Cloudflare for Government Achieves FedRAMP Class D (High) Certification

Cloudflare for Government Achieves FedRAMP Class D (High) Certification Cloudflare has attained FedRAMP Class D (High) Certified status with the sponsorship of the National Institute of Standards and Technology (NIST), and is leveraging these systems to pursue U.S. Department of Defense Impact Level 4 (DoD IL4) authorization. Cloudflare for Government achieved FedRAMP Class D (High) certification sponsored by NIST, advancing from its 2022 FedRAMP Moderate authorization. The systems built for FedRAMP High will serve as the foundation for Cloudflare's pursuit of DoD IL4 authorization for controlled, unclassified data. Rather than creating an isolated, pared-down government cloud, Cloudflare deployed the certified offering on its standard global network using software-defined regionality and its Data Localization Suite to restrict processing to U.S. data centers. FedRAMP High Certification and DoD IL4 Pursuit Sponsored by the National Institute of Standards and Technology, Cloudflare for Government achieved FedRAMP Class D (High) Certified status after full verification by the FedRAMP Program Management Office. This expands upon the company's 2022 FedRAMP Moderate authorization to address higher-complexity controls. Cloudflare is using the systems developed for this milestone to pursue U.S. Department of Defense Impact Level 4 (DoD IL4) authorization for handling controlled, unclassified defense data. Unified Global Network Architecture Unlike traditional public-sector cloud models that construct isolated, lagging environments, Cloudflare built its FedRAMP High offering directly on its existing global network and software stack. Using its Data Localization Suite, Cloudflare enforces software-defined controls to guarantee that traffic inspection and data processing occur strictly within U.S. data centers, allowing federal customers to receive the same commercial features, Zero Trust tools, and performance updates without platform compromises.

Cloudflare for Government 获得 FedRAMP Class D (High) 认证并推进国防部 IL4 授权 Cloudflare 宣布其政府服务 Cloudflare for Government 已正式获得美国联邦风险与授权管理计划（FedRAMP）Class D（High）认证，赞助机构为美国国家标准与技术研究院（NIST）。同时，公司正以此架构为基础推进美国国防部 Impact Level 4（DoD IL4）授权。 Cloudflare for Government 在 NIST 的赞助下获得 FedRAMP Class D (High) 认证。 基于 FedRAMP High 系统基础，Cloudflare 正致力于获取用于处理受控非密数据的美国国防部 DoD IL4 授权。 Cloudflare 摒弃了行业传统的隔离式“技术孤岛”做法，直接在全球通用网络上通过数据本地化套件实现软件定义合规，确保流量处理严格限定在美国境内数据中心。 该架构使联邦机构无需使用功能缩水的政府专属云，能直接同步获取最新的零信任安全工具与开发者特性。 FedRAMP High 认证与 DoD IL4 拓展 Cloudflare 曾在 2022 年获得 FedRAMP 中等（Moderate）级别授权，此次跃升至高等（High）级别大幅增加了合规复杂性要求。该认证标志着相关能力已由联邦机构审查、赞助并经 FedRAMP 项目管理办公室核准。同时，Cloudflare 宣布正在将这套系统作为基石，积极推进美国国防部处理受控非密数据的 DoD IL4 授权。 基于全局网络的软件定义架构 以往服务公共部门的技术公司多采用构建隔离且功能落后的独立专有平台，导致出现“技术孤岛”。Cloudflare 则在其全球统一的基础设施上运行 FedRAMP High 服务，借助其数据本地化套件（Data Localization Suite），通过软件定义的区域控制，确保所有流量检查与数据处理完全限制在美国境内的数据中心完成。 保障前沿技术同步交付 通过统一网络架构，联邦机构与防务社区得以免受隔离政府云更新缓慢的限制，能与商业企业客户同步获得最新的零信任安全工具、应用性能优化及开发者功能，以此应对现代威胁并防御复杂的 DDoS 攻击。

