FedRAMP Moderate equivalency: what DoD asks of your cloud
Published 2026-10-23, 14 min read
FedRAMP Authorized at Moderate or higher
Listed on the FedRAMP Marketplace at Moderate or High. The DoD memo says such offerings need no further assessment.
Keep on file
- The Marketplace listing, printed with its date
- The provider's Customer Responsibility Matrix, in your SSP
32 CFR 170.16(c)(2)(i); memo p. 1
FedRAMP Moderate equivalent
Not authorized, but 100 percent of the latest Moderate baseline, assessed by a FedRAMP-recognized 3PAO.
Keep on file
- The body of evidence: 24 documents
- A 3PAO assessment every year
- The CRM, for DIBCAC and assessors
32 CFR 170.16(c)(2)(ii); memo pp. 1–3
Everything else
In Process, a vendor's letter, a SOC 2 report: none is a route on its own. A 20x class: ask in writing first.
Keep on file
- No CUI in the service until a route is met
- Your prime's or CO's written answer, if you ask
DFARS 7012(b)(2)(ii)(D)
- In force today
- DFARS 252.204-7012 still applies: NIST SP 800-171 Rev 2 on systems that hold covered defense information, cyber incidents reported to DoD within 72 hours, and FedRAMP Moderate or equivalent for any cloud that holds it. DFARS 252.204-7012(b)(2), (c)
- Suspended
- Phase 2, due in November 2026, is suspended for every contractor, whatever its size: contracts are not adding the third-party Level 2 (C3PAO) or Level 3 (DIBCAC) requirements. DoW CIO memo of 2026-07-13, applied by Class Deviation 2026-O0025 Rev 3
- Not yet known
- The outcome of the CMMC Reform Task Force review is not confirmed as of 2026-10-23: no report or rule change has been published. Federal Register search, 2026-10-23
Two rules, one test
Equivalency comes from one sentence of DFARS 252.204-7012. A cloud provider that stores, processes or transmits covered defense information must meet security requirements equivalent to the FedRAMP Moderate baseline and follow 7012(c)–(g). The whole clause is walked through in DFARS 252.204-7012 explained; the words that matter here are these:
“Equivalent” is not defined in the clause. The CMMC rule, 32 CFR Part 170, splits the cloud question into two routes and then points elsewhere for what the second one means. For a Level 2 self-assessment it reads:
“DoD Policy” is the DoD CIO memo of 2023-12-21, FedRAMP Moderate Equivalency for Cloud Service Provider's Cloud Service Offerings. It is three pages long and it is the only DoD document we found that says what “equivalent” has to look like. The same paragraph of Part 170 adds that your own systems connecting to the cloud are in your assessment scope, and that the provider's Customer Responsibility Matrix is documented or referred to in your SSP.
One more thing to know before you read on: the word in the clause is “covered defense information”, which is the CUI your contract hands you. If you are not sure what in your shop counts, start with what CUI is. A cloud that holds only your logs, settings or passwords is a different case; the scoping worksheet sorts those.
The DoD memo, line by line
The memo is signed by David W. McKeown, Deputy DoD CIO for Cybersecurity, and addressed to DoD's own leadership, not to contractors. Shops still live by it, because Part 170 points to it and the memo has DIBCAC review a provider's evidence against it. In short: an equivalent cloud offering must reach 100 percent compliance with the latest FedRAMP Moderate baseline, assessed by a FedRAMP-recognized 3PAO, and give the contractor the body of evidence. FedRAMP Moderate Authorized offerings need no further assessment.
“This memorandum does not confer FedRAMP Moderate Authorization to CSOs that meet the criteria for equivalency.” p. 1
An equivalent cloud is not on the Marketplace because of the memo. Equivalency is something you file, not something you look up.
“FedRAMP Moderate Authorized CSOs identified in the FedRAMP Marketplace … can be leveraged without further assessment to meet the equivalency requirements.” p. 1
If the service is Authorized at Moderate or High, the memo does not apply to it. The rest of this page is for services that are not.
“CSOs must achieve 100 percent compliance with the latest FedRAMP moderate security control baseline through an assessment conducted by a FedRAMP-recognized Third Party Assessment Organization (3PAO)” p. 1
Every control, not most of them, checked by an assessor FedRAMP recognizes. A SOC 2 report or the provider's own review does not meet this.
