FedRAMP's 2026 overview video: FedRAMP certifies cloud services, and each agency still authorizes its own use

FedRAMP's short 2026 overview says the program certifies cloud services once so agencies can reuse the work, and each agency still authorizes its own use. Providers start with FedRAMP Certification. Agencies start at the FedRAMP Marketplace and must still issue their own authorization to operate.

By FedXchange · November 7, 2026

FedRAMP's video, on its governance tracker page. The player loads from YouTube only when you press play.

The Federal Risk and Authorization Management Program (FedRAMP) posted a short introduction to the program on October 7, 2026. It is a plain overview, not a rules update. Its main message is one line from the video: "We certify, agencies authorize."

In short:

What FedRAMP does. FedRAMP sets minimum security standards for commercial cloud services. It certifies a service once, so many agencies can reuse that work instead of each one checking the service on its own.
Agencies. The video tells agencies to search the FedRAMP Marketplace to find and compare certified services. A FedRAMP Certification does not replace the agency's own decision. Each agency must still authorize its own use of the service.
Cloud providers. The video calls FedRAMP Certification a provider's first step. FedRAMP stops taking applications for new certifications on Rev5, its older path based on Revision 5 of the National Institute of Standards and Technology (NIST) control catalog, on June 11, 2027. After that date, new providers can apply only through FedRAMP 20x, the newer path.
When. The FedRAMP Consolidated Rules for 2026 (CR26) become mandatory for everyone on January 1, 2027.

From FedRAMP Certification to an agency's authorization to operate

Sources: the video, and FedRAMP's guidance for agencies on initial agency authorization under CR26.

Read the steps as text

FedRAMP certifies the service. FedRAMP grants the FedRAMP Certification, and agencies can find the certified service on the FedRAMP Marketplace.
The agency defines its need. The agency starts with its own needs, categorizes its own system, and selects its own controls.
The agency compares certified services. The agency searches the Marketplace and reviews the provider's certification package.
The agency checks the provider's setup guide. The agency reads the provider's Secure Configuration Guide to confirm the service supports the agency's planned use.
The agency configures and tests its use. The agency sets up the service, tests its own controls, and documents them in its own system security plan.
The agency authorizes its system. The agency's authorizing official issues an authorization to operate (ATO) for the agency system and notifies FedRAMP.

What does "We certify, agencies authorize" mean?

It means FedRAMP and each agency do different jobs. FedRAMP checks a cloud service once and grants a FedRAMP Certification. An agency that wants to use the service still decides whether and how to use it in its own system, and issues its own authorization to operate (ATO).

The term changed under CR26. FedRAMP used to call its approval a "FedRAMP authorization." FedRAMP's What's Changing in 2026 page explains that many people read that term as a risk acceptance for the whole federal government, which it is not. FedRAMP now says "FedRAMP Certification" so the term is not confused with an agency's ATO under Office of Management and Budget (OMB) Circular A-130. The program's name still contains "Authorization."

The video says this shared approach saves time and money for agencies, which would otherwise spend significant resources checking cloud security on their own.

How should an agency use the FedRAMP Marketplace?

The video tells agency staff to start at the FedRAMP Marketplace, where they can search and compare certified services in one place.

FedRAMP's guidance on initial agency authorization says to start with the agency's needs, not the provider's controls. The agency should:

Categorize its own system and select its own controls first.
Treat the provider's certification package as presumptively adequate evidence for the provider's work, and ask questions where needed.
Document what the agency does in its own system security plan, and not copy the provider's package into it.
Not authorize a service with only a 20x Class A Certification for more than 12 months, unless the provider is actively seeking a Class B, C, or D Certification.

FedRAMP's page for agencies says law and OMB policy require agencies to follow FedRAMP's processes when they use cloud services. OMB Memorandum M-24-15 requires agencies to update their own policies to align with FedRAMP.

Where should a cloud provider start?

The video says FedRAMP Certification is a provider's first step. FedRAMP's guide to choosing a certification path describes two paths:

Program Certification comes directly from FedRAMP and needs no agency sponsor. It is the path for FedRAMP 20x Classes A, B, and C, and, for a limited time, for Rev5 Classes B and C.
Agency Certification needs an agency to authorize the service first and then sponsor it. It is available only for Rev5.

FedRAMP will stop accepting applications for new Rev5 certifications on June 11, 2027. Existing Rev5 certifications stay active until at least December 31, 2028, unless FedRAMP is directed otherwise.

Since the video was posted, FedRAMP has reached a milestone on the 20x path. Its November 2, 2026 blog post says FedRAMP granted the first full CR26 20x Class C Certification on October 29, 2026. The first 20x Class A Certification came on August 25, 2026.

What should agencies and providers do now?

Agency staff: use the Marketplace to find certified services, then follow FedRAMP's initial agency authorization steps. Your agency's ATO is still required.
Agency policy owners: check that agency cloud policy uses the CR26 terms and matches FedRAMP's processes, as M-24-15 requires.
New cloud providers: read FedRAMP's provider guidance and plan for 20x. New Rev5 applications end June 11, 2027.
Everyone: prepare for CR26 to become mandatory on January 1, 2027.

Sources

Share this post:LinkedIn X Email

A weekly email on Fridays, an alert on the day the watch finds something new, or both. Free.