FedRAMP Vendor Authorization Status

FedRAMP defines three impact levels based on NIST FIPS 199. Under the Consolidated Rules for 2026 they are certification classes, and the Marketplace shows both names:

High (Class D) — For cloud systems where a loss of confidentiality, integrity, or availability would have severe or catastrophic effects on organizational operations, assets, or individuals. Requires 421 security controls.

Moderate (Class C) — For systems where loss would have serious adverse effects. Requires 325 security controls. This is the most common level.

Low (Class B) / LI-SaaS — For systems where loss would have limited adverse effects. LI-SaaS (Low Impact SaaS) is a streamlined path for low-risk SaaS applications. Requires fewer controls than Moderate.

The control counts above are the Rev5 baselines. Class A has no Rev5 equivalent: it is a FedRAMP 20x class for cloud services that already hold a recent SOC 2 Type II, GovRAMP or FedRAMP Rev5 certification. Classes A, B and C are available through FedRAMP 20x today; a 20x Class D is not yet available (FedRAMP estimates a pilot in FY27 Q1–Q2). What changed is set out in FedRAMP 20x vs. Rev5.

The class belongs to a specific cloud offering, not to the vendor: one vendor can hold a High offering and a Moderate one. To see which class each of a vendor's offerings holds, look the vendor up by domain.

FedRAMP status for commonly used vendors, read live from FedRAMP's own Marketplace data (as of Nov 1, 2026). FedRAMP certifies named offerings, so each line names the offerings that hold a certification and their class:

Amazon Web Services — FedRAMP Certified: AWS GovCloud (Class D (High)), AWS US East/West (Class C (Moderate))

Microsoft Azure and Microsoft 365 — FedRAMP Certified: Microsoft 365 Government Community Cloud & Supporting Services (Class C (Moderate)), Microsoft 365 Government Community Cloud-High (Class D (High)), Azure Commercial Cloud (Class D (High)), and 1 more

Salesforce — FedRAMP Certified: Salesforce Government Cloud Plus (Class D (High))

Okta — FedRAMP Certified: Okta IDaaS Government High Cloud (GHC) (Class D (High)), Okta IDaaS Regulated Cloud (Class C (Moderate))

GitHub — FedRAMP Certified: GitHub Enterprise Cloud (Class B (LI-SaaS))

Zoom — FedRAMP Certified: Zoom for Government (Class C (Moderate))

Snowflake — FedRAMP Certified: The Data Cloud on AWS GovCloud (High) (Class D (High)), The Data Cloud on AWS US East/West (Class C (Moderate)), The Data Cloud on Azure Government (High) (Class D (High))

Datadog — FedRAMP Certified: Datadog for Government (Class D (High))

Twilio — not on the FedRAMP Marketplace

DocuSign — FedRAMP Certified: Docusign - IAM eSignature (Class C (Moderate)), DocuSign CLM (Class C (Moderate))

Box — FedRAMP Certified: Box Enterprise Cloud Content Collaboration Platform (Class D (High))

ServiceNow — FedRAMP Certified: Government Community Cloud (Class D (High))

Splunk — FedRAMP Certified: Splunk Cloud Platform for FedRAMP High (Class D (High)), Splunk Cloud Platform for FedRAMP Moderate (Class C (Moderate))

CrowdStrike — FedRAMP Certified: CrowdStrike Falcon Platform for Government (Class D (High)), CrowdStrike Falcon Platform IL5 SaaS (Class D (High))

Zscaler — FedRAMP Certified: Zscaler Internet Access - Government (Secure Web Gateway - vTIC) (Class C (Moderate)), Zscaler Internet Access - Government (Secure Web Gateway - vTIC) - High (Class D (High)), Zscaler Private Access - Government (Zero Trust Exchange - VPN Replacement) (Class C (Moderate)), and 1 more

PagerDuty — FedRAMP Certified: PagerDuty Operations Cloud (Class B (Low))

Google Workspace — FedRAMP Certified: Google Workspace (Class D (High)), Gemini for Government (Class B (20x Low)), Google Services (Google Cloud Platform Products and underlying Infrastructure) (Class D (High))

Slack — FedRAMP Certified: GovSlack (Class D (High)), Slack (Class C (Moderate))

MongoDB — FedRAMP Certified: MongoDB Atlas for Government (Class C (Moderate))

New Relic — FedRAMP Certified: New Relic (Class C (Moderate))

Stripe — not on the FedRAMP Marketplace

Dropbox — not on the FedRAMP Marketplace

SendGrid — not on the FedRAMP Marketplace

HubSpot — not on the FedRAMP Marketplace

Notion — not on the FedRAMP Marketplace

Airtable — not on the FedRAMP Marketplace

1Password — not on the FedRAMP Marketplace

Linear — Initial Implementation (Linear), not yet certified

Shopify — not on the FedRAMP Marketplace

Vercel — not on the FedRAMP Marketplace

Supabase — not on the FedRAMP Marketplace

DigitalOcean — not on the FedRAMP Marketplace

A certified government edition does not cover the vendor's commercial product. Match the offering on your order form to the one listed. Any other vendor can be checked the same way with the FedRAMP status lookup.