“DoD requirements for FedRAMP Moderate Equivalency do not allow for POA&M's resulting from a 3PAO assessment of the CSP's CSO.” p. 2
Every finding from that assessment is fixed and validated closed. Only operational POA&M items, not from the 3PAO assessment, may stay open.
“… with the CSP required to have an Annual Assessment conducted by a 3PAO validating compliance with DFARS clauses 252.204-7012 and 252.204-7020.” p. 3
One assessment is not enough. Ask for the date of the last one and put the next on your calendar.
“The onus is on the contractor to validate the BoE provided by the 3PAO meets the Moderate Equivalent standards outlined in this memo” p. 3
You, the shop, decide whether the package is good enough, and you answer for that decision.
“The contractor, not the CSO's CSP, will be held responsible for reporting in the event of CSO compromise.” p. 3
If the provider is breached, the 72-hour report to DoD is yours. Get their notification promise in writing.
Read together, the sentences turn a vendor's “we are FedRAMP equivalent” into a test you run. The provider brings the evidence; you judge it; DIBCAC may check your judgment later. Nothing in the memo lets a provider certify itself, and nothing lets an open finding from the 3PAO assessment ride along on a plan of action.
The body of evidence, document by document
The memo lists 24 documents under four headings: the system security plan, the security assessment plan, the security assessment report and the plan of action and milestones. The provider presents them to you. Below, each one is in the memo's own words, with a line from us on what it tells a shop that has to sign off on it.
FedRAMP Moderate equivalency: the body of evidence (DoD CIO memo, 2023-12-21), cuideck.com
| Document (the memo's words) | What it tells you |
|---|---|
| System Security Plan (SSP) | |
| Information Security Policies and Procedures (covering all control families) | Every control family has a written policy. A gap here is a gap in the baseline. |
| User Guide | How your people are meant to use the service securely: the settings you own. |
| Digital Identity Worksheet | How strongly the provider proves who is signing in. |
| Rules of Behavior (RoB) | FedRAMP's template: "Describes the security controls associated with user responsibilities". |
| Information System Contingency Plan (ISCP) | What happens to your files if the provider's site goes down. |
| Incident Response Plan (IRP) | The plan the memo makes you confirm. Look for how and when they notify you. |
| Configuration Management Plan (CMP) | How the provider controls changes to the service. |
| Control Implementation Summary (CIS) Workbook | FedRAMP's template: it "Delineates the control responsibilities of CSPs and agencies". Your share is in here. |
| Federal Information Processing Standard (FIPS) 199 | The provider's own impact rating of the system. You are looking for Moderate or High. |
| Separation of Duties Matrix | Which provider roles can do what, so one admin cannot do everything. |
| Applicable Laws, Regulations, and Standards | What the provider says it is built to. Look for DFARS 7012 by name. |
| Integrated Inventory Workbook | Every component inside the assessed system. The service you buy should be in it. |
| Security Assessment Plan (SAP) | |
| Security Test Case Procedures | What the assessor planned to test, control by control. |
| Penetration Testing Plan and Methodology, conducted annually and validated by a FedRAMP-recognized 3PAO | This year's plan, not one from a past year. |
| FedRAMP-recognized 3PAO Supplied Deliverables (e.g., Penetration Test Rules of Engagement, Sampling Methodology) | The assessor's own papers. They name the 3PAO you check on the Marketplace. |
| Security Assessment Report (SAR) performed by a FedRAMP-recognized 3PAO | |
| Risk Exposure Table | FedRAMP's template is "designed to capture all security weaknesses and deficiencies" found in testing. |
| Security Test Case Procedures | The tests as run, with results. Compare them with the plan. |
| Infrastructure Scan Results, conducted monthly and validated annually by 3PAO | Monthly scans, not one clean scan picked for the file. |
| Database Scan Results, conducted monthly and validated annually by a FedRAMP-recognized 3PAO | The same, for the databases behind the service. |
| Web Scan Results, conducted monthly and validated annually by a FedRAMP-recognized 3PAO | The same, for the web front ends you sign in to. |
| Auxiliary Documents (e.g., evidence artifacts) | The evidence the assessor relied on. |
| Penetration Test Reports | What the testers got into, and what was fixed. |
| Plan of Action and Milestones (POA&M) | |
| Continuous Monitoring Strategy (required by CA-7) | How the provider keeps watching the controls between assessments. |
| Continuous Monitoring Monthly Executive Summary, validated annually by a FedRAMP-recognized 3PAO | FedRAMP's template: "an executive summary of a CSP's monthly continuous monitoring submission". |
Plus the memo's conditions: no open POA&M items from the 3PAO assessment, a 3PAO assessment every year validating DFARS 7012 and 7020, and a Customer Responsibility Matrix you can hand to DIBCAC and assessors.
