What is FedRAMP? FedRAMP (Federal Risk and Authorization Management Program) is the U.S. government program that certifies cloud services for federal agency use. A provider that earns a FedRAMP Certification has met standardized security requirements that FedRAMP reviews (NIST SP 800-53 controls on the Rev5 path, Key Security Indicators on the 20x path), so any federal agency can reuse the result instead of running its own security review from scratch. If you sell cloud to the federal market, FedRAMP is the gate, not an optional badge.
2026 update: FedRAMP now operates two active paths. Rev5 (Classes B, C, and D) accepts new Certification requests until June 11, 2027, and FedRAMP 20x is live for Class A, B, and C, with 20x Class D coming in 2027 and a pilot planned for Phase 4. VDR and VER become mandatory for all offerings obtaining or maintaining FedRAMP Certification on December 7, 2026, with a grace period to March 7, 2027.
Jump to: FedRAMP certification classes (A through D) · FedRAMP certification cost · VDR & VER requirements (December 7, 2026) · Agency FedRAMP obligations (CR26)
FedRAMP is a government-wide program that provides a standardized approach to security assessment, authorization, and continuous monitoring for cloud products and services used by U.S. federal agencies. (FedRAMP.gov)
The FedRAMP Program Management Office (PMO) manages the program within the General Services Administration (GSA). (GSA)
The FedRAMP Authorization Act (December 2022) established the program in law. OMB Memorandum M-24-15 (July 2024) governs it, replaced the prior policy, and established the framework for FedRAMP 20x.
A cloud service that earns a FedRAMP Certification can be reused by any federal agency under a presumption of adequacy, without a full independent re-assessment. This "authorize once, use many" model reduces duplicative effort for agencies and cloud providers alike. (M-24-15)
In plain terms: If a federal agency wants to use your cloud service with federal information, FedRAMP is how that service is reviewed once and then reused, instead of every agency running its own review.
Before FedRAMP, each federal agency independently assessed cloud vendors against NIST security standards. The result was duplicated effort, inconsistent assessments, and a fragmented patchwork of agency-specific authorizations that created security gaps and slowed cloud adoption government-wide.
FedRAMP standardizes that process. A FedRAMP Certification signals that a cloud service's security posture has been assessed and is "presumptively adequate" for agency use at or below the certified impact level or class. Agencies can then issue their own authority to operate (ATO) or authority to use (ATU) based on the FedRAMP package without starting from scratch.
For CSPs, FedRAMP authorization opens federal procurement opportunities that would otherwise require a separate security review for every agency sale, a process that could take years per agency.
Per OMB Memorandum M-24-15 and the FedRAMP Consolidated Rules for 2026, FedRAMP applies to cloud computing products and services that create, collect, process, store, or maintain Federal information on behalf of a Federal agency.
This includes:
Only a federal agency can determine whether a specific use case falls within FedRAMP scope. The Consolidated Rules for 2026 identify several categories explicitly outside FedRAMP scope, including single-agency systems not offered as shared services, social media platforms used for public communication, and ancillary services with negligible risk to federal information. (FedRAMP Scope)
| Situation | FedRAMP applies? | What to know |
|---|---|---|
| SaaS, PaaS, or IaaS sold to a federal agency that handles federal information | Yes, in scope | This is the core case. The agency determines how a specific use case is treated. |
| Cloud service a defense contractor uses to store, process, or transmit covered defense information | Security equivalent to FedRAMP Moderate | DFARS 252.204-7012(b)(2)(ii)(D) requires the contractor to ensure the provider meets requirements equivalent to those established for the FedRAMP Moderate baseline. The clause uses the legacy Moderate label. (DFARS) |
| Single-agency system not offered as a shared service | Outside FedRAMP scope | The Consolidated Rules for 2026 list this category as out of scope. |
| Social media platform used for public communication | Outside FedRAMP scope | Listed as out of scope in the Consolidated Rules for 2026. |
| Ancillary service with negligible risk to federal information | Outside FedRAMP scope | Listed as out of scope in the Consolidated Rules for 2026. |
A certification involves more parties than most first-time providers expect. Knowing who does what keeps the early planning realistic.
Runs the program, publishes the rules, and issues Program Certification directly under 20x, with no agency sponsor required.
Use certified services, can sponsor a Rev5 Agency Certification, and issue their own ATO or ATU based on the FedRAMP package.
Choose the path, class, and type, do the engineering and documentation work, and maintain the certification after it is issued.
