FedRAMP is the US federal program for assessing cloud services that agencies use. A SaaS vendor lists a service in the FedRAMP Marketplace under a class that matches data sensitivity. Agencies decide whether to use it. FedRAMP itself does not grant agency Authorizations to Operate (ATOs).
Key takeaways
- The FedRAMP Marketplace lists certified services by class: A (Pilot), B (LI-SaaS, Low), C (Moderate) and D (High).
- Agencies make their own ATO decisions, per the Marketplace guide.
- As of 19 October 2026, the FedRAMP site lists 544 certified services and 32 FedRAMP 20x certified services.
- FedRAMP is changing: the site links "Consolidated Rules for 2026" and a 20x program, and recent RFCs are open.
- Never describe your product as FedRAMP anything until it is listed. Target and in progress are not the same.
What is FedRAMP, in plain terms?
It is a government wide approach to security assessment for cloud services, so each agency does not start from zero. Controls come from NIST guidance, and the NIST Risk Management Framework has seven steps: prepare, categorize, select, implement, assess, authorize and monitor.
Which FedRAMP class does a SaaS vendor need?
It depends on the sensitivity of the data the agency will put in your service. The Marketplace filters use these classes: Class A (Pilot), Class B (LI-SaaS, Low), Class C (Moderate) and Class D (High). Agencies choose a class based on data sensitivity. Ask your target agency what they need before you plan.
How does a vendor get started?
- Find a buyer. An agency sponsor makes the path clearer than guessing.
- Confirm the class. Ask the agency for the data category.
- Read the current rules. The site now points to Consolidated Rules for 2026 and a legacy documentation reference. Use the current ones.
- Define your boundary. Which systems, data flows and third parties are in scope.
- Build the control set and evidence. Policies, configuration baselines, vulnerability management, logging, incident response and supply chain controls.
- Use an assessor. The Marketplace lists recognized assessors.
- Plan for continuous monitoring. Authorization is not a one time event.
We did not fetch the detailed requirements for each step. Treat this as a map, and verify each step against the current FedRAMP documents.
What is FedRAMP 20x?
20x is a FedRAMP program with its own section on the site. As of 19 October 2026 it lists 32 certified services, and RFC-0036 on Class D cloud hosted pilot requirements was dated 15 October 2026 and RFC-0035 on cryptographic module use updates was dated 14 October 2026. Details change often, so check the 20x pages before you plan.
How does software supply chain work fit?
Component inventory, vulnerability handling and evidence are central to many federal security expectations. An SBOM and a vulnerability inventory help you answer them. The free scan at gold.safeguard.sh/scan accepts CycloneDX or SPDX SBOMs and runs in the browser with no login.
Click through it at your own pace, or open it full screen.
Frequently asked questions
Does FedRAMP grant an ATO?
No. The Marketplace guide says FedRAMP does not grant ATOs. Agencies decide.
What are the FedRAMP classes?
Class A (Pilot), Class B (LI-SaaS, Low), Class C (Moderate) and Class D (High) in the Marketplace.
Can we say we are FedRAMP compliant while preparing?
No. Say you are preparing, and name the class you are targeting.
Is FedRAMP 20x the same as the older path?
It is a distinct program with its own listing. Read the current FedRAMP pages for how it differs.
Sources
Last reviewed: 19 October 2026.
