Box is FedRAMP Class D (High) Certified

The Federal Risk and Authorization Management Program (FedRAMP) is a U.S. government-wide program, codified by the FedRAMP Authorization Act of 2022, that provides a standardized approach to security assessment, certification, and continuous monitoring for cloud services used by federal agencies. Since July 4, 2026, the program operates under the FedRAMP Consolidated Rules for 2026 (CR26).

It depends on your role in handling federal information:

• If you're a U.S. federal agency, you are required to use FedRAMP Certified cloud services for federal information in the cloud, with limited exceptions established in law and OMB Memorandum M-24-15. When you adopt a certified service like Box, you can leverage its FedRAMP Certification to issue your own authorization rather than conducting a full security assessment from scratch.
• If you're a contractor or partner working with federal agencies, your contracts may require that federal information you handle in the cloud be stored and processed in FedRAMP Certified services. Using a certified service helps you meet those contractual and flow-down requirements.
• If you're a state, local, or tribal government, FedRAMP does not directly apply to you, but many public-sector organizations use FedRAMP Certification as a security benchmark, and programs like GovRAMP extend a similar model to state and local procurement.
• If you're a cloud service provider, FedRAMP Certification applies to you if you offer, or intend to offer, cloud services that hold federal information on behalf of federal agencies.

A FedRAMP Certification means a specific cloud service offering has completed FedRAMP's standardized process and is certified  for federal use. To earn it, the provider implements the security controls required for its Certification Class, undergoes independent testing by an accredited Third Party Assessment Organization (3PAO), and has its complete certification package reviewed and certified. The certified service is then listed on the FedRAMP Marketplace, where agencies can review its certification details.

Certification is not a one-time event. To keep it, the provider must meet continuous monitoring requirements, deliver recurring security documentation, and report significant changes to the service.

Under the Consolidated Rules for 2026, a cloud service provider pursues FedRAMP Certification through one of two defined paths, the Rev5 path or the FedRAMP 20x path, and the two paths are not interchangeable, so providers must select the path appropriate to their service. In general terms, the provider implements the required controls for its target Certification Class, undergoes an independent assessment, and submits its package for certification. Once certified, the service appears on the FedRAMP Marketplace and individual agencies can authorize its use. Ongoing changes to a certified service are managed through FedRAMP's Significant Change Notification (SCN) process, and providers must meet continuous monitoring requirements to maintain certification.

Certification Classes (A, B, C, and D) are the CR26 designations for the categories of assurance a FedRAMP Certified cloud service provides, increasing from minimal assurance at Class A to significant assurance at Class D. They replace the former Low, Moderate, and High impact-level labels: Class B requirements descend from the former LI-SaaS and Low baselines, Class C from the former Moderate baseline, and Class D from the former High baseline, while Class A is a new entry-level certification designed for established commercial products with mature security programs. CR26 notes that classes only loosely align with FIPS 199 impact levels rather than correlating directly. During the CR26 transition period, you may see both the legacy and new labels used together.

Yes, but both refer to the same status. Under the Consolidated Rules for 2026, the official designation for all FedRAMP authorizations is "FedRAMP Certified," and the former “High” baseline is now “Certification Class D”. Box holds a FedRAMP Class D Certification, previously described as "FedRAMP High Authorized."

Box is committed to providing our customers an intelligent content management solution that helps them meet and exceed their regulatory and compliance needs and obligations. Within the United States Federal and Department of War community, Box has achieved a number of certifications that demonstrate our capabilities and commitment to security. Learn more by visiting the Box Trust Center.

Yes. Box meets the security requirements that FISMA establishes for cloud services through its FedRAMP Certification at Class D, and federal agencies leverage that certification to satisfy their FISMA obligations when authorizing Box for their own use.

Some background on how this works: the Federal Information Security Modernization Act of 2014 (FISMA, which updated the 2002 Federal Information Security Management Act) requires federal agencies to protect federal information and information systems, including systems operated by contractors or cloud providers on the agency's behalf. FISMA compliance is determined system by system: agencies apply the NIST Risk Management Framework and the security controls in NIST Special Publication 800-53, Revision 5, and issue an authorization to operate (ATO) for each system. For cloud services, FedRAMP is the mechanism through which FISMA's requirements are applied and assessed. FISMA was not replaced by FedRAMP; it remains the governing statute, and FedRAMP implements it for cloud.

Multiple agencies use Box for their FedRAMP security needs, including the Department of Energy, Internal Revenue Service, Food and Drug Administration, Department of Veterans Affairs, and more. Visit the FedRAMP Marketplace to view a complete list of our FedRAMP customers.

Much like FedRAMP was created to provide a standardized approach to security assessment, authorization, and continuous monitoring for cloud products and services that store, process and transmit federal information, StateRAMP was designed to do the same for state and local government agencies. Learn more about how Box became StateRAMP Authorized in 2022.