnerability records already exist and can be trusted.

Without FedRAMP, a cloud service generally cannot be used by federal agencies for federal information. Misrepresenting security compliance to the federal government carries legal risk, including under the False Claims Act, which the US Department of Justice has used in cybersecurity cases.

Common mistakes and challenges for IT companies

• Pursuing FedRAMP without agency demand. Certification is costly; have a clear federal sales path first.
• Planning on old documents. Rev5 templates and terminology are being retired; plan for machine-readable packages and 20x.
• Boundary creep. Every external service inside the boundary needs to meet requirements; keep the boundary tight.
• Non-validated cryptography. FIPS 140 requirements can force library and service changes late in the project.
• Manual evidence. 20x favours automated, continuous validation; manual screenshots will not scale.
• Underestimating ongoing work. Ongoing certification requires continuous vulnerability response and reporting.

Best practices, tools and technologies

• Build on an underlying cloud platform that already holds FedRAMP certification at the needed class.
• Use infrastructure as code and policy as code to produce verifiable configuration evidence.
• Centralise logging and security monitoring with retention that meets federal expectations.
• Automate vulnerability scanning, prioritisation and remediation tracking.
• Use OSCAL or JSON tooling for packages, and map controls once to SOC 2 and ISO/IEC 27001 as well.
• Design tenant isolation and a government-only deployment if required.

Our SaaS product and modernisation work includes building the automated evidence, logging and configuration management that federal programs expect.

How FedRAMP relates to other frameworks

Framework	Relationship
NIST SP 800-53	The control catalogue underlying FedRAMP Rev5 baselines.
FISMA	The law requiring agencies to secure federal information, which FedRAMP supports for cloud services.
NIST RMF	The risk management process agencies follow when authorising systems.
GovRAMP	A similar program for US state and local governments.
SOC 2	Common private-sector assurance; does not replace FedRAMP for federal use.
CMMC	Defence contractor program; cloud services handling CUI often need FedRAMP Moderate or equivalent.

Real-world implementation examples

The FedRAMP Marketplace lists every certified cloud service offering, its class and the agencies using it, from major infrastructure platforms to specialised SaaS products. FedRAMP has published updates during 2026 on 20x pilots and the retirement of the "FedRAMP Ready" designation, showing how quickly the process is changing.

An illustrative path for a mid-sized SaaS company with an agency customer: it builds on a certified infrastructure platform, moves to FIPS-validated cryptographic modules, implements centralised logging and automated vulnerability management, encodes its configuration as code, and works with a 3PAO to validate key security indicators through automated evidence. The same automation cuts the effort of its annual SOC 2 audit.

Next steps

1. Confirm agency demand and the certification class required, and write down the expected contract value and timing so the business case is explicit.
2. Read the current Consolidated Rules and 20x status on fedramp.gov.
3. Assess gaps in cryptography, logging, vulnerability response and evidence automation.
4. Choose your underlying platform and boundary, keeping external services inside the boundary to the minimum you genuinely need.
5. Engage a 3PAO and plan the path to certification.

Frequently asked questions

Is FedRAMP mandatory?

For cloud services used by US federal agencies to handle federal information, yes. It is not required to sell to private companies or, generally, to state governments, which have their own programs.

What is FedRAMP 20x?

FedRAMP's new approach that replaces document-heavy assessments with key security indicators validated continuously, largely through automation. It is replacing the Rev5 process.

Is it still called FedRAMP authorization?

Under the 2026 Consolidated Rules, FedRAMP issues certifications; "authorization" now refers to an agency's own authorisation decision.

What happened to FedRAMP Low, Moderate and High?

They are being replaced by certification classes A to D under the Consolidated Rules. Check FedRAMP's guidance for how classes relate to the former impact levels.

When does Rev5 end?

FedRAMP stops accepting new Rev5 certifications on 11 June 2027, and existing Rev5 certifications remain active until at least 31 December 2028 unless FedRAMP directs otherwise.

Can a non-US company get FedRAMP?

Yes, if it meets the requirements, though federal agencies may impose additional conditions on data location and personnel.

What is a 3PAO?

A third-party assessment organisation accredited to assess cloud services for FedRAMP.

Do we need agency sponsorship?

Most providers have pursued FedRAMP with an agency partner that intends to use the service. Check current FedRAMP guidance for the pathways available under 20x.

How is FedRAMP different from SOC 2?

SOC 2 is a private-sector attestation against AICPA criteria. FedRAMP is a government certification based on NIST controls with federal-specific requirements and ongoing monitoring by the government.

Does FedRAMP require FIPS 140 encryption?

Federal requirements generally call for FIPS 140 validated cryptographic modules where encryption protects federal information, and the Consolidated Rules require providers to document their use of it.

What happened to FedRAMP Ready?

FedRAMP announced in 2026 that it had retired the FedRAMP Ready designation and opened a limited conversion pathway for affected providers. Check fedramp.gov for the current options if you held that status.

Does FedRAMP certification cover our customers' configuration?

No. It covers your cloud service offering within its boundary. Agencies remain responsible for configuring their use, managing their users and data, and making their own authorisation decision.

Can we reuse FedRAMP work for other customers?

Yes. The controls, automation and evidence built for FedRAMP map well to SOC 2, ISO/IEC 27001 and state programs such as GovRAMP, and many state agencies and regulated companies value FedRAMP certification.

What is the FedRAMP Marketplace?

FedRAMP's public listing of certified and in-process cloud service offerings, with their classes and agency users.