FedRAMP explains its new terms: FedRAMP Certification, not authorization, and Certification Classes, not impact levels

In a May 2026 video, FedRAMP speakers explained why FedRAMP certifies cloud services while agencies authorize their use, and why Classes A to D replaced the Low, Moderate, and High labels. Agencies still categorize their own systems and pick a class that fits their use.

By FedXchange · May 27, 2026

FedRAMP's video, on its governance tracker page. The player loads from YouTube only when you press play.

On May 27, 2026, the Federal Risk and Authorization Management Program (FedRAMP) posted a video about two changes in its terms. FedRAMP speakers explained why FedRAMP calls its approval a certification, not an authorization, and why it moved from impact levels to a class system on the FedRAMP Marketplace. The video came out before FedRAMP issued the FedRAMP Consolidated Rules for 2026 (CR26) on June 25, 2026. The terms it describes are now the current terms: "FedRAMP Certification" and "FedRAMP Certified."

In short:

What FedRAMP said. FedRAMP does not authorize agency systems. It certifies cloud services, so each agency's authorizing official has the information to decide whether to use one. The speakers also said FedRAMP is moving away from the security categories of Federal Information Processing Standard (FIPS) 199 for its baselines and using Classes A to D instead.
Who it affects. Agency authorizing officials and the staff who support them, and cloud service providers listed on the Marketplace.
What they should do. Use the current terms. Agencies still categorize their own systems and choose a certified service whose class fits their use.
When. FedRAMP's May 4, 2026, public preview said it had already changed the Marketplace's impact levels to classes. CR26 becomes mandatory for all FedRAMP stakeholders on January 1, 2027.

How FedRAMP's old baseline labels map to Certification Classes

Source: FedRAMP Notice 0004 (February 25, 2026). FedRAMP said it would not use the term "levels" or numbers for the new labels.

Read the steps as text

Class A. A new class, with no old label. FedRAMP called it a new pilot baseline.
Class B. Includes the old Low-Impact Software as a Service (LI-SaaS) and Low baselines.
Class C. Includes the old Moderate baseline.
Class D. Includes the old High baseline.

Why does FedRAMP say "certification" instead of "authorization"?

A speaker said FedRAMP's purpose is to create a standard, reusable process so an agency authorizing official has enough information to decide whether to use a cloud service. The speaker said an authorization, in government, means a system has been accepted as secure and usable, and that is the agency's decision, not FedRAMP's.

A speaker noted that the FedRAMP Authorization Act already used this idea. Under 44 U.S.C. 3607, "FedRAMP authorization" means "a certification that a cloud computing product or service has" completed a FedRAMP authorization process or received a FedRAMP provisional authorization to operate.

FedRAMP's What's Changing in 2026 page gives the reason in one line: "Using FedRAMP Certification avoids conflating a FedRAMP authorization with an agency authorization to operate." The CR26 definitions call a service that has received FedRAMP Certification "FedRAMP Certified."

A speaker also said a certification package is not proof that a service is secure at a certain level. It shows the provider's commitment to its processes and how complete and standard its information is.

Why did FedRAMP drop impact levels?

A speaker said FIPS 199 is the National Institute of Standards and Technology (NIST) standard for categorizing the impact on an agency if information in a federal information system is compromised. Its categories are low, moderate, and high. NIST published FIPS 199 in February 2004.

The speaker's point: the customer decides what information goes into a commercial cloud service. So only the agency can judge the impact of a loss of confidentiality, integrity, or availability of that information. A provider cannot be given a FIPS 199 category on its own. The speaker said the old labels really meant how much a provider had to do and share: less at Low, more at High.

FedRAMP Notice 0004, issued February 25, 2026, set the new labels. It said each baseline would align to a FedRAMP Certification Class, A to D, and that old and new labels would be linked during a transition.

What do the classes mean?

The CR26 definitions call a Certification Class "the category of assurance that a cloud service offering supplies to federal government customers," rising from minimal assurance at Class A to significant assurance at Class D.

A speaker compared the classes to classes of trucks or chemicals: each names its own set of criteria, and Class A is not simply worse than Class B. The speaker said a class shows how much information is in the package and what the provider commits to for ongoing certification, communication, and response to agency customers. In the video, a speaker described a Class D provider as saying, "I am willing to host government services where a problem with my cloud service could result in a loss of life or catastrophic damage to the United States of America."

The CR26 rules show how demands rise by class. On FedRAMP Certification, 20x providers may use automated checks of each Key Security Indicator at Class A, should use at least 1 at Class B, and must use at least 2 at Class C and at least 4 at Class D.

What does this change for agencies?

A speaker said agencies can use Class A services to pilot new tools for lower-risk uses. The speaker also said an agency can use a Class A service inside a high-impact agency system if only lower-impact information flows to it, such as a system that collects public comments. This is the speaker's explanation, not a quoted rule. Agencies should check it against CR26's agency use rules and their own policies.

Those rules say agencies should not authorize a Class A Certified service for more than 12 months, unless the service is actively seeking a Class B, C, or D Certification. They also say agencies must keep agency-wide policy aligned with OMB Memorandum M-24-15.

Sources

Share this post:LinkedIn X Email

A weekly email on Fridays, an alert on the day the watch finds something new, or both. Free.