FedRAMP for Security Leaders: Authorization Paths and FedRAMP 20x

TL;DR: The Federal Risk and Authorization Management Program (FedRAMP) is how the U.S. government checks the security of cloud products before agencies put federal data in them. On the Rev 5 agency path, a provider and an agency partner move through preparation, authorization and continuous monitoring toward an Authority to Operate (ATO). An authorization is not an endorsement. FedRAMP 20x and the Consolidated Rules for 2026 are replacing Rev 5 guidance, which is now marked legacy.

What FedRAMP is and what an authorization means

The Federal Risk and Authorization Management Program (FedRAMP) is how the U.S. government checks the security of cloud products before agencies put federal data in them. It was established in 2011 to give agencies a cost-effective, risk-based way to adopt cloud services. It grew out of the Federal Information Security Management Act (FISMA), the law that protects the government's sensitive information.

The two regimes differ in how far an approval travels. A FedRAMP authorization can be reused by multiple agencies, while a FISMA authorization is agency specific. The FedRAMP Program Management Office (PMO) sits within the General Services Administration (GSA) and keeps a secure repository of authorizations so that security packages can be reused.

What "authorized" means

A cloud service offering (CSO) counts as FedRAMP-authorized once the PMO approves it for inclusion in the Marketplace. That status is easy to over-read. The governing guidance states that a FedRAMP authorization is not an endorsement of a product or service. It establishes something narrower: the product's security posture has been assessed and is presumptively adequate for use by Federal agencies.

What this means for a security leader

If your company sells cloud services, treat an authorization as a federal baseline that you have to keep earning. It is not a badge to use in sales copy. In our reading, a lapse in continuous monitoring is the quickest way to lose the main benefit, because the presumption that agencies rely on depends on it.

If you buy, the authorization does not move your control work onto the provider. Which controls belong to you, to the provider, or to both is set out in the Customer Responsibility Matrix (CRM) and Control Implementation Summary (CIS) inside the provider's package. Read those two documents before you accept the presumption for your own use.

For related terms, see the glossary. Other compliance walkthroughs are in our guides.

Who runs FedRAMP and who sets the rules

Three parts of government shape FedRAMP: a board that votes, a program office that runs the work day to day, and a standards body whose guidance the rules must follow. When a contract team asks who decided a requirement, the answer usually traces back to one of them.

The FedRAMP Board

The Board is the voting body for FedRAMP. It works directly with the FedRAMP Director and is made up of seven federal technology executives from different agencies who are selected by the Federal Chief Information Officer in the Office of Management and Budget, known as OMB.

Its core duty is rule-setting. The Board must establish and regularly update requirements and guidelines for security authorizations of cloud products and services, consistent with standards and guidelines from the National Institute of Standards and Technology (NIST). Those requirements are what an assessment is measured against.

The Board also has two quieter roles. It approves any new authorization path that the program office designs in consultation with OMB and NIST. In our reading, and it will proactively identify Federal agency IT leaders to form authorization groups so more agencies can sign off jointly.

The Program Management Office and the Director

The Program Management Office (PMO), part of the General Services Administration (GSA) as the previous section noted, supports agencies and cloud service providers through the FedRAMP authorization process. It also certifies the independent assessors: FedRAMP requires a Third Party Assessment Organization (3PAO), certified through GSA FedRAMP Program Management Office (PMO), to carry out initial and periodic assessments.

The FedRAMP Director holds signing and judgment powers. Program authorizations are signed by the FedRAMP Director. The Director also decides whether an agency's additional security needs merit conducting additional FedRAMP authorization work when an agency finds a package falls short.

NIST as the reference point

NIST does not run authorizations, but its standards set the boundaries for the Board's rules. FedRAMP then goes further for cloud: FedRAMP has additional, cloud-specific controls on top of the NIST guidance that FISMA systems follow.

In our reading, a security leader selling to federal buyers should track Board decisions as closely as any regulator's. A change there flows straight into the assessment your team will face. For how this sits alongside board-level oversight at your own company, see our glossary entry on board cybersecurity oversight.

