FedRAMP certificationGet FedRAMP certified without building a federal compliance team first.
FedRAMP certification is how cloud services earn the trust of US federal agencies, and the Consolidated Rules for 2026 replace a paperwork-heavy process with certification classes and measurable Key Security Indicators. A dedicated SecureSlate compliance lead picks the right class for your service, builds your Security Decision Record, and prepares you for the independent assessment, while our compliance automation platform keeps evidence current for quarterly reporting. One fixed price covers the work.
FedRAMP 20x KSIs: 46 indicators, 1 Cybersecurity Education, 4 Change Management, 8 Cloud Native Architecture, 6 Identity and Access Management, 3 Incident Response, 5 Monitoring, Logging, and Auditing, 5 Policy and Inventory, 4 Recovery Planning, 2 Supply Chain Risk, 8 Service Configuration. 7 highlighted: Evidenced by included security scanning.
Evidenced by included security scanningScoped with your compliance lead
- Rules
- Consolidated Rules for 2026, mandatory from January 2027
- Certification classes
- A to D, increasing in assurance
- Rev5
- No new Rev5 certifications after June 2027
The standard
FedRAMP certification now scales by class, and 20x measures security instead of documenting it.
FedRAMP is the US government program for the security of cloud services used by federal agencies. Under the Consolidated Rules for 2026, a cloud service earns a certification class, and the modern 20x approach is based on measured outcomes rather than documented plans.
Four certification classes
Assurance increases from Class A to Class D. Class A lets a service with a recent SOC 2 Type II, GovRAMP, or FedRAMP Rev5 assessment enter the marketplace, though agencies should not rely on it for more than 12 months unless the service is working toward a higher class. Classes B and C need a fresh assessment from a FedRAMP Recognized assessor.
46 Key Security Indicators
On the 20x path, your security decisions are measured against 46 indicators in 10 themes, from identity and access management to supply chain risk. Class C requires at least two automated validation methods for every indicator and six months of historical metrics.
Reporting every quarter
Every certified provider supplies an Ongoing Certification Report every three months, and Class C and D providers must also host a quarterly review for agencies. Vulnerability detection, incident reporting, and significant change notifications follow timelines that tighten as the class increases.
How it works
We take your cloud service through FedRAMP certification, then keep it reporting every quarter.
Four stages from the scoping call to a certification you can maintain, with a named compliance lead accountable at every one.
Choose the right class
We look at the agencies you sell to, how widely your service will be used, and the assessments you already hold, then recommend a class, usually on the 20x path now that new Rev5 certifications end in June 2027. A current SOC 2 Type II report can be your route into Class A.
Map your Key Security Indicators
Your compliance lead maps how you already run identity, change management, logging, recovery, and supply chain security to each indicator, and ranks the gaps by what assessors and agencies will look at first.
Build the Security Decision Record and package
We document your security decisions, set up validation for each indicator, and assemble the certification package, then prepare you for the independent assessment where your class requires one.
Report every quarter
Ongoing Certification Reports, vulnerability detection, and significant change notifications run on schedule, with evidence collected continuously, so your certification stays current and agencies keep trusting the data.
What is included
Everything FedRAMP assessors and agency reviewers ask for, prepared before they ask.
FedRAMP compliance software and the expert who runs it arrive together under one fixed price, so federal certification does not stall your product roadmap.
A dedicated compliance lead
One experienced practitioner owns your FedRAMP program end to end. They choose the class, map the indicators, write the Security Decision Record, and work with your assessor, so your engineers keep building instead of reading the Consolidated Rules.
Indicator mapping and a gap assessment
All 46 Key Security Indicators mapped to the controls, tests, and evidence that meet them, with each gap owned and scheduled, and the work that already counts toward SOC 2 or NIST CSF marked.
Continuous testing from your stack
Connect your cloud provider, identity provider, code host, and devices once. Controls are tested continuously against live configuration, which supports the automated validation and historical metrics that higher classes expect.
Vulnerability detection and response
Code, dependency, cloud, and surface scanning on a schedule, with findings evaluated and tracked to remediation, supporting the detection and response timelines your class sets.
Supply chain and vendor risk
Third-party services and software inventoried and reviewed, with supply chain risks identified and mitigated as the Supply Chain Risk indicators expect.
Ongoing Certification Reports
Your compliance lead prepares the quarterly Ongoing Certification Report from current evidence and helps you run quarterly reviews with agency customers, so reporting does not become a quarterly scramble.
Included security scanning
Included security scanning evidences seven FedRAMP Key Security Indicators.
Every engagement includes scanning across code, dependencies, cloud, and your public surface. These are the indicators it evidences directly, which gives your validation work a head start.
KSI-PIY-RSD Reviewing Security in the SDLC
Code security scanning
Repositories scanned for vulnerable code, with findings ranked by severity and traced to the line, which shows security is built into your software development lifecycle.
KSI-SCR-MON Monitoring Supply Chain Risk
Dependency and license risk
An SBOM for every repository, with vulnerable open source components flagged, so third-party software is monitored for upstream vulnerabilities.
