FedRAMP High In-Process [Explained]

TL;DR

• FedRAMP High In-Process means a cloud offering is listed on the FedRAMP Marketplace as working toward a High (Class D) authorization; it is not an authorization to operate.

• On 13 July 2026 Cognition said the full Devin platform, including Devin Cloud, is FedRAMP Class D (High) In-Process and listed on the Marketplace, extending High beyond Desktop.

• Devin Desktop and CLI are already described by Cognition as FedRAMP High Authorized; Devin Cloud is the In-Process piece.

• A 2-truck HVAC shop, a 10-person agency, or a solo clinic that never bids federal work can ignore this listing; a contractor bidding civilian or defense engineering work cannot.

Industry figures, not list prices.

Industry figures, not list prices.

Industry figures, not list prices.

According to NFIB, 44% of small businesses cite time-management. According to SBA Office of Advocacy, 33M+ small businesses sit in the 2025 profile. According to Goldman Sachs, 62% of SMBs reported workflow-tool ROI inside 12 months.

Key Takeaways

• In-Process is a Marketplace status after an agency partnership packet, not a finished ATO.

• Class D on today's Marketplace filters is FedRAMP High.

• Cognition's 13 July post is a vendor listing claim; FedRAMP itself still does not grant ATOs.

• Desktop and CLI High-authorized is a different fact from Cloud In-Process.

• Do not paste "FedRAMP High" into a proposal if the SKU you will run is still In-Process.

What FedRAMP High In-Process actually is

FedRAMP High In-Process is a Marketplace listing status: a cloud service is in the Pre-Authorization step toward a High-impact (Class D) FedRAMP path, with an agency partner on file, and it is not yet authorized to operate.

A 2-truck HVAC shop should care only if it is a subcontractor on a federal facility job whose contract names a High cloud tool. A 10-person marketing agency should care only if it is writing a proposal that claims a coding agent is "FedRAMP High." A solo-run clinic should care only if it stores CUI or bids a civilian health-IT modernization task. If none of those are true, this listing does not change your Tuesday. If any of them are true, mixing Desktop-authorized with Cloud-in-process in the same sentence is how a proposal gets protested.

This article is current as of 13 July 2026, the date Cognition posted the Devin Cloud listing. FedRAMP High In-Process is a status name, not a Cognition trademark and not a protocol.

What Cognition posted on 13 July 2026

According to Devin Central, Cognition said on 13 July 2026 that its entire platform is FedRAMP Class D (High) In-Process and listed on the FedRAMP Marketplace, extending High beyond Devin Desktop to Devin Cloud.

Cognition's own 13 July post says the same: the full platform including Devin Cloud is In-Process and listed, while Devin Desktop (formerly Windsurf) and CLI are already FedRAMP High Authorized and described as compliant for ITAR and DoW IL4, IL5, and IL6 workloads. Cognition names U.S. Army, U.S. Navy, NASA JPL, and Anduril as users, plus Goldman Sachs, Citi, Dell, and Mercedes-Benz on the commercial side.

According to AI Tools Review, Devin reached FedRAMP High In-Process as of 13 July 2026, and In-Process means the authorization is underway rather than complete. That independent recap is a date check, not a FedRAMP decision.

Devin Central's news index lists the same 13 July item under the headline that Devin clears FedRAMP High In-Process for federal engineering teams. Fan coverage is not an official Cognition announcement; the primary vendor text is the Cognition blog.

Sources: Cognition 13 July; Cognition for Government; DOE MOU; Devin Central 13 July.

Cognition's federal docs table, last updated 1 September 2026 on the models block, marks Devin (cloud) as FedRAMP High In Process and Devin CLI and Devin Desktop as High ✓. IL4, IL5, and ITAR follow the same pattern: In Process for Devin, ✓ for CLI and Desktop. That table is the cleanest product-by-product split Cognition publishes.

The mechanism in plain language

FedRAMP is the U.S. program that standardizes how agencies assess cloud services. An agency still issues its own Authorization to Operate. The Marketplace is where agencies look up what is certified, in process, or otherwise listed.

