Certification Classes - FedRAMP Consolidated Rules for 2026

Publisher

U.S. General Services Administration (FedRAMP PMO)

URL

https://www.fedramp.gov/2026/agencies/use/classes/

Published

unknown

Updated

unknown

Accessed

2026-10-02

HTTP status

200

License

US federal government work; public domain; public domain; excerpts permitted

Source notes citing this source

• FedRAMP presumes Class A adequate only for pilots, testing, or extremely low or negligible risk use cases. in context
• FedRAMP presumes Class D adequate for most agency information systems regardless of impact level, whereas Class C is presumed adequate for most Low and Moderate systems and only some High systems with compensating controls. in context
• Under the FedRAMP Consolidated Rules for 2026, a Certification Class describes the level of assurance information a cloud service provider supplies through FedRAMP for a cloud service offering. in context
• FedRAMP tells agencies not to treat Certification Classes as one-for-one replacements for the Low, Moderate or High FIPS 199 impact levels. in context
• FedRAMP states that Certification Classes are not aligned to how secure a cloud service offering is; they measure the depth of assurance information supplied. in context
• FedRAMP defines four Certification Classes, labelled A, B, C and D. in context

Cite this source record

APA

WarmTransfer. (2026, October 2). Certification Classes - FedRAMP Consolidated Rules for 2026. WarmTransfer. https://warmtransfer.net/knowledge/sources/fedramp-cr26-certification-classes

BibTeX

@misc{warmtransfer-fedramp-cr26-certification-classes,
  title  = {Certification Classes - FedRAMP Consolidated Rules for 2026},
  author = {{WarmTransfer}},
  year   = {2026},
  url    = {https://warmtransfer.net/knowledge/sources/fedramp-cr26-certification-classes},
  note   = {U.S. General Services Administration (FedRAMP PMO), accessed 2026-10-02}
}