By Michael Branson, Founder and COO, i3solutions

The question usually arrives secondhand. A prime’s security lead asks whether your application is FedRAMP High, a proposal manager repeats it into a capture meeting, and by the time it reaches the people who would have to build the thing it has hardened into a requirement nobody can trace to a clause. Sometimes it is a real requirement. More often it is a correct question asked about the wrong object, because the person asking has confused the platform your application runs on with the application itself, and the two are authorized by different parties under different rules.

Is FedRAMP High authorization required for developing government contractor applications?

Usually no. FedRAMP authorizes a cloud service offering sold to federal agencies, not a contractor’s development work. Most contractor applications inherit controls from an authorized platform such as Azure Government or GCC High, and the binding regimes are NIST SP 800-171, DFARS and CMMC. FedRAMP becomes yours only if you offer the application to agencies as a shared service.

What follows is the scope test that decides whether FedRAMP reaches you at all, the three build situations that produce three different answers, where the word “High” actually comes from, what an authorized platform gives you and what it does not, and the boundary cases where two reasonable people would rule differently. Every regulatory statement below is linked to its primary source with the date that source carried when this page was written.

1. What FedRAMP authorization is attached to

FedRAMP authorizes a cloud service offering. Not a company, not a development methodology, and not a line of code. The program’s own scope statement is narrow and worth reading literally: in scope are cloud computing products and services, such as IaaS, PaaS and SaaS, “that create, collect, process, store, or maintain Federal information on behalf of a Federal agency” (FedRAMP, Scope of FedRAMP, Consolidated Rules for 2026).

The exclusions are where most contractor applications land. FedRAMP’s published out-of-scope list includes “information systems that are only used for a single agency’s operations, hosted on cloud infrastructure or platform, and are not offered as a shared service” (FedRAMP, Scope of FedRAMP). An application you build for a single agency, running inside that agency’s own boundary, is described by that sentence. It still needs to be secure, and it still needs an authorization, but the authorization it needs is the agency’s, not FedRAMP’s.

The direction of the obligation matters too. FedRAMP binds federal agencies to procure in-scope cloud services from the authorized set, and it binds a company only through that procurement: sell an in-scope cloud service to an agency and you have to be authorized, because the agency is not permitted to buy it otherwise. Nothing in the program reaches a contractor who is building software rather than selling a cloud service.

The rules themselves changed recently, which is one reason 2024-vintage advice on this question now reads slightly wrong. FedRAMP’s Consolidated Rules for 2026 took effect on 4 July 2026 as optional early adoption and “take mandatory effect for all stakeholders” on 1 January 2027, with new Rev5 certifications ending 11 June 2027 (FedRAMP, Important Dates for the Consolidated Rules for 2026). The vocabulary moved with them: the program now certifies a cloud service offering, and the agency issues the authorization.

2. Three build situations, three different answers

Almost every real case is one of the following. Decide which one you are in before anyone quotes a control count.

Situation A: you are building an internal application that handles CUI. A workflow app for your own contracts team, a data system your engineers use, a portal your subcontractors log into. FedRAMP does not reach this, because you are not offering a cloud service to an agency. What reaches it is DFARS 252.204-7012 and NIST SP 800-171, and now CMMC. There is one FedRAMP-shaped catch inside that regime, covered in section five: if you park the covered defense information on somebody else’s cloud, that cloud has to clear a FedRAMP Moderate bar.

Situation B: you are building an application delivered into a single agency’s environment. The agency owns the tenant or the subscription, the application lives inside a boundary the agency already had authorized, and the agency’s authorizing official signs. FedRAMP authorization is not yours to hold here and asking for it confuses the paperwork. Your job is to build so the agency’s assessor can accept the system, which means the control evidence has to exist in a form the agency’s package can absorb.

Situation C: you are offering the application to agencies as a service. Multi-tenant SaaS, one codebase, several agency customers, you operate it. This is the case FedRAMP was written for, and here the answer is yes, you need an authorization. It is also the case where the level question finally becomes real, and the answer to the level question is usually Moderate rather than High.

The distinction between B and C is not always obvious from the contract, and it is the single most common place this decision goes wrong. A system that starts as a single agency’s application and is later offered to another agency has changed category, and the security work that would have made that transition cheap has to be designed in at the start or paid for twice.