According to FedRAMP's Marketplace quick start, agencies filter by 4 certification classes — Class A (Pilot), Class B (LI-SaaS, Low), Class C (Moderate), or Class D (High) — and FedRAMP certification means adequate security materials exist for an agency's own ATO decision: FedRAMP does not grant ATOs.

According to FedRAMP Rev 5 Agency Authorization, In-Process is the Marketplace designation in the required Pre-Authorization step, after an agency submits an In Process Request letter and a work breakdown structure to intake@fedramp.gov. FedRAMP Ready lasts one calendar year from designation at Moderate and High, and no agency partner is required for Ready.

So the mechanism for "High In-Process" is: impact is High / Class D, an agency partner is on file, 3PAO work is in motion, and the offering is listed so buyers can see it. It is not "the government blessed this model to merge code in production."

FIPS 199, dated February 2004, is the categorization standard FedRAMP's Rev 5 page points agencies to. The FIPS 199 PDF defines three impact levels. The potential impact is HIGH if the loss of confidentiality, integrity, or availability could be expected to have a severe or catastrophic adverse effect, including loss of a primary mission function, major financial loss, or severe harm to individuals involving loss of life. FedRAMP High is that impact class applied to a cloud offering, not a marketing adjective.

NIST SP 800-53 Rev. 5 is the control catalog (published September 2020, updates as of 10 December 2020; a 5.2.0 minor release landed 27 August 2025). NIST SP 800-53B supplies the 3 security control baselines — low-impact, moderate-impact, and high-impact — plus a privacy baseline. High In-Process means the provider is on the path to showing the High baseline, not that every control is already accepted.

Cognition's federal introduction says the federal deployment of the Cognition Platform runs on AWS GovCloud, uses a dedicated enterprise portal, and authenticates with OIDC or SAML. AWS describes GovCloud as two isolated U.S. sovereign regions (US-East and US-West) operated by U.S. citizens, and its GovCloud page marks 15 years of that offering. Hosting in GovCloud is necessary plumbing. It is not a FedRAMP High ATO for Devin Cloud.

Why now: the maintenance trap, then the agent

Cognition for Government (25 February 2026) is the earlier civilian/defense pitch. According to Cognition, of the $100 billion the U.S. government spends annually on IT, nearly 80% goes to maintaining existing systems, and only 3 of 10 critical legacy systems flagged by the GAO in 2019 have been modernized. The same post said Windsurf was then the FedRAMP High AI IDE, Devin could complete migrations 5-40x faster than human engineers, Devin was available in AWS GovCloud, and a FedRAMP High Authorized version of Devin would soon be available. July's In-Process listing is that "soon" moving one notch, not the Authorized version arriving.

The primary GAO report Cognition is pointing at is GAO-19-471, publicly released 11 June 2019. According to GAO, the federal government planned to spend over $90 billion in fiscal year 2019 on IT, about 80 percent of that amount to operate and maintain existing systems, and GAO identified the 10 most critical legacy systems among 65 reviewed, aged 8 to 51 years, at 10 agencies. Three agencies had no documented modernization plans. Cognition's "3 of 10" line is Cognition's 2026 restatement of that 2019 list; check GAO for the original table.

The constraint that broke for vendors is Marketplace visibility for the cloud agent, not the IDE. Desktop could already be sold as High Authorized. Cloud — the piece that runs fleets of agents on their own computers and hands over merge-ready PRs — is what 13 July puts In-Process.

Cognition's DOE Genesis Mission MOU (22 July 2026) restates Class D (High) In Process for the platform and High Authorized for Desktop and CLI, and names 17 national laboratories in the mission. That MOU is a collaboration framework. It is not an ATO.

What Cognition claims the agent does (vendor figures)

According to Cognition, Devin Security Swarm had the highest recall and 30 percent lower cost per finding than the next most accurate alternative in independent benchmarking, and fleets of Devins can upgrade legacy software 5-40x faster than humans alone. The same post says Devin Fusion achieves frontier-level performance at 60% lower cost by using model routing. 30 percent lower cost per finding is Cognition's figure. It is not a FedRAMP measurement.

