Saviynt Wins FedRAMP Certification at Class D, Where the Rules Just Changed
The scope is real and the engineering behind it substantial. The release’s description of what the class means is where the trouble starts.
Saviynt has achieved FedRAMP Class D certification for its identity security platform, following an independent assessment by a third-party assessment organisation. Class D is the highest of four certification classes introduced under FedRAMP’s Consolidated Rules for 2026, and it brings identity governance and administration, privileged access management and application access governance for human, nonhuman and AI identities inside a single certification boundary. That is a substantive achievement. The description of what it means is where the release runs into difficulty.
What Saviynt actually achieved
The scope is the interesting part. Federal agencies and their contractors must govern access across employees, contractors, privileged users, applications, cloud resources and non-human identities, and historically they have done it by buying separate products for governance, privileged access and application access governance. Each product carries its own authorisation, its own assessment and its own ongoing monitoring obligation. Saviynt’s claim is that one certification boundary now covers all three, which reduces the number of vendors, contracts and assessment cycles a federal programme has to manage.
The release also notes that Saviynt held FedRAMP Moderate authorisation, serving federal customers since 2019. Under the 2026 rules, Moderate maps to Class C. So this is a C to D upgrade, which FedRAMP recognises as a defined path requiring a new certification application and a fresh independent assessment completed within the previous three months. The assessment route deserves a note. FedRAMP requires Class D applicants to supply a fresh independent assessment completed within the previous three months, which makes the evidence behind a Class D certification recent by design rather than accumulated over years. That is a stricter standard than the earlier Moderate authorisation carried, and it is the part of the achievement the release does not explain.
Why class is not security level
The release describes Class D as the programme’s High Assurance class and characterises the assessment as against the highest federal security standard. FedRAMP’s own published guidance says something different, and the distinction matters for anyone reading the announcement as a security claim.
Certification classes replaced the old Low, Moderate and High impact level labels in the 2026 rules. FedRAMP states plainly that classes are not aligned to how secure a cloud service is, that a class indicates the level of assurance information a provider commits to supplying, and that agencies should not treat classes as one-for-one replacements for impact levels. The agency still categorises its own system and decides whether a service suits its use.
Assurance Data
What Class D does mean is that a provider commits to supplying the deepest and most frequent assurance data to agency customers, and that the package is presumed adequate for most agency systems regardless of impact level. That is a significant commitment about transparency and evidence rather than a certificate of superior security. FedRAMP notes that many services with world-class security programmes choose to stop at Class A or B to keep government pricing aligned with commercial pricing, which is the clearest sign that the class measures what a provider will disclose rather than how well it defends. The naming change was not cosmetic, and FedRAMP said so.
Its notice recording the outcome of public consultation explains that the old labels invited a persistent misconception: that an assessment baseline carrying a FIPS 199 security category amounted to an acceptance of risk for agency use at that category. FedRAMP concluded that the baseline identifies the depth and complexity of information a provider supplies, not the overall security of a system, and that a FedRAMP certification package is a set of reusable materials for an agency to review and accept risk itself. The classes exist to make that distinction visible.
The Rev5 versus 20x question
The release does not say which type of FedRAMP certification Saviynt obtained, and that is the most consequential omission in the document.
FedRAMP currently runs two paths. Rev5 is the legacy process, requires a government-specific build, and faces retirement: FedRAMP stops accepting new Rev5 certifications on 11 June 2027, and existing ones remain active until at least the end of 2028. FedRAMP 20x is the modern path, designed to replace Rev5 entirely and to serve government from commercial cloud offerings rather than separate government-only versions.
Class D is available only on Rev5 today. FedRAMP plans to pilot 20x Class D certifications in late 2026 and make them a formal option in early 2027, and it states that 20x Class D will be significantly more robust than Rev5 Class D, requiring deployment on Class D certified infrastructure, restrictions on which third-party information resources may be used, and new security indicators including one on foreign ownership and control.
A federal buyer reading this release therefore needs to know whether Saviynt certified on Rev5 or on 20x, because the two carry different life expectancies and different assurance levels. The release is silent, and since 20x Class D does not yet exist as a formal option, the answer is almost certainly Rev5. A vendor announcing a certification at the moment the framework underneath it changes should say which one it holds, particularly when the replacement is explicitly designed to be stronger.
What the shift demands of providers
The move to 20x also changes what a provider has to build. FedRAMP’s 2026 rules shift the certification package away from Word and Excel templates toward JSON documents or OSCAL, remove most FedRAMP-defined organisational requirements in favour of provider-defined ones, eliminate Plans of Action and Milestones in favour of a list of accepted weaknesses, and widen vulnerability detection well beyond monthly scanning. Providers must acquire or build modern governance, risk and compliance tooling to produce these materials from real-world data rather than hand-crafted documents. A certification obtained in this transition window therefore says something about a provider’s engineering maturity as well as its security posture, which is a more interesting claim than the one the release makes.
What is genuinely new
Two elements of the announcement are substantive regardless of the labelling question. The first is the treatment of non-human and AI identities inside the same certification boundary as human ones. Federal identity programmes have historically governed people and machines through separate tooling, and the arrival of AI agents with their own credentials has made that separation harder to defend. Bringing them into one governance scope is the right architectural answer to a real problem.
The second is the explicit mapping to Executive Order 14028 and OMB Memorandum M-22-09, which set the federal Zero Trust requirements, alongside CMMC support for defence contractors. Those are the obligations a federal buyer actually has to satisfy, and a certification scoped to them is more useful than a general compliance claim. For a federal buyer the practical consequence is narrower than the headline suggests. A FedRAMP certification does not authorise a service for an agency; the agency still issues its own authorisation to operate after reviewing the package and deciding whether the service fits its system. What Saviynt’s FedRAMP certification at Class D supplies is a deeper evidence base for that review, which shortens the work an agency has to do rather than removing it. FedRAMP states that a certification is not a guarantee that a service meets all requirements for a given security category.
The Deloitte quotation signals distribution as much as technology. Biff Lyons, who leads Deloitte’s government and public services cyber portfolio, frames the certification as giving agencies more options to modernise through Deloitte’s alliance with Saviynt. Federal deployments often run through an integrator rather than direct, so an alliance partner endorsing the certification inside the announcement tells a buyer how they would actually procure the thing.
What is missing
Beyond the certification type, the release gives no date for the certification, no indication of which cloud environments fall inside the boundary, and no statement of whether the Class D environment is a separate government build or the commercial platform. That last point matters because the 2026 rules actively encourage providers to serve government from commercial offerings, and a buyer will want to know which model applies.
The claim that this is the most complete identity security Class D offering is one the document does not support, since verifying it would mean comparing scope against every other Class D certified identity product. It may well be true. The release does not show it.
What to watch
Whether Saviynt states the certification type publicly, and whether it plans a 20x Class D certification once that becomes available in early 2027. Whether other identity vendors follow with Class D scope covering AI identities, which would turn a differentiator into a baseline. And whether the class-versus-security confusion persists across the industry, because FedRAMP’s own notice records that public comment on the change revealed widespread misunderstanding, and a vendor has an obvious incentive not to correct it.
The industry test will come in 2027. When 20x Class D opens, providers will have to decide whether to invest again for a stronger certification or hold a Rev5 FedRAMP certification that still works but no longer represents the current path. FedRAMP has warned providers to consider carefully before investing in a certification type it is actively working to replace. Saviynt’s next announcement on this subject will say more about its federal strategy than this one does.