FedRAMP - the Federal Risk and Authorization Management Program - began as a December 8, 2011 memo from the Federal CIO and has been a matter of statute since Congress passed the FedRAMP Authorization Act as part of the James M. Inhofe National Defense Authorization Act for Fiscal Year 2023 (Public Law 117-263, Section 5921, December 23, 2022). The Act placed the program in the General Services Administration, created a FedRAMP Board, and is codified in part at 44 U.S.C. Section 3608 and the surrounding sections of Chapter 36. Section 3608 describes a standardized, reusable approach to security assessment and authorization for cloud computing products and services that process unclassified information used by agencies. OMB issued the implementing policy on July 25, 2024: Memorandum M-24-15, which rescinded the 2011 memo. The same Act strikes 44 U.S.C. Sections 3607 through 3616 effective December 23, 2027, five years after enactment, unless Congress extends them. That sunset is about the statutory text. It is not a statement that agency cloud oversight ends on that date. FedRAMP's own copy of the sunset is on its Authorization Act page.
For a TPRM program, "FedRAMP compliant" does not name a precise status. FedRAMP's own Consolidated Rules for 2026 say the older phrase "FedRAMP authorization" was widely misread, inside and outside government, as a blanket risk acceptance for the whole federal government. It is not. The checkable questions are which FedRAMP Certification a cloud service offering actually holds, at which Certification Class, which agency has issued its own authorization to operate or to use, and whether Ongoing Certification is current.
What the words mean as of October 31, 2026
The statute and M-24-15 say "FedRAMP authorization" and FIPS 199 impact levels. The Consolidated Rules for 2026, effective July 4, 2026 and mandatory for stakeholders on January 1, 2027, use different words for the same work. Dates below are FedRAMP's published timeline as of October 31, 2026; confirm them on the What's Changing page and the timeline before you rely on a cutoff.
- FedRAMP authorization is now FedRAMP Certification, so it is not confused with an agency authorization to operate under OMB Circular A-130.
- Low, Moderate, and High map to Certification Classes: Class A (Pilot), Class B (LI-SaaS, Low), Class C (Moderate), and Class D (High). A class is not a one-for-one label for the agency system's impact level. See FedRAMP's class guidance.
- The cloud provider's continuous monitoring is now Ongoing Certification. Failing it can cost the provider the Certification. Agencies still do their own continuous monitoring under Circular A-130.
- The system security plan is now a Certification Package Overview and Security Decision Record. Plans of action and milestones have been replaced by Accepted Weaknesses.
This page uses "FedRAMP Certification" for the current program status and the statute's own words when it is quoting Section 3613 or M-24-15.
What is actually in scope
M-24-15 scopes FedRAMP to cloud computing products and services - infrastructure, platform, and software alike - that create, collect, process, store, or maintain federal information on behalf of a federal agency. Footnote 6 limits that scope to information systems that process unclassified information and are not national security systems as defined in 44 U.S.C. Section 3552. The memo then lists categories that are outside that scope, subject to exceptions the FedRAMP Director makes with OMB's approval: single-agency systems that are not offered as a shared service, social media and communications platforms used under an agency social-media policy, search engines, widely available services that provide commercially available information without collecting federal information, ancillary services whose compromise would pose negligible risk, and any further category the FedRAMP Board identifies with the Federal CIO's concurrence. A vendor can be outside FedRAMP for a legitimate reason. The test is what the service does with federal information, not a rule that every government-facing SaaS product needs a Certification.
The presumption of adequacy, and its limits
44 U.S.C. Section 3613(a) tells an agency to check whether a FedRAMP authorization already exists before starting a new one, and, to the extent practicable, to reuse the existing assessment and materials. The mechanic that does the third-party risk work is the presumption of adequacy in Section 3613(e)(1): the assessment of security controls and materials in the authorization package "shall be presumed adequate for use in an agency authorization to operate cloud computing products and services." The statutory sentence does not mention an impact level.
