‍FedRAMP High is the most stringent baseline under the Federal Risk and Authorization Management Program (FedRAMP), built for cloud systems where a breach would cause severe or catastrophic harm to government operations, federal assets, or public safety. The FedRAMP High baseline requires 410 security controls from NIST Special Publication (SP) 800-53 Revision 5, spread across 17 control families. Cloud service providers (CSPs) need FedRAMP High when their software, platform, or infrastructure stores, processes, or transmits high-impact federal data. Government contractors need FedRAMP High only when their contract flows the requirement down or when they deliver a cloud product that handles high-impact federal data.

FedRAMP High also carries a new name in 2026. The FedRAMP Consolidated Rules for 2026 relabeled FedRAMP High as Class D and changed "FedRAMP Authorized" to "FedRAMP Certified." In this article, we cover what FedRAMP High means, how it compares to FedRAMP Moderate, which agencies and contractors need it, how cloud providers earn it, what happened to FedRAMP Ready, and how contractors should prepare.

What Is FedRAMP High?

FedRAMP High is the highest of the FedRAMP security baselines, and it applies to cloud services that handle the government's most sensitive unclassified data. The baseline sits above FedRAMP Low and FedRAMP Moderate, and it carries the largest control set of any FedRAMP baseline.

FedRAMP itself is a governmentwide program that gives federal agencies one standardized approach to security assessment, authorization, and continuous monitoring for cloud products. The Office of Management and Budget (OMB) created FedRAMP in 2011, and Congress made the program permanent law through the FedRAMP Authorization Act, signed in December 2022 as part of the National Defense Authorization Act for fiscal year 2023. The General Services Administration (GSA) houses the FedRAMP Program Management Office (PMO), and the FedRAMP Board that votes on program direction consists of seven federal technology executives selected by the Federal Chief Information Officer.

The FedRAMP model runs on a "do once, use many times" principle. One cloud service earns one certification, and every other federal agency can reuse that security package instead of repeating the same assessment. That reuse is the reason FedRAMP baselines are standardized, and the standard behind every baseline is the same federal control catalog.

Every FedRAMP baseline draws its controls from NIST SP 800-53, the catalog behind most federal NIST compliance work. FedRAMP selects, tailors, and adds parameters to those controls for cloud environments, and the FedRAMP High baseline uses the deepest selection of them.

What Does FedRAMP High Mean?

FedRAMP High means that losing the confidentiality, integrity, or availability of a cloud system would have a severe or catastrophic adverse effect on an agency's operations, assets, or people. That definition comes from Federal Information Processing Standards Publication 199 (FIPS 199), the National Institute of Standards and Technology (NIST) standard that sorts federal information systems into three impact levels.

FIPS 199 impact levels measure harm on a three-step scale. A Low impact system would cause a limited adverse effect if compromised, a Moderate impact system would cause a serious adverse effect, and a High impact system would cause a severe or catastrophic adverse effect. Severe or catastrophic harm includes loss of life, failure of a critical mission, and major financial loss.

FIPS 199 scoring follows a "high-water mark" rule. The agency rates confidentiality, integrity, and availability separately, and the system takes the highest of the three ratings. An emergency dispatch platform illustrates the rule well: its call records carry Moderate confidentiality risk, but a dispatch outage during a disaster carries High availability risk, so the entire platform is categorized FedRAMP High.

How Many Controls Does FedRAMP High Require?

FedRAMP High requires 410 security controls from NIST SP 800-53 Revision 5, organized across 17 control families. Some sources still list 421 controls, which was the count under the older Revision 4 baseline.

The 410-control High baseline compares to 323 controls at FedRAMP Moderate and 156 controls at FedRAMP Low, according to FedRAMP's official Rev. 5 security controls baseline workbook. FedRAMP High therefore adds 87 controls beyond Moderate. Secureframe's breakdown of the High baseline shows Access Control as the largest family with 50 controls, followed by Contingency Planning, System and Communications Protection, and System and Information Integrity at 35 controls each.

