FedRAMP is the US federal program that assesses and authorizes cloud services for government use. A first security hire should learn three things first: how the newer FedRAMP 20x classes are defined, how the Marketplace shows status, and why continuous evidence matters more than a one time audit.
What is FedRAMP, in one paragraph?
FedRAMP.gov describes its Marketplace as a searchable database of cloud services, authorizing agencies and recognized assessors. On the day we checked, the home page listed 544 services in total and 32 under FedRAMP 20x. Those counts change often, so look at the live page before you quote any number.
What is FedRAMP 20x?
FedRAMP's own 20x page calls it a new approach to cloud security assessment and authorization that moves beyond traditional compliance toward the security decisions that matter most. The full rules for certification are finalized for Class A, Class B and Class C, and Class D is planned for Phase 4. A Class D pilot requirements document (RFC-0036) was published on 15 October 2026, which signals the area is still moving.
The page describes the classes this way. Class A is for services with mature security and compliance programs that want to enter the federal marketplace. Class B is for common, small scale or light use services where an entire agency is unlikely to use the service for important work. Class C is for common enterprise services likely to be used across an entire agency or to provide important government services. Pick the one that matches your real customer use, and read the current rules, because they are still being published.
What principles should shape your program?
FedRAMP lists five: transparency, flexibility, accountability, accuracy and automatic validation. Two matter most for a new hire. Accountability, in its words, means security should be continuously enforced, monitored and reported, not staged for a point in time audit. Automatic validation means status, progress and outcomes should be enforced and validated automatically when possible, and that continuous evidence is stronger than a policy saying something should happen.
For a security hire the practical meaning is simple. Build evidence that your systems produce on their own, such as configuration state, scan results and access logs, and do not rely on screenshots collected in a rush.
What does the Marketplace tell a buyer?
It tells them whether a service is listed, who authorized it and which assessors are recognized. It does not tell them whether your use of the service fits their data. FedRAMP says context matters: the right expectations depend on the agency use case and mission, not on a single yes or no verdict.
Constructed example: a startup hosts an analytics tool on a major cloud. The cloud platform may be listed, but that does not make the startup's application listed. The agency still needs to know who authorized the application layer and under which class or path. A new hire who can explain that difference saves the sales team an awkward call.
What should you not claim?
Do not say a product is "FedRAMP compliant" or "certified" unless the Marketplace lists it, and quote the exact status shown there. A plan, a gap assessment or an architecture aimed at a level is not authorization. Marketing and sales need that sentence in writing from you.
What to do in your first month
- Read the FedRAMP 20x page end to end, then read the current class rules for the class you might target.
- Find the Marketplace entries for your cloud providers and note their listed status.
- Ask sales which agencies are asking and what use case they describe. Match that to a class.
- List which security evidence you can already produce automatically, and which you cannot.
- Write the approved public wording for your own status and get leadership to sign it.
- Subscribe to FedRAMP's change log, since new RFCs appear frequently.
Quick check
Is FedRAMP 20x finished?
Not entirely. FedRAMP says rules are finalized for Classes A, B and C, while Class D is planned for Phase 4 and a pilot requirements document was published in October 2026.
Does a listed cloud provider make my app listed?
No. Each service needs its own status. Check the Marketplace entry for the exact application and the wording of its status.
Sources
Last reviewed: 18 October 2026.