3. Where “High” comes from, and the three High words that are not the same thing

FedRAMP baselines are set by the impact of a loss of confidentiality, integrity or availability under FIPS 199, and there are three: Low, Moderate and High. High means severe or catastrophic effect. The size difference is real: the FedRAMP Moderate baseline has 323 controls and the FedRAMP High baseline has 410 (FedRAMP Security Controls Baseline (Rev 5), FedRAMP.gov). Nothing about being a government contractor puts your data at High. The categorization follows the information, and it is the government’s determination rather than yours.

Three separate things in this market carry the word High or the word Level, and they are routinely swapped for one another in requirements documents:

  • FedRAMP High is a civilian-side baseline of 410 controls describing the impact of a compromise on an agency’s mission (FedRAMP Security Controls Baseline (Rev 5), FedRAMP.gov).
  • GCC High is a Microsoft 365 environment name. Office 365 GCC High “is assessed using the National Institute of Standards and Technology (NIST) Special Publication 800-53 controls at a FIPS 199 High Categorization”, and Microsoft says it “can demonstrate equivalency to IL4 or necessary inheritance for CMMC” (Microsoft Learn, Office 365 GCC High and DoD service description, updated 3 August 2026, and Microsoft Learn, FedRAMP: Microsoft Compliance, updated 2 June 2026). Demonstrating equivalency to an impact level is not the same as holding that impact level’s authorization, and buying GCC High does not give your application a FedRAMP High authorization.
  • DoD Impact Levels are a separate DoD ladder. IL4 covers controlled unclassified information; IL5 covers CUI needing higher protection plus unclassified national security systems. Azure Government’s US Gov Arizona, Texas and Virginia regions carry FedRAMP High, DoD IL4 and DoD IL5 authorizations, and Azure Government does not handle IL6, which is classified up to Secret (Microsoft Learn, Azure Government DoD Overview, updated 8 September 2025).

When a prime’s questionnaire says “FedRAMP High required,” ask which of those three it means. In our experience the intended answer is frequently the second or third, and the cost difference between them is measured in hundreds of thousands of dollars over a program’s life.

4. What you inherit from an authorized platform, and what you do not

Building on an authorized platform is the mechanism that makes most of this affordable, and it is also the mechanism most often oversold. Inheritance is real and it is partial.

Microsoft states the boundary plainly for its own services: you can use the certifications of Microsoft cloud services “as the foundation for any program or initiative that requires an ATO from a federal government agency. However, you need to achieve your own authorizations for components outside these services” (Microsoft Learn, FedRAMP: Microsoft Compliance, updated 2 June 2026). Your application code, your configuration, your identity design and your data handling are components outside those services. They inherit nothing automatically.

FedRAMP says the same thing from the agency’s side, and the 2026 rules are unusually direct about it: “Agencies remain responsible for issuing their own ATO or ATU even when they rely on a FedRAMP Certification,” and “FedRAMP certifies the cloud service offering; the agency authorizing official accepts risk for the agency’s specific use of that service, including the information processed, the configuration selected, the integrations enabled, and the controls the agency is responsible for operating” (FedRAMP, Using a FedRAMP Certified Cloud Service, Consolidated Rules for 2026). The same page warns agencies not to simply authorize a cloud service offering by itself.

For the defense side the inheritance language is explicit. Microsoft says Office 365 GCC High “can demonstrate equivalency to IL4 or necessary inheritance for CMMC” (Microsoft Learn, Office 365 GCC High and DoD service description, updated 3 August 2026). Inheritance for CMMC is exactly the right phrase: the environment carries controls you would otherwise have to implement and evidence yourself, which shortens your assessment rather than replacing it.

Two boundary details are worth carrying into a design review because they surprise people at assessment time. GCC High and DoD are sold through a validation process rather than a trial, so eligibility is confirmed before an environment is established. And Microsoft states that GCC High and DoD customer support “isn’t included in the service accreditation boundary,” which means the support channel does not carry FedRAMP, DoD SRG, ITAR, IRS 1075 or CJIS data-handling assurances (Microsoft Learn, Office 365 GCC High and DoD service description, updated 3 August 2026). Anything sensitive that travels through a support ticket has left the boundary you paid for.

5. The regime that usually does bind the contractor

For a defense contractor building applications, the requirements that actually appear in the contract are these.

NIST SP 800-171 and DFARS 252.204-7012. Contractor information systems that process, store or transmit covered defense information implement the 800-171 requirements. The clause also contains the one place FedRAMP does reach a contractor indirectly: “If the Contractor intends to use an external cloud service provider to store, process, or transmit any covered defense information in performance of this contract, the Contractor shall require and ensure that the cloud service provider meets security requirements equivalent to those established by the Government for the Federal Risk and Authorization Management Program (FedRAMP) Moderate baseline” (DFARS 252.204-7012, clause date MAY 2024). Read the level: Moderate, and it is a requirement on your provider, not on your application.