How the Rev 5 agency authorization path works

The Rev 5 agency path is a partnership. In it, agencies work directly with a cloud service provider (CSP) for authorization, and the work runs in three phases: preparation, authorization and continuous monitoring. The agency's goal is to issue an Authority to Operate (ATO).

Phase 1: Preparation

Preparation can start with an optional Readiness Assessment. A third party assessment organization (3PAO) produces a Readiness Assessment Report (RAR). FedRAMP Ready is only available at the Moderate and High impact levels, lasts one calendar year and needs no agency partner.

The required step is pre-authorization. The CSP formalizes the partnership by sending an In Process Request (IPR) letter and work breakdown structure (WBS) to the FedRAMP intake address. Once FedRAMP has both from the agency, the offering can be listed as In Process on the FedRAMP Marketplace.

Before this point the CSP should have a system that is fully built and functional. FedRAMP's planning guidance asks for at minimum one technical writer, one technical subject matter expert and one project manager. It also prefers a Just-In-Time review approach, where the agency reviews each deliverable in turn so that problems surface before 3PAO testing.

After intake, FedRAMP opens its secure repository for Low and Moderate impact offerings. High impact offerings use their own organization's repository.

The phase ends with a kickoff meeting. The agenda covers the system architecture, authorization boundary, data flows, and core security capabilities, along with the customer responsible controls that must be implemented and tested by the agency.

Phase 2: Authorization

The agency playbook sets out this phase as a sequence:

1. Full security assessment by the 3PAO.
2. Agency review of the security authorization package.
5. Agency final review and ATO.

A security leader on the provider side should budget time for at least one round of fixes before the final review.

Phase 3: Continuous monitoring

The ATO starts an ongoing obligation. Each authorizing agency's work includes reviewing the monthly Plan of Action and Milestones (POA&M), approving deviation and significant change requests, and reviewing the annual assessment. In our reading, under the Rev 5 baselines, security control CA-7 requires CSPs with more than one customer agency to implement collaborative ConMon, which gives agencies one shared forum for these decisions.

FedRAMP Ready, In Process and Authorized compared

The FedRAMP Marketplace shows three designations. Each answers a different question for a buyer: has an assessor looked at the offering, is an agency working on it, and has an agency accepted the risk. Read them as separate signals, not as grades of the same thing.

What each designation tells a buyer

A Ready listing means an assessor has documented the offering's capability to meet federal security requirements. The Readiness Assessment Report (RAR) documents the CSP's capability to do so. It does not mean any agency has accepted the risk.

In our reading, an Authorized listing is narrower than many buyers assume. The initial agency partner is the first agency to grant an ATO, and its decision is not a government-wide risk acceptance. Office of Management and Budget (OMB) Circular A-130 requires agencies to individually authorize a system and accept the risk, so each new agency runs its own review and grants its own ATO.

The initial agency also does not carry oversight for everyone else. FedRAMP says it is not the initial authorizing agency's responsibility to conduct continuous monitoring oversight on behalf of other agencies.

How long each one holds

Ready carries a fixed term from the date of designation, set out in the earlier section on the Rev 5 path. In our reading, an Authorized listing stays meaningful only while agencies keep reviewing the provider's continuous monitoring, as covered earlier. An In Process listing reflects work under way, and in our reading its age is worth asking about.

What to check before relying on a listing

• For Ready, confirm the designation date and whether the term has run out.
• For In Process, ask which agency is the partner and where the package stands.
• For Authorized, ask which agency granted the ATO and plan your own risk review regardless.

In our reading, Package quality affects the first agency most. FedRAMP notes the initial review may take longer and require more effort if parts of the package are unclear or incomplete. We think a buyer who is the first agency should budget review time with that in mind.

What FedRAMP 20x and the Consolidated Rules for 2026 change

FedRAMP is moving its rulebook. The Rev 5 pages that described the agency path now sit under a legacy address, and newer material is published as the Consolidated Rules for 2026. For a security leader, the date on a FedRAMP page now matters as much as what the page says.

