FedRAMP in 2026: Certified replaces Authorized, Ready is retired, 20x goes live

FedRAMP is the one framework in a vendor review where the public source is better than anything the vendor can send you. The Marketplace publishes a machine-readable data file with every cloud service offering, its status, its impact level, its authorising agency and its assessor, and CertReports mirrors it every night as registry-verified rows. In 2026 the programme rewrote its rulebook. The Consolidated Rules for 2026 took effect on 4 July 2026, "FedRAMP Certified" replaced "FedRAMP Authorized" as the official label, and "Ready" became a legacy status on 28 July 2026. This article explains the statuses as they stand, the classes that replaced impact levels, and what 20x changes for a buyer.

4 Jul 2026

Consolidated Rules for 2026 in force

Enforcement for all providers from 1 January 2027

561

FedRAMP rows in the CertReports index

All registry-verified from the Marketplace file, 18 September 2026

502

services listed on the Marketplace in early 2026

Knox Systems, FedRAMP Marketplace explained

The 2026 vocabulary

The programme adopted "certification" because the underlying statute defines a FedRAMP authorization as a certification that a cloud product has completed the FedRAMP process, and because "authorization" was routinely confused with an agency’s own authority to operate. A provider that was FedRAMP Authorized in June became FedRAMP Certified in July with the same controls and the same boundary. Impact levels became certification classes, the system security plan became a certification package overview and security decision record, and continuous monitoring became ongoing certification, with loss of certification as the consequence for lapses.

The law defines a "FedRAMP authorization" as "a certification that a cloud computing product or service has completed a FedRAMP authorization process."

Reading the Marketplace file

The Marketplace data file carries one row per cloud service offering. The fields a buyer reads first are the status, the class or impact level, the certifying or authorising agency, the third-party assessment organisation (3PAO), and the certification date. CertReports records all of them verbatim and links the agency and the assessor to their pages. The status text on a row is whatever the Marketplace published at the last sync; during the transition some rows still carry legacy wording and the index shows it as published rather than rewriting it.

Classes and control baselines

What 20x changes

• Key Security Indicators replace much of the narrative package; vendors publish machine-readable evidence that assessors and agencies validate continuously.
• 20x moved from pilots to a permanent programme in 2026, with the submission pipeline opening in the final quarter of the federal fiscal year.
• The "Ready" designation lost its purpose once certification could be reached faster, which is why it became legacy in July 2026.
• The Marketplace stays the source of truth. CertReports keeps recording the status, class, agency and assessor exactly as the data file states them.
• Rev5 remains the control baseline for existing certifications; 20x changes how evidence is produced and checked, not what the controls are.

FedRAMP 20x is a comprehensive overhaul of the program that will deliver a new approach to authorization based on automation, transparency, and continuous validation.

How to read a FedRAMP row on CertReports

1. 1

   Status and class

   Both come from the data file. Certified is the bar; In Process is intent. A class C certification does not cover class D data.

2. 2

   Agency and assessor

   The 3PAO is the assessor; the agency is who accepted the risk. Both link to their pages in the index.

3. 3

   The service, not the company

   FedRAMP certifies cloud service offerings. Confirm the product on your order form is the one listed.

4. 4

   Date

   The row shows when the Marketplace last listed the status. Browse everything on the FedRAMP registry mirror.

Timeline to keep on file