FedRAMP is the US federal program, run by the General Services Administration (GSA), that sets a common way to assess cloud services before agencies use them. As of the fedramp.gov pages read on 18 October 2026, it is moving from a document-heavy process toward FedRAMP 20x certification classes, so check the current rules before you plan.
Who runs it and where do you find the rules?
The FedRAMP name and logo are property of GSA. The program publishes a Marketplace, a searchable list of cloud services, the agencies that authorize them and recognized assessors. When we read it, the front page showed a count of services marked as FedRAMP 20x alongside the larger total of certified services.
The rules now live on a site called FedRAMP Consolidated Rules for 2026. It describes itself as bringing together the rules, definitions, timelines, stakeholder guidance and source material for agencies, cloud service providers, independent assessors and advisors. It also lists important dates for preview, adoption, transition and expiration. A separate Legacy Documentation Reference holds the older materials.
That structure tells you something: the rules are in transition, and dates matter. Anyone quoting a process from a few years ago may be describing the legacy path.
What is FedRAMP 20x?
The 20x page says it is a new approach to cloud security assessment and authorization that moves beyond traditional compliance toward the security decisions that matter most. The goal it states is for providers to set their own security goals, continuously measure the effectiveness of their decisions, and assure agencies through progressively increasing commitments.
It describes classes of certification, with these statuses on the day we read it:
- Class A: for services with mature security and compliance programs entering the federal marketplace. Requires a small amount of information up front and a small subset of initial ongoing monitoring and reporting. Available now.
- Class B: for fairly common, small-scale or light-use services where an entire agency is unlikely to use the service for important work. Available now.
- Class C: for common enterprise services likely to be used across an agency or that provide important government services. Available now.
- Class D: to be developed in FedRAMP 20x Phase 4. A pilot for cloud-hosted Class D has its own request for comment.
The site lists five principles, including transparency and flexibility, and frames assurance as evidence rather than paperwork.
What does "earning trust" involve?
Across both the legacy and newer paths, the pattern is the same: a provider documents how its service handles security, an independent assessor checks it, a federal authority decides, and the provider keeps reporting afterwards. What changed is how much is a document and how much is measured evidence.
For a provider, the useful questions are practical. Which class matches the service? Which federal agencies actually want it? What continuous reporting can you keep up for years? Federal buyers care less about the label than about whether the evidence is current.
A constructed example: a small SaaS vendor sells a project tracking tool to civil agencies. Its use is light and departmental. The vendor would read the Class B description, check whether an agency customer is willing to use the service, and compare the stated requirements with its existing monitoring before committing budget.
What should you not claim?
Do not say a service "is FedRAMP compliant" unless it is listed in the Marketplace at the level you mean. Aligning with the underlying NIST SP 800-53 controls is not authorization. Architecture targets are not certification. If you buy cloud services for a federal workload, check the Marketplace entry yourself.
How to check or apply this
- Read the Consolidated Rules for 2026 overview and the Important Dates page first.
- Search the Marketplace for the service you use or plan to build, and note the class or level shown.
- Decide which class or legacy path matches your service and customers.
- Map your logging, vulnerability management and change records to the evidence the rules ask for.
- Identify an agency partner early, since the program centers on agency use.
- Re-check fedramp.gov before each planning cycle, since the rules and dates are still moving.
Quick check
Who decides whether a cloud service is FedRAMP authorized?
The program is run by GSA, and the Marketplace lists services with their authorizing agencies and assessors. Confirm the specific service in the Marketplace rather than relying on a vendor's description.
Is FedRAMP 20x the same as the old process?
No. 20x is a newer approach built around certification classes and continuous measurement. The older material is kept as legacy documentation, so verify which path applies.
Sources
Last reviewed: 18 October 2026.
