Executive Summary: What is it?
The Federal Risk and Authorization Management Program (FedRAMP) is a government-wide program within the General Services Administration that provides a standardized, reusable approach to security assessment and authorization for cloud computing products and services that process unclassified information used by federal agencies.
CFO / Business Impact: What does it cost/risk?
- Federal Agency Requirement: OMB requires a federal agency to obtain and maintain a FedRAMP certification (formerly authorization) for any cloud service in FedRAMP's scope: broadly, one that creates, collects, processes, stores or maintains federal information on the agency's behalf.
- Certification Path: A 20x certification comes directly from FedRAMP with no agency sponsor; Rev5, the legacy type, generally needs a sponsoring agency. FedRAMP stops accepting new Rev5 applications on 11 June 2027.
Technical Reality: How does it work?
- Machine-Readable Packages: The 2026 rules replace Word and Excel templates with simplified JSON documents for the certification package; the Open Security Controls Assessment Language (OSCAL) is optional in some cases.
- KSI Validation: Under 20x, certification rests primarily on measured outcomes, and follow-on assessments of Key Security Indicators (KSIs) maintain it; Rev5 rests primarily on documented plans and Rev5 controls.
What the Label Means in a Solution Profile
FedRAMP certifies specific cloud services for US federal use; it never covers software you run yourself.
- Self-Hosted line: No self-hosted line carries a FedRAMP label: FedRAMP certifies cloud services a provider supplies to customers, not software an agency runs itself. "FedRAMP Ready" is an official Marketplace designation, a pre-authorization step for cloud services (legacy since 28 July 2026), and never a solution profile label.
- Managed service line: Audited is the only basis. It means the named service appears as FedRAMP Certified (formerly Authorized) on the official FedRAMP Marketplace, at the class or impact level the label shows. The label shows the class ("FedRAMP Class A" to "FedRAMP Class D" under the 2026 rules) whenever the listing names one, even when an impact level stands beside it: a Rev5 listing reads, for instance, "Class C (Moderate)". "FedRAMP Low", "FedRAMP Moderate" or "FedRAMP High" is only for a listing that shows an impact level and no class. A label reads, for example, "FedRAMP Class C (Audited)". The certification belongs to one provider's offering: the label may name the vendor's own offering after the dot, and a certification held only by a third party's offering of the software is not shown.