FedRAMP Recognized independent assessment services, commonly called 3PAOs, perform the initial assessment and ongoing assessments. Engaging one is mandatory for Class B, C, and D, and a Class A provider can skip that step.
FedRAMP notes that government work differs from commercial business, so most providers will probably need an advisory service before they choose a path.
FedRAMP Recognition and the related A2LA requirements set a minimum bar for assessors, and FedRAMP states that neither reviews expertise or experience in depth, so technical depth varies widely between assessment services. A Marketplace listing is not an endorsement. Interview several assessors and compare proposals. (Finding an assessor)
As of 2026, FedRAMP operates two active certification paths. CSPs choose a path for a new certification, and FedRAMP stops accepting new Rev5 Certification requests on June 11, 2027.
| Item | Rev5 | FedRAMP 20x |
|---|---|---|
| Framework | NIST SP 800-53 Rev 5 | OMB M-24-15, Consolidated Rules 2026 |
| Structure | Class B, C, and D (Class A is not offered) | Class A, B, and C (Class D coming in 2027) |
| Assessment model | 3PAO assessment, with Agency Certification generally required | Key Security Indicators, with Program Certification |
| Sponsor | Typically an active agency contract or sponsor in advance | FedRAMP processes the certification directly; no active agency contract or sponsor required |
| Status | Active; new requests end June 11, 2027 | Live for Class A, B, and C (pipelines opened August 3 and August 31, 2026) |
| Class D | Available now through Agency Certification | Coming in 2027; Phase 4 pilot estimated FY27 Q1 to Q2 |
| Direction | FedRAMP is working to replace and retire Rev5 over the next few years | Designed for use over the next decade |
Your service is cloud-native and can deploy on FedRAMP Certified infrastructure or platforms. FedRAMP processes the certification directly, so no agency contract or sponsor is needed to start.
You run your own infrastructure, or you need a Class D Certification now. Rev5 typically needs an active agency contract or sponsor and more investment, and FedRAMP is retiring it, so weigh that before you commit. (Choose a type)
A provider can also earn a 20x Class A Certification first and later move to a Rev5 Class B, C, or D through Agency Certification. (Choose a path)
Both paths require VDR and VER compliance from December 7, 2026 under NTC-0014. See what VDR and VER require
FedRAMP organizes certification into Certification Classes. FedRAMP describes them as loosely aligned with the Low, Moderate, and High baseline expectations, without a direct correlation. The 20x Class A pipeline opened August 3, 2026, and the 20x Class B and Class C pipelines opened August 31, 2026. (FedRAMP.gov)
FedRAMP designs the classes to be pursued in stages, so spending can grow with agency demand. Each class offers more assurance than the one before and needs more preparation, familiarity with the federal process, and investment. (Choose a class)
For existing commercial products that already hold a SOC 2 Type II and run a mature security program. FedRAMP calls it the recommended starting point for most providers entering the federal market, and it takes the place of the retired FedRAMP Ready designation.
Adequate for most non-sensitive use cases. Available through 20x Program Certification only, and the independent assessor step can be skipped. After a federal customer begins using the service, the provider has 12 months to start moving to Class B or higher.
FedRAMP describes Class B as adequate for most Low security objectives and some Moderate or High objectives.
Available on 20x through Program Certification. On Rev5, Agency Certification is generally required, with a limited Program Certification pipeline for Lost Sponsor and Ready Conversion applicants.
FedRAMP describes Class C as adequate for most Low and Moderate security objectives and some High objectives. It is intended for providers with an active customer base that have already invested in a federal compliance program.
FedRAMP advises providers not to go straight to Class C unless an existing government contract requires it.
FedRAMP describes Class D as adequate for most use cases regardless of security objective, excluding systems that process classified information. Rev5 Class D requires Agency Certification, and a 20x Class D pilot is planned for Phase 4 (estimated FY27 Q1 to Q2).
The same caution applies: do not plan to go straight to Class D without a contract that requires it. Quzara Cybertorch is FedRAMP Certified Class D (High) under the Rev5 path (FR2214150164) while 20x Class D finalizes.
