FedRAMP

FedRAMP is the US government-wide program that certifies cloud services for federal agency use; an agency still issues its own authorization to use a service. It is administered by the FedRAMP Program Management Office at GSA, and the underlying control set is NIST SP 800-53 Revision 5.

Traditionally a cloud service provider (CSP) prepared a System Security Plan and supporting documents, was assessed by an accredited Third Party Assessment Organization (3PAO, now called a FedRAMP Recognized independent assessment service), and received an authorization at the Low, Moderate or High baseline listed on the FedRAMP Marketplace.

In 2025 the program launched FedRAMP 20x, a redesign built on automated, machine-readable Key Security Indicators instead of narrative control-by-control packages.

As of mid-2026 FedRAMP describes the new outcome as FedRAMP Certification in classes: Class A (entry level, replaces FedRAMP Ready; pipeline opened August 3, 2026), Class B and Class C (successors to the Low and Moderate impact levels, though FedRAMP says the match is not one-to-one; pipelines opened August 31, 2026) and Class D (pilot planned late 2026, formal availability expected early 2027).

The Consolidated Rules for 2026 launched June 24, 2026, could be adopted early from July 4, 2026 and become mandatory on January 1, 2027. FedRAMP has stated it will stop accepting new Rev5 certifications on June 11, 2027; existing Rev5 certifications stay active until at least December 31, 2028.

The 2026 rules also rename several older terms: the system security plan becomes a Certification Package, continuous monitoring becomes Ongoing Certification, and the plan of action and milestones (POA&M) is replaced by a list of Accepted Weaknesses.

Whatever the path, a provider keeps in writing its Certification Package or 20x equivalent, policies and procedures, an incident response plan, and its list of Accepted Weaknesses.