Skip to main content

Inteltech

There Is No FedRAMP Shortcut to IL4

FedRAMP 20x changes how cloud security evidence is produced and reviewed. It does not turn a FedRAMP High package into a DoD impact level authorization.

By Amyn PorbanderwalaJuly 30, 20254 min read

Contents
  1. What 20x actually changed
  2. Three things that stay separate
  3. Why the confusion survives
  4. What to build if you need both
  5. The useful version of reciprocity

Every few months someone tells me a FedRAMP High authorization now satisfies DoD IL4. It is a persistent belief, it is good for a slide, and it is wrong.

What exists is a real modernization effort called FedRAMP 20x, a statute that put FedRAMP on firmer legal ground, and a DoD authorization process that still belongs to DoD. Those are three different things. Vendors keep collapsing them into one because the collapse sells.

What 20x actually changed

FedRAMP started 20x (opens in a new tab) in March 2025. The premise is that the old process produced a document package that took months to read and went stale the day it was approved. 20x replaces the package with machine-readable indicators, a narrower assessment scope, and continuous reporting.

The public timeline is specific. The Phase One pilot soft launched in early May 2025 and opened for formal submissions on May 30. On the same day, FedRAMP's Key Security Indicators, aligned to NIST SP 800-53B, took effect for pilot authorizations, along with a Minimum Assessment Scope standard that lets a provider define its boundary narrowly without cutting out components that matter.

The program also published numbers, which is rare and useful. In May 2025 it authorized 21 new cloud services, bringing the fiscal year total to 95, and cut its review queue to 11 packages. By 2026 it had published consolidated rules and granted a first full 20x certification.

That is a real reform. It is a reform of how evidence is produced and reviewed. It is not a reform of who is allowed to authorize what.

Three things that stay separate

The program owner. FedRAMP is a GSA program. Congress codified it at the end of 2022 in the defense authorization act. Codification gave it a board, a legal basis, and a mandate to standardize. It did not transfer DoD's authorization authority to GSA.

The impact levels. IL4, IL5, and IL6 are DoD impact levels, defined by the department's own security requirements guide and tied to the data a system will hold. They are not FedRAMP baselines with different names. A cloud can be FedRAMP High and not be authorized for CUI in a DoD environment, because the authorization decision is a different decision.

The authorizing official. A DoD authorizing official signs for a DoD system, inside a DoD boundary, with DoD continuous monitoring requirements attached. That signature is not delegable to another agency's package.

There is a legitimate middle ground. A provider with a FedRAMP High authorization has done most of the control work. Its assessment evidence is reusable. A DoD reviewer can inherit controls and focus on the delta. That is reciprocity of evidence, not reciprocity of authorization, and the distinction is the whole argument.

Why the confusion survives

The phrase "IL4 equivalent" is the tell. It appears in marketing, in partner decks, and in the occasional contract proposal. There is no such designation. A system is authorized at an impact level by a DoD authorizing official, or it is not.

The confusion is reinforced by a genuine convergence. Both frameworks trace back to NIST SP 800-53. Both care about access control, audit, incident response, and configuration management. A provider that implemented FedRAMP High controls has addressed much of what an IL4 review will ask about.

But the residual is where programs die. Boundary definition, data segregation, cross-domain transfer, supply chain risk management, incident reporting timelines, and the continuous monitoring feed are not paperwork. They are the parts of the system that determine whether classified or controlled data can touch it.

What to build if you need both

A provider that wants to sell into DoD should stop treating FedRAMP as the finish line and start treating it as the evidence base.

  • Write the control implementation once, in a machine-readable form. 20x rewards this directly. A hand-written system security plan is a dead asset.
  • Document the boundary as a data flow, not a diagram. What enters, what leaves, where it is stored, who can read it, and what happens at each crossing.
  • Separate the CUI enclave from everything else. The reviewer's first question is whether controlled data can reach a component that was not assessed.
  • Build the continuous monitoring feed before you need it. A monthly report assembled by hand is a liability at scale.
  • Plan for the DoD delta explicitly. Name the controls you have not implemented and the ones you implement differently. A gap you disclose is a schedule item. A gap the reviewer finds is a stop.

The useful version of reciprocity

The reason to pursue FedRAMP High is that it makes the DoD review shorter. That is a true and valuable benefit. It can turn a multi-month assessment into a focused one, and it gives the authorizing official a body of evidence to rely on.

It does not remove the review. Anyone who tells you otherwise is either selling something or has not read the authorization letter.

The reform worth watching is 20x's bet that continuous, machine-readable evidence will make authorization faster and cheaper across every framework. If it works, DoD will consume the same evidence, and the delta will shrink. That is the path to real reciprocity. It runs through better evidence, not through a law that declares two different decisions to be one.