To tick them off as they arrive, use the evidence checker in CMMC vs FedRAMP.
Two things the list does not say out loud. First, the documents describe one system: check that the service you will actually use (the email, the file share, the sync client) sits inside it, in the inventory workbook and the assessment scope. Second, the dates matter as much as the titles. Scans are monthly and validated each year, and the 3PAO assessment is annual, so a package that is two years old is not the package the memo describes.
Who answers for what
The memo names four parties. Only one of them signs your contract, and that one carries the most lines. The provider's side of each duty, set against yours row by row, is in CMMC vs FedRAMP; here is the whole cast.
The contractor holding the CUI
- Approve the use of the service for your company. p. 3
- Check that the body of evidence meets the memo's standard. The onus is yours. p. 3
- Confirm the provider has an incident response plan, follows it and can notify you. p. 3
- Hand the Customer Responsibility Matrix to DIBCAC and 3PAO assessors. p. 3
- Report a compromise of the service. DFARS 7012 sets 72 hours. p. 3; 7012(c)
The company running the service
- Meet 100 percent of the latest FedRAMP Moderate baseline. p. 1
- Present the body of evidence to you. p. 1
- Have a 3PAO assess it every year, validating DFARS 7012 and 7020. p. 3
- Follow 7012(c)–(g): incident reporting, malware, media, forensics, damage assessment. 7012(b)(2)(ii)(D)
The provider's assessor
- Be FedRAMP-recognized. The Marketplace's Assessor tab lists them. p. 1
- Assess the service against the full Moderate baseline. p. 1
- Validate every POA&M action from its assessment as closed. p. 2
- Validate the monthly scans and the pen-test plan each year. p. 2
DCMA's assessment center
- Regularly validate compliance with DFARS 7012 and 7020. p. 3
- Review the provider's body of evidence for equivalency. p. 3
- Receive your Customer Responsibility Matrix. p. 3
If your company uses a managed service provider for the cloud tenant, it is not a fifth party in the memo. It works for you, so its checks are your checks; the CMMC MSP compare covers what to ask of one.
Where FedRAMP 20x classes fit
FedRAMP is changing how it certifies. Some offerings are certified through the FedRAMP 20x pilot, and the product page shows it in the listing's certification profile: its Type (20x or Rev5), its Path (Program or Agency), and its Class (A–D, reflecting documentation and ongoing reporting requirements). A 20x pilot listing reads Type “20x Pilot”, Path “Program”.
The classes line up with the old impact levels in name: Class B (LI-SaaS, Low), Class C (Moderate), Class D (High). That is where shops get caught. No DoD source we read says a 20x class counts as FedRAMP Moderate under DFARS 252.204-7012, and the 2023 memo predates the pilot and does not mention it. Three 20x Class C listings, read on 2026-10-22:
- Vanta Government CloudCertified 20x (Moderate)
- Paramify CloudCertified 20x (Moderate)
- Secureframe PlatformCertified 20x (Moderate)
Every CuiDeck page marks these listings partial for that reason alone, not because anything is wrong with the offerings. The question will matter more each year: FedRAMP Ready went legacy on 2026-07-28; the Consolidated Rules for 2026 take mandatory effect on 2027-01-01; FedRAMP accepts no new Rev5 certification applications after2027-06-11.
How to check a provider in six steps
This is the order we would work in for any cloud service a shop is about to buy, from email to a file share to a compliance tool. A service listed at Moderate or High clears in steps 1 to 4 and 6; one that is not listed needs step 5, and that is where the time goes.