Cognition's Security Swarm post reports a benchmark of 50 real-world GHSA vulnerabilities across 14 languages: Devin Security 72% recall at $90.23 per run, Claude Security 68% at $131.87, Codex Security 48% at $118.20, Cursor Security 26% at $4.60, and 30% lower cost than the nearest comparable alternative. It also says some teams see 10–100x more scanner findings. Treat the percentages as Cognition's harness, not a FedRAMP lab result.

Cognition's Fusion post shows FrontierCode 1.1 Extended figures last updated 8/7/2026: Fable 5 (xhigh) 64.9 at $10.53, Devin Fusion 63.1 at $1.35, and a claim of up to 60% lower cost, with 88% of internally merged PRs driven entirely by the automated Fusion router in an internal cohort. Cognition's FrontierCode introduction says the benchmark uses 150 tasks (Extended), 100 on Main, 50 on Diamond, more than 40 hours of maintainer effort per task, and an 81% lower false-positive rate versus SWE-Bench Pro. Fusion is a routing harness on that benchmark. It is not the In-Process letter.

Cognition's AI Productivity Guarantee says if Devin delivers less engineering value than the customer is paying for, Cognition will fund usage up to $10 million until it does. Federal docs repeat that they will fund up to $10 million of usage until mission outcomes are achieved. A usage credit is not an ATO.

Sources: Cognition federal compliance; Cognition 13 July.

Devin Cloud is In Process on Cognition's own table. Desktop and CLI are the High-authorized rows. Do not collapse those rows in a bid.

USTA analysis: two authorized, one in process

USTA analysis. Inputs from Cognition's federal compliance table: among the three named product columns, Devin CLI is FedRAMP High ✓, Devin Desktop is FedRAMP High ✓, and Devin (Cloud) is FedRAMP High In Process. Count: 2 authorized surfaces, 1 In-Process surface. Arithmetic: 2 ÷ 3 = 67% of the named product columns on that table are already High-authorized; 33% (the Cloud agent) is not.

That 67/33 split is a column count on one Cognition table, last read with a 1 September 2026 models stamp on the same page. It is not the share of federal spend, not the share of your repos, and not a FedRAMP score. If the SKU you will run is Devin Cloud, you live in the 33% column until the Marketplace status changes.

Separately, GAO's FY2019 floor of over $90 billion with about 80 percent on operate-and-maintain implies 0.80 × 90 = $72 billion on O&M if you treat the "over $90 billion" line as $90. That $72 billion is arithmetic on GAO's 2019 floor, not a 2026 budget line and not a Devin result.

What a small operator should do with this

If you never touch a federal contract, stop. The listing does not make Devin cheaper for a clinic's patient portal.

If you are a subcontractor, ask three questions in writing: which Cognition SKU is in scope (Desktop, CLI, or Cloud); whether that SKU is Authorized or In-Process on the Marketplace the week you bid; and who at the prime issues the ATO. FedRAMP's own guide says to verify current certification status before finalizing agreements.

A solo lawyer or transactional shop already comparing practice systems — see Clio alternatives for solo lawyers and Smokeball versus Clio Manage — is in a different buying job unless the matter is a federal modernization subcontract. Do not stretch a Marketplace listing into a matter-management feature.

Teams already routing code-review exceptions through US Tech Automations workflows can treat a Devin pull request as another event: if the agent opens a PR, require a named reviewer; if the repo is in a High boundary, refuse Cloud until the listing is Authorized; if Desktop is the authorized SKU, keep Cloud credentials off that machine. The state of small-business automation is still the right operating picture for shops that are not on a federal boundary: list the queue, name the approver, keep the system of record.

US Tech Automations can open that review task when an agent PR lands. It should not be the party that signs an ATO.