Full breakdown of Classes A through D
The Low, Moderate, and High names come from FIPS 199, which defines each by the potential adverse effect of a compromise. They are the baseline names the classes loosely align with. FedRAMP stops accepting new Rev5 Certification requests on June 11, 2027, and existing Rev5 certifications continue past that date.
| Impact level | Potential adverse effect if compromised (FIPS 199) |
|---|---|
| Low | Limited |
| Moderate | Serious |
| High | Severe or catastrophic |
There is no direct correlation between a class and an impact level, for two reasons. Providers may tailor baseline controls to emphasize different security objectives, and agencies may include services with different categorizations by tailoring baselines, using compensating controls, or controlling information flow. FedRAMP classes loosely align with the baseline expectations in NIST SP 800-53B, and the impact categories come from FIPS 199 and FIPS 200.
The Joint Authorization Board (JAB) no longer exists. Under the Consolidated Rules for 2026 there are two certification paths:
FedRAMP notes that providers do not really choose a path, because it follows from earlier choices. Intending a 20x Certification puts you on the Program Certification path, and having an agency sponsor ready for Rev5 puts you on the Agency Certification path.
| Class | 20x Program | Rev5 Program | Rev5 Agency |
|---|---|---|---|
| Class A | Required path | Unavailable | Unavailable |
| Class B | Required path | Limited | Generally required |
| Class C | Required path | Limited | Generally required |
| Class D | Coming in 2027 | Unavailable | Required |
Two temporary Rev5 pipelines: Rev5 Program Certification is open only in very limited circumstances. Two pipelines for Class B or Class C opened on August 10, 2026, and they close on June 11, 2027, when FedRAMP stops accepting new Rev5 applications.
Lost Sponsor is for providers that began the legacy process with an agency sponsor but could not finish for reasons outside their control. Ready Conversion is for providers that completed a FedRAMP Ready assessment or reached FedRAMP Ready on the Marketplace. FedRAMP must confirm eligibility before submission, and applicants must follow the updated Rev5 rules by February 19, 2027. (Choose a path)
Both paths require continuous monitoring, VDR and VER compliance from December 7, 2026, and annual assessments as specified under the Consolidated Rules for 2026.
The Consolidated Rules for 2026 describe three stages: Preparation, Initial Implementation, and Ongoing Certification. The steps below follow FedRAMP's own getting started and implementation pages. (Getting started, Initial Implementation)
To be listed as Implementing, a provider must address five rules when it applies. Before applying, providers are expected to work with advisors or other third parties, and FedRAMP does not guide providers through the listing process. (Getting listed)
Plan for the wait: FedRAMP states a goal of making an initial decision within 30 days of receiving an application, and it also states that there is no service level agreement for review. The goal pauses while FedRAMP waits on the applicant, FedRAMP generally does not follow up on outstanding requests, and it does not grant requests for prioritized reviews, delays, or exemptions. Watch for FedRAMP emails and answer them promptly. This covers the review only, not the time you need to get ready. (Getting certified)
For a longer walk through both paths, see the full step-by-step breakdown.
These are the dates that most affect a provider planning in late 2026. Dates were checked against fedramp.gov on October 14, 2026, and future dates are targets that may change. Read each ruleset on the Rev5 deadlines page for its own obtain, maintain, and grace dates.
| Date | What happens | Applies to |
|---|---|---|
| Jul 28, 2026 | FedRAMP Ready becomes a legacy designation; Class A takes its place as the entry tier | All providers |
| Aug 3, 2026 | 20x Class A pipeline opens | 20x Class A |
| Aug 10, 2026 | Lost Sponsor and Ready Conversion Rev5 Program Certification pipelines open | Rev5 Class B and C |
| Aug 31, 2026 | 20x Class B and Class C pipelines open | 20x Class B and C |
| Dec 7, 2026 | VDR and VER become mandatory (NTC-0014); grace period runs to Mar 7, 2027 | Both paths |
| Jan 1, 2027 | Consolidated Rules for 2026 take mandatory effect for all stakeholders, subject to the dates in individual rulesets; new Rev5 applications must follow all applicable rules | Both paths |
| Feb 19, 2027 | Grace period ends for Lost Sponsor and Ready Conversion applicants | Rev5 Class B and C |
| Apr 2, 2027 | Collaborative Continuous Monitoring required to maintain certification | Rev5 |
| Jun 11, 2027 | FedRAMP stops accepting new Rev5 applications; the temporary Rev5 pipelines close | Rev5 |
| 2027 | 20x Class D becomes a formal option, after a pilot planned for Phase 4 | 20x Class D |
| Aug 1, 2027 | Certification Data Sharing and Security Decision Record required to maintain certification | Rev5 |
| Feb 1, 2028 | Every CR26 grace period has expired | All providers |
| Dec 31, 2028 | Existing Rev5 certifications remain active until at least this date unless FedRAMP is otherwise directed | Rev5 |
For the full ruleset table and a plan that works backward from these dates, use the Rev5 sunset and CR26 transition guide.
