Cloudflare announced that the Cloudflare for Government platform has achieved FedRAMP Class D (High) authorization, in a move aimed at enabling U.S. government agencies to use its services to handle the most sensitive unclassified government data. In parallel, the company said it has begun using the systems it developed for this authorization as the foundation for its commitment to pursue DoD Impact Level 4 (IL4) authorization from the U.S. Department of Defense.
The announcement was made in cooperation with the authority sponsoring the authorization process, the National Institute of Standards and Technology (NIST). Cloudflare received FedRAMP Moderate authorization in 2022, but moving to the High level does not represent a simple incremental increase. Instead, it requires meeting more complex requirements, along with a significant increase in the consequences of any potential failure in security controls.
What Does FedRAMP High Authorization Mean?
The FedRAMP program is a U.S. government-wide federal program that establishes a standardized methodology for assessing, authorizing, and continuously monitoring the security of cloud products and services. Cloudflare explains that achieving authorization requires an assessment of the company’s capabilities by a federal agency, sponsorship by that agency for the full authorization, and then verification of the authorization by the FedRAMP Program Management Office.
FedRAMP Class D (High) classifies systems that handle the most sensitive unclassified government data, including data related to law enforcement, emergency services, financial systems, and national security. According to the company, a breach of the controls for these systems could have catastrophic consequences, such as causing loss of life or threatening the economic and national security of the United States. This differs from Class C (Moderate), which covers systems whose compromise could result in a serious adverse effect, such as some National Park Service systems.
One Network with Data Localization Controls
Cloudflare says its government offering does not rely on a separate, isolated, and limited version of its commercial platform. Instead, FedRAMP High services were built on the same global network that operates the company’s services, using the same software in its data centers and relying on the concept of software-defined regional distribution.
The company relies on the Data Localization Suite to apply precise controls over where data is processed and stored. For FedRAMP High services, Cloudflare says it can guarantee that traffic inspection and processing are performed exclusively within its data centers located in the United States.
According to the announcement, federal agencies within the United States will receive Zero Trust security tools, application performance optimization capabilities, and new developer product features when they are released, rather than using a government platform that lags behind the commercial platform. The text does not specify separate availability conditions or pricing.
Next Step: DoD IL4
Cloudflare explained that DoD IL4 is the U.S. Department of Defense cybersecurity standard for systems that handle controlled unclassified information. The company believes that the systems designed for the FedRAMP High process will form the backbone of its future offering seeking IL4 authorization, but it announced its pursuit of the authorization and did not announce that it had obtained it.
Cloudflare says this approach could allow government agencies and the defense community to access security innovations and new tools at a pace closer to that of its public platform, while maintaining the residency and data-processing requirements necessary for sensitive government environments.
The company connects this step to public-sector modernization plans, including helping federal agencies adopt Zero Trust architectures, protecting infrastructure from advanced distributed denial-of-service attacks, and delivering faster and more resilient digital services. It said it is working with U.S. government agencies, including the Department of State and the Department of Commerce.