The "at or below that FIPS 199 impact level" condition is M-24-15's reading, not the statute's text. Section IV.a says that if a cloud product has a FedRAMP authorization at a given FIPS 199 impact level, the Act requires agencies to presume the package is adequate for an authorization to operate at or below that level, and footnote 10 cites Section 3613(e)(1). The same memo also says an agency may authorize a provider that already has a FedRAMP authorization at a higher impact level after the appropriate tailoring. FedRAMP's current class guidance goes further: agencies should not treat Certification Classes as one-for-one replacements for Low, Moderate, or High. Class B is described as adequate for most Low systems and some Moderate or High systems with compensating controls; Class C for most Low or Moderate systems and some High systems with compensating controls; Class D for most systems regardless of impact level, especially with compensating controls. The agency still categorizes its own system.
Section 3613(e)(2) says the presumption does not alter an agency's FISMA responsibility, or an agency head's authority to find a demonstrable need for security requirements beyond those in the FedRAMP authorization. Separately, Section 3613(b) covers "wholly or substantially deficient." If an agency determines that the information it reviewed under Section 3613(a)(2) or (a)(3) is wholly or substantially deficient for performing an authorization, the agency head must document the reasons in the resulting FedRAMP authorization package. M-24-15 treats that deficiency finding as a ground for overcoming the presumption, and its footnote cites Section 3613(b). The document-and-notify duty is narrower than "either ground." The memo says that if a new authorization is issued following additional work, the agency that did that work must document in the resulting package why it found the previous package deficient, and must inform the FedRAMP PMO. The FedRAMP Director remains responsible for deciding whether the agency's additional security needs merit additional FedRAMP authorization work.
M-24-15 also ties the presumption to upkeep. It applies only "as long as a FedRAMP authorization is actively maintained by satisfying ongoing requirements (i.e., continuous monitoring)." Under the Consolidated Rules, that provider-side duty is Ongoing Certification. A lapsed Certification does not carry the same weight as a current one - the same gap this cluster describes between a point-in-time artifact and continuous monitoring.
The Section 3613(e) presumption binds agencies. A private integrator or prime contractor is not bound by it and should treat a FedRAMP Certification as one input to its own assessment, alongside the rest of the vendor's evidence. See NIST SP 800-161 for the broader federal supply-chain control set that sits next to, and does not replace, that agency decision.
Marketplace listing, FedRAMP Certification, and the agency ATO
These are three different facts. FedRAMP's Marketplace Quick Start Guide says: "A FedRAMP certification certifies that there are adequate security materials available for an agency to use in their own Authorization to Operate (ATO) decisions - FedRAMP does not grant ATOs." M-24-15 is consistent with that split. A cloud service offering is FedRAMP-authorized - FedRAMP Certification, in current usage - once the PMO confirms it meets FedRAMP requirements and approves it for the Marketplace. That is not an endorsement of the product, and it is not the agency's authorization. Each agency still issues its own authorization to operate (ATO) or authorization to use (ATU).
The FedRAMP Marketplace can show a cloud service offering in process, fully certified, or, since July 6, 2026, in an Initial Implementation listing. The guide's Authorization Details tab shows the agency sponsor, the assessor, the annual assessment date, and every agency that has authorized the offering. The Dependent Products tab shows related offerings that depend on the service. The guide's own closing step is to verify that the current certification status has not changed before finalizing an agreement.
M-24-15 describes three paths that can produce an authorization. An agency authorization is signed by that agency's authorizing official. A joint authorization by several agencies is, in the memo's words, "similar in concept" to the old Joint Authorization Board provisional ATO, but any group of agencies can issue one, and existing JAB provisional ATOs are re-designated as the FedRAMP PMO determines in collaboration with the provider. A program authorization is signed by the FedRAMP Director for a service with broad expected reuse, including where no agency sponsor has been identified. The PMO may also design other paths, in consultation with OMB and NIST and with Board approval. A vendor's claim to be "FedRAMP Authorized" or "FedRAMP Certified" is a fact to check against the Marketplace record, not a status to take from a marketing page.
