Infrastructure

Cloudflare Now Serves 100+ US Agencies at FedRAMP High

Cloudflare for Government achieved FedRAMP High authorization on August 8, 2026, the US government's toughest commercial-cloud security bar. Five other vendors now sell to government riding on that same authorization - and the EU has no single equivalent.

InfrastructureBy Servola Tech Desk2026-08-134 min read

AI-assisted, edited by humans. | Editor-in-Chief: Leon Soliman | Editorial standards

Cloudflare Now Serves 100+ US Agencies at FedRAMP High

Key takeaways

Cloudflare for Government achieved FedRAMP High authorization on August 8, 2026, clearing the US government's toughest commercial-cloud security bar - the level reserved for data tied to national security, critical infrastructure, and financial systems, where a breach is classified as having severe or catastrophic consequences.
More than 100 US federal agencies already use Cloudflare, including the Departments of Commerce, Energy, Health and Human Services, Homeland Security, the Interior, Justice, and State, and the company separately holds GovRAMP Moderate authorization for state and local government customers and has announced it will pursue Department of Defense Impact Level 4 next.
At least five other vendors - Workday, New Relic, Armis Federal, Darktrace Federal, and GitLab - sell to US government customers by building on Cloudflare's own FedRAMP-authorized infrastructure rather than clearing the full authorization independently, turning Cloudflare's certification into leverage for an entire layer of software vendors above it.
The EU and UK have no single, portable accreditation that plays the same role: a vendor seeking to sell government-grade cloud services across the EU still has to work through separate national accreditation processes state by state, rather than clearing one bar once and having every member state accept it, the way FedRAMP High now works across the US federal government.
The timing is not incidental - FedRAMP's own director has publicly warned that slow-to-patch vendors should not be selling into government at all, a warning issued against a backdrop of agency leadership citing a recent high-profile vendor breach, which makes Cloudflare's authorization read as a competitive move as much as a compliance one.

What Cloudflare Actually Cleared, and When

Cloudflare for Government achieved FedRAMP High certification on August 8, 2026, according to the company's own announcement, alongside a separately held GovRAMP Moderate authorization that satisfies state and local government requirements. FedRAMP High is the top of the US Federal Risk and Authorization Management Program's three-tier system, reserved specifically for information whose loss, corruption, or unauthorized access would have severe or catastrophic effects on an agency's operations, assets, or mission - the bar used for national security, critical infrastructure, and financial-system data rather than routine administrative information.

The authorization lets Cloudflare for Government operate within authorized US boundaries across 15 metropolitan areas, and the company says more than 100 federal agencies already use its services, naming the Departments of Commerce, Energy, Health and Human Services, Homeland Security, the Interior, Justice, and State specifically. Cloudflare has also confirmed it intends to pursue Department of Defense Impact Level 4 authorization next, an even narrower bar aimed at defense-specific workloads.

A Certification That Doubles as Infrastructure for Other Vendors

One detail in Cloudflare's own disclosure matters more than the headline: at least five other software vendors - Workday, New Relic, Armis Federal, Darktrace Federal, and GitLab - are already selling into the US government by building their own products on top of Cloudflare's FedRAMP-authorized platform rather than independently clearing the full authorization process themselves.

That arrangement effectively turns one company's multi-year compliance investment into a shortcut for an entire layer of vendors above it, which is a meaningfully different market dynamic than a single company clearing a bar for its own sake: it means Cloudflare's FedRAMP High status is now a piece of go-to-market infrastructure that other vendors' government sales cycles depend on, not just a badge on Cloudflare's own sales collateral.

David Mihalchik on the Strategy, and Why the Timing Is Not Accidental

David Mihalchik, Cloudflare's VP of US Public Sector, framed the three-part push - FedRAMP High, GovRAMP Moderate, and the stated intent to pursue DoD IL4 - as letting Cloudflare 'bring a platform to federal, state, local, and defense teams' as agencies face pressure to modernize technology, move faster, and cut costs while protecting sensitive data.

