FedRAMP Moderate is now called Class C. Your contract still says Moderate.

Checked on 8 October 2026.

What happened

  • 25 February 2026. FedRAMP (the Federal Risk and Authorization Management Program, the government’s security program for cloud services) announced new names. “FedRAMP Certification”, or “FedRAMP Certified”, replaces “FedRAMP authorization”. The old levels, Low, Moderate and High, give way to four Certification Classes, A to D.
  • How the classes match. FedRAMP said Class C would include the current Moderate baseline and Class D the current High. Class B takes the current Low baselines (FedRAMP names two), and Class A is a new pilot.
  • 4 July 2026. FedRAMP’s Consolidated Rules for 2026, which use the new names, took effect. Providers on FedRAMP’s older process, called Rev5, had only a few of them mandatory before 1 January 2027.

What it means for you

If you keep CUI (Controlled Unclassified Information: sensitive government information your contract marks or describes) in a cloud service, such as email, file storage or backup, two rules still use the old words.

  • The contract clause DFARS 252.204-7012 says an outside cloud service that stores, processes or sends your CUI must meet security requirements equivalent to the FedRAMP Moderate baseline. DFARS is the Defense Federal Acquisition Regulation Supplement, the defense rules written into your contracts.
  • The CMMC (Cybersecurity Maturity Model Certification) rule says the same for Level 2: the service is FedRAMP Authorized at Moderate or higher, or meets equivalent requirements.

As of 8 October 2026 neither rule uses the new names. FedRAMP says a service with a FedRAMP Certification counts as FedRAMP authorized for meeting requirements in laws and regulations. It also says the new labels do not change the requirements, though it planned minor changes to the baselines themselves. So:

  • Class C is the class that includes the Moderate baseline your clause names. Class D includes the old High, which the CMMC rule’s words “or higher” also cover.
  • Class A and Class B are not the Moderate baseline.
  • For a while you may see both names. FedRAMP planned a transition in which the old and new labels are linked.

FedRAMP chose letters, not levels, to avoid confusion with the separate Impact Level (IL) system of the Department of War (the new name of the Department of Defense).

The class is only part of the answer. The same paragraph of the clause also asks you to make sure the provider follows the clause’s rules on cyber incidents, such as reporting them.

What comes next

  • 1 January 2027. The date FedRAMP set for the Consolidated Rules for 2026 to become mandatory, though some parts have their own dates.
  • 11 June 2027. The date FedRAMP set to stop accepting applications for new Rev5 certifications. Existing Rev5 certifications stay active until at least 31 December 2028, unless FedRAMP is directed otherwise.

Whether the clause or the CMMC rule will be changed to use the new names is not known as of 8 October 2026.

What to do now

  1. List the cloud services that store, process or send your CUI, such as email, file storage and backup. Your IT provider can help.
  2. Ask each provider, in writing, which FedRAMP Certification Class (or old baseline) the exact service you use holds, or, if none, how it meets requirements equivalent to Moderate. Class C or D lines up with Moderate or higher.
  3. We suggest checking the answer yourself on the FedRAMP Marketplace, FedRAMP’s searchable list on fedramp.gov, where you can check that the service is shown as certified, not only listed. Keep a dated screenshot with your records.
  4. Ask the provider, or your IT provider, how the service meets the clause’s rules on cyber incidents, and how it encrypts your CUI.

Sources