The sentence that starts most FedRAMP projects comes from a contracting officer or an agency program manager, and it is short: we can only buy FedRAMP authorized cloud. What follows is a search, and the search is where the trouble starts. A lot of the material in circulation describes a Joint Authorization Board that no longer issues authorizations, a control catalog two revisions old, and a process FedRAMP replaced on June 24, 2026 when its Consolidated Rules for 2026 went live.
The program is written down. It is a statute, an OMB memorandum and a published ruleset, all of them public, and everything below traces to that text rather than to a vendor's summary of it.
What Is FedRAMP?
FedRAMP solves a procurement problem before it solves a security problem. Without it, a cloud company selling the same product to fifteen agencies would be assessed fifteen times, against fifteen readings of the same federal standards, by fifteen sets of officials who never compare notes. FedRAMP makes the assessment once and makes the resulting package reusable.
The program began in 2011 as a Federal Chief Information Officer memorandum. Congress put it in statute in the FedRAMP Authorization Act of 2022, enacted as section 5921 of Public Law 117-263 and codified at 44 U.S.C. 3607 through 3616. OMB then rescinded the 2011 memorandum and replaced it with Memorandum M-24-15, issued July 25, 2024, which is the policy the program runs under today.
Four words do most of the work in any FedRAMP conversation. A cloud service provider is the company. A cloud service offering is the specific packaged product being assessed, and it is the offering that carries the status, not the company. An independent assessment service performs the assessment and cannot be the party that built the controls. An authorizing official is the senior agency officer who accepts the risk of running the thing.
One naming point settles a long argument. SOC 2 has no certificate and calling yourself SOC 2 certified marks you as unfamiliar with what you bought. FedRAMP is the opposite case: the statute uses the word certification, and FedRAMP's 2026 definitions make FedRAMP Certified the current program term for a cloud service offering that satisfies the statutory concept of FedRAMP authorization. Both words are now correct.
Who Needs FedRAMP Authorization?
The obligation formally lands on agencies, not on you. In practice it lands on you the moment an agency wants to buy your product, because the agency cannot complete the purchase without a package to rely on.
Read that list before you budget anything. The first exclusion is the one that catches people out in both directions: a system built and run for one agency alone, not offered as a shared service, is outside FedRAMP and inside that agency's own authorization process instead. The fourth and fifth exclusions cover a large amount of what a modern engineering team plugs into without thinking, from data feeds to status monitors.
What Are the FedRAMP Impact Levels?
An impact level is not a measure of how good your security is. It is a statement about the damage that would follow if the data you hold were exposed, altered or made unavailable, and the answer comes from the government's data rather than from your architecture.
Under the Rev5 approach, each level carries a fixed baseline of controls drawn from NIST SP 800-53. The counts come straight from the FedRAMP Security Controls Baseline workbook published on FedRAMP's legacy documentation site.
| Level | What puts you there | Rev5 baseline controls | Typical offering |
|---|---|---|---|
| Low | Loss would have a limited adverse effect | 156 | Public-facing information services, low sensitivity workloads |
| Moderate | Loss would have a serious adverse effect | 323 | The bulk of business software an agency buys |
| High | Loss would have a severe or catastrophic adverse effect | 410 | Law enforcement, emergency services, financial and health systems |
A fourth designation, LI-SaaS, existed for low impact software as a service holding little more than login credentials. It sits in the legacy documentation now, and the workbook that carries it opens with a warning that FedRAMP is actively moving away from these materials and that both humans and AI services should be careful citing them.
The engineering consequences concentrate in a few control families whatever the level. Access control means phishing resistant authentication and least privilege, applied to your own staff as much as to customers. Cryptography means FIPS validated modules, which is a stricter demand than encryption in transit and at rest alone. Boundary protection means you can say precisely where the authorized system ends.
What Is FedRAMP 20x?
In March 2025 GSA announced a rebuild of the program, developed in public and delivered in phases. The old model produced a large documentation package assessed at a point in time. FedRAMP 20x replaces the package with continuously validated evidence, and replaces the control checklist with Key Security Indicators that describe outcomes.
