FedRAMP is the U.S. government program that standardizes security assessment for cloud services used by federal agencies. In 2026 the program changed more than at any point since it started: new terminology, a new primary path (FedRAMP 20x), new certification classes, and a defined end date for new Rev5 applications. Much of the guidance online, including many "FedRAMP authorization playbooks," predates these changes.
This guide walks through the current FedRAMP authorization types, the steps of the process, how to define your authorization boundary, and the practical decisions that determine how hard the journey will be.
What is FedRAMP authorization?
FedRAMP (the Federal Risk and Authorization Management Program) provides a standardized way to assess and monitor the security of cloud products so that multiple agencies can reuse one assessment. The FedRAMP Authorization Act, enacted in December 2022 in the FY2023 National Defense Authorization Act, put the program into law.
The law defines a FedRAMP authorization as a certification that a cloud product or service has completed a FedRAMP authorization process. Under the Consolidated Rules for 2026, FedRAMP now calls this a FedRAMP Certification, to keep it distinct from an agency's own Authorization to Operate (ATO). Agencies still issue their own ATOs; see our companion guide on FedRAMP ATO.
FedRAMP authorization types in 2026
By certification type
- FedRAMP 20x: the modernized approach, now widely available. It focuses on measurable, reusable, automation-friendly evidence.
- FedRAMP Rev5: the legacy approach based on NIST SP 800-53 Rev. 5 baselines. New Rev5 applications will not be accepted after June 11, 2027; existing Rev5 certifications remain active until at least December 31, 2028.
By certification path
- Program Certification: granted directly by FedRAMP with no agency sponsor required. Required for 20x; only available for Rev5 in two limited 2026 pipelines (Ready Conversion and Lost Sponsor, Classes B and C).
- Agency Certification: an agency authorizes the service first and sponsors it. Only for Rev5, and generally required there.
By class
FedRAMP replaced the Low/Moderate/High impact levels with Certification Classes A, B, C, and D. For 20x, Classes A–C are available now and Class D is expected in 2027. For Rev5, Classes B and C (generally via agency) and D (agency only) apply.
Historical types you will still see
- JAB P-ATO: discontinued after the JAB was replaced by the FedRAMP Board in 2024.
- FedRAMP Ready: became legacy on July 28, 2026; no new Ready submissions.
- FedRAMP Tailored (LI-SaaS): an older low-impact SaaS baseline; check current applicability on fedramp.gov.
FedRAMP Ready vs Authorized
FedRAMP Ready meant a 3PAO readiness assessment had been reviewed and the provider was considered likely to achieve authorization. It was not an authorization and agencies could not rely on it as one. FedRAMP Authorized (now FedRAMP Certified) means the service completed the full process. With Ready now legacy, providers that recently achieved Ready may be eligible for the Ready Conversion pipeline toward a Rev5 Class B or C Program Certification.
FedRAMP authorization steps
FedRAMP describes three phases: Preparation → Initial Implementation → Ongoing Certification. In practice:
Step 1: Decide whether FedRAMP is right for you now
FedRAMP is a significant investment in engineering, documentation, assessment, and ongoing operations. Validate federal demand first.
Step 2: Choose your type, path, and class
Your path mostly follows from your choices: pursuing 20x means Program Certification; having an agency sponsor for Rev5 means Agency Certification. Pick the class that matches the federal data and use cases you plan to support.
Step 3: Define the authorization boundary
The boundary is the set of components, services, people, and data flows that make up the offering. (More below.)
Step 4: Build and automate the security program
Implement controls, and invest in tooling that produces evidence automatically. The 2026 rules move certification packages from Word/Excel templates to simplified JSON (or optional OSCAL), and the old System Security Plan concept is replaced by a Certification Package Overview and Security Decision Record. FedRAMP also removed most FedRAMP-defined organizational parameters from the SP 800-53 baselines and expects providers to define their own.