That framing lands against a specific backdrop: FedRAMP's own director has publicly stated that vendors who are slow to patch known vulnerabilities should not be selling into government at all, a position agency leadership has connected explicitly to a recent, high-profile vendor breach. Read against that warning, Cloudflare's authorization is not simply a compliance milestone; it is a public signal, at a moment when government buyers are scrutinizing vendor security posture more closely than usual, that Cloudflare has cleared the bar those buyers are now watching for.

The Gap This Exposes for EU and UK Public-Sector Buyers

FedRAMP works because it is a single accreditation that every US federal agency is required to accept once granted, which is precisely the feature the EU and UK do not have. A vendor - whether a US hyperscaler, a European sovereign-cloud specialist, or a smaller software company - seeking to sell government-grade cloud services across the EU still has to navigate separate national accreditation and procurement processes in each member state, with no single certification that automatically satisfies all 27.

For an EU or UK public-sector buyer, the practical takeaway is not that Cloudflare's US authorization is directly usable in Europe - it is not - but that the underlying market dynamic Cloudflare has just demonstrated, where one hard-won accreditation becomes reusable leverage for an entire ecosystem of vendors built on top of it, is exactly the capability gap that GAIA-X and the EU's various sovereign-cloud initiatives are still trying to solve, and have not yet solved with anything as portable as FedRAMP High.

Frequently asked questions

Does Cloudflare's FedRAMP High authorization apply to its services outside the United States?

No. FedRAMP High is a US federal government accreditation that governs Cloudflare's US-authorized government cloud boundary specifically, operating across 15 US metropolitan areas; it does not extend automatically to Cloudflare's commercial services used by EU or UK organisations, which fall under different regulatory and compliance frameworks entirely.

What is GovRAMP, and how is it different from FedRAMP?

GovRAMP is an accreditation aimed at US state and local government customers, distinct from FedRAMP which governs federal agencies; Cloudflare holds GovRAMP Moderate authorization alongside its federal FedRAMP High certification, covering the two main tiers of US government procurement below the Department of Defense's own separate Impact Level system.

Is there an EU equivalent to FedRAMP that a vendor could clear once and sell across all member states?

Not yet in a form comparable to FedRAMP's single, mandatory-acceptance model. The EU's sovereign-cloud efforts, including GAIA-X-linked initiatives, are still developing frameworks intended to address this, but as of today a vendor seeking to serve government customers across the EU generally has to satisfy separate national accreditation and procurement requirements in each member state rather than clearing one certification that every state must accept.

FedRAMP High is not just a US compliance badge - it is proof that a single accreditation can become reusable infrastructure for an entire market of vendors built on top of it, since five other companies are already selling into government on the strength of Cloudflare's certification rather than their own. The EU has no equivalent mechanism yet, and that gap, not any specific feature of Cloudflare's platform, is the story worth watching from Brussels.

CloudflareFedRAMPGovRAMPcloud sovereigntyGAIA-Xpublic sector cloud

CLDAP Floods Surged 580% as DDoS Tactics Shift

Cloudflare's H1 2026 DDoS Threat Report shows attackers moving from raw botnets to DNS and CLDAP reflection attacks that exploit other organizations' misconfigured servers. What that shift means for EU and UK security budgets, and why the government sector's 20-rank jump in targeting is a live warning.

5 min read

Infrastructure

Multi-Homing Does Not Mean You Choose the Path

Cloudflare measured what other networks do to a BGP attribute it sets. About 70% of paths came back rewritten, and the biggest networks are the ones doing it.

5 min read

Decisions

The Third Pivot Was the Warning Magic Leap Missed

Magic Leap filed a WARN notice for 193 layoffs effective 1 October 2026, its fourth strategic pivot after $4 billion raised. The lesson is the pattern, not the pivot.

4 min read

← All articles