Three structural changes matter to anyone planning work. First, the System Security Plan is gone: the 2026 definitions replace it with a Security Decision Record, a persistently maintained record of the security decisions a provider made across the life of the offering, including implementation rationale, resulting customer risk and assessment findings. Second, assurance now has a class, from Class A at minimal assurance to Class D at significant assurance, rather than a single pass mark. Third, a certification profile is now three things together: a type, either Rev5 or 20x; a path, either through an agency sponsor or direct from the program; and a class.
The Key Security Indicators come in ten families: cybersecurity education, change management, cloud native architecture, identity and access management, incident response, monitoring and logging and auditing, policy and inventory, recovery planning, supply chain risk, and service configuration. They read like engineering goals rather than control text. Adopting passwordless methods sits under identity, which is where multi-factor authentication work lands. Operating a SIEM capability sits under monitoring, so centralized logging and alerting is named directly. Mitigating and monitoring supply chain risk is its own family rather than a footnote.
The pilots are the only real evidence about how the new model performs, and FedRAMP publishes the numbers. Phase 1, the Low pilot, ran from April to September 2025 and received 26 complete packages between May 30 and August 18, 2025, with the first cohort authorized in late July. Demand outran capacity: 13 reviews were completed during Phase 1, and the October 1 to November 13, 2025 government shutdown pushed the rest into Phase 2. Phase 2, the Moderate pilot, ran from November 18, 2025 through March 2026, drew 14 qualifying submissions, and authorized its first cohort on March 6, 2026, with six more providers authorized by April 27, 2026.
- The FedRAMP Authorization Act is enacted as section 5921 of Pub. L. 117-263, codified at 44 U.S.C. 3607 to 3616
- OMB Memorandum M-24-15 rescinds the 2011 policy and sets the current scope, authorization paths and continuous monitoring principles
- GSA announces FedRAMP 20x, to be built in public and delivered in phases
- The FedRAMP Consolidated Rules for 2026 launch, carrying the definitions, rules and dates the program now runs on
- FedRAMP Ready goes legacy. No new Ready submissions are accepted after this date
- The FedRAMP 20x Class A pipeline opens for applications
- The FedRAMP 20x Class B and Class C pipelines open for applications
- The Consolidated Rules for 2026 take mandatory effect for all stakeholders
- FedRAMP stops accepting applications for new Rev5 certifications
- Absent further legislation, 44 U.S.C. 3607 to 3616 are repealed five years after enactment under section 5921(d)(1)
How to Get FedRAMP Authorized
Start by settling the certification profile, because everything downstream is priced off it. The Important Dates page records when each pipeline opened: Class A applications from August 3, 2026, Class B and Class C from August 31, 2026, with a temporary Rev5 route for providers converting from a Ready listing or one that lost its agency sponsor from August 10, 2026.
The path question is now largely settled by the calendar. Under M-24-15 there were two named routes, an agency authorization signed by an agency's authorizing official and a program authorization signed by the FedRAMP Director. The 2026 definitions record that the agency path "is a legacy path that is only available for FedRAMP Rev5 and still requires review and approval from FedRAMP." A provider starting fresh is heading for a program certification.
How Long FedRAMP Authorization Takes
Nobody publishes a guaranteed duration, and the confident single figures in circulation are not drawn from a dataset anyone has released. What is published is the pilot record, and it is worth reading as a floor rather than a promise: Phase 1 opened in April 2025 and completed 13 reviews by the end of September; Phase 2 opened on November 18, 2025 and issued its first authorizations on March 6, 2026.
Two things move the number more than anything else. The first is how much evidence you can produce automatically on the day you apply, because a review that has to chase artifacts stalls. The second is the queue, which is a function of how many other providers applied and whether the government is open.
How Much Does FedRAMP Cost?
Treat any confident single number with suspicion, including the ranges published by companies that sell readiness services, because no authoritative dataset exists. What is knowable is which variables move the figure.
Impact level and class set the size of the assessment. The boundary sets how much of your estate is in scope. Engineering time to close gaps is usually the largest line and never appears on an invoice. The independent assessment is a recurring cost rather than a one-off, since FedRAMP defines a FedRAMP Independent Assessment as typically performed first for the initial certification and then repeated annually. Continuous monitoring is a permanent operating expense, and for most providers it is the line that decides whether the federal market is worth entering at all. Firms that do cloud security work for a living are usually cheaper than hiring the same skills, but they are not cheap.
