What is FedRAMP?
The Federal Risk and Authorization Management Program gives US federal agencies a standardised way to assess, authorise and continuously monitor the security of cloud products and services. Instead of every agency assessing every cloud provider separately, FedRAMP sets common requirements, so that an authorisation can be reused across agencies (“do once, use many”).
FedRAMP launched in 2011 and was codified by the FedRAMP Authorization Act in December 2022. It is run by the General Services Administration (GSA), with governance from the FedRAMP Board. OMB Memorandum M-24-15 (July 2024) updated federal policy for the programme.
Purpose and objectives
- Speed the safe adoption of cloud services by agencies.
- Apply consistent security baselines based on NIST guidance.
- Enable reuse of authorisations, reducing duplicate effort.
- Make sure authorised services stay secure through continuous monitoring.
Who does it apply to?
Cloud service providers (CSPs) that want federal agencies to use their offerings, whether IaaS, PaaS or SaaS, at any scale. Agencies, the FedRAMP office, independent assessors (3PAOs) and the CSP each have defined roles.
The current transition: Rev5 and FedRAMP 20x
FedRAMP is changing how authorisation works. Understanding both models matters during the transition.
FedRAMP Rev5 (established model)
- Baselines from NIST SP 800-53 Rev. 5 at Low, Moderate and High impact, plus a tailored baseline for low-impact SaaS.
- Package: system security plan (SSP), security assessment plan and report (SAP and SAR) produced by a 3PAO, and a plan of action and milestones (POA&M).
- Authorisation: typically sponsored by an agency, which issues an authority to operate (ATO), with FedRAMP review.
- Continuous monitoring: monthly vulnerability scanning and POA&M updates, annual assessments and significant-change requests.
FedRAMP 20x (go-forward model)
Announced in March 2025, 20x focuses on automation and machine-readable evidence. Providers show security through key security indicators and continuous, verifiable data rather than long narrative documents.
| Phase | Timing (per FedRAMP) | Status |
|---|---|---|
| Phase 1 — Low pilot | April–September 2025 | Completed |
| Phase 2 — Moderate pilot | November 2025–March 2026 | Completed. First pilot authorisations in March 2026 |
| Phase 3 | From April 2026 | Active. FedRAMP describes 20x as the standard path |
| Phase 4 — Class D (High) pilot | Estimated FY2027 Q1–Q2 | Planned |
| Phase 5 | Estimated FY2027 Q3–Q4 | Planned, including a transition path for existing Rev5 offerings |
FedRAMP 20x groups offerings into classes:
| Class | Intended for | Rough Rev5 equivalent |
|---|---|---|
| A | Providers with established security programmes entering the federal market (pilot) | — |
| B | Small-scale or light-use services | Low |
| C | Common enterprise services used widely across an agency | Moderate |
| D | High-impact services | High (in development) |
FedRAMP has stated it will stop accepting new Rev5 submissions on 11 June 2027, while noting that future dates are estimates.
Key terminology
| Term | Meaning |
|---|---|
| CSO | Cloud service offering: the specific product being authorised, not the whole company |
| ATO | Authority to operate: an agency’s formal acceptance of the risk of using a system |
| 3PAO | Third Party Assessment Organization: the independent assessor |
| SSP | System security plan: describes the system boundary and how each control is implemented |
| POA&M | Plan of action and milestones: tracks known weaknesses and their remediation |
| ConMon | Continuous monitoring: ongoing scanning, reporting and annual assessment after authorisation |
| Significant change | A change to the system that requires FedRAMP and agency review before or after implementation |
| KSI | Key security indicator: a 20x concept for measurable, machine-verifiable security outcomes |
| Marketplace | FedRAMP’s public listing of offerings and their status |
Choosing a target impact level or class
The level of protection depends on the potential impact if the information or system were compromised: the effect on agency operations, assets and individuals of a loss of confidentiality, integrity or availability. A collaboration tool holding routine, non-sensitive information may justify a lower level. A service holding law-enforcement, health or financial data, or supporting critical operations, typically needs Moderate or High. Choose based on the data your federal customers will actually put into the service. Starting too low can force re-authorisation later. Starting too high adds cost and time you may not need.
Under 20x, the class is also shaped by how widely the service is used. Class B suits light, limited use, and Class C suits services an entire agency is likely to depend on. Agency customers, not providers alone, ultimately decide what level of assurance they need.
Implementation lifecycle (high level)
- Decide the target. Impact level or class, based on the data and mission the service will support.
- Find federal demand. Agency sponsorship remains central for most paths.
- Readiness. Gap-assess against the applicable baseline or 20x requirements. For 20x, invest early in automating evidence.
- Independent assessment by a FedRAMP-recognised 3PAO.
