Do You Need FedRAMP to Sell to the Government?
What you need to know about FedRAMP requirements and if it's the right next step for your business.
If a government prospect shows up, FedRAMP will usually show up on your radar pretty soon after. Federal Risk and Authorization Management Program (FedRAMP) compliance shows government agencies that you meet the government-required security standards.
But FedRAMP isn't mandatory for every organization. FedRAMP is only required if you sell cloud software that will touch federal data. Many state and local governments and the defense industry use other programs.
Whether FedRAMP is the right fit for your organization depends on the nature of your business and the types of customers you serve.
Here's what you need to know about who needs FedRAMP and when it's required.
Is FedRAMP Mandatory?
FedRAMP is not a mandatory requirement for every organization selling into the US government. But federal agencies have to follow FedRAMP requirements when procuring cloud services that process, store, or manage federal information.
Whether you need FedRAMP depends on who you're selling to, how your product is used, and the type of federal information it handles:
| Who you're selling toBuyer | Do you need FedRAMP?Answer | WhyReason |
|---|---|---|
| A federal agency using your SaaS or cloud product | Usually yes | Agencies can only put federal data in FedRAMP-certified services |
| A federal contractor | Maybe | Yes, if the contract flows FedRAMP requirements down to you, or federal workloads run in your system |
| A state or local government | Usually no | They ask for GovRAMP, TX-RAMP, CJIS, SOC 2, ISO 27001, or their own security review |
| An agency that hosts your software itself | Usually no | FedRAMP covers cloud services, not on-premises software |
| Services only | Usually no | Unless the service includes a cloud system that holds federal data |
FedRAMP requirements come from the FedRAMP Authorization Act, part of the National Defense Authorization Act signed in December 2022. And the July 2024 memo from the White House Office of Management and Budget (OMB), M-24-15, confirms that any cloud service that falls under FedRAMP's scope must have a FedRAMP authorization before an agency can use it.
There are no fines or legal issues for any cloud service provider that doesn't have FedRAMP. Without FedRAMP, you'll just be unable to win or work on a federal agency contract that touches federal information.
Here are three questions that can help determine whether your organization will fall under FedRAMP's scope:
- Do you offer a cloud service? FedRAMP covers organizations offering Software-as-a-Service (SaaS), Platform-as-a-Service (PaaS), and Infrastructure-as-a-Service (IaaS) solutions.
- Will your cloud service handle federal information? This includes services that create, collect, process, store, or maintain federal information.
- Can more than one agency use it? FedRAMP is designed for cloud services that can be used across government agencies. A system built for a single agency can fall outside FedRAMP's scope.
Is FedRAMP Still Required After the 2026 Changes?
Which organizations need FedRAMP hasn't changed. What's changed in 2026 is how organizations get certified. FedRAMP 20x means that agency sponsors are no longer required, opening up the federal market to more innovative, cloud-based providers.
FedRAMP 20x also changes how compliance is proved, switching from Rev5's narrative-based approach to a continuous, compliance-as-code approach.
With 20x, we're now working with commercial SaaS companies I never would have expected to move into the federal market.
As part of its 2026 changes, FedRAMP also switched up how it labels its baselines, replacing Low, Moderate, and High with Classes B, C, and D, which loosely map to those baselines. It also introduced Class A as an on-ramp for organizations with an existing SOC 2 Type II report.
Can You Sell to an Agency Before You're FedRAMP Certified?
You can start the sales conversation and see if there's interest in your product, but if FedRAMP is a requirement, an agency can't use your service for federal data until you have a FedRAMP certification at the required class. The exception is a limited pilot that only uses public or low-risk information.
If you're exploring FedRAMP certification, Class A is a good way to get the ball rolling. It's built for organizations that already have existing commercial frameworks like SOC 2 in place, and offers a way to get listed on the FedRAMP Marketplace while you work toward Class B or C (the classes most contracts will require).
Since it was announced, there's been a lot of debate about Class A. I see it as a great on-ramp to FedRAMP certification, and you're not wasting any work, as the key security indicators (KSIs) you build for Class A will carry forward into Class B and C.
Do State and Local Governments Require FedRAMP?
FedRAMP isn't required by state and local buyers. Depending on who you're selling to, state and local agencies may require GovRAMP, TX-RAMP, CJIS, SOC 2, ISO 27001, or a custom security review.
Of all the frameworks out there, GovRAMP is the closest thing to a state-level FedRAMP, and it's required by a number of states now, including Arizona, Nevada, and Georgia. But it's not yet a requirement in every state, so it's worth checking with the buyers in your pipeline.
Texas has its own program called TX-RAMP (the Texas Risk and Authorization Management Program). State law bars Texas state agencies and public universities from signing or renewing covered cloud contracts unless the vendor complies. However, organizations with FedRAMP or GovRAMP may be eligible for TX-RAMP certification through a reciprocity process.
If you're selling to both federal and state buyers, GovRAMP has a Fast Track that reuses your federal security work, so it can make sense to pursue FedRAMP first, then go after GovRAMP. On the flip side, GovRAMP doesn't map over to FedRAMP, but it can be used as a prerequisite for FedRAMP Class A.
Do Defense Contractors Need FedRAMP?
FedRAMP isn't usually a requirement for defense contractors. Defense contracts tend to run on the Cybersecurity Maturity Model Certification (CMMC), but separate rules apply to cloud services. If you're a cloud service provider selling SaaS, PaaS, or IaaS directly to defense contractors or the federal government, FedRAMP can be in scope, depending on how your service is used and what information it handles.
Under DFARS 252.204-7012, external cloud service providers used by defense contractors to store, process, or transmit covered defense information must meet security requirements equivalent to the FedRAMP Moderate baseline.
When Should You Start Pursuing FedRAMP?
My advice is generally to start considering FedRAMP when you have the federal pipeline to justify the investment. With 20x, there's no agency sponsor required, so the door is open. But what really matters is whether there's demand for your product that'll show ROI on the investment required for FedRAMP 20x readiness work, the assessments, and the ongoing continuous monitoring.
Treat the federal market like any other expansion opportunity. Work out how big it is for you and where it ranks against your other markets. Then cost what it takes to win it: the sales and RFP effort, plus the security path, whether that's FedRAMP, CMMC, or GovRAMP. If that ROI gives you conviction, go.
Our public sector practice helps SaaS companies work out how to go from commercial compliance to federal, then gets them ready for it, whether that's FedRAMP 20x, GovRAMP, or CMMC. If a government deal is on the table and you want to know what it would take for your company, talk to our team.
