FedRAMP Ready vs Authorized vs ATO: What the Labels Mean in 2026

A FedRAMP Certification (the 2026 label that replaced "FedRAMP Authorized") means FedRAMP has assessed a cloud service's package and confirmed it is complete enough for federal agencies to reuse. It is not an agency Authority to Operate (ATO) — each agency still issues its own ATO before using the service. "FedRAMP Ready," meanwhile, is being retired and folded into a new Preparation listing state on the Marketplace.

Key takeaways

• In 2026, the official label for a FedRAMP authorization is FedRAMP Certified — a single label covering both Rev 5 and 20x. There is no separate "FedRAMP Validated."
• A FedRAMP Certification is not an agency ATO. FedRAMP packages the security evidence; an agency Authorizing Official still makes the risk decision and issues the ATO.
• The four assessment baselines are now Certification Classes A, B, C, and D — not "Low/Moderate/High levels" — to avoid confusion with DoD Impact Levels.
• "FedRAMP Ready" is retiring. Providers early in the process now appear under a Preparation status on the Marketplace.
• These changes come from RFC-0020 and its outcome notice NTC-0004, formalized in the FedRAMP Consolidated Rules for 2026 (CR26), expected by the end of June 2026.

What's the difference between FedRAMP Ready and Authorized?

Historically, FedRAMP used a series of Marketplace statuses to show where a cloud service offering sat in the process: Ready, In Process, and Authorized. In 2026 those labels have been overhauled, but the underlying idea is the same — they mark progress through assessment, not a guarantee of security or a license for any agency to use the service.

Here is what each legacy status meant, and what it maps to in 2026:

Legacy status (pre-2026)	What it meant	2026 equivalent	What it means now
FedRAMP Ready	A 3PAO confirmed the provider's package was likely capable of meeting requirements; an optional starting designation.	Preparation	The provider is doing the essential work to manage its security and privacy risks before formal assessment. "Ready" as a label is being retired.
In Process	An agency or the program had begun an authorization and the package was under active review.	Agency Authorization In Process / Assessment by FedRAMP	An agency has notified FedRAMP it began an authorization, or FedRAMP is performing its final assessment (targeted at under 30 days for a complete package).
Authorized	FedRAMP had granted an authorization and the service was listed as reusable by agencies.	FedRAMP Certified (Continuous Monitoring status)	FedRAMP has certified the package is complete and the provider is in ongoing continuous monitoring. This is the target end state.

Source: FedRAMP RFC-0020, FedRAMP Authorization Designations

The most important distinction: "Ready/Preparation" is the on-ramp, "Certified" is the destination. A service in Preparation has not been authorized and should not be treated as cleared for federal use. A service that is FedRAMP Certified has a reviewed, reusable package — but, as the next section explains, that still is not the same as permission to operate inside a specific agency's system.

Is FedRAMP authorization the same as an ATO?

No. This is the single most common misconception in federal cloud procurement, and it is exactly why FedRAMP changed the terminology in 2026.

A FedRAMP Certification means FedRAMP has packaged a cloud service provider's essential security information so an agency can decide whether to use the service. An Authority to Operate (ATO) is a separate decision made by an agency's Authorizing Official under the NIST Risk Management Framework and OMB Circular A-130. Only that official can authorize the operation of an information system for their agency's specific use.

In FedRAMP's own words from RFC-0020, a FedRAMP authorization "is not a decision by an Authorizing Official that the service has been granted an Authorization to Operate (ATO)." The FedRAMP Board found that using the words "authorized" and "authorization" for both concepts created real risk — providers assumed certification was a government-wide ATO, and agency staff sometimes adopted services without reviewing the package or owning the risk.

	FedRAMP Certification	Agency ATO
Who grants it	FedRAMP (within GSA)	An agency Authorizing Official
What it confirms	The security package is complete and reusable	This agency accepts the risk of operating the system
Scope	Government-wide reusable evidence	One agency's specific use and security category
Required to sell to an agency	Effectively yes, as the basis	Yes — each agency issues its own

Source: FedRAMP RFC-0020, FedRAMP Authorization Designations

A practical consequence: a FedRAMP Certification earned at one security category does not lock an agency into using the service at that category. FedRAMP explicitly encourages agencies to reuse a Certification package at a higher or lower security category than the one it was assessed against, after running their own NIST RMF Categorize step. The certification supplies the evidence; the agency owns the decision.

What is FedRAMP Certified?

FedRAMP Certified is the 2026 replacement for "FedRAMP Authorized." It is a single, official label that applies to both the legacy Rev 5 path and the newer FedRAMP 20x path. Per NTC-0004, FedRAMP decided not to create separate "FedRAMP Validated" branding for 20x, because separate labels would create more procurement confusion, not less. Instead, both paths carry the FedRAMP Certified label, and the Marketplace provides filters so agencies can tell Rev 5 and 20x apart.

The label traces directly to statute. The FedRAMP Authorization Act defines a FedRAMP authorization as "a certification that a cloud computing product or service has completed a FedRAMP authorization process." That is why the program now uses FedRAMP Certification for the authorization and FedRAMP Certification Package for the authorization package. Any cloud service with a FedRAMP Certification is FedRAMP authorized for statutory and regulatory purposes, including adequacy for an agency to use when authorizing operation of that service.

A critical caveat FedRAMP repeats in both RFC-0020 and NTC-0004: a FedRAMP Certification does not measure the overall security of a cloud service. It indicates the depth and completeness of the assessment evidence available to agencies — not a security score, and not a substitute for an agency's own risk decision.

