FedRAMP: Selling Cloud Services to the US Government

FedRAMP (the Federal Risk and Authorization Management Program) is how the US federal government checks that cloud services are secure enough for agencies to use. It is run by the General Services Administration (GSA). If a cloud product or SaaS application will hold or process federal information, the agency using it generally needs it to be FedRAMP authorised or certified.

FedRAMP changed significantly in 2026. This guide covers both the long-standing Rev5 process and the new FedRAMP 20x approach, and the timeline for moving between them. Check fedramp.gov for the latest rules before making plans.

What is FedRAMP?

FedRAMP provides a standard approach to security assessment, authorization and continuous monitoring for cloud services, so that a service assessed once can be reused by many agencies (“do once, use many times”).

Certification classes under 20x

History and why it was introduced

FedRAMP was introduced because every agency was separately assessing the same cloud services, which was slow, expensive and inconsistent. 20x was introduced because even FedRAMP’s shared process had become too slow and paper-based for modern cloud services.

Main objectives:

1. Make sure cloud services used by the government are secure.
2. Assess once and reuse across agencies.
3. Monitor security continuously, not just at authorization.
4. Speed up access to modern cloud services (the focus of 20x).

Who needs FedRAMP?

Is FedRAMP mandatory?

Yes, for cloud services used by US federal agencies, under OMB policy and the FedRAMP Authorization Act. It is not a law that applies to private companies generally: it is a condition of selling to the federal government. There are no fines; the consequence of not having it is that agencies can’t use your service.

Key requirements

Security requirements

• Rev5: implement the controls in the FedRAMP baseline for your impact level, derived from NIST SP 800-53 Rev. 5. The Moderate baseline contains several hundred controls and enhancements.
• 20x: meet the requirements of the target class, demonstrated through automated validation and machine-readable evidence where possible. The Consolidated Rules group requirements into rulesets.

Rulesets with early dates

Under the Consolidated Rules, providers must adopt the Vulnerability Detection and Response and Vulnerability Evaluation and Reporting rulesets by 7 December 2026.

Assessment

• Independent assessment has traditionally been performed by an accredited 3PAO (third-party assessment organisation).
• Class A eligibility can be based on a readiness assessment report or a SOC 2 Type 2 report.

Continuous monitoring

Authorised and certified services must continuously monitor security: vulnerability scanning, remediation within set timeframes, incident reporting, significant change management and regular reporting to agencies and FedRAMP.

How to pursue FedRAMP

1. Confirm demand. Identify the agencies or integrators who want to buy your service and what class or level they need.
2. Read the Consolidated Rules and decide between the 20x path and a remaining Rev5 path (Rev5 is closing to new applications on 11 June 2027).
3. Define the boundary of the cloud service offering: components, data flows, external services and inherited controls from your infrastructure provider.
4. Run a gap assessment against the class requirements. Existing SOC 2 or ISO 27001 controls help, but expect gaps in areas such as federal-grade encryption (FIPS 140 validated modules), continuous monitoring and supply chain risk.
5. Build automated evidence for the 20x approach: configuration, vulnerability and access data exported in machine-readable form.
6. Get assessed by an accredited assessor.
7. List on the FedRAMP Marketplace and work with agencies.
8. Operate continuous monitoring and report as required.

Documentation

Rev5 requires a large documentation package, including a system security plan, policies and procedures, an incident response plan, a contingency plan, a configuration management plan, a security assessment plan and report, and a plan of action and milestones (POA&M).

20x aims to replace much of this with automated, machine-readable evidence, but you will still need clear policies, a boundary description and records of how you meet each rule. Check the current FedRAMP documentation requirements for your class.

Assessment and authorization

Cost

FedRAMP is one of the most demanding security programmes a cloud provider can pursue. Main cost areas:

20x is intended to reduce time and cost compared with Rev5, but your starting maturity still drives most of the effort.

Benefits

• Access to the US federal market.
• Reuse across agencies once listed or certified.
• Strong evidence for state, local, defence and regulated commercial customers.
• A mature, continuously monitored security programme.

Risks of not having it

• No federal cloud sales.
• Losing federal customers when existing authorizations sunset without adopting the new rules.
• Losing ground to competitors who are listed on the Marketplace.

Common mistakes

• Starting without real agency demand.
• Underestimating continuous monitoring.
• Poorly defined boundaries that pull corporate systems into scope.
• Non-FIPS-validated cryptography.
• Ignoring the 2026 to 2028 timeline, especially the Rev5 application cut-off and the Rev5 sunset.

Challenges for IT companies

• The pace of change in FedRAMP rules during the 20x transition.
• Producing machine-readable evidence from existing tools.
• Supply chain and third-party service requirements.
• Personnel and data location expectations for some classes.

Best practices

• Follow fedramp.gov notices and RFCs closely during the transition.
• Start with SOC 2 Type 2 and Class A if federal demand is early-stage.
• Design automation for evidence from day one.
• Use a customer responsibility matrix to show what agencies must do themselves.
• Inherit as much as possible from a FedRAMP-authorised infrastructure provider.

Tools that help

How FedRAMP relates to other frameworks

Real-world examples

• Major cloud platforms such as AWS GovCloud, Microsoft Azure Government and Google Cloud hold FedRAMP High authorizations for many services.
• FedRAMP Marketplace. Hundreds of cloud services are listed, from collaboration tools to security products.
• Illustrative scenario, not a real company: a SaaS analytics company with a SOC 2 Type 2 report wins interest from a federal agency. It lists as Class A, builds automated evidence pipelines, and plans its move to Class C within the 12-month window after the agency starts using the service.

Frequently asked questions

Is FedRAMP mandatory? For cloud services used by US federal agencies, yes. It is not required for purely commercial sales.

What is FedRAMP 20x? FedRAMP’s modernised approach, with automated validation, machine-readable evidence and certification classes. It became widely available in 2026.

What happens to existing Rev5 authorizations? They must adopt the Consolidated Rules by 1 January 2027 (with grace periods to 1 February 2028) and sunset on 31 December 2028.

What is Class A? The entry-level 20x Marketplace listing that replaced FedRAMP Ready.

Can a non-US company get FedRAMP? It is possible in principle, but rare because of data, personnel and supply chain expectations.

Is a SOC 2 enough for FedRAMP? No, but a SOC 2 Type 2 can support Class A eligibility.

Do I need an agency sponsor? Under Rev5, an agency sponsor was central. 20x changes the paths; check the Consolidated Rules for current requirements.

Next steps

• Confirm which agencies want your service and at what class.
• Read the Consolidated Rules and pick your path.
• Define your cloud service boundary.
• Start automating security evidence.