| Term | What it actually means |
|---|---|
| FedRAMP Certification (statutory term: FedRAMP authorization) | The PMO has confirmed the offering meets FedRAMP requirements and approved it for the Marketplace. The package is presumed adequate for an agency authorization to operate. It is not itself that agency ATO. |
| Certification Class | Class A (Pilot), Class B (LI-SaaS, Low), Class C (Moderate), Class D (High). The class describes how much assurance information the provider committed to supply. It is not a one-for-one stand-in for the agency system's FIPS 199 impact level. |
| FedRAMP Marketplace listing | A directory entry. It can be in process, an Initial Implementation listing (opened July 6, 2026), or Certified. A listing is not an authorization to use the service. |
| ATO / ATU | The agency authorizing official's own authorization to operate or authorization to use, leveraging the FedRAMP package. This is what clears a specific use for that agency. |
| FedRAMP Recognized assessor (historically a 3PAO) | An independent assessor the Marketplace lists as FedRAMP Recognized. Historically the evidence was a system security plan, a security assessment report, and a plan of action and milestones. Plans of action and milestones have been replaced by Accepted Weaknesses, and the plan is now a Certification Package Overview and Security Decision Record. |
| Ongoing Certification (formerly continuous monitoring) | The provider's ongoing duty after Certification. Failing it can mean losing the Certification. Agencies still perform their own continuous monitoring under Circular A-130. The presumption of adequacy is conditioned on this upkeep. |
Ongoing Certification, and FedRAMP 20x replacing Rev5
M-24-15 tells the FedRAMP PMO, with the FedRAMP Board and CISA, to build a monitoring framework that watches the provider's change process rather than approving every individual change, so a cloud provider can keep an agile release cadence. The memo also required machine-readable artifacts and designated NIST's Open Secure Control Assessment Language (OSCAL) until NIST named a successor. The Consolidated Rules for 2026 change that packaging rule: for some packages, OSCAL is now optional alongside simplified JSON.
FedRAMP 20x is the path that replaces Rev5, not a side track that leaves Rev5 in place indefinitely. FedRAMP's rules say "FedRAMP 20x will replace FedRAMP Rev5." As of October 31, 2026, the published timeline is: no new Rev5 Certifications after June 11, 2027; existing Rev5 Certifications stay active until at least December 31, 2028, unless FedRAMP is directed otherwise; FedRAMP Ready stopped accepting submissions on July 28, 2026, and providers are pointed to 20x Class A instead. Classes A, B, and C are open (the Class A pipeline opened August 3, 2026, and Classes B and C opened August 31, 2026). Class D (High) is the Phase 4 pilot. FedRAMP lists Phase 4 as a later phase, not an open pipeline, on that date. Rev5 and 20x Certifications coexist during the transition. A TPRM program should read the current Marketplace record for the pathway and the Ongoing Certification state, not assume the program still looks like the last assessment cycle.
Turning FedRAMP into TPRM actions
- Verify the Marketplace record, not the vendor's claim. Use the Authorization Details tab: agency sponsor, FedRAMP Recognized assessor, annual assessment date, and every agency that has authorized the offering. Confirm the Certification Class. Verify that the current certification status has not changed before you finalize.
- Separate the three layers. An in-process or Initial Implementation listing, a FedRAMP Certification, and an agency ATO or ATU answer different questions. An agency authorization scoped to one agency's risk tolerance is also different from a program authorization meant for broader reuse.
- Confirm Ongoing Certification is current. The presumption of adequacy depends on that upkeep. Failing Ongoing Certification can cost the provider the Certification. The agency's own Circular A-130 continuous monitoring still sits with the agency. A stale package is the same kind of gap as a stale SOC report or an expired certificate elsewhere in this cluster.
- Do not treat the presumption as absolute, or as yours. An agency can overcome it for demonstrable need, or where Section 3613(b) makes the package wholly or substantially deficient, and a new authorization after that additional work is what triggers documentation and notice to the FedRAMP PMO. A private integrator or prime is not bound by Section 3613(e) at all.
- Read the fourth parties the package actually names. The Dependent Products tab and the package's leveraged and external services are the documented dependencies. A Certification of the offering does not automatically extend to the provider's other vendors. See fourth-party risk.
