FedRAMP, explained in the 10 minutes you actually have
I'm an engineer who has built AI systems inside classified environments but had never once approached the U.S. government from the outside. This page is what I wish I'd found on day one: the shortest honest path to understanding FedRAMP — as it works today, not as it worked when most blog posts were written. Every claim is cited to an official source, and the numbers in the companion tool are computed from FedRAMP's own published data, not typed in by hand.
First: most of what you'll google is now wrong
FedRAMP rebuilt its rules in mid-2026. The Consolidated Rules for 2026 went live on June 25, 2026, capping a modernization effort called FedRAMP 20x that GSA kicked off in March 2025. Three things you'll still read everywhere that are no longer true:
“You need an agency sponsor”
No longer required. FedRAMP now reviews and certifies directly — 20x has no sponsor requirement, and even the legacy path gained sponsor-free certifications in February 2026.
That's why this site leans on FedRAMP's machine-readable sources — the same data that powers the official Marketplace and the rules themselves, published as JSON — so the numbers stay current even when the prose around them ages.
What FedRAMP is, in three sentences
FedRAMP (the Federal Risk and Authorization Management Program) is the U.S. government's single security-approval program for cloud services, written into law at 44 U.S.C. §§ 3607–3616 and run out of GSA. The deal: a cloud provider proves its security once, and every federal agency can then reuse that approval instead of re-assessing from scratch — the law even gives reuse a formal “presumption of adequacy”. The public record of who's approved, in process, and reusable lives on the FedRAMP Marketplace — which is what the companion tool draws from.
Who's who (five parties, one goal)
You — the CSP
Cloud Service Provider
Build and operate the service, implement the security requirements, produce the (now machine-readable) evidence.
The assessor — 3PAO
Third-Party Assessment Organization
An accredited independent firm that tests your claims before FedRAMP sees them.
FedRAMP (PMO at GSA)
Sets the standards, runs the reviews and the Marketplace — your primary counterpart under the 2026 rules.
The fork in the road: legacy Rev5 vs. FedRAMP 20x
Two systems are running side by side while the program transitions — and the clock on the old one is public. If you're starting fresh, you are almost certainly choosing between them right now, which is why the difference is worth two of your ten minutes.
| Rev5 (legacy) | FedRAMP 20x (current) | |
|---|---|---|
| Philosophy | “Documented plans” — prove security with narrative packages against NIST SP 800-53 controls | “Measured outcomes” — prove security with validated, largely automated evidence against Key Security Indicators |
| Scope of work | 156 / 323 / 410 controls at the Low / Moderate / High baselines | KSI indicator sets that vary by certification class — the KSI Quest tab renders them straight from the rules file |
| The package | Word/PDF System Security Plan, assessment reports, POA&M | Machine-readable (JSON) digital packages |
| Sponsor | Historically required an agency partner to issue the ATO | None required |
| Availability | Closing: no new Rev5 certifications after June 11, 2027 | Class A open since Aug 3, 2026; Classes B & C scheduled for Aug 31, 2026 |
The dates that matter (computed live, so they can't go stale)
- Mar 24, 2025 GSA announces FedRAMP 20x
- Jul 2025 first 20x pilot authorizations issued
- Jun 25, 2026 Consolidated Rules for 2026 launch; 20x becomes the standard path
- Aug 3, 2026 Class A submission pipeline opens
- Aug 31, 2026
- Jan 1, 2027
- Jun 11, 2027
What does it cost? Honest answer: there are no official figures — FedRAMP considered requiring assessment-cost reporting and decided against it (RFC-0019, “Not Implemented”). Industry estimates for a traditional Rev5 effort commonly land anywhere from the mid six figures to a few million dollars all-in — treat those as vendor marketing, not gospel. 20x is expected to cost less mostly because it automates evidence; it's too new for reliable numbers.
Certification Classes: A, B, C, D
The 2026 rules organize certifications into classes of increasing assurance — “minimal assurance at Class A to significant assurance at Class D”. They loosely echo the old Low/Moderate/High impact levels, but the official definitions are what count. A rough, honest guide:
Which sounds most like your service? (a study aid — the official class definitions decide, not this page)
Look at Class A
FedRAMP describes Class A as the entry tier for organizations with mature security programs that are new to the federal marketplace — minimal assurance, fastest on-ramp. Its pipeline opened August 3, 2026.
Look at Class B
Aimed at small-scale, light-use services (the territory the old Low baseline covered). Available via 20x from August 31, 2026, and via Rev5 until it sunsets.
Look at Class C
The workhorse tier for common enterprise services (roughly the old Moderate territory, where most of the marketplace lives — see the live data). Available via 20x from August 31, 2026, and via Rev5 until sunset.
Key Security Indicators — the heart of 20x
A KSI flips the old model. Instead of writing a narrative explaining how you plan to be secure, each indicator is a concrete security outcome you demonstrate — with largely automated, machine-readable evidence, validated continuously rather than re-audited yearly. The KSI standard was adopted in May 2025 (RFC-0006) and is now the backbone of every 20x certification class.
You don't have to take this page's word for what the catalog contains: the companion tool's KSI Quest tab renders the official rules file itself — every family and indicator, fetched from FedRAMP's machine-readable rules repository. Tick indicators you believe you already meet to get a feel for the surface area — it's a study aid, not an assessment; only a real review decides.
Sources for this page
Numbered in order of first citation above; each superscript links to its entry here. The full registry, verification dates, and method notes live on the Sources & method page.