The Uptime report

Uptime Report Research · Federal Cloud

FedRAMP Statistics 2026: 517 Authorized Cloud Services, and How Few of Them Carry Federal Demand

FedRAMP statistics can say more than a count of authorized products. GSA’s marketplace data, current to May 19, 2026, shows when each service was authorized, how long it took, which assessor reviewed it, and how many federal agencies use it. We analyzed every product in the dataset. Among currently authorized services, more were authorized in 2025 than in any other year, but federal demand still flows to a small group of them.

Version 1.0 · Published October 19, 2026 · Data as of GSA marketplace data, last changed May 19, 2026

517FedRAMP authorized cloud services

Key findings

  1. 517 cloud services held a FedRAMP authorization in GSA’s marketplace data as of May 19, 2026: 347 at Moderate impact, 88 at High, 54 at Low or LI-SaaS, and 28 at FedRAMP 20x levels (16 Low, 12 Moderate).
  2. 140 of today’s authorized services were authorized in 2025, the most of any year and 3.0 times the 46 of 2024; 52 more were authorized in 2026 through May 19, 2026.
  3. Federal use is concentrated: the top 10% of authorized products account for 55% of all 3,228 agency authorizations (Gini coefficient 0.66), while 226 products (44%) have exactly one.
  4. The median time from a product’s first in-process date to authorization was 346 days for agency authorizations, 220 for JAB, and 76 days for program authorizations, almost all of them FedRAMP 20x (Mann-Whitney U, program faster than agency, p < 0.001).
  5. 31 third-party assessment organizations (3PAOs) are named on authorized products; the three largest assessed 55% of products with a named assessor, and the assessor market’s HHI is 1,408, below the 1,800 threshold for a highly concentrated market in the 2023 Merger Guidelines.
  6. Microsoft and Amazon products together hold 14% of agency authorizations.

Authorizations by year

413
714
915
1516
1617
2118
4219
4220
3621
4722
4023
4624
14025
5226

Currently authorized products by year of authorization. Products that were authorized and later left the marketplace are not counted. 2026 is through May 19, 2026.

How concentrated is federal use?

Products, fewest to most authorizationsShare of all authorizationsGini 0.66

Each product’s agency authorizations count how many federal agencies have authorized it for use. The 51 most-used products hold 55% of all authorizations, and the curve’s Gini coefficient of 0.66 sits closer to total concentration than to an even spread.

Provider Agency authorizations Share
Microsoft 254 7.9%
Amazon 189 5.9%
ServiceNow 98 3.0%
Zscaler, Inc. 73 2.3%
Salesforce 64 2.0%
Oracle 57 1.8%
Box Inc. 51 1.6%
Adobe 48 1.5%

How long authorization takes

Authorization type Products with an in-process date Median days Interquartile range
Agency 432 346 210 to 503
JAB 54 220 128 to 354
Program 28 76 35 to 93
Year authorized 2019 2020 2021 2022 2023 2024 2025 2026
Median days 307 284 228 245 415 510 316 207

The assessor market

3PAO Authorized products assessed Share
Schellman Compliance, LLC 140 27.3%
Coalfire Systems, Inc. 79 15.4%
A-LIGN Compliance and Security, Inc. dba A-LIGN 63 12.3%
Fortreum, LLC 54 10.5%
Kratos 48 9.4%
Lunarline, Inc. 37 7.2%
Emagine IT 16 3.1%
First Information Technology Services, Inc. 12 2.3%

What this means for MSPs and cloud providers

For an MSP serving federal agencies or contractors, the authorized product list defines what can be deployed. For a provider pursuing authorization, the data shows two things: the program route, including 20x, has been far faster than the agency route, and authorization alone does not bring demand, since most authorized products are used by one or two agencies.

Frequently asked questions

How many FedRAMP authorized cloud services are there?

517 as of May 19, 2026, according to the GSA marketplace data file, with 66 more designated FedRAMP Ready and 67 in process.

How long does FedRAMP authorization take?

Measured from the earliest in-process date on record to the authorization date, the median is 312 days across 514 authorized products; 346 days for agency authorizations and 76 days for program authorizations.

What is FedRAMP 20x?

FedRAMP describes 20x as a new approach to cloud security assessment and authorization that focuses on the security decisions that matter most rather than traditional compliance. 28 authorized products in the marketplace data carry a 20x impact level, and 28 of the 29 program authorizations are 20x products.

Which cloud providers have the most FedRAMP authorizations?

By agency authorizations: Microsoft (254), Amazon (189), ServiceNow (98), Zscaler, Inc. (73), Salesforce (64).

Who are the largest FedRAMP 3PAOs?

By authorized products assessed: Schellman Compliance, LLC (140), Coalfire Systems, Inc. (79), A-LIGN Compliance and Security, Inc. dba A-LIGN (63).

Download the data. fedramp-marketplace-products-2026.csv (CSV). Licensed under CC BY 4.0: free to reuse with attribution to The Uptime Report.
Data dictionary (10 fields)
id / cso / csp Marketplace product ID, cloud service offering, and provider
status FedRAMP Authorized, FedRAMP Ready, In Process, or Agency In Process
impact_level Low, LI-SaaS, Moderate, High, or 20x levels
auth_type Agency, JAB, or Program
auth_date Authorization date
first_in_process_date Earliest of the in-process dates on record
days_to_authorization auth_date minus first_in_process_date
agency_authorizations Number of agency authorizations recorded
assessor Third-party assessment organization
service_model / deployment_model As listed in the marketplace

Methodology

Source. GSA, FedRAMP Marketplace data file (data.json in the GSA/marketplace-fedramp-gov-data repository), last changed May 19, 2026, retrieved October 19, 2026. It is the published dataset behind marketplace.fedramp.gov; products added after May 19, 2026 are not included.

Measures. Agency authorizations are the marketplace’s authorization count per product. Concentration uses the Gini coefficient over that count and the share held by the top decile of products. Time to authorization runs from the earliest in-process date recorded for the product to its authorization date; products without an in-process date before authorization were excluded (3 of 517). The Herfindahl-Hirschman Index is computed from each named 3PAO’s share of authorized products (4 products with a blank assessor field excluded). Interquartile ranges use linear interpolation (inclusive method).

Statistics. One-sided Mann-Whitney U test comparing program and agency times to authorization.

Limitations. The dataset reflects current status; withdrawn products are absent, which understates older years. In-process dates are recorded by the program and may not match when a provider began preparing.

Not advice. This is an analysis of public program data, not procurement or compliance advice.

Cite as:The Uptime Report. "FedRAMP Statistics 2026: 517 Authorized Cloud Services, and How Few of Them Carry Federal Demand." October 2026. https://theuptimereport.com/fedramp-statistics/

References

  1. GSA, FedRAMP Marketplace data repository. Last changed May 19, 2026.
  2. FedRAMP Marketplace. Accessed October 19, 2026.
  3. FedRAMP, FedRAMP 20x. Accessed October 19, 2026.
  4. US Department of Justice and FTC, Merger Guidelines (2023), HHI thresholds.

Research library

More original data reports from The Uptime Report. Every report includes its methodology and a free CSV download. Browse all research

Threats and breaches

Infrastructure and uptime

Regulation and disclosure

Workforce and pay

MSP market and spending

Comments

Leave a Reply

Your email address will not be published. Required fields are marked *

More posts