FedRAMP 20x stopped being a pilot on June 25, 2026. That is the date FedRAMP released the Consolidated Rules for 2026, the single ruleset that governs the program through December 31, 2028. The 20x rules took force on July 4. They become mandatory for every stakeholder on January 1, 2027.
Sera Brynn is a FedRAMP Recognized Independent Assessor (formerly 3PAO), a GovRAMP 3PAO, and an Authorized C3PAO under CyberAB (CPN 59175). Our assessors work inside FedRAMP baselines every day. This article covers what changed under the Consolidated Rules, which decisions carry deadlines, and what your evidence pipeline has to produce.
20x at a Glance:
-
The rules are final. The Consolidated Rules for 2026, referred to as CR26, replace a decade of memos, RFCs, notices, and templates with one ruleset. FedRAMP has issued several corrections to the ruleset since its June 25 launch, most recently on July 14. Rule text changes over time. Check FedRAMP's changelog before treating any single rule as final.
- Authorization is now Certification. Impact levels are now Certification Classes A, B, C, and D. Third-Party Assessment Organization is now Independent Assessor.
- Classes A, B, and C are available now. Class D is scheduled for development in Phase 4, estimated FY27 Q1 to Q2.
- Rev5 has an end date. FedRAMP stops accepting new Rev5 Certifications on June 11, 2027. Existing Rev5 Certifications continue.
- You pick one lane. For Program Certification, 20x and Rev5 are separate paths. They are not interchangeable.
- Evidence is machine-readable. Key Security Indicators validated through structured JSON replace narrative documentation. FedRAMP publishes the schemas and a browser-based validator.
- The System Security Plan (SSP) is retired. The Security Decision Record takes its place as a persistently maintained record rather than a point-in-time document.
The Consolidated Rules Ended the Uncertainty
For fifteen months, 20x arrived as a stream of separate RFCs, notices, and pilot guidance. Tracking it required watching GitHub. CR26 ended that.
Three structural facts matter for planning.
One ruleset, one format. CR26 consolidates every requirement for both 20x and Rev5. Its source of truth is structured, machine-readable JSON published on GitHub. The human-readable site at fedramp.gov/2026 is reference material.
A thirty-month stability window. CR26 is intended to hold from July 2026 through December 31, 2028. A compliance posture that earns Certification in late 2026 will not be invalidated by a rule change in early 2027. This is the first realistic opportunity in years to build a multi-year federal roadmap.
Dated transitions. Individual rules carry their own effective dates. The broad transition lands January 1, 2027, and the Rev5 application window closes June 11, 2027.
The Vocabulary Changed, and It Matters Commercially
These are not cosmetic renames. They change what you can claim, what appears on the FedRAMP Marketplace, and what a contracting officer will accept.
FedRAMP moved off the Low, Moderate, and High labels to eliminate collision with DoD Impact Level designations, which had been producing misalignment in procurement and marketing. Under the mapping FedRAMP published, current Low and Li-SaaS map to Class B, current Moderate maps to Class C, and current High maps to Class D. Class A is new.
The Independent Assessor rename aligns the program with the explicit language of the FedRAMP Authorization Act. It also resolves a long-standing problem: the same firms were providing assessment and advisory services under one label.
Certification Classes Define Your Assurance Commitment
FedRAMP grants Classes based on how much assurance a provider is willing to supply to federal customers. Lower Classes cost less to procure and operate because the ongoing commitment is smaller. Higher Classes carry reporting obligations that most providers would never extend to a private-sector customer.
Class A is the on-ramp. It is a transitional designation available only through Program Certification, built for providers with mature security programs that have not invested in the Rev5 path. It requires a limited amount of information in advance and a reduced set of ongoing monitoring obligations. Class A providers must show a scheduled assessment for Class B, C, or D within two years of their initial Marketplace listing, or FedRAMP suspends the listing until one is scheduled.
Class A is also where external framework evidence has real standing. A provider seeking Class A supplies materials from an alternative security framework assessment, including a complete SOC 2 Type II report with any bridge or gap letter and verified audit engagement documentation. Legacy FedRAMP Ready and GovRAMP Readiness Assessment Reports and Security Assessment Plans are also recognized inputs. Every one of these must have been completed within the past 12 months.
Class B covers common small-scale or light-use services where an entire agency is unlikely to depend on the offering for important work.
Class C covers common enterprise services likely to be used across an agency, or services delivering important government functions. If you hold a Rev5 Moderate authorization today, Class C is your lane.