A vendor not being listed on the FedRAMP Marketplace does not mean they are insecure — it means they have not completed the federal authorization process. Many vendors maintain strong security programs (SOC 2, ISO 27001, PCI DSS) without pursuing FedRAMP because their customer base does not require it.

However, if your organization is subject to federal compliance requirements (FISMA, CMMC, FedRAMP itself), you must use FedRAMP-authorized services for covered workloads. For non-federal workloads, FedRAMP authorization is a positive signal but not a requirement. Your vendor due diligence checklist should include FedRAMP status as one data point among many — alongside SOC 2 verification, sanctions screening, cyber risk scoring, and adverse media analysis.

ThirdProof's vendor risk assessment includes FedRAMP authorization verification as part of its ${ACTIVE_SOURCE_COUNT}-source assessment. The platform checks the FedRAMP Marketplace registry, scans the vendor's trust page for compliance claims, and classifies each certification as independently verified (confirmed in a public registry), vendor-attested (claimed on trust page only), or not found in evidence. This three-tier verification approach ensures you know the confidence level behind every compliance claim — not just whether the vendor says they have it.

ThirdProof's assessment of Dropbox illustrates a common FedRAMP scenario. The assessment identified 10 compliance certifications on Dropbox's trust page — including SOC 1, SOC 2, ISO 27001, ISO 27017, ISO 27018, HIPAA, PCI DSS, CSA STAR, GDPR, and CCPA. All 10 were classified as vendor-attested — claimed on the trust page but not independently verifiable through a public registry.

FedRAMP is the exception: it has a public registry. Dropbox's status on the FedRAMP Marketplace, read live: not on the FedRAMP Marketplace (as of Nov 1, 2026). A vendor with no Marketplace listing has not completed the federal authorization process through a 3PAO assessment, and for organizations subject to FISMA, CMMC, or federal acquisition regulations its product cannot be used for covered workloads.

How to document this in your risk register: record the vendor's FedRAMP status as the Marketplace shows it, with the date read and the specific offering, note the impact on any federal workloads, document compensating controls if the organization accepts the risk for non-federal use, and set a reassessment date.

This is one of the most common pain points in federal compliance. A vendor's marketing page claims "FedRAMP compliant" or "FedRAMP ready," but when you search marketplace.fedramp.gov, they are not listed. The distinction matters.

FedRAMP Certified ("Authorized" before the Consolidated Rules for 2026) means a specific cloud service offering has passed an independent assessment and been certified through one of two paths: directly by FedRAMP (the Program path, which FedRAMP 20x uses and which needs no agency sponsor), or through a federal agency's Authorization to Operate (the Agency path, now a legacy path available only for Rev5). Older listings show a JAB P-ATO; those remain listed. A certified offering stays subject to ongoing monitoring and reporting. This is the status federal procurement relies on.

FedRAMP Compliant is not an official designation. Vendors use this term loosely to mean they follow FedRAMP-aligned security practices or have begun the authorization process. It carries no legal weight and should not be accepted as evidence of authorization.

FedRAMP Ready meant a 3PAO Readiness Assessment Report found the offering likely capable of achieving authorization. FedRAMP stopped accepting Ready submissions on 28 July 2026; existing Ready offerings must convert to a certification or be renamed Legacy FedRAMP Ready, and the status is removed entirely on 31 December 2027. It was never an authorization.

Initial Implementation is a newer Marketplace listing for providers early in preparing for certification. It is a prerequisite for applying, not a certification.

When a vendor claims FedRAMP compliance without marketplace listing, document the discrepancy in your assessment, ask the vendor for their specific authorization status and timeline, and flag it as a finding requiring risk acceptance if federal workloads are involved.

Your risk register entry for FedRAMP should capture four elements. First, the verification result — Certified or Authorized (with class or impact level and date), In Process, Initial Implementation, Legacy FedRAMP Ready, or Not Listed. Always cite the FedRAMP Marketplace as the source, not the vendor's marketing materials. Second, the scope — FedRAMP authorization covers specific cloud service offerings, not the vendor's entire product line. Slack offers GovSlack with FedRAMP Moderate authorization, but standard Slack is not authorized. Document which product you are using and whether it falls within the authorized scope. Third, the impact on your workloads — note which of your systems or data flows rely on this vendor and whether they involve federal data, CUI, or CMMC-scoped assets. If the vendor is not authorized but your workload is federal, document the compensating controls or alternative vendor selection. Fourth, the reassessment trigger — set a date to re-check the marketplace, particularly for offerings that are In Process, in Initial Implementation, or Legacy FedRAMP Ready, whose status is expected to change.