What “equivalent” means was tightened by DoD CIO guidance rather than by the clause. The memorandum titled Federal Risk and Authorization Management Program Moderate Equivalency for Cloud Service Provider’s Cloud Service Offerings, published by the DoD Chief Information Officer and dated 21 December 2023, set the bar at a FedRAMP-recognized third-party assessment against the full FedRAMP Moderate baseline with no outstanding plan of action and milestones, plus a body of evidence available to DoD assessors. In practice, choosing a provider that already holds a FedRAMP Moderate or High authorization is the cheapest route through that requirement, because the alternative is proving equivalence yourself.

CMMC. This is now contractual rather than prospective. DFARS clause 252.204-7021, Contractor Compliance With the Cybersecurity Maturity Model Certification Level Requirements, carries a clause date of NOV 2025 and requires a contractor to “Have and maintain for the duration of the contract a current CMMC status at the following CMMC level, or higher” and to “Only process, store, or transmit FCI or CUI on contractor information systems that have a CMMC status at the CMMC level required” (DFARS 252.204-7021). The acquisition rule became effective 10 November 2025 and phases in over three years, beginning with Level 1 and Level 2 self-assessment requirements in new solicitations.

Notice what this means for the application you are building. Its home has to sit inside a system that carries the required CMMC status. That is a statement about your environment and your boundary, and it is a far more common blocker than FedRAMP ever is.

i3solutions runs migrations against named control families across CMMC, HIPAA, SOC 2, and NIST 800-171, producing artifacts auditors can review. i3solutions has successfully delivered software development projects under CMMC, HIPAA, ITAR, and SOC 2 compliance frameworks with audit-ready documentation and governance practices built into our standard delivery methodology. The pattern that holds across those programs is that the evidence is produced by the build rather than written about it afterwards.

6. Where this is genuinely ambiguous

Three boundaries in this decision are matters of judgment, and a page that flattened them would be misleading you.

“Offered as a shared service” is a judgment, not a switch. FedRAMP’s out-of-scope category turns on whether a system serves a single agency’s operations and is not offered as a shared service (FedRAMP, Scope of FedRAMP). An application built for a single agency that another agency later wants to use has moved, and the moment of the move is not marked by anything in your code. Decide with the sponsoring agency in writing, early, and revisit it when the next customer appears.

Scope is applied per agency use case, not per product. The same application can be in scope for a single agency’s use and out of scope for another’s, because the categorization of the information and the way the agency integrates the system differ. Different agencies can reach different answers about the same software and both be right.

Moderate equivalency is contested ground. The equivalency route exists in the DFARS clause and was defined by a DoD CIO memorandum dated 21 December 2023, and FedRAMP’s own program rules were rewritten under the Consolidated Rules for 2026. Whether and how the new rules change what a contractor may rely on for equivalency is being argued in the assessor community. If your architecture depends on an equivalency claim rather than an actual FedRAMP authorization, put that dependency in front of your contracting officer rather than in front of an assessor for the first time at audit.

Where the boundary is unclear, the cost of asking is one conversation and the cost of guessing is a re-architecture. i3solutions advises clients on federal compliance posture as its own assessment rather than as a restatement of Microsoft’s documentation, including whether SharePoint Online meets NIST 800-53, whether Azure Government is required under the DoD Cloud Computing SRG, and whether a CMMC gap assessment is needed to bid.

Schedule a 30-minute scoping call

7. What this changes in a build, and what it costs

The decision has a sequence, and running it in this order is what keeps the cost in the band rather than above it.

  1. Get the information categorization from the government, in writing. FCI, CUI, CUI needing higher protection, or unclassified national security system data. Everything downstream follows from this, and it is not a determination a vendor can make for you.
  2. Decide which of the three situations you are in, and get the sponsoring agency or prime to confirm it. This is the step that decides whether FedRAMP is your problem at all.
  3. Choose the environment on the evidence, not on the requirement someone repeated. Commercial, GCC, GCC High, Azure Government or a DoD region are five different cost and capability positions.
  4. Design for inheritance. Put the controls the platform already carries on the platform, and keep your application’s residual control surface small and documented. This is what makes an assessment a review rather than a rebuild.
  5. Produce the evidence as you build. Control mappings, boundary diagrams, audit configuration and a runbook, all dated and reviewable.