Those control families translate into specific technical demands. FedRAMP High systems run FIPS 140 validated encryption for data at rest and in transit, tested disaster recovery, detailed audit logging, and strong identity verification for every user and administrator.

Identity controls carry special weight at the High level, and phishing-resistant multi-factor authentication sits at the center of the FedRAMP High identification and authentication family. Once a provider implements all 410 controls, the next question becomes how the government formally recognizes that work.

What Is FedRAMP High Certification?

FedRAMP High certification is the official recognition that a cloud service meets the FedRAMP High baseline, and in 2026 FedRAMP renamed it FedRAMP Class D Certification. Before 2026, the same recognition was called a FedRAMP High Authorization, backed by an agency Authority to Operate (ATO).

The renaming came from FedRAMP Notice 0004, published in February 2026. FedRAMP stated that every authorization would carry the single label "FedRAMP Certified," which matches the FedRAMP Authorization Act's own definition of an authorization as a certification by FedRAMP. The notice also replaced the Low, Moderate, and High labels with Certification Classes A, B, C, and D.

The Consolidated Rules for 2026 (CR26) made the change official in June 2026, and FedRAMP set those rules to remain valid until December 31, 2028. Class B covers the former Low and LI-SaaS baselines, Class C covers the former Moderate baseline, and Class D covers the former High baseline. Existing FedRAMP High authorizations carried over to Class D, and the 410-control High baseline itself did not change. Only the label changed, and the gap between that label and the next one down is where most buying decisions happen.

How Is FedRAMP High Different From FedRAMP Moderate?

FedRAMP High differs from FedRAMP Moderate in three ways: High covers data whose loss would be severe or catastrophic instead of serious, High requires 410 controls instead of 323, and High places heavier demands on contingency planning, auditing, and system integrity.

FedRAMP Moderate remains the most common baseline by a wide margin. Secureframe's review of the FedRAMP Marketplace in July 2025 counted 585 listed cloud offerings, with Moderate-impact offerings making up about 73% of listings and High-impact offerings making up about 16%. The FedRAMP baselines line up side by side as follows.

The table shows that FedRAMP High is a smaller, more demanding tier. Fewer providers reach FedRAMP High because the High baseline asks for more controls, deeper testing, and stronger resilience, and the deciding factor behind all of those demands is the type of data a cloud system holds.

What Data Requires FedRAMP High?

Data requires FedRAMP High when its exposure, corruption, or downtime could cause loss of life, failure of a critical mission, or catastrophic financial harm. The most common categories of FedRAMP High data include:

• Law enforcement and criminal justice records, including investigative case files and biometric identifiers.
• Emergency response and disaster recovery systems, where an outage delays help to people in danger.
• Health records and life-critical medical data handled for federal health programs.
• Financial data such as taxpayer records and federal payment systems.
• Critical infrastructure data, export-controlled technical data under the International Traffic in Arms Regulations (ITAR), and higher-sensitivity defense data.

High-impact data carries a high price when it leaks. IBM's 2025 Cost of a Data Breach Report found that the average breach in the United States cost a record $10.22 million, and the same report recorded the public sector's breach costs rising 10.8%, the largest percentage increase of any sector. That cost explains why FedRAMP High demands encryption at every layer.

Encryption protects high-impact data even after an attacker gets past the perimeter, and strong file encryption is a requirement every FedRAMP High provider must prove to its assessor. Data this sensitive narrows the list of organizations that must hold FedRAMP High, and that list starts with cloud providers.

Who Needs FedRAMP High?

FedRAMP High is needed by cloud service providers that store, process, or transmit high-impact federal data on behalf of a federal agency. An agency cannot place high-impact data into a cloud product until that cloud product holds a FedRAMP High (Class D) certification or the agency issues its own High ATO.

