FedRAMP, explained

The Federal Risk and Authorization Management Program (FedRAMP) is the General Services Administration (GSA) program for assessing and authorizing cloud computing products and services that process unclassified information used by federal agencies. Congress put it in law with the FedRAMP Authorization Act, section 5921 of the James M. Inhofe National Defense Authorization Act for Fiscal Year 2023, Public Law 117-263, enacted December 23, 2022. A FedRAMP authorization is not an agency's authorization to operate (ATO). It is a reusable package that each agency's own authorizing official (AO) uses to decide. Since May 4, 2026, FedRAMP calls it a FedRAMP Certification.

What the law says an authorization is

44 U.S.C. 3607 defines a FedRAMP authorization as a certification that a cloud product or service has completed a FedRAMP authorization process, as determined by the GSA Administrator, or has received a FedRAMP provisional authorization to operate from the FedRAMP Board. The authorization package is the essential information an agency can use to decide whether to authorize the operation of an information system. An ATO keeps the meaning given in Office of Management and Budget (OMB) Circular A-130.

Section 3613 sets the agency side. The assessment in a FedRAMP package is presumed adequate for use in an agency ATO. The presumption does not change the agency's own compliance duties under subchapter II of chapter 35 of Title 44, and an agency head may still find a demonstrable need for added security requirements for a particular control. An agency that issues an ATO based on a FedRAMP authorization sends a copy of the ATO letter to the GSA Administrator.

The 2024 edition of the Code carries a note that section 5921(d)(1) repeals these sections 5 years after December 23, 2022.

Low, Moderate, High, and the new classes

FedRAMP's February 25, 2026 notice set out the relabeling. The single official label became FedRAMP Certification, because the Act defines an authorization as a certification. Four baselines continue, with minor changes. On the Rev5 path, Class A is a new pilot baseline, Class B includes the current Low baseline and the one FedRAMP labels Li-SaaS, Class C includes Moderate, and Class D includes High. FedRAMP dropped levels and numbers to avoid confusion with the Department of Defense (DoD) impact level system, which the notice writes as DOD/DOW. The FedRAMP changelog records the change on May 4, 2026.

The notice also says what a certification is not. It is not a guarantee that a cloud service meets all requirements for agency use at a given Federal Information Processing Standards (FIPS) 199 security category, and FedRAMP lacks the authority to make that determination for an agency AO. The baseline identifies the depth and complexity of the information the provider supplies, not the overall security of the system. The Consolidated Rules for 2026 are to remain valid until December 31, 2028.

FedRAMP 20x, with dates

GSA announced FedRAMP 20x in March 2025, to be developed with industry and government, tested in public, and delivered in increments. On October 21, 2026, the program page gives these phases:

• Phase 1, Low pilot (completed). April through September 2025. FedRAMP received 26 complete packages between May 30 and August 18, 2025, and the first pilot authorizations came in late July.
• Phase 2, Moderate pilot (completed). November 18, 2025 through March 2026. FedRAMP received 14 qualifying submissions. The first cohort received pilot authorizations on March 6, 2026, and six more providers had them by April 27, 2026.
• Phase 3, wide-scale adoption (active). The third and fourth quarters of fiscal year 2026. The Consolidated Rules for 2026 were planned by the end of June 2026 and the submission pipeline for July to September 2026. Class A (Pilot), Class B (Low), and Class C (Moderate) come first, and the page says their full rules are finalized.
• Phase 4, Class D (High) pilot. Estimated for the first and second quarters of fiscal year 2027.
• Phase 5. FedRAMP will stop accepting new Rev5 Certifications on June 11, 2027.

The page says future dates are estimates for public awareness, not firm commitments.

What FedRAMP does not cover

Classified systems. The scope page says FedRAMP covers cloud services that process unclassified information. The Defense Information Systems Agency (DISA) Cloud Service Provider Security Requirements Guide, Version 1, Release 7 of June 30, 2026, says FedRAMP baselines do not address national security systems or classified information.

DoD impact levels. The same guide calls impact levels a construct of the Department of War (DoW) only. FedRAMP Moderate or High is essentially an automatic Impact Level 2 provisional authorization. Level 4 and above need a DoW provisional authorization, assessed on FedRAMP plus added DoW controls.

Excluded cloud uses. The scope page quotes OMB Memorandum M-24-15. Outside scope are single-agency systems, social media and communications platforms, search engines, services that provide commercial information without collecting federal information, and negligible-risk ancillary services. Only an agency can decide whether its use case is in scope.

Installed software. The scope covers cloud services such as infrastructure, platform, and software as a service. The scope page places independent software vendor applications installed in a single tenant of an infrastructure or platform service outside FedRAMP, though the host service is in scope. The DISA guide says cloud computing does not include dedicated hardware an organization assembles for its own exclusive use, so software run on an agency's own machines sits outside that definition.

What to check

• Is the service listed as FedRAMP Certified, and at which class or former baseline?
• Has the agency's own AO issued an ATO, with a copy sent to GSA?
• For DoD use, at which impact level does the service hold a DoW provisional authorization? FedRAMP Moderate or High reaches Impact Level 2 only.
• Is the use case inside FedRAMP's scope, or in an excluded category?
• Is the service on the Rev5 or the 20x path, and how does the June 11, 2027 stop date for new Rev5 Certifications affect it?
• Is the product installed software rather than a cloud service?

Azcuna's BABEL reads, translates, and searches foreign-language documents entirely on-device, with no cloud and no connection, and keeps every claim tied to the passage it came from.

Sources

1. 1Public Law 117-263, James M. Inhofe National Defense Authorization Act for Fiscal Year 2023 · U.S. Government Publishing Office, December 23, 2022
2. 2United States Code, 2024 Edition, Title 44, Section 3607 - Definitions · U.S. Government Publishing Office
3. 3United States Code, 2024 Edition, Title 44, Section 3613 - Roles and responsibilities of agencies · U.S. Government Publishing Office
4. 4NTC-0004 Initial Outcome from RFC-0020 FedRAMP Authorization Designations · FedRAMP, General Services Administration, February 25, 2026
5. 5FedRAMP Changelog · FedRAMP, General Services Administration
6. 6FedRAMP 20x · FedRAMP, General Services Administration (read October 21, 2026)
7. 7Scope of FedRAMP - FedRAMP Consolidated Rules for 2026 · FedRAMP, General Services Administration
8. 8Cloud Service Provider (CSP) Security Requirements Guide (SRG), Version 1, Release 7 · Defense Information Systems Agency, 30 June 2026, zip download

Where this shows up in our work

• ELLMENT, the offline LLM for E-2D crews answers a crew's question from the aircraft's own manuals and cites the page, with no network.
• BABEL, offline multilingual translation and search translates and searches foreign-language documents on-device, every fact tied to its source passage.
• TRACE, the offline S1000D and IETM viewer opens S1000D, MIL-STD-3001 and PDF technical manuals on a tablet with every marking intact.