FedRAMP Explained: Rev. 5, FedRAMP 20x & Authorization

For a cloud company, FedRAMP authorization is the gateway to the US federal market. Without it, federal agencies generally cannot use your cloud service for federal information. The programme is also in the middle of its biggest change since it began: FedRAMP 20x is replacing document-heavy assessments with automated, machine-readable evidence, and FedRAMP has announced a planned end date for new applications under the traditional Rev. 5 process. This guide explains how FedRAMP works today, the impact levels, the authorization paths, the role of 3PAOs, and how to plan during the transition.

Quick answer: FedRAMP is a US government authorization programme for cloud services used by federal agencies, established by OMB policy in 2011 and codified by the FedRAMP Authorization Act in December 2022. It is mandatory for cloud service providers that want to sell to federal agencies and irrelevant otherwise. Authorization is based on NIST SP 800-53 Rev. 5 baselines at Low, Moderate or High impact, assessed by an accredited Third Party Assessment Organization (3PAO). The FedRAMP 20x programme is rolling out an automated approach, and FedRAMP has announced 11 June 2027 as the planned last date for new Rev. 5 applications (subject to change).

What is FedRAMP?

FedRAMP provides a standardised approach to security assessment, authorization and continuous monitoring for cloud products and services used by the US federal government. Its principle is "do once, use many times": one authorization package can be reused by many agencies.

Full form and definition

FedRAMP stands for the Federal Risk and Authorization Management Program. It is run by a Program Management Office within the General Services Administration (GSA), with policy from the Office of Management and Budget (OMB) and oversight from the FedRAMP Board.

Law, standard or certification?

FedRAMP is a government authorization programme backed by statute (44 U.S.C. 3607 to 3616, added by the FedRAMP Authorization Act). It is not a certification: an agency or the programme authorizes a cloud service to operate with federal data, based on an accepted level of risk.

History and background of FedRAMP

OMB established FedRAMP by memorandum in December 2011 to support the federal "cloud first" policy and avoid each agency assessing the same cloud services separately. The FedRAMP Authorization Act, part of the FY2023 National Defense Authorization Act signed in December 2022, put the programme into law. OMB Memorandum M-24-15 (July 2024) modernised FedRAMP policy, replacing the Joint Authorization Board with a FedRAMP Board and emphasising automation and reuse.

In March 2025 FedRAMP announced FedRAMP 20x, a new approach based on key security indicators validated through automation rather than long narrative documents. It has been rolled out in phases, starting with Low impact pilots in 2025 and extending to Moderate. FedRAMP has also announced a plan to stop accepting new authorization applications under the traditional Rev. 5 process on 11 June 2027. Dates and details are still evolving, so check fedramp.gov before planning.

Why was FedRAMP introduced?

Agencies were duplicating expensive security assessments of the same cloud services, slowing adoption. A shared, standardised authorization lets agencies reuse each other's work and gives cloud providers a single path into government.

Main objectives and purpose

Ensure cloud services used by agencies meet consistent security requirements.
Reduce duplicate assessments through reuse of authorizations.
Provide continuous monitoring of authorized services.
Speed safe adoption of modern cloud technology across government.

Who needs FedRAMP?

SaaS, PaaS and IaaS providers that want federal agency customers
Resellers and system integrators delivering cloud services to agencies, who need their underlying services to be authorized
Vendors selling to state governments that recognise FedRAMP (some states run their own programmes, such as StateRAMP, now GovRAMP)

FedRAMP is a US federal programme. Non-US companies can pursue authorization, but agencies and FedRAMP impose requirements on data location, personnel access and supply chain that often require a US-based environment and staff.

Defence workloads also follow the Department of Defense Cloud Computing Security Requirements Guide, which builds impact levels on top of FedRAMP baselines.

Key requirements of FedRAMP

Impact levels

FedRAMP baselines
Level	Use	Basis
Low (including LI-SaaS tailored baseline)	Systems where loss of confidentiality, integrity or availability would have limited adverse effect	NIST SP 800-53 Rev. 5 Low baseline plus FedRAMP parameters
Moderate	Most federal cloud use; serious adverse effect	Moderate baseline plus FedRAMP parameters
High	Law enforcement, emergency services, financial and health systems; severe or catastrophic effect	High baseline plus FedRAMP parameters

Core security expectations

A clearly defined authorization boundary covering all components that process federal data
FIPS 140 validated cryptography for data in transit and at rest
Multi-factor authentication, including phishing-resistant methods for privileged users
Comprehensive logging, monitoring and incident reporting to agencies and CISA
Vulnerability scanning and remediation within defined timeframes
Configuration baselines and change control
Supply chain risk management
Continuous monitoring with monthly deliverables

FedRAMP 20x

Under 20x, providers demonstrate a set of Key Security Indicators with automated, machine-readable evidence, aiming for faster authorizations and continuous validation. Providers planning a new authorization should check which path FedRAMP is currently accepting for their impact level.

How to get FedRAMP authorized: step by step

Confirm the market: identify target agencies and the impact level your data requires.
Choose a path: agency authorization (an agency sponsors you and grants an ATO) or the 20x path where available.
Define the boundary and build a government-ready environment if needed.
Run a readiness assessment, optionally through a 3PAO-led Readiness Assessment Report to reach "FedRAMP Ready".
Implement controls for the baseline and document them (SSP under Rev. 5, or machine-readable evidence under 20x).
Full security assessment by an accredited 3PAO.
Authorization review by the sponsoring agency and the FedRAMP PMO.
Listing on the FedRAMP Marketplace as authorized.
Continuous monitoring: monthly vulnerability scans and POA&M updates, annual assessments and significant change requests.