Rev 5 material is for reference only

The legacy pages carry a banner: "This page contains legacy content for reference only!" (FedRAMP). A notice dated June 24, 2026 says all materials in the legacy documentation site are intended only for reference during the transition (FedRAMP). The same notice warns that humans and AI services must take care when referencing content under the legacy path. In our reading, that warning applies to the internal wikis and AI assistants your team uses to summarize requirements.

Rev 5 still changes, in small steps

Version 4.1 of the agency playbook, dated 11/17/2025, was updated to reflect new Rev 5 Balance Improvement Releases (BIRs) (FedRAMP playbook). FedRAMP says it will limit updates to current Rev 5 processes, guidance documents and templates. It will fold 20x standards that apply to Rev 5 into the BIR initiative, and each BIR goes through beta testing with volunteer cloud service providers and agencies before wide release (FedRAMP playbook). In our reading, a Rev 5 package started now may have to absorb a BIR before it closes.

The vocabulary is shifting

The 2025 playbook states: "There are no other FedRAMP recognized designations." (FedRAMP playbook). The 2026 agency pages use the term FedRAMP Certified. They say certification gives agencies reusable security information but does not replace the agency's own continuous monitoring program (FedRAMP). They also tell agencies to monitor the provider's change process instead of trying to approve every individual change (FedRAMP).

We think contracts, vendor questionnaires and board reports that use either set of terms should name the page and date they rely on.

Dates reported outside fedramp.gov

Advisory firm A-LIGN reports that FedRAMP will stop accepting new Rev 5 certification applications on June 11, 2027. It also reports that under 20x, providers no longer need an agency sponsor to pursue Low-impact authorization (A-LIGN). Confirm both against fedramp.gov before building a plan on them.

Before you plan

The playbook tells readers to follow the Community Working Group (CWG) discussion forum for 20x and the FedRAMP changelog for the most recent updates (FedRAMP playbook). Put both on someone's weekly list. For related terms, see the glossary.

What a SaaS company commits to after it is authorized

Authorization starts a working relationship that runs for as long as federal customers use the service. The provider's ongoing duties are written mostly as agency expectations, so a SaaS security leader has to read them from the other side of the table.

The authorization only holds if monitoring continues

The value of the package to the next agency depends on upkeep. OMB guidance says the presumption of adequacy applies as long as a FedRAMP authorization is actively maintained through ongoing requirements, meaning continuous monitoring. If the monthly evidence stops, so does the reuse argument.

Agencies are told to review ongoing FedRAMP Certification Data, check Ongoing Certification Reports for changes that affect the risk tolerance in their Authorization to Operate, and review vulnerability information at intervals that suit their system, using automated processing when possible. In our reading, that means a provider should publish its monitoring data in a form machines can parse, not in screenshots.

Collaborative continuous monitoring is a people commitment

The rules ask agency security teams to build working relationships with provider security teams based on mutual trust, clear expectations and timely communication. Agencies are also expected to keep contact paths that survive staff turnover. We think the provider should match that: a named shared mailbox, an escalation list and a standing review slot, not one account manager's phone number.

The traffic runs both ways. An agency should notify the provider and FedRAMP when certification information raises significant concerns for its authorizing official. Agencies should also avoid placing additional security requirements on the provider unless they have a demonstrable need and follow the FedRAMP notification process. A provider can point to that rule when a single customer asks for bespoke questionnaires.

Reuse by other agencies and by inheriting offerings

The package travels. Its assessed controls should be presumed adequate when built into a broader authorization for another cloud offering. When a system inherits controls this way, each agency using the downstream offering must understand and monitor the inherited package where it affects its use. Your evidence therefore reaches readers you never signed a contract with.

The stakes for those readers are real. FedRAMP says it commonly sees Inspectors General and the Government Accountability Office issue findings against agencies that do not monitor their cloud services properly. In our reading, a provider whose data is clear and on time makes it easier for an agency to show it is monitoring, and that helps the sales cycle at the next agency.

If adoption spreads widely, a program authorization may be used for services that have become widely adopted by agencies to centralize oversight. Track your agency count. It can change who oversees you.