FedRAMP is explicit that certification should not be treated as a compliance exercise. It will require some processes to change, and it is not simply a matter of documenting what already exists. Use this checklist before you start.
FedRAMP is one of several programs a regulated provider meets. They overlap in vocabulary but not in scope, and confusing them is a common planning error.
| Program | What it is | How it relates to FedRAMP |
|---|---|---|
| FISMA | The federal law that requires agencies to secure their information and information systems. | Agencies authorize the systems they use. A FedRAMP package gives an agency a reusable basis for its own ATO or ATU decision. |
| NIST SP 800-53 | The NIST catalog of security and privacy controls. | The Rev5 path builds on the Rev 5 controls. The 20x path organizes its requirements as rulesets and Key Security Indicators. |
| DFARS 252.204-7012 | The DoD contract clause for safeguarding covered defense information and reporting cyber incidents. | A contractor using an external cloud provider for covered defense information must ensure the provider meets requirements equivalent to the FedRAMP Moderate baseline, and the clause sets a 72 hour reporting window for cyber incidents. |
| CMMC | The DoD program that verifies contractors protect federal contract information and CUI. (DoD CIO) | CMMC assesses the contractor's environment. FedRAMP certifies the cloud service the contractor may use. |
| DoD Impact Levels | DoD's own categories for cloud services, IL2 through IL6. | A separate scheme from FedRAMP classes. Quzara Cybertorch is FedRAMP Certified Class D and authorized for DoD IL-4. |
| GovRAMP | A nonprofit program for state, local, tribal, and education governments (StateRAMP, now GovRAMP). (GovRAMP) | A separate program with its own verification statuses. It is not a FedRAMP Certification. |
| SOC 2 | An AICPA attestation report on a service organization's controls. | SOC 2 Type II is what FedRAMP's Class A is designed for as a starting point, but a SOC 2 report is not a FedRAMP Certification. |
A certification is maintained through continuous monitoring, and FedRAMP can revoke it. NTC-0014 states that certification will be revoked for offerings not following the VDR and VER rules after the grace period ends on March 7, 2027.
FedRAMP does not present 20x that way. Requirements for each class are published as rulesets and Key Security Indicators, and what changes is how compliance is proven: continuously validated evidence rather than a single point in time.
A SOC 2 Type II qualifies a product to submit for Class A, but it is not a FedRAMP Certification. The provider still addresses FedRAMP's rules and goes through FedRAMP's review.
FedRAMP Ready became a legacy designation on July 28, 2026, and Class A takes its place. Ready providers have a limited Ready Conversion pipeline on Rev5, not a new Ready listing.
FedRAMP advises against going straight to Class C or Class D unless an existing agency contract requires it. Start with the lowest class that meets your customers' requirements.
New Rev5 applications stop June 11, 2027, but existing Rev5 certifications remain active until at least December 31, 2028 unless FedRAMP is otherwise directed. NTC-0013 says the final end date is likely no later than 2029.
The full timeline, the ruleset deadlines, and a realistic plan are in the Rev5 sunset and CR26 transition guide.
FedRAMP does not publish a fixed time to certification for any path, and Quzara does not promise one. FedRAMP lists the factors that move the schedule:
Cost follows the same drivers: boundary size, class, path, how much of your security program already meets the requirements, how much you can inherit from a FedRAMP Certified platform, and the recurring work after certification. FedRAMP's assessor guidance gives no fee figures and advises requesting proposals from at least two or three assessors to compare pricing. Read FedRAMP certification cost for a driver-by-driver budgeting table. (Initial Implementation)
Path selection (Rev5 vs 20x, impact level or class), gap analysis, boundary definition, certification package preparation, and independent assessor coordination.
Quzara Cybertorch™ is a FedRAMP Certified Class D MDR and SOC as a Service platform (FR2214150164) on Azure Government, authorized for DoD IL-4, staffed by U.S.-citizen analysts and built on Microsoft Sentinel and Defender XDR, 24/7.
We operate the full VDR and VER program from inside the authorization boundary: continuous detection, PAIN/LEV/IRV evaluations, governed exceptions, and schema-valid machine-readable reporting. Mandatory from December 7, 2026.