Cloud service providers fall into three groups, and each group can need FedRAMP High:

• Software-as-a-Service (SaaS) providers whose applications hold high-impact agency data, such as case management, health record, or emergency dispatch platforms.
• Platform-as-a-Service (PaaS) providers whose platforms host high-impact applications that agencies or their developers build.
• Infrastructure-as-a-Service (IaaS) providers that supply the computing, storage, and networking underneath high-impact federal systems.
• Security and identity services that sit inside a High system boundary, such as identity platforms, endpoint detection tools, and monitoring services.

The three cloud service models split the 410 FedRAMP High controls differently. An IaaS provider owns the physical and infrastructure controls, and a SaaS provider built on a FedRAMP High infrastructure inherits those controls instead of rebuilding them. Control inheritance shortens the path for SaaS providers, but the SaaS provider still owns every application-level control.

FedRAMP scope also has firm edges. OMB memorandum M-24-15, issued in 2024, places search engines, social media platforms used under agency social media policies, and single-agency systems that are not offered as shared services outside FedRAMP scope. Inside that scope, the agency that owns the data decides which baseline applies.

Which Agencies Require FedRAMP High?

The agencies that most often require FedRAMP High are the Department of Defense (DoD), the Department of Homeland Security (DHS), the Department of Justice (DOJ), and the Department of Health and Human Services (HHS), along with any agency running law enforcement, emergency response, health, or financial systems in the cloud.

FedRAMP High requirements attach to systems, not to whole agencies. One agency can run its human resources software at FedRAMP Moderate and its investigative case system at FedRAMP High, because the agency categorizes each system separately under FIPS 199. A cloud provider selling to that agency needs the baseline that matches the specific system its product supports.

DoD adds one more layer to that system-level decision. A December 2014 DoD Chief Information Officer memo set FedRAMP as the minimum security baseline for every DoD cloud service, and the Defense Information Systems Agency (DISA) builds its own Impact Levels on top of that FedRAMP floor.

Is FedRAMP High the Same as DoD Impact Level 5?

No, FedRAMP High is not the same as DoD Impact Level 5 (IL5), but FedRAMP High is the required foundation that IL5 builds on. DISA defines Impact Levels in the DoD Cloud Computing Security Requirements Guide (CC SRG), and each Impact Level adds DoD-specific controls, called FedRAMP+ controls, to a FedRAMP baseline.

DoD Impact Levels stack in a clear order. IL2 accepts a FedRAMP Moderate or High baseline for non-controlled unclassified information. IL4 handles CUI and adds FedRAMP+ controls to a Moderate or High baseline. IL5 handles higher-sensitivity CUI and unclassified National Security Systems (NSS), and the Committee on National Security Systems sets the minimum for all unclassified NSS as equivalent to FedRAMP High.

IL5 goes well past FedRAMP High. The Rev. 5 version of the CC SRG adds 178 controls beyond FedRAMP High for IL5 National Security Systems, along with stronger tenant separation and hosting in DoD-approved regions. Every rule in this chain targets the cloud provider, which leaves contractors who are not cloud providers with a different question.

Is FedRAMP Required for Government Contractors?

No, FedRAMP is not automatically required for government contractors, and most government contractors never need a FedRAMP certification of their own. FedRAMP certifies cloud service offerings, not companies, so an engineering firm, a manufacturer, or a logistics contractor does not become a cloud service provider by winning a federal contract.

Government contractors still meet FedRAMP through the cloud tools they use. A contractor storing federal contract data in an outside cloud must pick a provider that meets the FedRAMP level the contract requires. A contractor that builds and sells its own SaaS product to agencies crosses the line and becomes a cloud service provider, with its own FedRAMP obligation.

Sorting out which rule applies to which contract is the core of contractor compliance work. The answer depends on the contract clauses, the type of data, and the cloud services that data touches.

Who Is Required to Be FedRAMP Compliant?

Cloud service providers that sell cloud services to federal agencies are required to be FedRAMP compliant, and contractors that store covered defense information in an outside cloud are required to use FedRAMP-compliant providers. The contractor requirement comes from Defense Federal Acquisition Regulation Supplement (DFARS) clause 252.204-7012, which appears in nearly every DoD contract involving CUI.

