FedRAMP Certification Classes A-D replacing Low/Mod/High under CR26
Key Questions
How is FedRAMP replacing its traditional impact levels?
FedRAMP is replacing Low, Moderate, and High impact levels with new Classes A through D under the CR26 framework, affecting ATO strategy, control baselines, and marketplace positioning.
When will the FedRAMP class transition details be finalized?
Official guidance and transition timelines are expected as CR26 approaches finalization on June 30, 2026, with existing authorizations mapping to the new classes.
What early examples exist of the new FedRAMP classes?
Riverbed's Class D certification serves as an early example of the new classification system in action, while broader terminology changes do not alter the underlying authorization work.
FedRAMP is replacing the traditional Low/Mod/High impact levels with Classes A through D under the CR26 framework. This major policy shift directly impacts ATO strategy, control baselines, and marketplace positioning. CSPs must understand the mapping of existing authorizations to new classes and prepare for transition timelines. Official guidance and transition details are expected as CR26 final approaches June 30, 2026. A new brief article on FdeRAMP Class confirms this change, and Riverbed's Class D certification is an early example of the new classification in action.