# FedRAMP Classes A to D vs Impact Levels **URL:** https://theauditrail.com/frameworks/fedramp/impact-levels/ **Published:** 2026-10-29 **Modified:** 2026-11-13 **Author:** The Audit Trail editorial desk > FedRAMP rules effective July 4, 2026 replace Low, Moderate and High with Classes A to D. Class C holds 382 of 557 certified products. --- [FedRAMP guide](https://theauditrail.com/frameworks/fedramp/) # FedRAMP Classes A to D: What Replaced the Impact Levels FedRAMP rules in effect since July 4, 2026 replace Low, Moderate and High with Classes A to D. 557 of 792 products are certified: 382 in Class C, 99 in D, 65 in B. The Audit Trail editorial desk Updated Nov 13, 2026 · First published Oct 29, 2026 [Some vendors pay us to be assessed or listed. Payment never changes a score, a rank or a verdict.](https://theauditrail.com/how-we-make-money/) In brief - FedRAMP Classes A to D replace the Low, Moderate and High impact levels under rules that took effect July 4, 2026. - 557 of 792 Marketplace products are certified (November 12, 2026). - Class C holds 382 of them, Class D 99, Class B 65 and Class A 11. - Low, Moderate and High leave the Marketplace in January 2027. - FedRAMP says a class measures the assurance a provider commits to supply. FedRAMP replaced the Low, Moderate and High impact levels with Certification Classes A to D when its Consolidated Rules for 2026 took effect on July 4, 2026. The Marketplace labels Class A as Pilot, Class B as Low, Class C as Moderate and Class D as High. FedRAMP says a class is not a one-for-one replacement for an impact level: a class describes the assurance a provider commits to supply, and an agency still sets the impact level of its own system. On November 12, 2026 the Marketplace listed 792 products, and 557 of them held a FedRAMP Certification: 382 in Class C, 99 in Class D, 65 in Class B and 11 in Class A. The [Marketplace notice](https://www.fedramp.gov/marketplace/) says the previous level prints in parentheses after each class until December 31, 2026, and that the Low, Moderate and High labels go in January 2027. ## What each class means FedRAMP grants a class according to the level of assurance a cloud service provider is willing to supply to government customers. A higher class brings more reporting to agencies and costs the provider more to run. [FedRAMP’s guidance for agencies](https://www.fedramp.gov/2026/agencies/use/classes/) describes the likely fit of each class: Class Marketplace label Likely fit for an agency system Class A Pilot Pilots, configuration and testing, and negligible-risk use cases Class B Low Most Low impact systems, and some Moderate or High systems with compensating controls Class C Moderate Most Low or Moderate impact systems, and some High systems with compensating controls Class D High Most agency systems at any impact level, with compensating controls FedRAMP states that classes are not aligned to how secure a service is. Many services with strong security programs choose Class A or Class B to keep government pricing close to commercial pricing. The agency still categorizes its own system first, then reviews the certification package to decide whether the service fits. ## How many products hold each class Every product has a certification status and a class. Products in Initial Implementation, Agency Authorization In Process, FedRAMP In Process or Legacy FedRAMP Ready are listed without a certification. The [Marketplace](https://www.fedramp.gov/marketplace/products.json) counts on November 12, 2026: Class Marketplace label Certified All listed Class A Pilot 11 11 Class B Low 65 67 Class C Moderate 382 473 Class D High 99 128 No class yet none 0 113 Total 557 792 Class C holds more than two thirds of the certified products. The October 29 data still carried the old impact level beside the class: all 374 certified products labelled Moderate were Class C, and all 98 labelled High were Class D. The 24 labelled Low and the 42 labelled LI-SaaS, the low-impact SaaS tier, were Class B. The November 12 data no longer carries the old label. By route, 461 of the 557 certified products went through an agency, 52 through the Joint Authorization Board and 44 through the FedRAMP program. Certification dates fall mostly in recent years: 133 in 2025, 109 in 2026 so far, 48 in 2022, 44 in 2024 and 39 in 2023. ## Who assessed the certified products Independent assessors carry the certification work. Five of them account for 401 of the 557 certified products. The assessor field is blank for 18 products. Assessor Certified products Schellman 149 Coalfire 83 A-LIGN 68 Fortreum 54 Kratos 47 Schellman and A-LIGN also audit SOC 2 reports for software companies, and the [SOC 2 audit firm list](https://theauditrail.com/best/soc-2-audit-firms/) shows which firms put a price on that work. The CMMC side has its own assessors, covered in [what a C3PAO is](https://theauditrail.com/frameworks/cmmc/c3pao/). ## 20x and Rev5 The Marketplace splits its 792 products by certification type: 656 are Rev5, 110 are 20x and 26 are 20x