Cloudflare achieves FedRAMP High without separate gov cloud

Cloudflare has secured FedRAMP High authorization for its government services, allowing federal agencies to process highly sensitive unclassified data on its platform. The certification, announced on 10 August 2026, became effective four days earlier and was sponsored by the National Institute of Standards and Technology (NIST). Unlike most providers at this compliance level, Cloudflare achieved the milestone without building a separate government-only cloud environment, instead using its existing public infrastructure with software-defined regional controls to meet strict data residency requirements.

How the certification was achieved

The FedRAMP High authorization process began in November 2025 and took approximately nine months to complete. Independent assessor Schellman Compliance conducted the review, with the certification recorded in the FedRAMP Marketplace as effective 6 August 2026. Cloudflare's approach relies on its Data Localization Suite, which ensures all traffic inspection and processing for government workloads occurs exclusively within U.S. data centers while maintaining a single global software stack. This architecture differs from the typical government community cloud model, where providers create isolated environments specifically for federal use.

The company's existing FedRAMP Moderate authorization, obtained in December 2022, provided a foundation for this higher-level clearance. FedRAMP High covers data where compromise could have catastrophic consequences, including law enforcement, emergency services, financial systems, and national security information. Cloudflare's implementation spans more than 30 U.S. data centers running its full technology stack locally.

Why the architecture matters

Cloudflare's approach challenges the conventional wisdom that government compliance at the highest levels requires physically separate infrastructure. Of the 92 services currently certified at FedRAMP High, 66 operate as government community clouds, while only 18 use public cloud deployments like Cloudflare's. The company argues that its software-defined regionality model provides agencies with immediate access to new features and security updates, rather than forcing them to wait for updates to be ported to isolated government environments.

This certification also represents an early adoption of FedRAMP's new classification system. While the Marketplace records Cloudflare's authorization under the traditional Rev5 path, the company markets it as Class D—the new designation for High-level certifications under FedRAMP's 20x overhaul. The program's roadmap had scheduled Class D pilots for fiscal 2027, making Cloudflare's achievement a preview of the forthcoming naming convention.

What comes next

The FedRAMP High authorization serves as a stepping stone for Cloudflare's planned pursuit of Department of Defense Impact Level 4 (IL4) clearance, which governs controlled unclassified defense data. The company states that the systems built for FedRAMP High were designed with IL4 controls in mind, suggesting a potential expansion of its government market presence. If successful, this would further validate the viability of shared infrastructure for high-security government workloads.

The certification has already gained traction among federal agencies, with 22 authorizations listed in the FedRAMP Marketplace. These include high-profile entities such as CISA, the Departments of State and Commerce, the Federal Reserve System, and the U.S. Election Assistance Commission. Cloudflare joins a select group of providers at this compliance level, with fewer than one in five FedRAMP-certified services achieving High authorization.