Is FedRAMP Required by Law?
Yes, but the duty is written onto agencies rather than onto vendors, which is why nobody will ever fine you for not having one. The consequence of not having one is simply that the agency cannot buy.
The statute also carries an expiry date that almost no published guide mentions. Section 5921(d)(1) of Public Law 117-263 repeals 44 U.S.C. 3607 through 3616 on the date five years after December 23, 2022, and the note appears under every one of those sections in the US Code. Unless Congress extends it, the statutory basis for the program lapses on December 23, 2027, a little over six months after the June 11, 2027 cutoff for new Rev5 certifications. The program predates the statute and would not simply stop, but anyone signing a multi-year plan should know the clause is there.
Two smaller obligations are worth knowing because they shape who can assess you. Under 44 U.S.C. 3612, an independent assessment service must submit information about any foreign interest, influence or control over it to the Administrator every year, and must file an update within 48 hours of a change in foreign ownership or control.
How FedRAMP Compares to FISMA, CMMC and SOC 2
These four names get used as if they were alternatives. They are not: one is a law about agencies, one is a mechanism inside it, one is a defense acquisition rule, and one is a commercial report.
FISMA is the agency's own statutory duty to secure its information systems. FedRAMP does not replace it; it supplies a reusable assessment the agency can rely on while discharging it, which is exactly why the presumption of adequacy in section 3613(e)(2)(A) says explicitly that it does not modify an agency's FISMA responsibilities.
CMMC is the Department of Defense program at 32 CFR part 170, and it applies to contractor systems that handle Federal Contract Information or Controlled Unclassified Information. FedRAMP applies to cloud services holding federal information on an agency's behalf. A defense supplier can need both, for different systems, and neither converts into the other.
SOC 2 is an AICPA attestation produced by a CPA firm for commercial buyers. No statute requires it and no agency issues it. The control overlap with a federal baseline is real but partial, and the evidence formats are different.
What FedRAMP Authorization Does Not Cover
A certification is a statement about a defined cloud service offering across a defined boundary, assessed against defined indicators. It is not a statement about the company, and M-24-15 says so directly: "A FedRAMP authorization is not an endorsement of a product or service." What it establishes is that the security posture of that offering has been assessed and is presumptively adequate for federal use.
It also does not clear the rest of the rulebook. Footnote 7 of M-24-15 records that FedRAMP does not replace other legal, executive order, regulatory or OMB compliance requirements in areas such as information management, records management, privacy and cybersecurity, and that agencies remain responsible for their own privacy program obligations.
The boundary point deserves care, because it cuts against a comfortable assumption. Federal policy is pushing away from separate government-only environments, not toward them. M-24-15 asks the continuous monitoring framework to avoid promoting the division of cloud services into commercially focused and government focused instances, and says that in general federal agencies should use the same infrastructure relied on by the rest of a provider's commercial customer base. That is a deliberate security judgment about patching speed and engineering attention. It also means the commercial platform's incidents are the federal customer's business.
Key takeaways
- FedRAMP is established at 44 U.S.C. 3608 as a government-wide, standardized and reusable approach to security assessment and authorization for cloud services that process unclassified federal information.
- The scope is cloud products and services that create, collect, process, store or maintain federal information on an agency's behalf. M-24-15 names six categories that fall outside it, starting with systems built for a single agency and not offered as a shared service.
- Impact levels come from FIPS 199 and follow the high water mark rule: one High data type makes the whole system High. The Rev5 baselines run 156 controls at Low, 323 at Moderate and 410 at High.
- FedRAMP 20x replaces the documentation package with Key Security Indicators in ten families, a Security Decision Record in place of the System Security Plan, and certification classes A through D.
- The dates that matter now are January 1, 2027, when the Consolidated Rules for 2026 become mandatory, and June 11, 2027, when FedRAMP stops accepting new Rev5 certifications.
- The legal duty binds agencies, not vendors. Agencies must presume a FedRAMP package adequate, and may require authorization as a condition of award only where competition allows.
- Section 5921(d)(1) of Public Law 117-263 repeals the FedRAMP sections of the US Code five years after December 23, 2022, so the statutory basis lapses in December 2027 unless Congress acts.