DFARS 252.204-7012 requires the contractor to "require and ensure" that any external cloud provider meets security requirements equivalent to the FedRAMP Moderate baseline. A December 21, 2023 memo from the DoD Chief Information Officer defined that equivalency strictly: 100% of the Moderate controls met, an assessment by a FedRAMP recognized Third Party Assessment Organization (3PAO), a complete body of evidence, and no open control-related Plans of Action and Milestones. Self-attestation by the cloud provider does not count.

FedRAMP Moderate is the DFARS floor, not the ceiling. A contract flows FedRAMP High down to a contractor when the contract explicitly names FedRAMP High, Class D, or IL5, or when the agency categorizes the data involved as high impact. The contractor then carries the duty to confirm that every cloud service touching that data holds the higher level.

Does CMMC Require FedRAMP?

CMMC does not require contractors to become FedRAMP certified, but CMMC does require that any cloud service storing CUI meet FedRAMP Moderate or an equivalent standard. The Cybersecurity Maturity Model Certification (CMMC) program began its phased rollout into DoD contracts on November 10, 2025.

CMMC Level 2 assessments measure contractors against the 110 security requirements in NIST SP 800-171. Assessors also review the contractor's external cloud services, and a cloud tool without FedRAMP Moderate certification or a valid equivalency body of evidence becomes a finding against the contractor, not against the cloud provider.

Contractors preparing for a CMMC assessment should list every cloud service that touches CUI well before the assessor arrives. That list also shows which contractors fall outside FedRAMP High entirely.

Which Government Contractors Do Not Need FedRAMP High?

Government contractors do not need FedRAMP High when they sell no cloud service to agencies, handle no high-impact federal data in the cloud, or work only for state and local governments. The groups that typically fall outside FedRAMP High include:

• Service contractors, such as engineering, construction, staffing, and consulting firms, that deliver work without offering a cloud product to an agency.
• Vendors of commercial off-the-shelf (COTS) software that does not process shared federal data.
• Providers of single-agency systems hosted in the cloud but not offered as shared services, which OMB M-24-15 places outside FedRAMP scope.
• Developers of on-premises software that runs inside an agency's own data center instead of a shared cloud.
• Vendors serving only state and local governments, which rely on frameworks such as GovRAMP (formerly StateRAMP), the Texas Risk and Authorization Management Program (TX-RAMP), or SOC 2.
• Contractors whose federal cloud data is categorized Moderate, where FedRAMP Moderate or a valid equivalent satisfies the requirement.

Contractors outside FedRAMP High still carry other federal cybersecurity obligations, especially DFARS and CMMC. For the cloud providers who do need FedRAMP High, the path to Class D follows a fixed sequence.

How Do Cloud Providers Get FedRAMP High Certification?

Cloud providers get FedRAMP High certification by securing a federal agency sponsor, implementing all 410 High controls, passing an independent 3PAO assessment, and earning an agency ATO that FedRAMP then certifies as Class D. The Rev. 5 Agency path is currently the only route to Class D, because FedRAMP 20x does not yet offer a Class D certification.

The Rev. 5 Agency path to FedRAMP High certification follows these steps:

1. Secure a federal agency sponsor that will review the security package and issue an ATO.
2. Categorize the system under FIPS 199 and define the authorization boundary, data flows, and inherited controls.
3. Close gaps and implement all 410 FedRAMP High controls across the 17 control families.
4. Document every control in a system security plan (SSP), along with its supporting policies and procedures.
5. Engage a FedRAMP recognized 3PAO to write the Security Assessment Plan (SAP), test the controls, and deliver the Security Assessment Report (SAR). Class D applicants must supply an independent assessment completed within the previous three months.
6. Remediate findings, record any remaining weaknesses, and submit the full package to the sponsoring agency.
7. Receive the agency ATO, after which FedRAMP issues Class D certification and lists the service on the FedRAMP Marketplace.
8. Run continuous monitoring with monthly reporting to the agency and an annual 3PAO reassessment.