On cost, three figures anchor the range without pretending to price your estate. Organizations facing CMMC Level 2 certification consistently discover 15-25 configuration gaps during Microsoft environment assessment. That remediation is real work rather than paperwork. A CMMC Level 2 implementation for a defense contractor with a defined CUI boundary typically ranges from $45,000 to $75,000, covering the Compliance Manager baseline assessment, Conditional Access redesign, DLP policy build and testing, Purview Audit Premium configuration, and post-implementation documentation. Regulated-industry SharePoint modernization carries roughly 25 to 35 percent cost overhead versus commercial work for equivalent scope, driven by control mappings, audit-trail discipline, and zero-downtime cutover patterns.

If you are genuinely in situation C and have to pursue an authorization of your own, expect a different order of magnitude in time as well as money. Industry guidance as of 2026 commonly places a government-cloud deployment with a FedRAMP authorization in the range of nine to thirteen months when control inheritance from Azure Government is leveraged, and longer without it, with cost scaling to the number and complexity of workloads. An unnecessary trip through that timeline is the most expensive mistake available on this question.

The environment decision can also go the other way from the default, and it is worth seeing an assessment that landed there. The assessment recommended partial-variant adoption with email and document storage on GCC High and the remainder of the productivity suite on Commercial; the contractor’s licensing economics improved materially relative to a full GCC High migration.

8. Where i3solutions fits, and what it does not claim

The record first, so you can weigh it rather than take it. i3solutions is an SBA certified small business providing technical and professional services to US Federal Agencies, the DoD and the private sector. i3solutions is a Microsoft Solutions Partner. i3solutions has been a Microsoft partner since 1997 and has delivered 600+ implementations across aerospace and defense, financial services, and health sciences. i3solutions installs and helps configure applications inside IL4 and IL6 government cloud environments and other government networks. i3solutions has deployed Power BI inside a GCC High tenant and inside Azure Government for a federal customer. i3solutions plans and runs governed Azure and Microsoft 365 migrations with senior, U.S.-based engineers. i3solutions provides dedicated US-based Microsoft teams for aerospace and defense programs.

The compliance work has a named shape rather than a promise. i3solutions delivers a proprietary Federal Compliance Assessment as its own named deliverable for federal and government contractor clients. The i3solutions Federal Compliance Assessment evaluates a client tenant against NIST SP 800-53 and CMMC using automated tenant configuration scripts and a 42-point security checklist. i3solutions engages its Federal Compliance Assessment when the scope spans a FedRAMP Moderate or FedRAMP High boundary, or when the client operates in a GCC High tenant. For government cloud infrastructure work, i3solutions produces three named artifacts across an Azure Government or AWS GovCloud engagement: an Architecture Fit Assessment at discovery, a Landing Zone Blueprint and Compliance Matrix at design, and a Migration Risk and Cutover Runbook at execution, each one a mandatory gate check before the engagement moves to the next phase. We manage GCC High migrations end-to-end: from eligibility validation and licensing coordination with your AOS-G supplier through identity architecture, data migration, security baseline configuration, and post-migration governance. i3Solutions plans and runs these migrations for regulated defense organizations, structuring each phase around the compliance evidence assessors expect.

Delivery inside the defense estate runs governance-led. i3solutions runs a governed Power Platform for a federal defense agency supporting roughly 10,000 personnel across about 180 locations, which works because it is governed, not despite it. In a National Guard payroll engagement the finding was narrower and just as checkable. Error rates that once averaged around 1% per payroll cycle were nearly eliminated, closing prior audit findings and ensuring compliance with federal reporting standards. That account is in the National Guard payroll modernization case study. More broadly, i3solutions has delivered enterprise SharePoint and Power Platform programs for aerospace and defense manufacturers, major defense organizations, a financial-services firm, a national healthcare system, and military organizations.

What i3solutions does not do is hold or issue an authorization. i3solutions does not hold a FedRAMP authorization, does not accredit a system, and does not issue an authority to operate. Those determinations sit with the government: FedRAMP certifies a cloud service offering, and the agency authorizing official accepts the risk for the agency’s specific use. Any firm implying it can hand you an ATO is describing something that is not theirs to give.

The fit is a federal agency or a government contractor that needs this question settled before an architecture is committed: which situation the application is in, what the sponsoring agency has to confirm in writing, which environment the evidence points to, and what control evidence the build has to produce as it goes.

