Where you are
What FedRAMP is, what changed with 20x, and what a certification class commits you to — the thirty-minute orientation for an engineer with no compliance background.
FedRAMP is the US federal government’s program for authorizing cloud services that agencies use. If your product wants federal customers, it needs a FedRAMP certification, and your team owes the evidence that earns it. That is the whole situation — the rest of this course is vocabulary and judgement.
Two rule generations are live at once, and you will meet both. The older one speaks in controlOne numbered security requirement — AC-02, “account management” — from NIST SP 800-53, the catalogue FedRAMP draws its baselines from.— NIST SP 800-53’s catalog of security requirements, of which your certification class assigns you a baselineThe set of controls one impact level requires. FedRAMP Rev5 publishes three, and which one binds you is the whole question of scope.. The newer one, FedRAMP 20x, speaks in Key Security Indicator (KSI)FedRAMP 20x’s unit of assurance: a question asked of the running system — “is MFA enforced?” — that a machine can answer, grouped into themes. — outcome statements you prove continuously, machine-first. The 2026 Consolidated Rules carry both, which is why this site does too.
The one decision that scopes everything else is the certification class. A class picks your baseline, your assessment obligations and — the part most teams discover late — your clocks. Here are the classes, read live from the ruleset this site renders:
| Class | Level | Baseline controls | Reached by a KSI | Annually assessed |
|---|---|---|---|---|
| A | — | no Rev5 baseline exists — an absence, not a zero | ||
| B | our reading: Rev5 Low | 155 | 95 | 35 |
| C | our reading: Rev5 Moderate | 322 | 199 | 80 |
| D | our reading: Rev5 High | 409 | 199 | 101 |
The rules name only classes. Low, Moderate and High are Rev5's, and pairing them with a class is our reading rather than something the rules state.
Read the table twice. Once for the row your team is pursuing — that row is your scope, and /classes holds the full side-by-side. And once for the gap between the middle two columns: in every class, the baseline is larger than the set of controls any indicator reaches. That gap has a name — indicator orphans — and it is where step 3 is going.
Exit check — which class has no baseline, and what does that mean?
Class A. The rules define the class but assign it no Rev5 baseline — so the honest rendering is the sentence in the table, never “0”, which a reader takes as full coverage. You will meet this pattern again: this corpus treats an absence as a fact to state, not a cell to leave blank.