Pilot. Rev5 is the older route, built on the NIST SP 800-53 baselines and Word and Excel templates. [FedRAMP 20x](https://theauditrail.com/frameworks/fedramp/20x/) is the replacement, and 38 certified products hold a 20x certification as of November 12, 2026. FedRAMP stops accepting new Rev5 certification applications on June 11, 2027. Existing Rev5 certifications stay active until at least December 31, 2028, unless FedRAMP is otherwise directed. Date What changes July 4, 2026 The Consolidated Rules for 2026 take effect. New 20x applications follow them. December 31, 2026 The Marketplace stops printing the previous impact level in parentheses after a class. January 2027 The Low, Moderate and High labels are removed from the Marketplace. January 1, 2027 New Rev5 applications and all active 20x certifications must follow the rules. June 11, 2027 No new Rev5 applications are accepted. February 1, 2028 Grace periods end. Services that do not follow the rules lose their certification. ## Terms that changed The 2026 rules renamed more than the levels. “FedRAMP Authorization” is now “FedRAMP Certification”, because an agency authorization to operate is a separate thing that [only the Rev5 agency route needs](https://theauditrail.com/frameworks/fedramp/authorization/). The system security plan and its appendices became a Certification Package Overview and a Security Decision Record. Continuous monitoring became Ongoing Certification, and plans of action and milestones gave way to a list of accepted weaknesses. ## Compliance platforms in the Marketplace Some compliance platforms hold a certification themselves. The Marketplace lists [Vanta](https://theauditrail.com/vendors/vanta/) in Class B and Class C, [Secureframe](https://theauditrail.com/vendors/secureframe/) in Class C and [Drata](https://theauditrail.com/vendors/drata/) in Class B. The [CMMC compliance software ranking](https://theauditrail.com/best/cmmc-compliance-software/) covers the Vanta Government Cloud certification in more detail. A platform that prepares evidence does not certify anything: FedRAMP certifies the cloud service, and an independent assessor tests it, the same split that runs through [SOC 2 audits](https://theauditrail.com/frameworks/soc-2/who-performs-a-soc-2-audit/). ## Choosing a class FedRAMP advises most providers to start at Class A, which it built for commercial products that already hold a SOC 2 Type II report. A team preparing a [SOC 2 report as a startup](https://theauditrail.com/frameworks/soc-2/for-startups/) is already doing most of the groundwork. FedRAMP warns against going straight to Class C or Class D without an agency contract that requires it. A cloud provider that holds covered defense information for a CMMC contractor faces a separate test: the DFARS clause points to the Moderate baseline, covered in the [Level 2 guide](https://theauditrail.com/frameworks/cmmc/level-2/). The [FedRAMP hub](https://theauditrail.com/frameworks/fedramp/) collects the rated platforms and guides. Trust centers name FedRAMP too: some level of it appears on 25% of the 132 trust centers in the [trust center study](https://theauditrail.com/research/trust-centers/). Platforms in this article [![Vanta logo](https://theauditrail.com/logos/vanta.png)Vanta (82/100)](/vendors/vanta/)[ ![Drata logo](https://theauditrail.com/logos/drata.png)Drata (76/100) ](/vendors/drata/)[ ![Secureframe logo](https://theauditrail.com/logos/secureframe.png)Secureframe (75/100)](/vendors/secureframe/) ## Frequently asked questions - What replaced FedRAMP Low, Moderate and High? Certification Classes A to D replaced them when the Consolidated Rules for 2026 took effect on July 4, 2026. The Marketplace labels Class A as Pilot, Class B as Low, Class C as Moderate and Class D as High. FedRAMP will drop the Low, Moderate and High labels in January 2027. - Is FedRAMP Class C the same as Moderate? Not one for one. FedRAMP says a class describes the assurance a provider commits to supply, while an impact level describes the agency system that uses the service. In the Marketplace data of October 29, 2026, all 374 certified products labelled Moderate sat in Class C, along with 5 certified products that carried no old label. The November 12 data no longer carries the old label. - How many FedRAMP certified products are there? The Marketplace listed 792 products on November 12, 2026, and 557 of them held a FedRAMP Certification. Class C had 382, Class D 99, Class B 65 and Class A 11. - When do Low, Moderate and High disappear from the Marketplace? FedRAMP prints the previous impact level in parentheses after each class until December 31, 2026. Beginning in January 2027 the Low, Moderate and High labels are removed. - Which FedRAMP class should a SaaS company start with? FedRAMP recommends Class A for most providers entering the federal market, and describes it as built for existing commercial products that already hold a SOC 2 Type II report. It warns against going straight to Class C or Class D without a federal customer that requires that level.