The FedRAMP 20x path is moving toward Class D. FedRAMP published RFC-0036, the FedRAMP 20x Class D Cloud-Hosted Pilot Requirements, on October 15, 2026, and FedRAMP stops accepting new Rev. 5 certification applications on June 11, 2027. Providers starting today still follow the Rev. 5 steps, and those steps take time.

How Long Does It Take to Become FedRAMP Certified?

Becoming FedRAMP certified at the High level takes 18 to 24 months or longer for most cloud providers working without outside help, according to RegScale's analysis of FedRAMP authorization levels. The same analysis places FedRAMP Moderate at 12 to 24 months and FedRAMP Low at 12 to 18 months.

FedRAMP High timelines stretch for three main reasons. Finding an agency sponsor can take months before formal work begins, documenting 410 controls takes longer than documenting 323, and every 3PAO finding sends the provider back into remediation.

Remediation shapes the final months of the timeline. Every weakness the assessor finds goes into a POA&M, and the sponsoring agency weighs those open items before it signs the ATO. That same depth of work also explains the price of FedRAMP.

Why Is FedRAMP So Expensive?

FedRAMP is so expensive because providers must build, document, independently test, and continuously monitor hundreds of security controls, and at the High level that work covers 410 controls. The main FedRAMP cost drivers are engineering remediation, documentation, independent assessment, and ongoing monitoring.

Engineering remediation usually costs the most. Providers re-architect logging pipelines, deploy FIPS 140 validated encryption, stand up vulnerability scanning, and connect security information and event management (SIEM) tools to meet the High baseline. The FedRAMP CSP Authorization Playbook also recommends dedicating at least a technical writer, a technical subject matter expert, and a project manager to the effort.

Ongoing costs continue after certification. Continuous monitoring requires monthly vulnerability reporting and an annual 3PAO reassessment for as long as the provider keeps its certification. FedRAMP's lifecycle also included a lower-cost early milestone for years, and that milestone just changed.

Is FedRAMP Ready Going Away?

Yes, FedRAMP Ready is going away; FedRAMP Ready became Legacy FedRAMP Ready on July 28, 2026, and FedRAMP no longer accepts new Ready submissions. The change arrived with the Consolidated Rules for 2026.

FedRAMP Ready was a readiness designation, not an authorization. A cloud provider earned FedRAMP Ready by passing a 3PAO readiness assessment reviewed by the FedRAMP PMO, without needing an agency sponsor, and the designation was available only for Moderate and High systems. FedRAMP Ready never allowed an agency to place federal data in the service.

The new entry point is Class A Certification. Providers that held FedRAMP Ready before July 28, 2026 can use a temporary Ready Conversion pipeline that runs through February 19, 2027, and Legacy FedRAMP Ready listings begin expiring on November 17, 2026, or at their assessment expiration, whichever comes later.

FedRAMP Ready's retirement matters to contractors as much as to providers. A vendor still advertising "FedRAMP Ready" does not hold a certification, and only a FedRAMP Certified service at the right class satisfies a contract that requires FedRAMP. Contractors who track federal cybersecurity rules should add Marketplace status checks to that routine, and that check is the first step in preparing for FedRAMP High requirements.

How Should Government Contractors Prepare for FedRAMP High Requirements?

Government contractors should prepare for FedRAMP High requirements by mapping where federal data lives, confirming the FedRAMP status of every cloud tool that touches that data, and closing gaps before a contract or assessment forces the issue.

Contract review comes first. Contractors should read every clause for DFARS 252.204-7012, CMMC level requirements, and any agency language that names FedRAMP High, Class D, or IL5. Those clauses set the minimum level for every cloud service in the contract's scope.

The cloud inventory comes next. Contractors should list every cloud service that stores, processes, or transmits federal data, including email, file sharing, backup, collaboration, and security tools, and then trace how data flows between them. Each service on that inventory needs a verified status on the FedRAMP Marketplace, checked by Certification Class and not by the vendor's marketing page.

