What FedRAMP Requires
FedRAMP requirements in cloud contracts exist to standardise how cloud services are secured and authorised for US federal use. The Federal Risk and Authorization Management Program assesses a cloud service offering against a defined set of NIST-based security controls across three objectives — confidentiality, integrity, and availability — and grants an Authorization to Operate (ATO) at a given impact level. For an agency, FedRAMP authorisation is the evidence that a cloud service meets the required security baseline; increasingly, it is also a precondition of contract award, provided there are enough authorised vendors to preserve competition.
That gating effect is the practical reason FedRAMP matters to procurement. A cloud service without the right authorisation may simply be ineligible, regardless of price or fit — which makes authorisation status a first-order question in any federal cloud sourcing exercise, sitting alongside the residency and sovereignty questions in the compliance and governance guide and the data sovereignty analysis.
Impact Levels: Low, Moderate, and High
FedRAMP sorts cloud offerings into three impact levels, and the level drives both the control burden and the available supply. Moderate is the workhorse: it applies where loss of confidentiality, integrity, or availability would cause serious adverse effects, it accounts for roughly 80% of all ATOs, and it requires 325 security controls. High is reserved for systems where such a loss would be severe or catastrophic — law enforcement, emergency services, financial, and health systems — and demands 421 controls, nearly 30% more than Moderate, covering advanced encryption, physical access restrictions, personnel vetting, and enhanced continuous monitoring. Low covers limited-impact systems.
Supply at the top is genuinely scarce: only around 48 cloud service offerings hold full High authorisation, against roughly 80 listed as High on the FedRAMP Marketplace — meaning fewer than half are fully authorised. For a buyer, that scarcity is a procurement risk in itself, because a High-impact requirement can shrink the viable vendor pool to a handful, which in turn affects pricing leverage. The AWS vendor hub is a useful reference given how much federal workload concentrates on GovCloud and equivalent environments.
Only about 48 cloud services hold full FedRAMP High authorisation. A High-impact requirement can collapse your viable vendor pool to a handful — a competition and pricing risk, not just a security checkbox.
The FedRAMP 20x Shift
The most consequential change in the programme is FedRAMP 20x, a redesign of the assessment and authorisation process led by the FedRAMP PMO with industry and agency input. The legacy path is slow — typically 18 months or more to authorisation — which constrains supply and entrenches incumbents. FedRAMP 20x aims to compress that dramatically: some participating providers achieved authorisation in roughly three months during the initial phase.
The timing matters for procurement planning. The public 20x path is not expected to open broadly until around the fourth quarter of FY26, with wide-scale adoption for Low and Moderate providers projected across the third and fourth quarters of 2026. For a buyer, that means the authorised-vendor pool should widen over the next contracting cycles, but the relief is not yet here — near-term sourcing still has to work within today's scarce supply, while longer-horizon strategies can anticipate a broader market. Building that timing into the renewal calendar is part of disciplined contract compliance monitoring.
Contracting Around FedRAMP
When FedRAMP authorisation is a requirement, several terms deserve explicit treatment. Specify the required impact level precisely, because over-specifying High where Moderate suffices needlessly shrinks competition. Require the vendor to maintain authorisation throughout the term, with notification if its authorisation status changes, since an ATO is not permanent. Address continuous-monitoring obligations and the agency's access to the vendor's security documentation. And treat authorisation status as part of broader third-party risk management, alongside the SOC and security evidence you would collect for any critical vendor. The Cloud Contract Framework white paper sets out the full clause set; to scope a FedRAMP-gated procurement before it narrows your options, request a confidential briefing.
Authorization Types and What They Mean for Buyers
Not all FedRAMP authorisations are equivalent, and the distinction matters when a buyer relies on one. Historically, a cloud service could be authorised through an individual agency, which sponsored and accepted the risk, or through the centralised programme route that produced a more broadly reusable authorisation. The practical question for a buyer is reusability: an authorisation that other agencies can readily leverage reduces friction and time-to-deploy, whereas one tied narrowly to a single agency's acceptance may require additional work for a different agency to rely on it.
This is why authorisation status deserves the same scrutiny as any other eligibility criterion. A vendor's marketing may state that it is "FedRAMP authorised" without making clear at which impact level, through which route, and whether the authorisation is current — and an authorisation is not permanent, requiring continuous monitoring to maintain. Confirming the specifics, rather than accepting the headline claim, is the diligence that prevents a procurement from stalling late when the authorisation turns out not to cover the intended use.
For buyers planning across multiple contracting cycles, the trajectory also matters. The scarce supply at the High level and the slow legacy authorisation timeline have entrenched a handful of incumbents, but the FedRAMP 20x redesign is expected to widen the field for Low and Moderate services through 2026. A buyer can use that trajectory deliberately: meeting near-term needs within today's authorised pool while structuring longer commitments to benefit from the broader competition expected as faster authorisation reaches the market. Treating FedRAMP status as a dynamic market condition, rather than a fixed checkbox, is what turns a compliance requirement into a sourcing strategy.