FedRAMP
Federal Risk and Authorization Management Program (FedRAMP), including FedRAMP 20x and Rev5
FedRAMP sets the security requirements federal agencies rely on when they use cloud services. Its Consolidated Rules for 2026 (CR26) use the term certification and sort cloud offerings into classes: Class A (pilot), Class B (Low) and Class C (Moderate), with Class D (High) to be developed in FedRAMP 20x Phase 4. Providers certify on one of two paths: Rev5, built on NIST SP 800-53 Rev. 5 control baselines, or FedRAMP 20x, which measures Key Security Indicators with automated validation. CR26 became optional on July 4, 2026 and is mandatory from January 1, 2027, and FedRAMP will stop accepting new Rev5 Certifications on June 11, 2027. On 5 November 2026 fedramp.gov listed 36 FedRAMP 20x certified services out of 554 certified services.
Who it applies to
Federal agencies that use cloud services, which must follow the processes and rules FedRAMP establishes; cloud service providers seeking FedRAMP Certification to sell to agencies; and the independent assessors and advisors that work with them.
Identity requirements
- KSI-IAM-APM: use secure passwordless methods for user authentication and authorization when feasible, otherwise strong passwords with phishing-resistant MFA
- KSI-IAM-AAM: manage the lifecycle and privileges of all accounts, roles and groups securely using automation
- KSI-IAM-ELP: use and persistently review identity and access management measures so each user or device can only access the resources they need
- KSI-IAM-JIT: use a least-privileged, role and attribute-based, just-in-time authorization model, persistently reviewed, for all user and non-user accounts and services
- KSI-IAM-SNU: use appropriately secure authentication for non-user accounts and services, and review it persistently
- KSI-IAM-SUS: disable or otherwise secure accounts with privileged access in response to suspicious activity
- Rev5 path: include the NIST SP 800-53 Rev. 5 controls listed for the class in the Security Decision Record; the Class B list includes IA-2, IA-2(1), IA-2(2), IA-2(8), IA-2(12), IA-5 and IA-8 among others
How it impacts identity systems
| Identity area | Impact |
|---|---|
| Authentication & MFA | For 20x certifications, the identity indicators make passwordless the default and phishing-resistant MFA the fallback for user authentication, so phishable factors such as SMS codes do not meet the indicator. |
| Privileged access (PAM) | Just-in-time authorization for all user and non-user accounts, and automatic securing of privileged accounts on suspicious activity, are stated indicators rather than optional enhancements. |
| Identity governance (IGA) | Account lifecycle and privilege management must be automated, and least privilege must be persistently reviewed for every user and device. |
| Audit, logging & accountability | 20x Class C providers must validate each Key Security Indicator with at least two automated methods and keep the certification package current at least every two weeks. |
Upcoming deadlines
- January 1, 2027 FedRAMP: Consolidated Rules for 2026 become mandatory
- June 11, 2027 FedRAMP: last day for new Rev5 certification applications
Penalties
FedRAMP does not set fines. Its rules bind through federal procurement: agencies must follow FedRAMP processes when they use cloud services, and the CR26 agency rules say agencies should not authorize a Class A certified offering for more than 12 months unless it is pursuing Class B, C or D certification.
Status and dates last verified against primary sources on 2026-11-05.
FedRAMP: frequently asked questions
- Does FedRAMP require phishing-resistant MFA?
- For FedRAMP 20x, the Key Security Indicator KSI-IAM-APM requires secure passwordless methods when feasible and otherwise strong passwords with phishing-resistant MFA. Rev5 certifications are assessed against NIST SP 800-53 Rev. 5 baselines, which include the IA-2 multi-factor authentication enhancements.
- When does FedRAMP stop accepting Rev5?
- FedRAMP will stop accepting applications for new Rev5 Certifications on June 11, 2027, according to the CR26 timeline and the FedRAMP 20x page. FedRAMP says it will publish a transition path and timeline for existing Rev5 offerings by the end of 20x Phase 5.
- What is the difference between FedRAMP 20x and Rev5?
- Rev5 certifications document and assess NIST SP 800-53 Rev. 5 controls. FedRAMP 20x certifications are built around Key Security Indicators that providers demonstrate with automated, persistent validation; at Class C each indicator needs at least two automated validation methods.