Step 5: Assessment
Rev5 assessments are performed by an accredited 3PAO. 20x relies on validation of measurable evidence; follow fedramp.gov/20x for current assessment requirements.
Step 6: Certification and agency use
After certification, agencies review the package and issue their own ATOs.
Step 7: Ongoing Certification
What used to be called continuous monitoring is now Ongoing Certification, and it is broader than monthly scans: vulnerability detection and response, change management, and incident reporting. POA&Ms are replaced with a list of accepted weaknesses. Failing these requirements can lead to loss of certification.
FedRAMP authorization boundary and boundary diagrams
The authorization boundary defines everything in scope: compute, storage, networking, management tools, personnel access, and every connection to external services that handle federal data. An authorization boundary diagram shows these components and the data flows across the boundary.
Common boundary mistakes:
- Leaving out support tools (ticketing, logging, CI/CD) that touch federal data or metadata.
- Undocumented data flows to subcontractors, partners, or SaaS tools.
- File transfers that leave the boundary by email or consumer file shares.
- AI services or agents that receive federal data without being in scope.
A smaller, well-defined boundary with few, controlled data flows is easier to assess and operate.
Building your FedRAMP authorization playbook
A practical internal playbook covers:
- Ownership: an executive sponsor and a dedicated compliance lead.
- Scope decisions: offering, class, path, and boundary, written down early.
- Architecture review: remove unneeded components and data paths before mapping controls.
- Evidence automation: logging, configuration management, and vulnerability data feeding your package automatically.
- Vendor and data-flow inventory: every external service and how federal data reaches it.
- Assessment readiness: internal dry runs before the formal assessment.
- Ongoing operations: staffing and tooling for Ongoing Certification from day one.
- Rule tracking: someone owns watching fedramp.gov for changes, given the 2026–2027 deadlines.
FedRAMP also publishes official guidance for agencies and providers; use fedramp.gov as the source of truth over third-party playbooks.
FedRAMP secure file sharing
Teams searching for a "FedRAMP secure file share" usually need to move files with agencies or contractors inside an authorized environment. Use services that are FedRAMP certified at the right class for the data involved and covered by your agency's ATO, or run file exchange inside your own authorization boundary. Avoid tools outside the boundary for federal data.
How Stellarbridge fits
Stellarbridge is not FedRAMP certified and is not a FedRAMP consulting or assessment service. Its relevance is the data-movement layer that FedRAMP boundaries depend on. Stellarbridge provides governed storage and transfer with a policy engine that decides allow, deny, or human approval before a file moves; distinct identities for people, API keys, and AI agents; encryption in transit and at rest; and audit trails and chain-of-custody reports that can be exported to a SIEM. Its self-hosted deployment keeps files, policy decisions, and audit records on infrastructure you operate, so they can sit inside your own boundary.
If you are designing how sensitive files move inside a federal program, see how authorization boundaries shape cloud architecture or talk to the team.
FAQ
What is the FedRAMP authorization process?
Preparation (choose type, path, class, and define the boundary), Initial Implementation (implement controls, assess, submit the package), then Ongoing Certification. Agencies then issue their own ATOs.
What are the FedRAMP authorization types?
In 2026: certification types 20x and Rev5; paths Program Certification and Agency Certification; and Classes A–D. The JAB P-ATO and FedRAMP Ready are now historical.
How to achieve FedRAMP authorization?
Confirm federal demand, choose 20x or Rev5, define a tight boundary, automate evidence, complete assessment, submit the package, and resource Ongoing Certification.
What is the difference between FedRAMP Ready and FedRAMP Authorized?
Ready meant a readiness assessment was accepted; Authorized (now Certified) means the full process is complete. Ready became legacy on July 28, 2026.
What is a FedRAMP authorization boundary?
The defined set of components, people, and data flows in scope for the offering, documented in an authorization boundary diagram.
What is the FedRAMP Authorization Act?
The December 2022 law, part of the FY2023 NDAA, that codified FedRAMP and defines a FedRAMP authorization.