What are FedRAMP Certification Classes A, B, C, and D?

FedRAMP kept four baselines of assessment, but in 2026 it relabeled them as Certification Classes A, B, C, and D instead of FIPS 199 "Low / Moderate / High" levels. Per NTC-0004, FedRAMP deliberately avoided the words "levels" and numbers to prevent confusion with the DoD/DoW Impact Level (IL) system, and to reinforce that a class describes the scope of the assessment, not the total quality or security of the service.

Certification Class	Maps to legacy baseline	Notes
Class A	New pilot baseline (Rev 5)	A new, lightweight pilot class introduced under CR26.
Class B	Li-SaaS and Low	Combines the historical Li-SaaS and Low baselines.
Class C	Moderate	The most common baseline for SaaS selling to agencies.
Class D	High	The most sensitive federal data; deepest assessment.

Source: FedRAMP NTC-0004, Initial Outcome from RFC-0020

NTC-0004 also clarifies that FedRAMP is not changing the underlying requirements of the baselines as part of this relabeling — only the names — and that 20x requirements will be aligned to these same classes in CR26. There will be a transition period where old and new labels are linked so the market can adjust.

What changed in 2026?

Several FedRAMP terminology and Marketplace changes landed together in early 2026 through RFC-0020 (and its sibling RFCs on the Marketplace and external frameworks), with outcomes formalized in NTC-0004:

• "FedRAMP Authorized" → "FedRAMP Certified." One label, both Rev 5 and 20x. No "FedRAMP Validated."
• "FedRAMP Ready" → "Preparation." The Ready designation is being retired in favor of a Preparation listing state on the Marketplace.
• Impact "levels" → "Certification Classes A/B/C/D." Four baselines remain; the names changed to avoid clashing with DoD Impact Levels.
• Sharper Certification-vs-ATO line. The program now reserves "authorization" language for the agency ATO under the NIST RMF, and uses "certification" for what FedRAMP does.
• Marketplace lifecycle redefined. Rev 5 services move through Preparation → Agency Authorization In Process → Assessment by FedRAMP → Continuous Monitoring (Certified) → Remediation, with a target of under 30 days for FedRAMP's final assessment of a complete package.

These changes are being consolidated into the FedRAMP Consolidated Rules for 2026 (CR26), which NTC-0004 says FedRAMP expects to publish by the end of June 2026, valid through December 31, 2028. Existing listings are auto-mapped to the new designations during a transition period in which old and new labels are linked. Always confirm a specific service's current status on the official FedRAMP Marketplace, since labels are in active transition.

For the full process from preparation through continuous monitoring, see our complete FedRAMP authorization guide. To understand where a listing sits and how agencies search it, read our FedRAMP Marketplace explained. And to budget the journey, see how much FedRAMP costs in 2026.

Frequently asked questions

Is "FedRAMP Certified" the same as "FedRAMP Authorized"?

Yes. As of 2026, "FedRAMP Certified" is the official label that replaced "FedRAMP Authorized." A cloud service with a FedRAMP Certification is FedRAMP authorized for statutory and regulatory purposes, including agency reuse. The change in wording is meant to reduce confusion with an agency Authority to Operate.

Does a FedRAMP Certification let any agency use my service immediately?

No. A FedRAMP Certification provides a reusable package of security evidence, but each agency must still run its own NIST Risk Management Framework process and issue its own ATO before operating your service in its environment. Certification is the basis for that decision, not the decision itself.

What happened to "FedRAMP Ready"?

"FedRAMP Ready" is being retired. Providers early in the process now appear under a Preparation status on the FedRAMP Marketplace, reflecting that they are doing the essential work to manage security and privacy risks before formal assessment.

Is there a "FedRAMP Validated" label for 20x?

No. FedRAMP initially proposed a separate "FedRAMP Validated" designation for the 20x path in RFC-0020, but after public comment it decided in NTC-0004 to use the single FedRAMP Certified label for both Rev 5 and 20x. The Marketplace provides filters to distinguish the two paths.

What are FedRAMP Certification Classes A, B, C, and D?

They are the four assessment baselines, renamed in 2026. Class A is a new Rev 5 pilot baseline, Class B covers the legacy Li-SaaS and Low baselines, Class C covers Moderate, and Class D covers High. The names replaced the old "Low/Moderate/High level" language to avoid confusion with DoD Impact Levels.

Who issues an ATO?

An agency's Authorizing Official issues the ATO. This is a federal risk-acceptance decision under OMB Circular A-130 and the NIST Risk Management Framework. FedRAMP does not issue ATOs; it certifies that an authorization package is complete and reusable.

When do the 2026 changes take effect?

FedRAMP expects to publish the FedRAMP Consolidated Rules for 2026 (CR26) by the end of June 2026, valid through December 31, 2028, and is transitioning existing Marketplace listings to the new designations during that rollout. Check the official Marketplace for any given service's current status.

How do I confirm a cloud service's current FedRAMP status?

Use the official FedRAMP Marketplace at marketplace.fedramp.gov. It is the authoritative source for whether a service is in Preparation, under assessment, or FedRAMP Certified, and it provides filters to distinguish the Rev 5 and 20x paths.

Sources

• FedRAMP RFC-0020 — FedRAMP Authorization Designations
• FedRAMP NTC-0004 — Initial Outcome from RFC-0020 (Authorization Designations)
• FedRAMP Requests for Comment (RFC index)
• FedRAMP Marketplace
• NIST Risk Management Framework — Categorize Step

---

Last updated: June 2026. Written by the Boundera team — the AI copilot for FedRAMP.