Perplexity Earns First Full FedRAMP 20x Class C Certification

FedRAMP confirmed on October 28, 2026, that Perplexity Enterprise and API Platform is the first cloud service to receive a full FedRAMP 20x Class C certification under the program’s 2026 Consolidated Rules. Class C corresponds to the former Moderate impact level and is intended for common enterprise cloud services that may be used across an agency or support important government services. The certification is a milestone for FedRAMP’s shift toward outcome-based security reviews, moving the 20x model beyond its limited-pilot phase and into full certification for a service profile with broad federal relevance.

FedRAMP 20x launched in March 2025, with consolidated rules published in June 2026 and the broader certification pipeline opened in August. Rather than relying primarily on documentation-heavy reviews, the framework assesses security capabilities through measurable Key Security Indicators (KSIs), outcome evidence, and automated validation. FedRAMP said the Perplexity offering addresses all final Class C rules developed during 19 months of work on the assessment framework. The service had previously been used by agencies under a limited pilot Class C certification; the new decision recognizes compliance with the final requirements.

For procurement teams, the certification creates a newly available option to evaluate AI-enabled research and knowledge-work workflows in a federally certified environment. Perplexity says users can conduct live web searches, receive answers with citations, summarize approved documents, draft briefing notes, and outline policy updates. The platform provides access to Perplexity models and third-party models, including OpenAI GPT, Anthropic Claude, Google Gemini, and Perplexity Sonar. Through the General Services Administration’s OneGov offer, agencies can obtain Enterprise Pro for Government for $0.25 per agency through March 31, 2027. That pricing and the new certification may support pilot planning, but agencies still need to assess mission fit, data handling, identity and access controls, and applicable authorization boundaries before deployment.

The Class C certification should not be treated as blanket approval for all agency uses. It does not, by itself, establish that every agency workload is authorized or that a particular controlled unclassified information (CUI) use case is permitted. Contractors should confirm the relevant agency authorization and contract requirements, including any separate Department of Defense Impact Level requirement. The certification also has no fixed expiration date but remains conditional on continued compliance, including an independent assessment at least annually. The independent assessor, 360 Advanced, reviewed the in-scope KSIs, the automated validation methods supporting each indicator, and machine-readable evidence. Agencies and vendors should also account for parallel FedRAMP developments: nearly 100 companies have entered the broader 20x pipeline, while the legacy Rev5 agency path is scheduled to phase out on June 11, 2027. The Department of Veterans Affairs has stated that FedRAMP certification is not required to compete for its cloud contracts, although post-award KSI reporting may be required.

• FedRAMP confirmed the first full 20x Class C (Moderate) certification on October 28, 2026, for Perplexity Enterprise and API Platform.
• Class C is designed for common enterprise cloud services likely to be used across an agency or to support important government services.
• GSA’s OneGov offer provides Enterprise Pro for Government for $0.25 per agency through March 31, 2027.
• The certified platform supports live web search and cited answers, and Perplexity describes use for summarizing approved documents, drafting briefing notes, and outlining policy updates.
• Available models include OpenAI GPT, Anthropic Claude, Google Gemini, Perplexity Sonar, and other models developed by Perplexity and third parties.
• 360 Advanced served as the independent assessor, reviewing KSIs within the minimum assessment scope, automated validation methods, and machine-readable evidence.
• Continued certification requires ongoing compliance and an independent assessment at least once a year; certification has no fixed expiration date.
• Agencies and contractors should verify workload-specific authorization and any separate DoD Impact Level requirements before using the service for CUI or other sensitive workloads.
• Nearly 100 companies have entered the broader FedRAMP 20x pipeline; the legacy Rev5 agency path is scheduled to phase out June 11, 2027.
• VA has said FedRAMP certification is not required to compete for its cloud contracts, though post-award KSI reporting may be required.