FedRAMP Authorization: The Steps, the Sponsor and How Long Each Route Took

FedRAMP calls the process certification now, and the Marketplace record shows a different wait on each route. Through an agency sponsor, 457 products took a median 11.2 months from Agency Authorization In Process to Certified. Under 20x, 38 products took a median 2.2 months from their first Marketplace status to Certified. Both figures come from the FedRAMP Marketplace’s product data as of 12 November 2026, and each measures the months between two dated status changes on that record, not the provider’s preparation before it. The 557 certified products are counted by class in the impact levels and classes guide and by 20x class in the 20x count.

The steps from start to certificate

FedRAMP lays the work out in three phases: preparation, initial implementation and ongoing certification. The steps below follow the Consolidated Rules for 2026.

1. Preparation. The provider picks an advisor, a class, a type and a path. FedRAMP says a provider new to the program will almost always benefit from an advisory service, and it flags an advisor who talks about impact levels or a FedRAMP Authorization as one who is not following the changes.
2. Get listed. The provider appears on the Marketplace as implementing. A listing needs a website with a JSON file of service details, proof the service is eligible, a basic FedRAMP-compatible trust center, quarterly progress updates, and a commitment to begin an assessment within 2 years. A trust center platform covers the page itself.
3. Do the work. FedRAMP says there are hundreds of rules to address and offers no tools or guidance for this phase. The provider builds a Certification Package Overview first, then a Security Decision Record, then meets the Assurance rulesets.
4. Find an assessor. A FedRAMP Recognized independent assessor is mandatory for Class B, C and D. The assessment must be less than 3 months old when the provider applies, and the package must show the service as validated within the previous 7 days.
5. Apply. The provider applies directly. FedRAMP does not allow a third party, an assessor included, to apply for it.
6. Review and certification. FedRAMP’s goal is an initial decision within 30 days. It offers no service-level agreement, and its clock stops whenever it waits on the provider. FedRAMP asks providers not to request prioritized reviews.

After certification the provider reports on an ongoing basis, and a move to a higher class is a new application. FedRAMP asks for 120 days notice before a downgrade or cancellation.

The sponsor on the agency path

Only the Rev5 agency path needs a sponsor. A provider on that path must complete the authorization to operate process with its agency sponsor, ending in a signed ATO letter that the agency sends to FedRAMP through official channels. The agency does its own review first, and FedRAMP certifies second.

The Marketplace records which agencies list an authorization for each of the 461 products certified through an agency. 191 of them, 41%, list one agency. 99 list two or three, 148 list four or more and 23 list none. Across the 461, 91 different agencies appear. Health and Human Services appears on 131 of the products, Energy on 120, Veterans Affairs on 105, Commerce on 100 and Homeland Security on 80.

A provider with no agency customer has no sponsor to ask. That is the gap 20x closes, since FedRAMP processes 20x certifications directly. A provider that holds a 20x Class A certification can later change to Rev5 Class B, C or D through an agency.

Which route took how long

The Marketplace marks each product’s route and logs every status change with a date. Of 557 certified products, 461 went through an agency, 52 through the Joint Authorization Board and 44 through the program: 38 under 20x and 6 under Rev5.

Route	Certified	Months, median	Middle half	Clock starts at
Rev5, agency	461	11.2	6.8 to 16.1	Agency Authorization In Process (457 products)
Rev5, Joint Authorization Board	52	6.7	4.2 to 11.9	FedRAMP In Process (51 products)
20x, program	38	2.2	0.7 to 2.7	First Marketplace status

The agency figure hides a wide spread. 90 of the 457 agency products, 20%, certified within 6 months of that first status, 256 (56%) within 12 months and 413 (90%) within 24. The other 44 took longer than 24 months. By year of certification the median was 18.1 months in 2024 (42 products), 10.9 in 2025 (123) and 8.7 in 2026 (71).

The Joint Authorization Board route has nearly closed. It certified 52 products in total, 1 of them in 2026, the last on 17 February 2026, and none in 2025.

Once a Rev5 agency product reaches the FedRAMP In Process status, the wait is shorter. For the 185 certified since 2025 the median was 1.9 months from that status to Certified. For 20x the median from FedRAMP In Process to Certified was 1.1 months across 35 products.

Independent assessors on the Marketplace

The Marketplace names an independent assessor on each record. Among the 519 Rev5 certified products, Schellman is named on 144, Coalfire on 80, A-LIGN on 63, Fortreum on 51, Kratos on 45 and Lunarline on 38. 31 different assessors appear once spelling variants are merged. Schellman and A-LIGN also sit on the SOC 2 audit firm list.

Rev5 or 20x

FedRAMP recommends 20x for a cloud service built on FedRAMP Certified infrastructure or platforms, and calls it the fastest and cheapest way to bring an existing commercial service into the federal market. Rev5 is the route for a service that runs its own infrastructure and for Class D, which 20x does not yet offer.

	20x	Rev5
Path	Program, direct with FedRAMP	Agency, with a signed ATO letter
Classes open	A, B and C. Class D is expected in 2027	B, C and D
New applications	Open	Close on June 11, 2027
Marketplace pipeline	98 in Initial Implementation	44 Agency Authorization In Process, 23 FedRAMP In Process, 17 Initial Implementation

A provider that already holds a SOC 2 Type II report has a short way into Class A, which accepts that report, FedRAMP Rev5 or GovRAMP within the last 12 months. The SOC 2 compliance software ranking scores the platforms that run those programs.

Vanta, Drata and Secureframe all hold 20x certifications themselves.

The dates that matter

• July 4, 2026: the Consolidated Rules for 2026 took effect. New 20x applications must follow them.
• January 1, 2027: new Rev5 applications must follow them.
• June 11, 2027: FedRAMP accepts no new Rev5 applications.
• February 1, 2028: grace periods end, and a service not following the rules loses its certification.

A contractor that handles controlled unclassified information in a cloud service meets the CMMC requirement through a service at the FedRAMP Moderate baseline, or one with equivalent controls. The Level 2 guide covers that side.

The FedRAMP hub lists the platforms rated for the program, and the CMMC software ranking scores the ones that serve defense contractors.