Documentation required

System security plan and attachments (policies, procedures, user guide, contingency plan, incident response plan, configuration management plan)
Control implementation summary and customer responsibility matrix
Security assessment plan and report from the 3PAO
Plan of action and milestones
Continuous monitoring deliverables
Under 20x: automated evidence of key security indicators in the required formats

Audit and assessment requirements

Assessments are performed by 3PAOs accredited under the FedRAMP programme. After authorization, providers undergo an annual assessment of a subset of controls, deliver monthly continuous monitoring data and request approval for significant changes. Agencies can suspend use of services that fail to meet continuous monitoring requirements.

Estimated implementation timeline

Traditional Rev. 5 Moderate authorization: commonly 12 to 24 months from start to ATO
Readiness work before assessment: 6 to 12 months for a provider without federal experience
FedRAMP 20x: designed to be faster for providers with automation-ready environments; timelines are still being established

Cost considerations

Engineering for a separate government environment and FIPS-validated components
Advisory support for readiness and documentation
3PAO assessment fees, initial and annual
Continuous monitoring staff and tools
Restrictions on tools and vendors that are not themselves authorized

FedRAMP is a significant investment and makes sense only with a credible federal sales pipeline.

Benefits of FedRAMP authorization

Access to federal agencies and listing on the FedRAMP Marketplace.
Reuse of the authorization by multiple agencies.
Credibility with state and local government and regulated industries.
A mature security programme built on NIST controls.

Risks of not being authorized

There are no fines. Without authorization, agencies generally cannot use your service for federal information, and resellers cannot include it in federal offerings.

Common mistakes

Pursuing FedRAMP without an agency sponsor or demand.
Underestimating boundary scope, including third-party services that also need authorization.
Using non-validated cryptographic modules.
Treating authorization as the finish line and failing continuous monitoring.
Planning on outdated paths and timelines during the 20x transition.

Challenges for IT companies

Maintaining separate commercial and government environments.
Restrictions on offshore personnel access to federal data.
Keeping up with programme changes under 20x.
Long sales cycles alongside high upfront cost.

Best practices and recommendations

Secure an agency partner before committing major investment.
Design for automation: infrastructure as code, policy as code and machine-readable evidence suit 20x.
Reuse SOC 2 and ISO 27001 controls, but expect gaps.
Build on authorized infrastructure providers to inherit controls.
Track fedramp.gov announcements monthly.

Tools and technologies that help

FedRAMP-authorized IaaS and PaaS platforms
OSCAL-based documentation and GRC tools
Vulnerability scanning and configuration compliance tools
SIEM with long retention and alerting
FIPS-validated cryptographic libraries and key management

Relationship with other compliance frameworks

FedRAMP and related frameworks
Framework	Relationship
NIST SP 800-53	The control catalogue behind FedRAMP baselines
FISMA	The law that requires agencies to secure systems, including cloud services they use
SOC 2	Commercial assurance; helpful preparation but not a substitute
ISO 27001	International certification; overlaps but is not accepted in place of FedRAMP

Real-world implementation examples

The following are illustrative composites based on common patterns, not named clients.

Collaboration SaaS

A SaaS vendor with an agency sponsor built a separate government environment on an authorized cloud platform, inherited about 40% of controls from the provider, and reached a Moderate ATO in 16 months.

Low-impact SaaS pilot

A small analytics vendor with heavily automated infrastructure pursued the 20x Low path, using policy-as-code outputs as evidence rather than writing a traditional SSP.

Frequently asked questions

Is FedRAMP mandatory?

For cloud services used by federal agencies to process federal information, yes. For other companies, no.

What is FedRAMP 20x?

A new FedRAMP approach announced in 2025 that uses key security indicators and automated, machine-readable evidence to make authorizations faster and continuous.

Is the Rev. 5 process ending?

FedRAMP has announced 11 June 2027 as the planned last date for new Rev. 5 authorization applications. Existing authorizations continue, and dates may change.

What are the FedRAMP impact levels?

Low (including the LI-SaaS tailored baseline), Moderate and High.

What is a 3PAO?

A Third Party Assessment Organization accredited to assess cloud services for FedRAMP.

Does the JAB still exist?

Under OMB M-24-15 the Joint Authorization Board was replaced by the FedRAMP Board, and authorizations now come through agencies or programme paths such as 20x.

How long does FedRAMP authorization take?

Under the traditional process, typically 12 to 24 months. 20x aims to shorten this.

Can non-US companies get FedRAMP authorized?

It is possible, but data location, personnel and supply chain requirements usually require US-based environments and staff.

What is FedRAMP Ready?

A designation showing a 3PAO has assessed a provider's readiness and FedRAMP has reviewed it. It is not an authorization.

Is FedRAMP the same as FISMA?

No. FISMA is the law requiring agencies to secure information systems; FedRAMP is the programme for authorizing cloud services agencies use.

Conclusion and next steps

FedRAMP is a demanding but valuable credential. During the 20x transition, the winners will be providers with automated, well-documented environments and a clear federal customer.

Validate demand and find an agency partner.
Choose the impact level and path.
Define the boundary and build on authorized infrastructure.
Prepare with a readiness assessment.
Plan for continuous monitoring from day one.

How we keep this guide up to date

We review this guide every three to six months during the 20x transition, and whenever OMB, GSA or the FedRAMP Board publish new policy, baselines or programme dates.