FedRAMP Class C vs Moderate: Checking Cloud Vendors for DFARS

FedRAMP is moving cloud providers from impact levels like “Moderate” to Certification Classes, while DFARS 252.204-7012 still requires security equivalent to the FedRAMP Moderate baseline. That gap does not change your obligations today, but it does change what vendors will show you. On October 8, 2026, FedRAMP said it will stop processing legacy Rev5 certification applications on June 11, 2027. Contractors should record how each cloud service holding covered defense information meets the clause, and ask the contracting officer when a vendor’s status does not match the clause wording.

Our earlier guides explain how CMMC and FedRAMP relate and why Moderate is the bar for CUI email. This article covers what changed this fall.

What did FedRAMP announce?

FedRAMP’s October 8 fiscal-year post summarizes the shift to FedRAMP 20x. It says FedRAMP retired FedRAMP Ready at the end of July, opened 20x Class B and Class C to all cloud service providers at the end of August, and will stop processing legacy Rev5 certification applications on June 11, 2027. It expects to publish transition paths and timelines for existing services by the end of fiscal year 2027.

The FedRAMP timeline and the What’s Changing page add three dates contractors should track:

None of these dates force you to change providers. They tell you when the labels on vendor documents are likely to change.

Is Class C the same as FedRAMP Moderate?

Not by FedRAMP’s own description. The Certification Classes page says Class C is “adequate for use in most Low or Moderate impact agency information systems.” The same page also states: “Agencies should not treat Certification Classes as one-for-one replacements for Low, Moderate, or High impact levels.”

That guidance is written for federal agencies choosing services for their own systems. It does not address defense contractors or DFARS. Still, it means a vendor’s statement that “Class C equals Moderate” is a simplification, not FedRAMP’s position.

What does DFARS 252.204-7012 still require?

Paragraph (b)(2)(ii)(D) of DFARS 252.204-7012 applies when you use an external cloud service provider to store, process, or transmit covered defense information. You must “require and ensure” that the provider meets security requirements equivalent to the FedRAMP Moderate baseline. The provider must also comply with the clause’s paragraphs (c) through (g), which cover incident reporting, malicious software, media preservation, forensic access, and damage assessment.

The DoD CIO’s FedRAMP Moderate Equivalency memo, dated December 21, 2023, explains how DoD reads that paragraph:

• Offerings that are FedRAMP Moderate Authorized and listed on the FedRAMP Marketplace can be used “without further assessment.”
• An offering claiming equivalency must reach 100 percent compliance with the latest FedRAMP Moderate baseline through a FedRAMP-recognized third-party assessor, with no open POA&Ms from that assessment.
• The contractor must validate the provider’s body of evidence and remains responsible for reporting incidents.

The memo predates Certification Classes and does not mention them. Until DoD addresses how classes map to the clause, the most defensible record for a Class-labeled vendor is one that shows how the offering meets the Moderate baseline language, plus written confirmation from your contracting officer where the answer is unclear.

Which vendor situations need a closer look?

Use the vendor’s own Marketplace listing, not its sales page, to decide which row applies.

Every row also needs the provider’s written commitment to the clause’s paragraphs (c) through (g). A strong FedRAMP status does not supply that commitment on its own.

What should you record now?

A short vendor review now saves a scramble later, when a provider’s documents change labels mid-contract.

1. List every cloud service that touches covered defense information. Include email, file sharing, backup, ticketing, and any tool that receives attachments.
2. Record each service’s FedRAMP status and the date you checked it. Save a copy of the Marketplace listing with the record.
3. File the customer responsibility matrix with your System Security Plan. The DoD memo expects contractors using an equivalent offering to provide it to assessors.
4. Confirm the incident reporting path. Know how the provider will notify you, since the memo puts reporting responsibility on you. Our guide to 72-hour reporting covers the clause timing.
5. Put the three FedRAMP dates on your compliance calendar. Re-check each vendor’s listing after January 1, 2027 and again after June 11, 2027.

If a vendor’s status changes from Moderate to a class label, update the record and ask the contracting officer the question in the table. Keep the written answer.

Where IRONKEEP stands

IRONKEEP is pursuing FedRAMP authorization but is not currently authorized. If you evaluate IRONKEEP, apply the same table above, and confirm with your contracting officer how its status fits your contract before using it for covered defense information.

If your vendor review shows mail, files, and chat spread across providers with different statuses and different evidence, request a defense pilot to compare one consolidated workflow with IRONKEEP. Use synthetic files, define the evidence your reviewer needs, and confirm deployment suitability and contractual requirements before introducing controlled information.

Assign the vendor review

Give one person ownership of the cloud vendor list and a date to finish the first pass. Bring the completed table to your contracts lead, and send the contracting officer any questions about Class-labeled services in writing.

Revisit the list when FedRAMP publishes its transition paths, and again if DoD updates its equivalency guidance. Each record should show what the vendor held, when you checked, and who confirmed it met the clause.