Key Facts
- Regulator
- FedRAMP, the US federal programme established by the FedRAMP Authorization Act (44 U.S.C. chapter 36) and run by the General Services Administration (GSA), with OMB guidance
- Latest version
- FedRAMP Consolidated Rules for 2026 (covering FedRAMP 20x and legacy Rev5 certification types)
- Effective
- 24 June 2026
- Official text
- www.fedramp.gov ↗
What is FedRAMP?
FedRAMP, the Federal Risk and Authorization Management Program, is the US federal programme that sets the security rules a cloud service must meet before federal agencies can use it. The General Services Administration runs it under the FedRAMP Authorization Act, with guidance from OMB. It applies to cloud service providers whose offerings serve US federal agencies.
It was created by statute (44 U.S.C. chapter 36) on 23 December 2022; the legal authority is published on the FedRAMP site. OMB Memorandum M-24-15 of 25 July 2024 then rescinded and replaced the earlier programme in full.
The current rulebook is the FedRAMP Consolidated Rules for 2026, which cover both FedRAMP 20x and the legacy Rev5 certification types. The rules launched on 24 June 2026 and have been amended since, including changes in September 2026. They are updated yearly.
A FedRAMP Certification covers a product, not a company.
The certification applies to a cloud service offering: a specific, packaged cloud product or service that a provider supplies to customers. The data in scope is federal customer data only: what agencies or their users upload, store or supply to the service. It does not include account data, service metadata or telemetry that the provider generates.
Why it matters
The agency wants your cloud product. The procurement team asks for your FedRAMP Certification. You don't have one, and the contract is waiting.
FedRAMP Certification is how a cloud service offering meets the legal requirement to be FedRAMP authorized. That requirement is what the procurement team is checking.
The route is changing too. The 2026 rules add FedRAMP 20x beside the legacy Rev5 type, so a provider starting now picks between a plan-led route and an outcome-led one.
A written plan describes intent. A measured outcome shows whether the control works.
Who it applies to
FedRAMP is mandatory for cloud service providers whose cloud service offerings serve US federal agencies. The 2026 rules become mandatory on 1 January 2027, and the programme's timeline page says all cloud service providers must follow them to maintain FedRAMP Certification.
It does not apply to a provider whose offerings serve no federal agency, and it does not reach a company's wider estate. The obligation attaches to the offering that serves the agency.
FedRAMP borrows two ISO conformity-assessment ideas, verification and validation, and cites ISO/IEC 27001:2022 as their source, but it certifies one cloud product, not a management system. The nearest ISO 27001 control, A.5.23, covers an organisation's own use of cloud services, not a service it sells to agencies.
The UK position
FedRAMP is a US federal requirement. A UK firm meets it only when it sells a cloud service to US federal agencies, and then the duty falls on the specific offering that serves them. A UK firm with no US federal customers rarely meets FedRAMP at all.
Key requirements
A FedRAMP certification profile combines three choices, set out in the definitions:
- Type: Rev5 or 20x. Rev5 follows a legacy approach based primarily on documented plans. 20x follows a modern approach based primarily on measured outcomes, and is built on Key Security Indicators.
- Path: Program (certified directly by FedRAMP) or Agency (sponsored by a federal agency). The Agency path is a legacy route open only to Rev5.
- Class: A, B, C or D, increasing from minimal assurance at Class A to significant assurance at Class D.
Impact levels (Low, Moderate and High) come from the NIST FIPS 199 security categories, which rate the harm that a loss of confidentiality, integrity or availability would cause.
Terms that have changed
Older guides use wording that the current rules have dropped:
- Assessor replaces "Third-Party Assessment Organization (3PAO)".
- Security Decision Record replaces the traditional System Security Plan.
- FedRAMP Certification is the current term for what was called authorization.
Dates to know
- 24 June 2026: official launch of the Consolidated Rules for 2026.
- 28 July 2026: FedRAMP Ready went legacy; providers seek 20x Class A Certification instead.
- 1 January 2027: the 2026 rules take mandatory effect for all stakeholders.
- 11 June 2027: new Rev5 certifications stop being accepted.
Check the current rules before you rely on any older description of FedRAMP, including this one.
Frequently asked questions
In FedRAMP's own terms, the status that counts is FedRAMP Certified: a cloud service offering that has received FedRAMP Certification and so meets the legal requirement to be FedRAMP authorized. A provider that says its product follows FedRAMP practices, but holds no certification for that offering, is not FedRAMP certified.
FedRAMP is better described as a federal programme than a control framework. It sets the rules, certification types and assurance classes, and states its security expectations as FedRAMP Practices: Key Security Indicators for FedRAMP 20x, or controls for Rev5, supplemented by FedRAMP rules.
Yes. FedRAMP is a statutory programme, and the Consolidated Rules for 2026 are its newest rulebook. FedRAMP 20x is designed to change every year, so expect a new rule set yearly rather than a one-off revision. FedRAMP's own guidance warns that certified providers who do not adjust to the 2026 rules will lose their FedRAMP Certification.
Rev5 is the legacy FedRAMP certification type, based primarily on documented plans. FedRAMP 20x is the newer type, based primarily on measured outcomes and built on Key Security Indicators. FedRAMP opened applications for 20x Class A on 3 August 2026, and for Classes B and C on 31 August 2026.
Search the FedRAMP Marketplace on the FedRAMP website, the programme's searchable database of certified cloud services, authorizing agencies and recognized assessors. FedRAMP certification covers a specific cloud service offering, so check the exact product you plan to buy or sell, not just the vendor's name. In October 2026 it listed 544 certified services, 32 of them under 20x.