Where this sits among TPRM platforms
Tracking which government cloud vendors hold a FedRAMP Certification, at which Certification Class, with which agency sponsor, and whether Ongoing Certification is current is governance workflow that questionnaire and GRC platforms are built to manage well. What that record does not tell a program is whether the vendor's actual, current environment still matches the package - the same gap this cluster covers generally in evidence-based risk scoring, where an externally observed security-rating signal fills in what a Marketplace listing cannot. Rescana runs continuous, evidence-based monitoring under your approval, pairing that with automated evidence collection, so a vendor's FedRAMP status and posture are checked against current signal rather than a marketing claim or a listing that was accurate on the day it was last checked. What gets acted on stays under your rules, with human control.
Frequently asked questions
What is FedRAMP and who does it apply to?
FedRAMP (the Federal Risk and Authorization Management Program) is the US federal government's standardized, reusable approach to security assessment and authorization for cloud computing products and services that process unclassified information used by agencies. Congress put it into law in the FedRAMP Authorization Act, part of the FY2023 National Defense Authorization Act, codified at 44 U.S.C. Chapter 36, and OMB Memorandum M-24-15 (July 25, 2024) is the implementing policy. As of October 31, 2026, the Consolidated Rules for 2026 call a completed FedRAMP authorization a FedRAMP Certification. The program applies to federal agencies and to cloud service providers that create, collect, process, store, or maintain federal information on their behalf. It is not a general commercial certification. Single-agency systems, social media, search engines, commercially available information services, and negligible-risk ancillary services are out of scope, as is any further category the FedRAMP Board excludes with the Federal CIO's concurrence. The Act's statutory sections are scheduled to sunset on December 23, 2027 unless Congress extends them.
Does a FedRAMP Marketplace listing mean a cloud service is certified for an agency to use?
Not by itself. FedRAMP's Marketplace Quick Start Guide says a FedRAMP certification certifies that adequate security materials exist for an agency's own authorization-to-operate decision, and that FedRAMP does not grant authorizations to operate. A Marketplace entry can be in process, an Initial Implementation listing (since July 6, 2026), or a FedRAMP Certification. The Certification is the package the FedRAMP program office has confirmed and approved for the Marketplace. The authorization to use the service is still that agency's own authorization to operate or authorization to use. The Authorization Details tab shows the agency sponsor, the assessor, the annual assessment date, and the agencies that have authorized the offering. Verify that the current certification status has not changed before finalizing.
What is FedRAMP's presumption of adequacy, and can an agency overcome it?
Section 3613(e)(1) says the security assessment and materials in a FedRAMP authorization package shall be presumed adequate for use in an agency authorization to operate. That statutory sentence does not mention an impact level. OMB Memorandum M-24-15 applies the presumption at or below the authorization's FIPS 199 impact level, in a passage whose footnote cites Section 3613(e)(1). Section 3613(e)(2) leaves the agency's FISMA responsibility in place, and it leaves the agency head's authority to find a demonstrable need for additional security requirements. Wholly or substantially deficient is Section 3613(b): if the agency finds the materials it reviewed under Section 3613(a)(2) or (a)(3) wholly or substantially deficient for performing an authorization, it must document the reasons in the resulting package. M-24-15 treats that finding as a ground for overcoming the presumption. The memo attaches documentation and notice to the FedRAMP program office to a new authorization issued after additional work, recording why the previous package was deficient. It does not attach that notice duty to demonstrable need by itself. The FedRAMP Director decides whether those additional needs merit more FedRAMP authorization work. The presumption holds only while the authorization is actively maintained, and it binds agencies. A private integrator or prime contractor is not bound by it.
Does a FedRAMP Certification replace an agency's own continuous monitoring of a cloud vendor?
No. Under the Consolidated Rules for 2026, the cloud provider's former continuous-monitoring duty is Ongoing Certification, and failing it can cost the provider its FedRAMP Certification. That provider duty does not replace the agency's own continuous monitoring under OMB Circular A-130. Memorandum M-24-15 still conditions the presumption of adequacy on the authorization being actively maintained by satisfying ongoing requirements. A lapsed Certification does not carry the same reliance value as a current one, so checking that Ongoing Certification is current is part of assessing a government cloud vendor, not a one-time checkbox.