Cloudflare lands FedRAMP High, eyes DOD IL4
FedRAMP High and GovRAMP Moderate are real; the IL4 pursuit is still just a declared intention.
TL;DR
Cloudflare achieved FedRAMP High authorization Thursday, allowing civilian agencies to use its platform for High-impact data covering national security, critical infrastructure, financial systems, and other sensitive workloads. GovRAMP Moderate followed in April for state and local governments. The company also announced it plans to seek DOD Impact Level 4 authorization for CUI workloads, but that's a declared intention, not a review in progress. DISA issues IL4 provisional authorizations under the DoD Cloud Computing SRG, and Cloudflare hasn't begun that assessment process. DOE, HHS, Commerce, DHS, Interior, Justice, and State already use Cloudflare technologies.
Cloudflare's FedRAMP High certification is the substantive news here. It means civilian agencies can now use Cloudflare for Government to process and store data at the High impact level, the designation for information whose loss of confidentiality, integrity, or availability could have severe or catastrophic adverse effects. The certification lands at a moment when FedRAMP's director has publicly warned that slow-to-patch vendors shouldn't be allowed to sell to government. Cloudflare cleared that bar.
The IL4 announcement is a different thing entirely. Impact Level 4 is the DoD's designation for CUI and export-controlled information, and it requires a provisional authorization from DISA under the DoD Cloud Computing Security Requirements Guide. That's a separate process from FedRAMP, with its own assessment criteria. Cloudflare has declared intent but hasn't entered the review pipeline. For defense agencies and contractors handling CUI, nothing changes Monday.
GovRAMP Moderate fills the state and local column. Taken together, the three designations, two achieved and one aspirational, sketch Cloudflare's playbook: secure the civilian authorization, lock down state and local, then push into the defense CUI market. Whether DISA moves at the speed Cloudflare's press release implies is, for now, an open question.
Published ·Deep Fathom