The inventory then feeds a formal gap analysis that compares each tool's certification to the contract's requirement. Any tool below the required level needs a replacement plan, a valid equivalency body of evidence, or removal from the data flow.

Documentation closes the loop. The contractor's SSP should describe each cloud boundary, each inherited control, and each shared responsibility, and continuous monitoring should confirm that every cloud vendor keeps its certification current after the contract starts.

Here in Huntsville, Alabama, we work beside one of the densest communities of defense and aerospace contractors in the country, and cloud scope questions come up in nearly every engagement. Contractors that answer these questions early move into new contracts with fewer surprises.

We fold contract review, cloud inventory, gap analysis, and SSP updates into one compliance program led by Certified CMMC Assessors (CCAs), so contractors meet CMMC, NIST, and FedRAMP flow-down requirements without juggling separate vendors.

Frequently Asked Questions

Which Companies Are Approved by FedRAMP?

The companies approved by FedRAMP are the cloud service providers listed as FedRAMP Certified on the FedRAMP Marketplace, which showed 547 certified services in October 2026. The Marketplace lets anyone filter listings by Certification Class, so contractors can see exactly which services hold Class D (High) certification and which agencies sponsored them.

How Much Does It Cost to Get FedRAMP Certified?

The cost to get FedRAMP certified depends on the baseline, the system's starting security maturity, and the amount of remediation needed, and FedRAMP High costs the most of any class. Engineering remediation, SSP documentation, 3PAO assessment fees, and annual continuous monitoring make up the largest cost categories, and providers with mature security programs spend far less on remediation than providers starting from scratch.

What Is the Difference Between FedRAMP Authorized and FedRAMP Certified?

The difference between FedRAMP Authorized and FedRAMP Certified is only the name. FedRAMP adopted "Certified" in 2026 to match the FedRAMP Authorization Act's wording, and every existing authorization carried over with its baseline intact, so a former FedRAMP High Authorized service is now a FedRAMP Class D Certified service.

What Is FedRAMP 20x?

FedRAMP 20x is FedRAMP's newer certification path that relies on automated, machine-readable security evidence instead of long narrative documents and point-in-time audits. FedRAMP 20x offers Class A, B, and C certifications today, the Marketplace listed 34 FedRAMP 20x certified services in October 2026, and Class D pilot requirements were published in October 2026.

Can a Company Pursue FedRAMP Voluntarily?

Yes, a cloud company can pursue FedRAMP voluntarily to prove its security, shorten federal procurement reviews, and qualify for future federal opportunities. Under the 2026 rules, the Program path lets providers apply directly to FedRAMP for Class A, B, or C without a committed agency sponsor, while Class D still requires an agency sponsor.

What Happens If a Cloud Service Is Not FedRAMP Authorized?

A cloud service that is not FedRAMP authorized cannot be used by federal agencies for in-scope federal data, and a contractor that stores CUI in it risks failing DFARS 252.204-7012 and CMMC requirements. The provider itself faces no fine, but the contractor carries the finding during an assessment.

Vendor reviews like this repeat with every new tool and every contract renewal, which is why many contractors hand the work to a managed compliance partner.

Putting It All Together

FedRAMP High, now called FedRAMP Class D, is the strictest FedRAMP baseline, with 410 NIST SP 800-53 controls for cloud systems where a breach would cause severe or catastrophic harm. Cloud service providers that handle high-impact federal data for agencies such as DoD, DHS, DOJ, and HHS need FedRAMP High, and FedRAMP High also serves as the required floor for DoD IL5.

Most government contractors never need their own FedRAMP certification. Contractors do need every cloud tool that touches CUI to meet FedRAMP Moderate or a valid equivalent, and they need FedRAMP High tools whenever a contract flows that level down. With FedRAMP Ready retired and new certification classes in place, checking each vendor's current status has become a routine part of staying eligible for federal work.

At Interweave Technologies, we help contractors sort out which requirements apply to each contract and keep their cloud tools in line with them.

Contractors with questions about FedRAMP, CMMC, or DFARS flow-down are welcome to reach out for a conversation about their current setup.

‍