KSI-CNA-MAT Minimizing Attack Surface
Public surface monitoring
Your domains and forgotten subdomains scanned on a schedule and when you ship, keeping the attack surface of internet-facing resources small and reviewed.
KSI-SVC-ASM Automating Secret Management
Secrets detection
API keys, tokens, and credentials committed to source code, found and pinpointed to the file and line, so gaps in secret management surface before anyone exploits them.
KSI-MLA-EVC Evaluating Configurations, KSI-CNA-IBP Implementing Best Practices
Cloud misconfiguration checks
AWS, Azure, and GCP configurations checked through read-only access against provider best practices for encryption, access, logging, and networking.
KSI-IAM-SUS Responding to Suspicious Activity
Dark web monitoring
Company email addresses checked against known breach data, so accounts with exposed credentials are secured before anyone uses them.
Beyond FedRAMP
One FedRAMP program that also serves your other frameworks.
FedRAMP overlaps with the frameworks your commercial and government buyers already ask for, so shared controls count more than once.
SOC 2
A SOC 2 Type II report from the past 12 months is one of the routes into FedRAMP Class A, so the program you run for commercial buyers can open the federal market.
CMMC
Defense contractors handling controlled unclassified information need CMMC, and the cloud services they use to store it are expected to meet FedRAMP Moderate or an equivalent.
GovRAMP
The state and local government counterpart to FedRAMP. A GovRAMP assessment is also one of the routes into FedRAMP Class A.
NIST CSF
The CSF comes from the same institute as NIST SP 800-53. Its Govern, Protect, Detect, and Respond outcomes line up with many of FedRAMP's Key Security Indicators.
ISO 27001
Global buyers ask for ISO 27001 alongside FedRAMP. Access, change, logging, and supplier controls serve both programs.
HIPAA
Cloud services for federal health programs often handle protected health information too, so HIPAA safeguards and FedRAMP indicators share much of the same evidence.
FedRAMP guides
What FedRAMP actually asks of your team
Three guides your team can read before the scoping call, from the 20x approach to how FedRAMP compares with SOC 2.
20x
FedRAMP 20x explained: goals, challenges, and readiness steps
SOC 2
FedRAMP vs SOC 2: key differences for cloud service providers
Marketplace
The FedRAMP Marketplace: how listings work and what agencies see
Resources
Read up before your scoping call.
Practical guides to FedRAMP, from who needs it to how it compares with other government programs.
FAQs
What teams ask before starting FedRAMP.
Cloud service providers that want federal agencies to use their service. FedRAMP certification meets the legal requirement for a cloud service to be FedRAMP authorized, so it applies to software, platform, and infrastructure providers selling to the US federal government.
FedRAMP now issues certifications in classes from A to D, and the 20x approach measures security outcomes through Key Security Indicators instead of relying mainly on documented plans. The rules opened for early adoption in July 2026 and take mandatory effect on 1 January 2027.
Class A is the entry point for services with a SOC 2 Type II, GovRAMP, or FedRAMP Rev5 assessment from the past 12 months, and agencies should not rely on it for more than 12 months unless you are working toward a higher class. Class B suits common small-scale or light-use services, and Class C suits common enterprise services used across an agency. Your scoping call ends with a recommendation.
For now. FedRAMP stops accepting applications for new Rev5 certifications on 11 June 2027, and FedRAMP Ready has moved to legacy status, with Class A as its replacement for new providers. Most new providers should plan for the 20x path.
An outcome FedRAMP uses to measure a cloud service's security decisions, such as automating account management or testing recovery capabilities. The 46 indicators are grouped into 10 themes, and higher classes are expected to validate them with automated methods and supply historical metrics.
An Ongoing Certification Report every three months, plus vulnerability detection and response, incident reporting, and significant change notifications on timelines that tighten as the class increases. Class C and D providers must also host a quarterly review open to agency customers.
Yes. A SOC 2 Type II completed in the past 12 months is one of the alternative frameworks that qualify a service for Class A, supplied with the complete report and a bridge letter if applicable. Much of the evidence behind it also maps to the Key Security Indicators.
One fixed price agreed before work starts, covering the platform and the expert work. Any independent assessment is paid directly to the FedRAMP Recognized assessor, because the assessment has to stay independent of whoever helped you prepare. We give you a realistic range for that fee on the scoping call.
No. Independent assessments come from FedRAMP Recognized independent assessment services, and certification comes from FedRAMP. We prepare you, build your certification package, and coordinate with the assessor you choose.
Software gives you templates, integrations, and a dashboard, and your team still works out how to meet each indicator. A consultant brings the expertise, but evidence often stays manual once the engagement ends. SecureSlate combines both: a dedicated compliance lead who does the work, from choosing the class to quarterly reporting, on a compliance automation platform, for one fixed price.
Find out what FedRAMP certification will take for your service
Bring the agencies you want to sell to and the assessments you already hold. You will leave the call with a recommended class, a gap summary, and a fixed price, whether or not you work with us.