What an agency still owns when it buys a FedRAMP service

FedRAMP evidence comes from the provider, but the authorization decision stays with the agency. Under the 2026 rules, agencies are responsible for monitoring the federal information systems they authorize, including any FedRAMP Certified cloud service offerings those systems use. If an agency does not monitor an offering in line with FedRAMP rules and its own program, the agency must accept the risk of not doing so.

That sentence matters for a buying-side security leader. Skipped monitoring does not move back to the provider or to FedRAMP. It stays as accepted risk on the agency's books.

What stays on the agency's side

The rules name duties that provider assurance does not replace: monitoring agency-managed configurations, reviewing logs, managing agency accounts, maintaining agency Plans of Action and Milestones (POA&Ms), and keeping the system within the agency's risk tolerance.

The rules tell agencies to review provider Secure Configuration Guides and keep agency-managed settings aligned with the authorization. They also limit agency POA&Ms to risks, decisions, and actions the agency is responsible for managing or accepting.

How to read FedRAMP's own monitoring

FedRAMP runs a minimum standard level of continuous monitoring. That monitoring checks whether the provider still meets certification requirements, and the rules call it shared provider evidence. The agency still decides how that evidence affects its authorization and whether the offering remains appropriate for its use.

When the presumption of adequacy can be set aside

The memo also says the presumption does not supersede agency heads' authority under the Federal Information Security Modernization Act of 2014 (FISMA).

An agency can overcome the presumption in two cases. It can show a demonstrable need for added requirements, or it can find the package "wholly or substantially deficient for the purposes of performing an authorization". If new authorization work follows, the agency must document the reasons in the new package and inform the FedRAMP Program Management Office.

A practical check before audit season

Earlier sections covered inherited packages and the auditors who write findings here. We think a short register goes a long way. For each cloud offering, record a named agency owner, the date of the last certification data review, the agency settings tied to the configuration guide, and any POA&M items the agency owns. A register like that makes it clear which risks the agency monitors and which it has chosen to accept.

Practical steps before you commit to an authorization

Settle these questions before you sign a statement of work. In our reading, each one is cheaper to answer in a planning meeting than halfway through an assessment.

1. Which impact level does your data need?

Start with the data, not the sales target. The Rev 5 path asks a cloud service provider to determine the security categorization of the data it will hold, using the Federal Information Processing Standards (FIPS) 199 template and a National Institute of Standards and Technology (NIST) publication. Do this with the federal buyers you expect, so the baseline matches what they will place in the system.

2. Is FedRAMP Ready worth the cost?

FedRAMP Ready is only available at the Moderate and High impact levels, so a Low categorization rules it out. If you qualify, the Readiness Assessment Report can serve as a self assessment that shows where your security gaps are. We think that gap view is the main return for a team that has not yet sized the work.

3. Do you have an agency partner, and are you ready for one?

Agency Liaisons can help answer questions about how to secure partnership at their agencies. Tell your partner plainly that its effort as the first reviewer depends on the quality of the authorization package.

4. Which third party assessment organization (3PAO)?

Shortlist from the FedRAMP Marketplace, which lets readers research FedRAMP recognized 3PAOs. Check your own marketing at the same time. The playbook states that there are no other FedRAMP recognized designations beyond Ready, In Process and Authorized, so any wording that implies a status you do not hold should come out before an agency sees it.

5. Who staffs continuous monitoring?

Budget people, not just tooling. Each authorizing agency reviews the monthly Plan of Action and Milestones (POA&M), approving deviation requests and significant change requests and the annual assessment. Once you add a second agency, control CA-7 requires CSPs with more than one customer agency to implement collaborative ConMon. Name an owner for that forum before the second customer arrives.

6. Which rules are you planning against?

Legacy guidance is marked as intended only for reference during the move to the Consolidated Rules for 2026.

What this guide does not cover

This guide does not walk through the individual security controls in each impact baseline, assessment costs, or how to pick a specific assessor or cloud provider. It describes what FedRAMP rules and guidance say. It is not legal or financial advice, so confirm requirements and dates on fedramp.gov before you commit. For the rules and the record behind it, see SEC Item 1.05 Materiality Decision Guide: Is This Incident Reportable?.