- 01
Find the exact service, not the company
Search the FedRAMP Marketplace for the product you will use. One company can hold several listings at different classes: Microsoft has two packages under the same GCC name, one certified at Moderate and one In Process at High.
fedramp.gov/marketplace
- 02
Read the status, the type and the class
FedRAMP Certified, Type Rev5, at Class C (Moderate) or Class D (High) is Route 1. Initial Implementation, (Legacy) FedRAMP Ready and either In Process status are not authorized yet. A 20x class goes to your prime or CO in writing.
32 CFR 170.16(c)(2)(i)
- 03
Check your service is inside the listing
The Overview tab lists the included services within the minimum assessment scope. If the part you will put CUI in is not named there, the listing does not cover it.
Marketplace guide
- 04
Get the Customer Responsibility Matrix
Both routes end here. The CRM says which controls are yours; your SSP documents or refers to them, and your side of the connection is in your assessment scope.
32 CFR 170.16(c)(2)(iii)
- 05
No listing at Moderate or above? Ask for the evidence
Request the full body of evidence. Check the named 3PAO on the Marketplace's Assessor tab, and check the dates of the last annual assessment and the monthly scans.
DoD CIO memo, pp. 1–3
- 06
Write the decision down, then re-check
File the listing or the evidence, the date you read it, the provider's incident notification terms and any written answer from your prime or CO. FedRAMP's own guide says to verify the status has not changed before you finalize an agreement.
memo p. 3; Marketplace guide
Three real listings, read the way the steps say. The status word is the one every CuiDeck compare page uses; the type, path and class are the Marketplace's own fields.
Certified (Moderate)
- Status
- FedRAMP Certified
- Type
- Rev5
- Path
- Agency
- Class
- Class C (Moderate)
Route 1 for the services inside it. Check that the one you use is in its scope, then get the CRM.
Read 2026-10-22
Certified 20x (Moderate)
- Status
- FedRAMP Certified
- Type
- 20x Pilot
- Path
- Program
- Class
- Class C (Moderate)
Certified, but through the 20x pilot. Ask your prime or CO in writing before CUI goes in.
Read 2026-10-22
In Process (High)
- Status
- Agency Authorization In Process
- Type
- Rev5
- Path
- Agency
- Class
- Class D (High)
Not authorized yet. Until it is, treat it as a Route 2 claim and ask for the evidence.
The same company's Kiteworks Federal Cloud is a separate listing: Certified (Moderate).
Read 2026-10-22
The same reading, applied to whole product categories, is in the compares for CMMC email, ITAR file sharing and GCC High alternatives.
Questions shops ask about equivalency
Is FedRAMP Moderate equivalent the same as FedRAMP Authorized?
No. The memo says in its first paragraph that it “does not confer FedRAMP Moderate Authorization” on an offering that meets the equivalency criteria. An equivalent service is not on the Marketplace because of it; what proves equivalency is the body of evidence in your files.
Is a FedRAMP High service good enough?
Yes. Part 170 asks for FedRAMP Authorized “at the FedRAMP Moderate (or higher) baseline”, so a High authorization clears the bar. You still need its Customer Responsibility Matrix in your SSP.
Does a SOC 2 report or an ISO 27001 certificate prove equivalency?
Not on its own. The memo asks for 100 percent of the latest FedRAMP Moderate baseline, assessed by a FedRAMP-recognized 3PAO, and a specific set of documents. A SOC 2 or ISO report can sit beside that package; it does not replace it. Where ISO 27001 helps your own program is in CMMC vs ISO 27001.
Our cloud tool only holds logs and passwords. Does it need equivalency?
No. A cloud provider that holds only Security Protection Data (configuration data, logs, vulnerability status, passwords for the in-scope environment) is in your assessment scope as a Security Protection Asset, and is assessed with you. FedRAMP is the test for a provider that holds CUI.
We only handle FCI, not CUI. Does any of this apply?
The equivalency test sits in DFARS 7012 and is about covered defense information, which is CUI. Federal contract information alone falls under FAR 52.204-21 and CMMC Level 1, which have no FedRAMP rule. Check which one you really hold with FCI vs CUI before you buy anything.
Did the CMMC Phase 2 suspension change the cloud rule?
No. The cloud test comes from DFARS 252.204-7012, which the status box near the top of this page shows as in force. The suspension is about third-party assessments, not about where CUI may be stored. The full picture is on CMMC status today.