- Review and authorisation, then listing on the FedRAMP Marketplace.
- Continuous monitoring. Under 20x, much of this is designed to be automated and continuous.
Evidence and documentation concepts
Under Rev5: SSP and attachments (policies, inventory, interconnections, incident response and contingency plans), SAP and SAR, POA&M, monthly scan results and continuous monitoring deliverables. Under 20x: machine-readable security data demonstrating key security indicators, plus the documentation the current class rules require.
Governance and accountability
Agencies remain responsible for deciding to use a cloud service and for accepting its risk. CSPs are accountable for implementing and maintaining controls and for reporting honestly. 3PAOs must remain independent of the providers they assess.
Common misconceptions and pitfalls
- “FedRAMP compliant” without an authorisation. Only offerings listed on the FedRAMP Marketplace with the relevant status are authorised. Readiness or “in process” status is not authorisation.
- Underestimating continuous monitoring. The ongoing effort is often larger than the initial package.
- Ignoring the transition. Providers starting now should plan around 20x and the published Rev5 timelines.
- Confusing FedRAMP with GovRAMP or CMMC. GovRAMP serves state and local government. CMMC applies to the defence industrial base.
Relationship with other frameworks
| Framework | Relationship |
|---|---|
| NIST SP 800-53 | Source of the Rev5 security control baselines |
| FISMA | Statute requiring agencies to secure information systems, including the cloud services they use |
| CMMC | Defence contractor programme. Cloud services handling CUI for contractors may need FedRAMP Moderate or equivalent |
| GovRAMP | State and local government counterpart, which has historically aligned with FedRAMP baselines |
| SOC 2 / ISO/IEC 27001 | Commercial assurance that may help with readiness but does not substitute for FedRAMP |
Open questions and items to watch
Points that were unsettled, contested or likely to change when this page was last reviewed. Check the official sources before relying on them.
- FedRAMP labels its future dates as estimates rather than firm commitments. This includes the 11 June 2027 cut-off for new Rev5 submissions and the timing of the Class D (High) pilot.
- FedRAMP's Consolidated Rules for 2026 (CR26) consolidate 20x requirements. The programme's public pages differed on whether all class rules were final when this page was reviewed. Use the current rules published on fedramp.gov.
- FedRAMP has said it will publish a transition path and timeline for existing Rev5 authorizations. Rev5 holders should track it closely.
Frequently asked questions
Is FedRAMP a law?
FedRAMP is a government programme, but it has a statutory basis. The FedRAMP Authorization Act, enacted in December 2022 as part of the FY2023 National Defense Authorization Act, codified it. For cloud providers, the requirement arises when federal agencies want to use their services, so it works in practice as a market-access and contractual requirement.
What is FedRAMP 20x?
FedRAMP 20x is the programme's modernisation, announced in March 2025. It replaces document-heavy packages with automated, machine-readable evidence and key security indicators, aiming to make authorisation faster and continuous. After Low and Moderate pilots in 2025–2026, FedRAMP declared 20x its standard path. It organises offerings into certification classes A to D.
Should a new provider pursue Rev5 or 20x?
It depends on the impact level needed, agency sponsorship and timing. FedRAMP has said it will stop accepting new Rev5 submissions in June 2027, and 20x classes cover Low and Moderate-equivalent offerings today. High-impact offerings remain on Rev5 until Class D is available. Check fedramp.gov for current eligibility before committing.
What does a 3PAO do?
A Third Party Assessment Organization is an independent assessor recognised by FedRAMP, typically accredited through A2LA. It tests a cloud service offering's security controls and produces the assessment results that agencies and FedRAMP rely on.
Sources and official references
- FedRAMP (programme home) — US General Services Administration — FedRAMP (official source)
- FedRAMP 20x — US General Services Administration — FedRAMP (official source)
- FedRAMP Marketplace — US General Services Administration — FedRAMP (official source)
- James M. Inhofe National Defense Authorization Act for FY2023 (includes the FedRAMP Authorization Act) — Congress.gov (Library of Congress) (official source)
- NIST SP 800-53 Rev. 5 — Security and Privacy Controls — NIST Computer Security Resource Center (official source)
Links go to the publisher's own site. Where a standard is sold or copyrighted, MajorCyber™ summarises it in original words and links to the official listing instead of reproducing its text.
Listen to this page
Read aloud in UK English by your own device. Nothing is sent anywhere, and the voice is whichever one your browser provides.
This page is general educational information, not legal, audit or certification advice. Requirements depend on your organisation's circumstances and the current official text. MajorCyber™ is not affiliated with US General Services Administration (GSA) FedRAMP office, with the FedRAMP Board; codified by the FedRAMP Authorization Act (2022).