We believe the Internet must be a force for good, and that it requires a foundation of trust. Nowhere is that trust more critical than in public service. Government agencies are the stewards of a nation’s most sensitive data. They protect national security, [critical infrastructure](https://www.cloudflare.com/the-net/government/critical-infrastructure/), and the personal information of every citizen. Cloudflare’s mission is to help build a better Internet. A key part of that mission is giving public sector agencies the best technology to stay secure, fast, and reliable. That means meeting the highest possible standards. Today, we are proud to announce a major milestone: [Cloudflare for Government](https://www.cloudflare.com/cloudflare-for-government/) has achieved FedRAMP Class D (High) [certification status](https://www.fedramp.gov/marketplace/products/FR2000863987A/). We are honored to take this step with our sponsoring agency, the National Institute of Standards and Technology, whose global mission demands the highest level of security. We are also very excited to announce that we are using the new systems we developed for FedRAMP High as the foundation of our commitment to pursuing U.S. Department of Defense Impact Level 4 (DoD IL4) authorization. IL4 is the department’s [cybersecurity standard](https://cic.gsa.gov/basics/cloud-security) for systems handling controlled, unclassified data. We are confident that bringing our global network to this space will change the pace of innovation in the defense community. The Federal Risk and Authorization Management Program (FedRAMP) is a U.S. government-wide program that provides a rigorous, standardized approach to security assessment, authorization, and continuous monitoring for cloud products and services. Think of FedRAMP as the gold standard for security in the U.S. government. Achieving "certified" status is a formal milestone. It means a federal agency has vetted our capabilities, sponsored our full authorization, and had that authorization verified by the FedRAMP Program Management Office. We achieved FedRAMP [Moderate authorization in 2022](https://blog.cloudflare.com/cloudflare-achieves-fedramp-authorization/), but moving from Moderate to High is not an incremental step. It is a substantial increase in both complexity of the requirements we have to meet and the impact of what would happen if we were to have a breach of those controls. For instance: For years, the standard approach for technology companies serving the [public sector](https://www.cloudflare.com/public-sector/) and the defense community was to build a separate, isolated, and often pared-down version of their commercial platform. The intention was good, but the result was often technology islands: isolated environments that frequently lagged years behind the pace of innovation. Federal agencies and contractors have been forced to choose between modern features and stringent compliance. We made a fundamentally different architectural decision on day one. Cloudflare operates a single, global network, with the same software stack running in every one of our data centers worldwide. We have built our FedRAMP High offering on those same machines, running the same services, using software-defined regionality. Instead of an isolated environment, Cloudflare for Government - FedRAMP High is built with the same network that powers Cloudflare today. Achieving FedRAMP High certification is a powerful validation of that core principle. So how do we meet the stringent data residency and handling requirements for FedRAMP High on a global network? The key is our [Data Localization Suite](https://www.cloudflare.com/data-localization/). It allows us to apply precise, software-defined controls to how and where data is processed and stored. For our FedRAMP High services, we can ensure that all traffic inspection and processing occurs exclusively within our U.S. data centers. Federal agencies don't have to settle for a watered-down version of our platform. Within the United States, they get the *exact same* cutting-edge technologies as our most innovative enterprise customers. Federal agencies will get our latest [Zero Trust security tools](https://www.cloudflare.com/zero-trust/products/), our industry-leading application performance, and our newest developer product features when they are released. When we began the FedRAMP process, we designed our systems with FedRAMP High and DoD IL4 controls in mind. We are excited that the same systems that power our global network and FedRAMP High will be the backbone of our DoD IL4 offering. For the defense community, this means that the pace of innovation in response to modern threats is no longer constrained by the pace of release-isolated government clouds. Our investment in FedRAMP High isn't just about achieving a compliance certification. It’s about helping to build a better Internet that includes the most critical applications on the planet. Now that we have achieved FedRAMP High authorization, we hope to help federal agencies move to a modern [Zero Trust security architecture](https://www.cloudflare.com/learning/security/glossary/what-is-zero-trust/), protect their infrastructure from the most sophisticated DDoS attacks, and deliver [faster, more resilient digital services](https://www.cloudflare.com/the-net/government/transform-gov-services/). Cloudflare is proud to work with agencies across the U.S. government, including the Department of State and the Department of Commerce, among many others. This milestone deepens that commitment. To learn more about what this means for the public sector, please visit our [**Cloudflare for Government**](https://www.cloudflare.com/cloudflare-for-government/) page.