A Guide to Salesforce FedRAMP Compliance

If you need Salesforce FedRAMP compliance, you need Salesforce Government Cloud Plus. The FedRAMP Marketplace lists it as Certified at Class D, which is what FedRAMP High is called now.

That certification covers the platform Salesforce runs. Each public sector agency or contractor still owns the controls it sets up inside its own org.

Government Cloud Plus got its Provisional Authority to Operate (P-ATO) from the Joint Authorization Board, and the Marketplace dates it to May 27, 2020. It's an isolated, dedicated environment built on AWS GovCloud (US), and Salesforce now sells two higher-assurance editions next to it.

Is Salesforce FedRAMP certified?

Yes, at the platform level. Salesforce describes Government Cloud Plus as holding a FedRAMP Class D (formerly FedRAMP High) P-ATO, and it lists DoD Impact Level 2 support for the same offering.

Government Cloud Plus isn't the only Salesforce company listing on the Marketplace. Here is what it showed for the Salesforce family on November 3, 2026.

Salesforce sells three Government Cloud editions for the public sector, each for a different class of data. Its Government Cloud page sets them out like this.

• Government Cloud Plus: Class D (High), IRS 1075 and HIPAA, plus DoD Impact Level 2.
• Government Cloud Plus - Defense: DoD IL4 and IL5 in a physically isolated environment, for the DoD and for contractors directly supporting DoD mission owners. Its compliance page says it's designed "to store and process highly sensitive Impact Level 5 data."
• Government Cloud Premium: Top Secret authorization in an air-gapped environment.

Not every Salesforce product runs inside Government Cloud Plus. Salesforce keeps a list of authorized products and features, linked from its government compliance page, so check it before you switch on something new such as Agentforce.

What changed in FedRAMP between 2024 and 2026?

The program has changed a lot since the 2020 Government Cloud Plus authorization. In May 2024 GSA launched a new board replacing the Joint Authorization Board, the body that granted the Government Cloud Plus P-ATO.

In August 2024 the program said all authorized providers would be FedRAMP Authorized, regardless of path. Then a February 2026 program notice made "FedRAMP Certified" the single official label and renamed the Low, Moderate and High baselines as Certification Classes.

Old and new terms

Contracts, older documents and the Marketplace still mix both sets of terms. This table lines them up with the current definitions, notice 0004 and GSA's Board announcement.

What CR26 and 20x mean for Salesforce customers

The Consolidated Rules for 2026 (CR26) allowed optional early adoption from July 4, 2026. They take mandatory effect on January 1, 2027, and the program stops accepting new Rev5 Certifications on June 11, 2027.

FedRAMP 20x is the newer, automated route: it's in Phase 3, with Class D (High) certifications planned for Phase 4 in the first half of fiscal 2027. The program says it will publish a transition path for existing Rev5 offerings.

For now Government Cloud Plus is listed in Ongoing Certification under the Rev5 type, with 67 ATO or ATU letters from federal agencies. Each of those government agencies still signs off its own use, so watch the Marketplace and program notices for changes.

What does the authorization boundary cover in Salesforce Government Cloud?

Only what sits inside the authorization boundary is covered. Salesforce's compliance document listing says the authorization applies only to the environment "branded and sold as Government Cloud Plus."

Anything you add on top sits with you, along with its compliance requirements. Salesforce's Government Cloud FAQ says AgentExchange apps aren't within its authorization boundaries, although many are native to the platform.

Under this shared responsibility model, Salesforce says it takes care of many security controls and patching. What you configure in your own org, such as users, permissions, data classification, integrations and custom code, stays yours to secure, as our post on who owns Salesforce security explains.

Which NIST SP 800-53 control families matter most for Salesforce?

Class D services are designed to meet NIST 800-53 controls, and SP 800-53 Rev. 5 has 20 control families. Five of them map most directly to settings you control inside a Salesforce org.

This table pairs each family with sample NIST controls. The last column lists the Salesforce features you'd show an assessor.

Access Control and Audit and Accountability

For AC, give people the fewest permission sets their job needs and remove access when they leave. A least privilege review on a fixed schedule gives the assessor a record of who had what.

For AU, Salesforce Shield bundles Event Monitoring with Shield Platform Encryption and Field Audit Trail. Event Monitoring tracks logins, API calls, Apex executions and report exports.

Some log types are free with 1-day retention, and keeping them for up to a year costs extra. Setup Audit Trail deletes setup records after 180 days, so export both logs to long-term storage, as our audit trail compliance guide explains.

Configuration Management, Identification and Authentication, and Communications Protection

For CM, assessors want a known baseline and proof that every change was approved. Keeping metadata in version control with an approval step in your development process gives you both, plus a way back if a release goes wrong.

For IA, Salesforce's terms of service say all customers must use MFA for user interface logins. Check integration and API users as well.

For SC, Shield Platform Encryption lets you encrypt sensitive data at rest natively, and you keep control of the encryption keys. Our Salesforce encryption guide walks through what each option covers.

How do you prepare a Salesforce org for assessment?

Build assessment readiness into the routine instead of cramming before each audit. These habits cover most of what an assessor asks to see.

• Evidence: for every control you own, keep a configuration snapshot, a log showing the control working and a short note on how it meets the control.
• AgentExchange (formerly AppExchange) apps: search the FedRAMP Marketplace before you install one. Document anything unlisted as outside the Salesforce boundary, with the compensating controls you rely on.
• Testing: run vulnerability scans and penetration tests in a full sandbox that mirrors production, so tests never touch live customer data.
• Integrations: limit API access to named integrations with their own credentials, and send their logs to your SIEM.

Continuous monitoring (CA-7) is a control in its own right. Real-time tracking of logins, exports and permission changes shows drift between assessments, much as 20x uses Key Security Indicators to show security posture in near real time.

Where does Flosum fit for public sector Salesforce teams?

Flosum offers three deployment options: Salesforce-native, Flosum-hosted cloud and customer-hosted. The same page says public sector teams often pair Salesforce Native in Salesforce Government Cloud with customer-hosted cloud apps in their own accredited enclave.

With that setup the accreditation boundary stays yours rather than a vendor's, one of the trade-offs in our deployment models guide. Whatever you pick, record each Flosum component in your system security plan as inside or outside the Government Cloud Plus boundary.

FAQs

Book a demo to see how Flosum fits with your Salesforce Government Cloud setup.