FedRAMP Classes A to D: What Replaced the Impact Levels

FedRAMP replaced the Low, Moderate and High impact levels with Certification Classes A to D when its Consolidated Rules for 2026 took effect on July 4, 2026. The Marketplace labels Class A as Pilot, Class B as Low, Class C as Moderate and Class D as High. FedRAMP says a class is not a one-for-one replacement for an impact level: a class describes the assurance a provider commits to supply, and an agency still sets the impact level of its own system. On November 12, 2026 the Marketplace listed 792 products, and 557 of them held a FedRAMP Certification: 382 in Class C, 99 in Class D, 65 in Class B and 11 in Class A. The Marketplace notice says the previous level prints in parentheses after each class until December 31, 2026, and that the Low, Moderate and High labels go in January 2027.

What each class means

FedRAMP grants a class according to the level of assurance a cloud service provider is willing to supply to government customers. A higher class brings more reporting to agencies and costs the provider more to run. FedRAMP’s guidance for agencies describes the likely fit of each class:

Class	Marketplace label	Likely fit for an agency system
Class A	Pilot	Pilots, configuration and testing, and negligible-risk use cases
Class B	Low	Most Low impact systems, and some Moderate or High systems with compensating controls
Class C	Moderate	Most Low or Moderate impact systems, and some High systems with compensating controls
Class D	High	Most agency systems at any impact level, with compensating controls

FedRAMP states that classes are not aligned to how secure a service is. Many services with strong security programs choose Class A or Class B to keep government pricing close to commercial pricing. The agency still categorizes its own system first, then reviews the certification package to decide whether the service fits.

How many products hold each class

Every product has a certification status and a class. Products in Initial Implementation, Agency Authorization In Process, FedRAMP In Process or Legacy FedRAMP Ready are listed without a certification. The Marketplace counts on November 12, 2026:

Class	Marketplace label	Certified	All listed
Class A	Pilot	11	11
Class B	Low	65	67
Class C	Moderate	382	473
Class D	High	99	128
No class yet	none	0	113
Total		557	792

Class C holds more than two thirds of the certified products. The October 29 data still carried the old impact level beside the class: all 374 certified products labelled Moderate were Class C, and all 98 labelled High were Class D. The 24 labelled Low and the 42 labelled LI-SaaS, the low-impact SaaS tier, were Class B. The November 12 data no longer carries the old label.

By route, 461 of the 557 certified products went through an agency, 52 through the Joint Authorization Board and 44 through the FedRAMP program. Certification dates fall mostly in recent years: 133 in 2025, 109 in 2026 so far, 48 in 2022, 44 in 2024 and 39 in 2023.

Who assessed the certified products

Independent assessors carry the certification work. Five of them account for 401 of the 557 certified products. The assessor field is blank for 18 products.

Assessor	Certified products
Schellman	149
Coalfire	83
A-LIGN	68
Fortreum	54
Kratos	47

Schellman and A-LIGN also audit SOC 2 reports for software companies, and the SOC 2 audit firm list shows which firms put a price on that work. The CMMC side has its own assessors, covered in what a C3PAO is.

20x and Rev5

The Marketplace splits its 792 products by certification type: 656 are Rev5, 110 are 20x and 26 are 20x Pilot. Rev5 is the older route, built on the NIST SP 800-53 baselines and Word and Excel templates. FedRAMP 20x is the replacement, and 38 certified products hold a 20x certification as of November 12, 2026. FedRAMP stops accepting new Rev5 certification applications on June 11, 2027. Existing Rev5 certifications stay active until at least December 31, 2028, unless FedRAMP is otherwise directed.

Date	What changes
July 4, 2026	The Consolidated Rules for 2026 take effect. New 20x applications follow them.
December 31, 2026	The Marketplace stops printing the previous impact level in parentheses after a class.
January 2027	The Low, Moderate and High labels are removed from the Marketplace.
January 1, 2027	New Rev5 applications and all active 20x certifications must follow the rules.
June 11, 2027	No new Rev5 applications are accepted.
February 1, 2028	Grace periods end. Services that do not follow the rules lose their certification.

Terms that changed

The 2026 rules renamed more than the levels. “FedRAMP Authorization” is now “FedRAMP Certification”, because an agency authorization to operate is a separate thing that only the Rev5 agency route needs. The system security plan and its appendices became a Certification Package Overview and a Security Decision Record. Continuous monitoring became Ongoing Certification, and plans of action and milestones gave way to a list of accepted weaknesses.

Compliance platforms in the Marketplace

Some compliance platforms hold a certification themselves. The Marketplace lists Vanta in Class B and Class C, Secureframe in Class C and Drata in Class B.

The CMMC compliance software ranking covers the Vanta Government Cloud certification in more detail. A platform that prepares evidence does not certify anything: FedRAMP certifies the cloud service, and an independent assessor tests it, the same split that runs through SOC 2 audits.

Choosing a class

FedRAMP advises most providers to start at Class A, which it built for commercial products that already hold a SOC 2 Type II report. A team preparing a SOC 2 report as a startup is already doing most of the groundwork. FedRAMP warns against going straight to Class C or Class D without an agency contract that requires it. A cloud provider that holds covered defense information for a CMMC contractor faces a separate test: the DFARS clause points to the Moderate baseline, covered in the Level 2 guide.

The FedRAMP hub collects the rated platforms and guides. Trust centers name FedRAMP too: some level of it appears on 25% of the 132 trust centers in the trust center study.