Common questions
What does FedRAMP stand for?
The Federal Risk and Authorization Management Program. It is a government-wide program inside the General Services Administration that produces one reusable security assessment for a cloud product or service, so federal agencies can rely on that assessment instead of each running their own.
Is FedRAMP a certification?
Yes, and this is the rare case where the word is right. Section 3607(7) of title 44 defines a FedRAMP authorization as a certification that a cloud service has completed a FedRAMP authorization process, and FedRAMP's 2026 definitions make "FedRAMP Certified" the current program term for an offering that satisfies that statutory concept.
Who needs FedRAMP?
Any cloud service that creates, collects, processes, stores or maintains federal information on behalf of a federal agency, unless it falls into one of the six exclusions in M-24-15. The agency carries the legal duty, but the practical effect is that agencies cannot buy from a provider without a package.
What are the FedRAMP impact levels?
Low, Moderate and High, categorized under FIPS 199 by the damage a loss of confidentiality, integrity or availability would cause: limited, serious, or severe and catastrophic. The Rev5 baselines attached to them contain 156, 323 and 410 controls respectively. A legacy LI-SaaS designation also exists for low impact software as a service.
How long does FedRAMP authorization take?
No guaranteed duration is published. The clearest public evidence is the 20x pilot record: Phase 1 opened in April 2025 and completed 13 reviews by the end of September, and Phase 2 opened on November 18, 2025 and issued its first authorizations on March 6, 2026. How much evidence you can produce automatically on day one matters more than anything else you control.
How much does FedRAMP cost?
There is no authoritative dataset, so treat single figures as marketing. Impact level, certification class, the size of the authorization boundary and the amount of engineering work to close gaps set the number. Annual independent assessment and continuous monitoring are permanent costs, not one-time ones.
What is FedRAMP 20x?
The rebuilt program GSA announced in March 2025 and delivered in phases. It swaps a large point-in-time documentation package for continuously validated evidence against Key Security Indicators, replaces the System Security Plan with a Security Decision Record, and grades assurance in classes A through D rather than as a single pass mark.
What is the difference between FedRAMP and FISMA?
FISMA is the law placing security duties on federal agencies for their own systems. FedRAMP is the reusable mechanism agencies use to satisfy those duties for commercial cloud services. The statutory presumption that a FedRAMP package is adequate explicitly does not modify an agency's own FISMA responsibilities.
Is a SOC 2 report enough to get FedRAMP?
No. The control overlap is real but the evidence model is different, and FedRAMP published the lesson itself: among the findings from its Phase 1 pilot is that no participants actively reused existing framework assessments such as SOC 2. Expect the underlying work to transfer and the artifacts not to.
What is a 3PAO?
A third-party assessment organization, which the statute calls an independent assessment service: an organization accredited by the GSA Administrator to undertake conformity assessments of cloud service providers and their offerings. Under the 2026 rules these bodies hold FedRAMP Recognized status, and they cannot assess work they helped build.
Does FedRAMP apply to state and local government?
No. The statute and M-24-15 both frame the program around federal agencies and federal information. A state, county or school district buyer sets its own cloud security requirements, and whether a FedRAMP package helps in that procurement is that jurisdiction's decision rather than a FedRAMP rule.
On this page
- What Is FedRAMP?
- Who Needs FedRAMP Authorization?
- What Are the FedRAMP Impact Levels?
- What Is FedRAMP 20x?
- How to Get FedRAMP Authorized
- How Long FedRAMP Authorization Takes
- How Much Does FedRAMP Cost?
- Is FedRAMP Required by Law?
- How FedRAMP Compares to FISMA, CMMC and SOC 2
- What FedRAMP Authorization Does Not Cover
Daniel Reyes
Daniel Reyes is a CISSP who spent twelve years in security operations, most recently leading a detection and response team for a mid-sized healthcare group in Texas. He reviews every resource and breach report on Cyber Security Firms for technical accuracy before it publishes.
Most of the people he has trained arrived having been told too much: a dozen acronyms, six vendors, and no clear idea which risk was theirs. His approach is to explain what an attack actually does before naming the tool that stops it, on the basis that most breaches start with something a reader could have recognised.