Scope
This guide explains the new FedRAMP Program Certification path introduced through RFC-0023, specifically for Rev5 Class A, B, and C certifications available without agency sponsorship. It details implementation requirements, rollout timelines, and conversion criteria for existing FedRAMP Ready providers. This guide is for cloud service providers pursuing FedRAMP Rev5 authorization until the transition to FedRAMP 20x (planned for FY27 Q3-Q4).
This guide does NOT cover: Agency Authorization path requirements, Class D (High baseline) Program Certifications, or FedRAMP 20x specifications beyond their influence on Rev5 Balance Improvement Releases.
Key Concepts and Definitions
Program Certification vs. Agency Authorization
FedRAMP now offers two paths to obtain a FedRAMP Certification:
- Agency Authorization: The traditional path where a government agency sponsors the initial assessment and ongoing monitoring.
- Program Certification: FedRAMP conducts the initial assessment directly without an agency sponsor. This is available only to providers meeting specific criteria and adopting Balance Improvement Releases.
Certification Classes
FedRAMP is moving from impact level terminology to Certification Classes:
- Class A: Time-limited certifications for initial testing and piloting; replaces FedRAMP Ready Designation.
- Class B: Equivalent to historical FedRAMP Low/Li-SaaS requirements.
- Class C: Equivalent to historical FedRAMP Moderate requirements.
- Class D: Equivalent to historical FedRAMP High Baseline; requires agency sponsorship.
Balance Improvement Releases
These are optional requirements developed through FedRAMP 20x to reduce assessment review burdens. Adoption is mandatory for Program Certification eligibility but optional for Agency Authorization.
Critical Clarification: No FedRAMP Certification constitutes a government-wide authorization to operate. Agencies must still perform Risk Management Framework reviews and issue their own ATOs. FedRAMP aims to make this agency review faster, not eliminate it.
Requirements Breakdown
Stage 1: Class A Program Certifications (Available July 28, 2026)
Eligibility: Cloud services with FedRAMP Ready Designation.
Conversion Requirements:
- Meet updated Class A requirements (minor changes from FedRAMP Ready).
- Submit conversion application by July 28, 2026.
- Providers not converting will be labeled "Legacy FedRAMP Ready" and retired.
Submission Deadline: No new FedRAMP Ready submissions after July 28, 2026.
Stage 2: Class B and C Program Certifications
Eligibility Window: Must meet one criterion between January 1, 2025, and March 1, 2026:
- Listed as FedRAMP Ready on FedRAMP Marketplace.
- Listed as In Process on FedRAMP Marketplace.
- Completed FedRAMP Ready assessment with Readiness Assessment Report.
- Completed full FedRAMP assessment with Security Assessment Plan and Security Assessment Report.
Mandatory Requirements:
- Adopt all required Balance Improvement Releases.
- Meet criteria in FedRAMP Consolidated Rules for 2026 (available by June 30, 2026).
Timeline: Available until Rev5 retirement (planned FY27 Q3-Q4).
Stage 3: Expanded Class A Availability (Tentative)
Proposed Eligibility: Cloud service providers using external security frameworks 80%+ compatible with FedRAMP Rev5 requirements.
Status: Dependent on FedRAMP evaluation of Stage 1 and 2 impact using real-world metrics.
Additional Pipeline: GRC automation tools and services with proven agency demand may qualify for Class B and C certifications.
Implementation Guidance
For Current FedRAMP Ready Providers
- Review conversion requirements when published in Consolidated Rules for 2026.
- Assess gap between current FedRAMP Ready Designation and Class A requirements.
- Prepare conversion application before the July 28, 2026 deadline.
- Decide: Convert to Class A or accept Legacy FedRAMP Ready retirement.
For Providers Meeting Stage 2 Criteria
- Verify eligibility against the January 1, 2025 - March 1, 2026 window.
- Document qualifying status: Marketplace listing, RAR, or SAP/SAR completion.
- Review Balance Improvement Releases currently published.
- Assess implementation feasibility. If you can't adopt Balance Improvement Releases, pursue Agency Authorization instead.
- Wait for formal criteria publication before contacting FedRAMP.
For Providers Seeking Class D (High Baseline)
You must secure an agency sponsor. No Program Certification path exists for Class D.
Alternative approach: Pursue Class C Program Certification, then create an authorization package addendum documenting additional High baseline control implementations. Agencies with High security objectives can review this addendum when issuing their ATO.
Balance Improvement Release Adoption
These releases reduce FedRAMP's assessment review burden, making Program Certification feasible. If you can't implement them, you lack the maturity FedRAMP requires to maintain your certification without agency resources.
Non-negotiable: Balance Improvement Release adoption is mandatory for Program Certification. Providers unable to meet these requirements must use the Agency Authorization path.
Common Pitfalls
Misunderstanding FedRAMP Certification scope: A FedRAMP Certification doesn't authorize any agency to use your service. Agencies still must perform Risk Management Framework reviews and issue ATOs. Budget for agency engagement even with Program Certification.
Assuming "trusted assessor" requirements apply: RFC-0023 proposed this concept, but FedRAMP won't implement it. Public comment identified the risk of assessors losing trusted status mid-engagement, unfairly penalizing providers.
Treating FedRAMP Ready conversion as automatic: Conversion from FedRAMP Ready to Class A requires meeting updated requirements and submitting an application. Passive FedRAMP Ready listings become "Legacy FedRAMP Ready" and retire.
Expecting Stage 3 availability on a fixed timeline: Stage 3 Program Certifications depend on FedRAMP's evaluation of real-world Stage 1 and 2 metrics. Don't build business plans around tentative expansions.
Contacting FedRAMP before criteria publication: FedRAMP will publish all Stage 2 criteria, requirements, and application processes simultaneously to ensure fairness. Premature inquiries waste your time and FedRAMP's limited resources.
Ignoring machine-readable package requirements: While LPC-GEN-LMR wasn't implemented specifically for Rev5 Program Certifications, machine-readable authorization data remains critical for agency ATO velocity. GRC tools that ingest this data receive prioritization.
Quick Reference Table
| Certification Class | Baseline Equivalent | Program Cert Available? | Agency Sponsor Required? | Key Requirement |
|---|---|---|---|---|
| Class A | FedRAMP Ready (testing/pilot) | Yes (Stage 1, July 28, 2026) | No | FedRAMP Ready conversion |
| Class B | FedRAMP Low/Li-SaaS | Yes (Stage 2, criteria by June 30, 2026) | No | Balance Improvement Release adoption + Stage 2 eligibility |
| Class C | FedRAMP Moderate | Yes (Stage 2, criteria by June 30, 2026) | No | Balance Improvement Release adoption + Stage 2 eligibility |
| Class D | FedRAMP High Baseline | No | Yes | Traditional Agency Authorization |
Critical Dates:
- June 30, 2026: FedRAMP Consolidated Rules for 2026 published.
- July 28, 2026: FedRAMP Ready retirement; Class A Program Certifications available; last day for FedRAMP Ready submissions.
- December 31, 2026: All providers must comply with Consolidated Rules for 2026.
- FY27 Q3-Q4: Planned Rev5 retirement and transition to FedRAMP 20x Phase 5.
Stage 2 Eligibility Window: January 1, 2025 - March 1, 2026 (must have met at least one qualifying criterion during this period).
Bookmark the FedRAMP Consolidated Rules for 2026 when published. That document supersedes all preliminary guidance and establishes enforceable requirements through December 31, 2028.
