Government Cloud Authorisation Schemes Compared: How Seven National Schemes Work and Overlap

A cloud provider selling to governments in several countries quickly learns that there is no single "government cloud certificate": each country runs its own scheme, with its own control baseline, assessor model and decision maker, and only some of them issue anything that could be called a certification. FedRAMP in the United States is being rebuilt around FedRAMP 20x, GovRAMP covers US state and local buyers, Australia relies on IRAP assessments that inform an agency decision, Germany uses BSI C5 attestations, Japan registers services under ISMAP, the EU's EUCS scheme has not been adopted, and the UK buys through the G-Cloud framework with assurance agreed per contract. This map compares the seven side by side: who runs each scheme, what is assessed, who decides, how long the result lasts and how identity and machine credentials are examined. It is written for cloud providers' compliance and security leads planning a multi-country programme, and for public sector buyers and assessors who need to read another country's evidence. Platforms and schemes are listed in the same order throughout; order is not a ranking.

Status line: scheme status was checked on official scheme sources (fedramp.gov, govramp.org, cyber.gov.au, bsi.bund.de, the European Commission and Council of the EU, digital.go.jp and soumu.go.jp, gca.gov.uk and ncsc.gov.uk) on 14 November 2026. Several of these schemes are changing during 2026 and 2027; confirm the current position on the official page before relying on any date.

Key takeaways

• Only some schemes certify. FedRAMP issues certifications and GovRAMP issues verification statuses, but IRAP assessors "do not accredit, certify, endorse or register systems", a C5 report is an attestation with no certification procedure, and ISMAP is a registration list.
• The decision always stays with the buyer. In every scheme the agency or authority that uses the service still makes its own risk decision; the scheme result is evidence, not permission.
• FedRAMP is mid-transition. New Rev5 certifications end on 11 June 2027, 20x Classes A, B and C are available, and Class D for High-impact services is planned as a pilot in FY27.
• EUCS is not a scheme you can hold. No EU implementing act adopting the cloud scheme has been published, and the Commission's January 2026 Cybersecurity Act proposal cites it as an example of stalled progress; C5:2026 and national schemes fill the gap.
• Build once, evidence many. The control content overlaps heavily (identity, logging, key management, vulnerability handling), so a single control set with continuous evidence, mapped to each catalogue, is cheaper than seven separate projects.

Regulations and frameworks at a glance

Scope: who and what each scheme covers

The schemes look similar from a distance, but they answer different questions. FedRAMP and GovRAMP answer "has an independent assessor checked this service against a defined baseline, and is it being monitored?". IRAP answers "how well do this system's ISM controls actually work, and how good is the evidence?". C5 answers "did the provider's controls meet the BSI criteria over this period, in an auditor's opinion?". ISMAP answers "has this service been audited and registered so agencies may pick it?". G-Cloud answers a procurement question first: "is this supplier on the framework, and what security terms does this contract carry?".

• FedRAMP: cloud services that handle federal information for a US federal agency. FedRAMP describes 20x as an approach that emphasises "continuous evidence over point-in-time compliance audits". Class A is for providers with mature programmes entering the federal market, Class B for common, small-scale or light-use services, and Class C for common enterprise services used across an agency or supporting important services. Detail is in the FedRAMP Guide and FedRAMP 20x.
• GovRAMP: state, local, tribal and education governments, plus providers, 3PAOs and small businesses. Its lighter Security Snapshot statuses (top 40 NIST controls) let a provider show progress before a full verification. See the StateRAMP / GovRAMP Guide and FedRAMP vs StateRAMP (GovRAMP).
• IRAP: ICT systems, cloud services and gateways used by Australian government. ASD's cloud guidance was developed for OFFICIAL: Sensitive and PROTECTED public clouds, and the ISM's control applicability codes run from non-classified to TOP SECRET. See the Australia IRAP Guide.
• BSI C5: professional cloud services. C5 is generally recommendatory, but the BSI's minimum standard for external cloud services requires federal agencies to request proof of C5 fulfilment, and section 393 of the German Social Code Book V requires a C5 attestation or comparable certificate for cloud use in healthcare. See the Germany BSI C5 Guide.
• EUCS: intended to be an EU-wide cloud certification scheme under the Cybersecurity Act (Regulation (EU) 2019/881). See the EU Cybersecurity Act and EUCS Guide.
• ISMAP: cloud services procured for Japanese government information systems, assessed and registered in advance. ISMAP-LIU, which started on 1 November 2022, covers SaaS used for low-risk business and information processing. See the Japan ISMAP Guide.
• UK G-Cloud: G-Cloud 15 (RM1557.15) has lots for IaaS and PaaS at OFFICIAL (Lot 1a) and above OFFICIAL (Lot 1b), infrastructure SaaS (Lot 2a), other SaaS (Lot 2b) and cloud support (Lot 3). It is a commercial agreement, not a security certification.

