# Amazon Braket enters FedRAMP Class C scope in three US regions > AWS says Braket’s AWS-operated components are covered in three US regions, while third-party quantum execution remains outside the boundary. Canonical URL: https://www.devobs.io/news/news-event-cc10a807e94087c6537653c0/ By: Owen Park Published: 2026-10-18T08:31:59.625Z Updated: 2026-10-18T08:31:59.625Z Event date: 2026-10-16 Section: Cloud AWS announced on October 16, 2026, that Amazon Braket is now in scope for FedRAMP Class C in three US regions: US East (N. Virginia), US West (N. California), and US West (Oregon). The announcement covers AWS-operated components of the quantum computing service, but explicitly excludes the third-party quantum hardware providers that execute quantum workloads. [AWS announcement](https://aws.amazon.com/about-aws/whats-new/2026/10/braket-fedramp-class-c/) FedRAMP provides a US government-wide approach to security assessment, authorization, and continuous monitoring of cloud products and services. For teams evaluating Braket, the important detail is which parts of a workflow fall within the stated authorization boundary. ## What the boundary includes—and excludes AWS lists Braket’s API and SDK, job orchestration and management, compilation, and result storage in Amazon S3 among the AWS-operated components inside the boundary. Third-party Quantum Hardware Providers (QHPs) remain outside it. AWS also says all data sent to QHPs meets its privacy and security requirements, including removal of all personally identifiable information, encryption in transit and at rest, and adherence to AWS’s standard data retention and deletion policies. These are AWS’s stated safeguards; they do not place the providers inside Braket’s FedRAMP boundary. [AWS scope and data-handling statements](https://aws.amazon.com/about-aws/whats-new/2026/10/braket-fedramp-class-c/) ## Engineering implications: trace the handoff The distinction is between managing a quantum workload through covered AWS components and executing it on an external provider. Using an in-scope API does not extend the stated authorization boundary to that provider. Teams evaluating government workloads should map what information crosses the QHP handoff, where results return, and how those transfers fit their own authorization requirements. AWS’s data-handling assurances are relevant to that assessment, but should be considered separately from authorization scope. The practical takeaway is a scoped compliance expansion: assess the complete workflow, not just the Braket service label. ## Source references -