FedRAMP is the US federal government's program for assessing and authorizing cloud services. You need it if you sell a cloud product that federal agencies will use to handle their data. Companies that do not sell to US federal agencies generally do not need it.
What does the program do?
FedRAMP's own pages describe a marketplace of assessed cloud services, authorizing agencies and recognized assessors. As of our fetch on 18 October 2026, the FedRAMP home page listed a count of services under its "certified" label and a separate count for 20x. We do not repeat those numbers here because they change; check the page for the live totals.
The program exists so that agencies do not each repeat the same security review of the same cloud service. A provider is assessed against a defined set of requirements, and agencies use that result to make their own risk decisions.
What is FedRAMP 20x?
FedRAMP 20x is the program's newer approach. According to the program, it lets providers set their own security goals, measure whether their decisions work, and give agencies growing assurance over time. It leans on evidence and automated validation more than point-in-time paperwork.
The 20x page we fetched describes classes of certification:
- Class A is for services with mature security and compliance programs that want to enter the federal marketplace. It asks for a small amount of information in advance and a small subset of initial ongoing monitoring and reporting.
- Class B is for common small-scale or light-use services, where an entire agency is unlikely to rely on the service for important work.
- Class C is for common enterprise services likely to be used across an agency or to deliver important government services.
- Class D is planned for a later phase.
The program says the rules for Classes A, B and C are finalized and available, and that 20x is in its third phase. It also says future dates are estimates and will shift. Earlier phases ran pilots for Low and then Moderate impact services.
Who needs it, and who does not?
You probably need it if:
- You sell software as a service, a platform or hosted infrastructure to US federal agencies.
- A prime contractor passes through a requirement that your cloud service be authorized.
- An agency has told you a procurement depends on it.
You probably do not need it if you sell only to private companies, or if your product is software that runs fully on agency-owned systems and does not send federal data to your cloud. Whether a given product counts as a cloud service in scope is a program decision, so ask the FedRAMP team or your agency sponsor before you plan a budget.
What should a vendor check first?
Start with the use case. FedRAMP's own material makes the point that the right expectations depend on the agency use case and mission, and that a public website and a medical records application need different levels of confidentiality, integrity and availability. That shapes which class and impact level you aim for.
Then check the cost of staying in. 20x talks about continuous monitoring and reporting, so authorization is a program you keep running and not a certificate you frame. Budget people for it.
Where does Safeguard stand?
Safeguard does not claim FedRAMP authorization. Our deployment options include private tenancy, on-prem and air-gapped installs, and federal readiness is an architecture target for us, not an achieved status. If your buyer requires an authorized provider, ask any vendor, including us, for the authorization listing on the FedRAMP marketplace.
What to do
- Confirm with your buyer or prime that FedRAMP is a requirement, in writing.
- Define the data your service handles and which impact level an agency would assign.
- Read the current FedRAMP 20x page for the class that fits your service.
- Find an agency sponsor or check whether the class you target needs one.
- Inventory your own dependencies and suppliers, since agencies will ask about them.
- Plan for continuous monitoring staffing before you apply.
- Check the FedRAMP marketplace for any provider you rely on that must itself be authorized.
Quick check
Is FedRAMP a law?
FedRAMP is a federal program, and agencies apply it to cloud services they buy. Whether it binds your sale depends on the contract and the agency.
Does having a SOC 2 or ISO 27001 report satisfy FedRAMP?
No source we fetched says so. FedRAMP has its own requirements and assessment process, so treat other reports as supporting material, not substitutes.
Sources
Last reviewed: 18 October 2026.