Key obligations and assessment models

The table below sets out what a provider actually has to produce and maintain. It is where the effort, cost and calendar time differ most.

Threat model each scheme is built around

• FedRAMP 20x: drift between documented and actual controls. Point-in-time packages go stale; persistent, automated validation is meant to show posture "in near real time".
• GovRAMP: the long tail of state and local SaaS suppliers with uneven maturity, hence graduated statuses that let a buyer accept a smaller supplier on a known subset.
• IRAP: controls that exist on paper but not in practice. The Common Assessment Framework rates policy restatements and verbal confirmation as Poor evidence and direct testing as Excellent.
• BSI C5: opaque provider operations and an unclear split of duties. Every report lists the controls the customer must run itself.
• ISMAP: inconsistent security checks across ministries, solved by central audit and a shared register.
• UK G-Cloud: no central threat model; the buyer sets assurance in proportion to the data and risk of each call-off.

Timeline and current status

Reciprocity and reuse: what transfers between schemes

None of the official sources read for this map describe formal mutual recognition between these national schemes. What transfers is evidence, not status. Plan on that basis.

For the generic certifications that sit under these schemes, see the Cloud Security Alliance CCM and STAR Guide and the ISO 27001 Certification Guide.

Where identity and non-human identities are examined

Every scheme puts identity at the centre, and assessors increasingly look beyond human administrators to service accounts, API keys, CI/CD credentials and workload identities.

• FedRAMP 20x: Key Security Indicators KSI-IAM-APM (passwordless methods, or strong passwords with phishing-resistant MFA), KSI-IAM-JIT (least-privileged, just-in-time authorisation for all user and non-user accounts and services), KSI-IAM-SNU (securing non-user authentication) and KSI-SVC-ASM (automated rotation of keys, certificates and other secrets) make machine credentials a measured outcome. See the NHI Authentication Guide.
• GovRAMP and FedRAMP Rev5: NIST SP 800-53 AC (access control) and IA (identification and authentication) families apply to system and service accounts as well as people.
• IRAP: ISM controls on privileged access and credential management are assessed with the same evidence grading, so a vault policy alone is Poor evidence while a tested rotation is Excellent.
• BSI C5: the identity and access management (IDM) and cryptography (CRY) areas cover privileged rights, authentication and key management.
• NCSC Cloud Security Principles: principle 9 (secure user management), principle 10 (identity and authentication) and principle 12 (secure service administration) are the questions G-Cloud buyers commonly use.

A single inventory of machine identities, with owners, scopes and rotation evidence, answers the identity questions of every scheme at once. See the Public Sector Identity Security Guide.

Decision guidance: which scheme first

• Your first government customer is US federal: start with FedRAMP 20x if your service runs on FedRAMP certified infrastructure and fits Class A to C; Rev5 only if you need High (until Class D exists) or already have significant Rev5 progress and a sponsor.
• Your buyers are US states and cities: GovRAMP, starting with a Security Snapshot if your programme is young; a FedRAMP package shortens the work because both are NIST-based.
• Australia: commission an IRAP assessment at Focused or Comprehensive degree against the latest ISM, sized to the classification your buyers need.
• Germany or EU-wide buyers: a C5 Type 2 attestation is the established German cloud evidence and is often requested by other EU buyers while EUCS is not available.
• Japan: ISMAP registration for general services; ISMAP-LIU if your SaaS fits the low-impact eligibility guidance.
• United Kingdom: list on G-Cloud 15 in the right lot, and prepare a written response to the 14 NCSC Cloud Security Principles plus Cyber Essentials, because buyers can call these up in the contract.