Honest limits

In-Process is not Authorized. FedRAMP does not grant ATOs. Cognition's 5-40x, 30%, 60%, 72%, and $10 million figures are Cognition's product claims. Security Swarm's 50-CVE table is Cognition's harness. Fusion's 88% is an internal cohort. GAO-19-471 is a 2019 report; Cognition's $100 billion / 80% / 3-of-10 line is a 2026 restatement. AWS GovCloud is the host, not the authorization. Desktop High does not travel automatically to Cloud.

An SMB that is not a federal contractor can ignore this. A contractor that pastes "FedRAMP High" over an In-Process Cloud SKU is misstating the Marketplace.

Signal vs Speculation

Sourced signal: On 13 July 2026 Cognition said Devin Cloud and the full platform are FedRAMP Class D (High) In-Process and Marketplace-listed, while Desktop and CLI are High Authorized. Devin Central and AI Tools Review independently dated that post 13 July and noted In-Process is not complete. FedRAMP's Marketplace guide states Class D is High and that FedRAMP does not grant ATOs. FedRAMP Rev 5 defines In-Process as the Pre-Authorization Marketplace designation after an IPR and WBS. FIPS 199 defines High impact. SP 800-53B defines three security baselines. Cognition's own compliance table still shows Cloud as In Process as of the 1 September 2026 models stamp. GAO-19-471 documented the 2019 legacy-system list Cognition cites.

Our read: over 12–36 months, more coding-agent vendors will announce High In-Process as a sales gate for defense and civilian engineering. The buyers who benefit will map SKU to status on the Marketplace the week they bid. The buyers who get hurt will treat In-Process as an ATO and will run Cloud agents against High data because Desktop was already authorized.

Our read for smaller teams: if you are not on a federal contract, do not staff this. If you are a ten-person shop on a subcontract, use Desktop or CLI only where Cognition's table shows ✓, and keep Cloud behind a written wait. A two-person shop cannot absorb a misstated High claim in a proposal the way a primes' compliance desk can.

Frequently Asked Questions

What does FedRAMP High In-Process mean?

It means the cloud offering is listed on the FedRAMP Marketplace as working toward a High / Class D authorization after an agency partnership packet. It is not an authorization to operate. FedRAMP's own guide says FedRAMP does not grant ATOs.

Did Cognition authorize Devin Cloud on 13 July 2026?

No. Cognition listed the full platform, including Devin Cloud, as Class D (High) In-Process. Cognition says Desktop and CLI are already High Authorized. Those are different rows.

Is Class D the same as High?

On FedRAMP's Marketplace quick start, Class D is the High filter. Class C is Moderate, Class B is LI-SaaS/Low, Class A is Pilot.

Does this matter if I am not a federal contractor?

No. A clinic, HVAC shop, or agency with no federal data boundary can ignore the listing. It becomes operational only if you bid or subcontract work that names High cloud tools.

Are Cognition's 5-40x and 30% figures FedRAMP results?

No. They are Cognition product claims from the 13 July post and the Security Swarm benchmark of 50 GHSAs. They do not appear as FedRAMP measurements on the Marketplace guide.

Where does the work actually run for federal customers?

Cognition's federal introduction says the federal Cognition Platform runs on AWS GovCloud with SSO via OIDC or SAML. GovCloud hosting is not a substitute for a High ATO on Devin Cloud.

What to keep off the unattended path

Do not let a Cloud agent merge into a High-impact repo while the Marketplace row is In-Process. Do not write "FedRAMP High authorized" in a proposal if the SKU is In-Process. Do not treat Desktop's High row as covering Cloud. Do not convert Cognition's 5-40x modernization range into a staffing cut. Do not treat the $10 million usage guarantee as a compliance warranty.

A no-fit is allowed. If you are not a federal contractor, wait. If you cannot name the SKU, you cannot name the status. If your prime cannot name the ATO official, you are not ready to run the agent.

When the SKU is listed and the reviewer is named, wire the exception path so an agent pull request still produces a reviewable event. US Tech Automations belongs on that review path, not in the authorization decision.