Schedule a Federal Compliance Assessment

Frequently asked questions

Is FedRAMP High required for developing government contractor applications?

Usually not. FedRAMP authorizes a cloud service offering sold to federal agencies, and its published scope covers cloud products and services that create, collect, process, store or maintain federal information on behalf of an agency (FedRAMP, Scope of FedRAMP). Building an application for internal use or for a single agency’s environment is not that. The requirements that normally apply are NIST SP 800-171, DFARS 252.204-7012 and CMMC. FedRAMP applies to you when you offer the application to agencies as a shared cloud service, and even then the level is set by the government’s categorization of the information, which is Moderate far more often than High.

Does building on Azure Government or GCC High make my application FedRAMP authorized?

No, and this is the most expensive misunderstanding in the market. Microsoft states you can use its cloud service certifications as the foundation for a program requiring an agency ATO, but that “you need to achieve your own authorizations for components outside these services.” Your code, configuration, identity design and data handling are outside those services. What the platform gives you is inheritance, which reduces the controls you have to implement and evidence yourself. Microsoft describes GCC High as able to demonstrate equivalency to IL4 or necessary inheritance for CMMC, and inheritance is the accurate word.

What is the difference between FedRAMP High, GCC High and DoD IL5?

Three different things that share vocabulary. FedRAMP High is a 410-control baseline for cloud services whose compromise would have a severe or catastrophic effect, against 323 controls at Moderate (FedRAMP Security Controls Baseline (Rev 5), FedRAMP.gov). GCC High is a Microsoft 365 environment assessed using NIST SP 800-53 controls at a FIPS 199 High categorization, which Microsoft says can demonstrate equivalency to DoD IL4 (Microsoft Learn, Office 365 GCC High and DoD service description). DoD IL5 is a Defense Department impact level covering CUI needing higher protection and unclassified national security systems (Microsoft Learn, Azure Government DoD Overview). When a requirement document says “FedRAMP High,” ask which of the three it means before you price anything.

When does a contractor actually need its own FedRAMP authorization?

When the application is offered to federal agencies as a cloud service that they procure and use, rather than a system operated inside a single agency’s own authorized boundary. FedRAMP’s out-of-scope list explicitly excludes information systems used only for a single agency’s operations that are not offered as a shared service (FedRAMP, Scope of FedRAMP). The practical trigger is an additional agency customer, so if another customer is plausible, decide the question at design time rather than after the first is live.

How does FedRAMP relate to DFARS 252.204-7012?

Through your cloud provider rather than through your application. The clause requires that if you use an external cloud service provider to store, process or transmit covered defense information, you ensure that provider meets security requirements equivalent to the FedRAMP Moderate baseline (DFARS 252.204-7012). That is Moderate, not High, and it is an obligation on the provider you select. DoD CIO guidance dated 21 December 2023 defined equivalency as a third-party assessment against the full Moderate baseline with no outstanding plan of action and milestones. Selecting a provider that already holds a FedRAMP authorization is normally cheaper than proving equivalence.

Does CMMC require FedRAMP?

Not directly. CMMC is now contractual through DFARS clause 252.204-7021, which carries a NOV 2025 clause date and requires a current CMMC status at the level the contract specifies, with FCI and CUI processed only on systems carrying that status. Where FedRAMP enters is through the cloud-provider condition in DFARS 252.204-7012 and through inheritance: an environment such as GCC High carries controls that shorten a CMMC assessment. Your CMMC status is a fact about your systems and your boundary, and no platform purchase produces it on its own.

Who issues the authorization if my application runs inside an agency’s environment?

The agency does. FedRAMP’s Consolidated Rules for 2026 put it directly: agencies remain responsible for issuing their own ATO even when they rely on a FedRAMP certification, and the agency authorizing official accepts risk for the information processed, the configuration selected, the integrations enabled, and the controls the agency operates. Your job in that arrangement is to produce control evidence the agency’s package can absorb, which is a build discipline rather than a document written afterwards.

Can a consulting firm certify my application or get it an ATO?

No. FedRAMP certifies a cloud service offering and an agency authorizing official issues the authorization to operate. A consulting firm cannot do either, and i3solutions does not hold a FedRAMP authorization, accredit systems, or issue authorities to operate. What a firm can do is decide the environment question on evidence, design the application so inheritance does the heavy lifting, and produce the control artifacts so the assessment is a review. Treat a vendor implying more than that as a disqualification rather than a differentiator.

Sources

Related