Menu
Key facts
- Controls
- Profile-specific: the applicable requirements depend on the FedRAMP Certification type, class, and path
- Recertification cycle
- Ongoing Certification under the selected profile; no single cycle describes every 2026 path
- Ongoing oversight
- Profile-specific monitoring and Ongoing Certification Reports under the Consolidated Rules for 2026
- Public registry
- FedRAMP Marketplace ↗
- Common gap categories
- Authorization boundary definition; Continuous monitoring program (CA-7); Incident response (IR); Configuration management (CM); Supply chain risk (SR)
- Related standards
What is FedRAMP?
The Federal Risk and Authorization Management Program is the US government-wide program for standardized assessment and certification of cloud service offerings used by federal agencies. The Consolidated Rules for 2026 use FedRAMP Certification profiles defined by a certification type, class, and path; agencies still make their own Authorization to Operate decisions for federal information systems that use those services.
Is FedRAMP a certification or an attestation?
FedRAMP now calls its cloud-service outcome a FedRAMP Certification, replacing the former 'FedRAMP authorization' terminology. FedRAMP does not grant an agency Authorization to Operate or accept risk for an agency. The agency Authorizing Official makes the ATO decision for the federal information system that uses the certified cloud service.
Who needs FedRAMP?
Cloud service providers whose offering will be used by a US federal agency and falls within FedRAMP scope. FedRAMP requires a federal agency use case; a company does not need a FedRAMP Certification merely because it sells other products or services to the government.
What does FedRAMP cost and how long does it take?
The Consolidated Rules for 2026 define multiple certification types, classes, and paths rather than one universal project. Scope the target profile, assessment path, package, implementation work, and ongoing certification duties before requesting a price or schedule; historical Low, Moderate, and High estimates do not describe every current path.
FedRAMP launched the Consolidated Rules for 2026 on June 24, 2026. Adoption is transitional through January 1, 2027, and application pipelines open on different dates by certification profile. Recheck the current rules and timeline before scoping an engagement.