FedRAMP Certification Classes¶

FedRAMP grants different classes of FedRAMP Certification based on the level of assurance the cloud service provider is willing to supply to government customers. In general, services with a lower Certification Class will be cheaper to procure and operate due to a reduced commitment to assurance while higher Certification Class offerings will be more expensive with a higher level of assurance for government customers.

For example, commercial cloud service providers rarely share detailed continuous monitoring information with their private-sector customers but agency customers expect to see an unprecedented amount of information about how a cloud service provider is operating their service. Class C and Class D Certified cloud service offerings have made extraordinary commitments to provide additional assurance information in a timely manner to federal agency customers, typically including information and timeframes that they would never share with private-sector customers.

Impact Levels vs. Certification Classes¶

Agencies are required by FIPS-199 and FIPS-200 to categorize their information systems based on the risk of a potential adverse impact to the confidentiality, integrity, or availability of the information they will put into that system; then agencies must categorize the information system itself with an overall impact level of low, moderate, or high.

FedRAMP Certification Classes are different. A Certification Class describes the level of assurance information a cloud service provider supplies through FedRAMP for a cloud service offering. Certification Classes are about the depth, frequency, and quality of FedRAMP Certification Data available to agencies; they are not a direct label for how sensitive an agency system is.

A simple way to think about it:

Agencies should not treat Certification Classes as one-for-one replacements for Low, Moderate, or High impact levels. A cloud service’s Certification Class can help an agency understand what evidence is available, but the agency still has to decide whether the service is appropriate for the agency’s specific use, configuration, integrations, data, mission, and risk tolerance.

In practice, agencies should categorize their own information system first, then review the FedRAMP Certification Package to determine if the cloud service offering has sufficient protections in place. The agency authorization should document what the agency configures, what the agency operates, and any additional controls or compensating controls needed for the agency’s use case.

Certification classes may be used by agencies to quickly gauge the general level of investments into security capabilities that each service provider has made, however final agency risk determinations must take into account how the agency will use the cloud service. Federal information systems could be composed of components that separately process information at different security categorization levels. Agencies are encouraged to properly architect federal information systems to use cloud services that appropriately match the security categorization of the information.

Broad Considerations on Certification Classes¶

The following table may help agencies understand the likely level of assurance in a FedRAMP Certification Package for a specific class:

Comments