NISTcompliance.ai is Quzara's AI-native compliance automation platform: gap analysis and control mapping across NIST SP 800-53 Rev 5, FedRAMP, FISMA Moderate, and CMMC Level 2, SSP and POA&M generation with DOCX export, and OSCAL machine-readable output.
A cloud service built on a FedRAMP Certified Class D platform can reference the controls the platform implements in its own package, which reduces what the service has to implement and document itself. How much a customer can claim depends on the platform's responsibility matrix.
Quzara operates a FedRAMP Certified platform every day and builds the AI that automates the compliance work beneath it. Quzara is SBA 8(a) certified and a Women-Owned Small Business, and it holds a GSA Multiple Award Schedule contract that includes Highly Adaptive Cybersecurity Services (HACS).
Contact Quzara to speak with a FedRAMP advisor, or review the December 7, 2026 VDR/VER requirements.
Rev5 is the traditional path: Agency Certification is generally required at Class B, C, or D, with an independent assessment. FedRAMP 20x uses Program Certification at Class A, B, or C today, built on Key Security Indicators. New Rev5 requests stop June 11, 2027. Both paths require VDR and VER compliance from December 7, 2026.
FedRAMP does not publish a fixed time to certification for any path, and the time depends on your scope, readiness, and the path you choose. In all cases, starting early is the critical variable. See the full step-by-step breakdown for timeline detail by path.
A FedRAMP Certification is maintained through continuous monitoring, and FedRAMP can revoke it. NTC-0014 states that certification will be revoked for offerings not following the VDR and VER rules after the grace period ends on March 7, 2027.
A Third-Party Assessment Organization (3PAO) is an accredited firm that independently assesses a CSP's system. CR26 calls the role a FedRAMP Recognized independent assessment service. Engaging one is mandatory for Class B, C, and D, and a Class A provider can skip the step. Verify current requirements at fedramp.gov.
VDR (Vulnerability Detection and Response) and VER (Vulnerability Evaluation and Reporting) are mandatory rulesets under NTC-0014, effective December 7, 2026, for all cloud service offerings obtaining or maintaining FedRAMP Certification, with a grace period to March 7, 2027. Full VDR and VER requirements
The JAB no longer exists. FedRAMP now certifies through Agency Certification and Program Certification. Check fedramp.gov for the current status of any legacy JAB provisional authorization.
FedRAMP calls Class A the simplest route when you have no certification and no agency customers requiring one. It is designed for existing commercial products that hold a SOC 2 Type II and run a mature security program, and it is available through 20x Program Certification.
Not on 20x. FedRAMP processes 20x certifications directly, with no active agency contract or sponsor required. Rev5 typically needs an active agency contract or sponsor in advance, and Rev5 Class D requires Agency Certification.
Class A is the entry class for existing commercial products, available through 20x Program Certification only. After a federal customer begins using the service, the provider has 12 months to begin the transition to Class B or higher.
FedRAMP Ready became a legacy designation on July 28, 2026, and FedRAMP describes Class A as the entry tier that takes its place. Providers that held or completed a Ready assessment can use the limited Ready Conversion pipeline for Rev5 Class B or C, which closes on June 11, 2027.
It lists a service that is working toward certification, so agencies, assessors, and FedRAMP can see its progress. The listing carries five rules, including quarterly progress updates and beginning an assessment within 2 years of the initial listing.
FedRAMP runs a cursory scan, assigns a review team, reviews the Certification Package Overview, may hold a Deep Dive on 20x, raises serious issues early, and sends a final assessment. FedRAMP states a goal of an initial decision within 30 days of receiving an application and states that there is no service level agreement for review.
No. FISMA is the federal law that requires agencies to secure their systems, CMMC verifies defense contractors, and GovRAMP serves state, local, tribal, and education governments. FedRAMP certifies cloud services for federal agency use. A defense contractor that uses a cloud provider for covered defense information must ensure the provider meets requirements equivalent to the FedRAMP Moderate baseline.
FedRAMP does not publish a price, and cost depends on your boundary, class, path, existing security program, and the recurring work after certification. See FedRAMP certification cost for the cost drivers and where to cut.
Yes. Class A is built for existing commercial products with a SOC 2 Type II, and 20x Program Certification does not need an agency sponsor. Plan for the step up to Class B or higher within 12 months of a federal customer starting to use the service.
Dates, class descriptions, and process steps in this guide were checked against the primary sources below on October 14, 2026. Future dates are targets and may change, so confirm them before you plan.
Map your path, your class, and your VDR and VER program with Quzara.
Schedule a Consultation