Small vs large providers: a small SaaS provider should sequence by revenue, usually one scheme per year, starting with the lightest status that unlocks buyers (GovRAMP Snapshot, FedRAMP Class A or B, ISMAP-LIU). A large provider should invest in one unified control framework with automated evidence, because FedRAMP 20x, IRAP evidence grading and C5 Type 2 all reward evidence that is produced continuously rather than assembled for an audit.

Worked scenario

A mid-sized SaaS provider hosted on a FedRAMP certified IaaS wants US federal, Australian and German health customers within two years. Year one: map its control set to NIST SP 800-53, build automated validations for identity, logging and vulnerability management, and apply for FedRAMP 20x Class B. Year one, quarter four: start the C5 Type 1 audit against C5:2026 (allowed before June 2027) so the following Type 2 period satisfies section 393 SGB V. Year two: commission an IRAP Comprehensive assessment against the current ISM, reusing the automated evidence, which rates higher than screenshots under the Common Assessment Framework. The same machine identity inventory and rotation evidence is submitted to all three assessors.

Common failure patterns

• Calling an attestation a certificate: marketing a C5 report or IRAP assessment as "certified" contradicts the BSI and ASD and undermines trust with assessors.
• Promising EUCS: tender responses that commit to EUCS certification promise something that does not yet exist.
• Letting IRAP evidence age: long engagements that drift more than one ISM version behind trigger a delta assessment.
• Ignoring customer-side controls: C5 reports and shared responsibility matrices list controls the buyer must run; in German health they are a legal condition. See the Shared Responsibility Models Guide.
• Starting new Rev5 work too late: applications after 11 June 2027 will not be accepted.
• Leaving machine identities out of scope: assessors now test non-user accounts and secret rotation; a scope that covers only human administrators fails the identity sections of several schemes.

Practitioner checklist

• List target countries and buyer types, then map each to its scheme and the decision maker who will read your evidence.
• Confirm current status on each official scheme page and record the date checked.
• Build one control framework mapped to NIST SP 800-53, the ISM, C5 and the ISMAP criteria.
• Automate evidence for identity, logging, configuration and vulnerability handling.
• Inventory every machine identity with owner, scope and rotation evidence.
• Choose the lightest status that unlocks buyers first, then plan upgrades.
• Publish a customer responsibilities document aligned to C5 and FedRAMP expectations.
• Track scheme change dates (FedRAMP Rev5 end, C5:2026, G-Cloud expiry) in your compliance calendar.

Standards and references

• FedRAMP: FedRAMP 20x
• FedRAMP: Key Security Indicators
• FedRAMP: Consolidated Rules for 2026 timeline
• GovRAMP: Verification statuses and programme overview
• Australian Signals Directorate: IRAP Common Assessment Framework
• Australian Signals Directorate: IRAP cloud services
• BSI: C5 frequently asked questions
• Council of the EU: Proposal for a Regulation on ENISA, the European cybersecurity certification framework and ICT supply chain security, COM(2026) 11
• Ministry of Internal Affairs and Communications: Commencement of ISMAP-LIU operation
• Digital Agency: ISMAP-LIU
• Government Commercial Agency: G-Cloud 15 (RM1557.15)
• NCSC: The cloud security principles

Related NHI Mgmt Group resources: FedRAMP Guide · Australia IRAP Guide · Germany BSI C5 Guide · EU Sovereign Cloud Options Compared Guide · Global Cybersecurity Regulatory Map. This guide summarises government cloud authorisation schemes in selected countries and is not legal advice.