Class D is under development in Phase 4.
Your Evidence Pipeline Has to Produce Five Things
20x rewards providers who already run mature Development, Security, and Operations (DevSecOps) pipelines. It penalizes those who assemble evidence in the weeks before an assessment.
The requirements FedRAMP set out under CR26 include the following:
Key Security Indicators (KSI). Continuous, measurable benchmarks reported in near real time. FedRAMP's Phase 1 finding was direct: KSIs can demonstrate security capabilities continuously, replacing static annual manual assessments while improving confidence.
FedRAMP JSON schemas. Machine-readable packages built to FedRAMP's published schemas. FedRAMP released a JSON Schema Validator on July 15, 2026 that runs entirely in the browser. Treat the schemas as a specification, not a reference.
A Security Decision Record (SDR). A persistently maintained record of the security decisions you make across the lifecycle of the offering, covering implementation rationale, resulting customer risk, assessment findings, and supporting artifacts.
Certification data sharing. Certification data must be stored and shared through a FedRAMP-compatible Trust Center following the data sharing rules.
Collaborative continuous monitoring. After Certification you share ongoing data with every agency customer, produce a regular Ongoing Certification Report, host a synchronous Quarterly Review, and undergo Persistent FedRAMP Assessments focused on your KSIs.
The Record Behind the Current Rules
The pilots are over. The record behind the current rules is short and worth knowing.
- December 2022. The FedRAMP Authorization Act writes FedRAMP into law within GSA, codifies the Joint Authorization Board, and creates the Federal Secure Cloud Advisory Committee.
- July 2024. OMB Memorandum M-24-15 rescinds and replaces the 2011 policy in its entirety, creating a program with the same name and an entirely different set of authorities. The Joint Authorization Board is dissolved and replaced by the FedRAMP Board. The provisional authorization pathway is sunset.
- March 24, 2025. GSA announces FedRAMP 20x.
- April to September 2025. Phase 1, the Low pilot. FedRAMP receives 26 complete packages. The first pilot authorizations arrive in late July 2025.
- November 2025 to March 2026. Phase 2, the Moderate pilot. Fourteen qualifying submissions. The first cohort receives pilot authorizations on March 6, 2026.
- April 2026 to present. Phase 3, wide-scale adoption. CR26 launched June 24. Marketplace listings for initial implementation opened July 6. The Class A pipeline opened August 3. Class B and Class C open August 31.
- FY27 Q1 to Q2, estimated. Phase 4, the Class D pilot.
- June 11, 2027. FedRAMP stops accepting new Rev5 Certifications.
Speed Comes With New Obligations
Faster Certification changes the go-to-market calculus. It also moves work forward in the calendar.
What it demands in return:
- Engineering ownership. FedRAMP's Phase 1 finding was that providers need deep engagement from engineering teams, not a compliance function working alone.
- Continuous obligations. Quarterly Reviews, Ongoing Certification Reports, and Persistent Assessments are recurring commitments, not a one-time milestone.
- Evidence quality. Assessments that moved fastest in the pilots shared specific traits: timely submission access, consistent machine-readable schemas, concise evidence context, clear failure criteria, and assessor review of validation code.
- A path decision with consequences. Choosing 20x or Rev5 for Program Certification carries documentation, evidence, and assessment implications that are difficult to unwind.
The Independence Rule Changes Who You Can Hire
FedRAMP has always required assessor independence. CR26 makes the language explicit and adds an activity floor.
CR26 also sets a volume floor. Independent Assessors must complete a minimum of two assessments every two years to retain recognition. Expect that to reduce the field of firms holding accreditation without an active assessment practice.
For CSPs, two practical steps follow. Confirm your assessor holds current recognition under CR26 and has a documented transition plan. Confirm the firm advising you is not the firm assessing you.
Sera Brynn takes that boundary seriously and structures engagements around it. We offer FedRAMP assessment services and FedRAMP advisory services. For any given client, we do one or the other, never both.
The Marketplace Now Shows More
FedRAMP updated the Marketplace for CR26 on July 17, 2026. Product pages now carry a lifecycle Phase field distinguishing Initial Implementation from Ongoing Certification, a "FedRAMP Certified (In Remediation)" status, a Corrective Action Plan indicator, and a Certification History event log. Reuse authorization metrics are no longer displayed publicly.
If you sell into the federal market, your Marketplace entry is now a more detailed public record of your operational discipline than it was in June.
A Note for Defense Contractors
If you are pursuing CMMC Level 2, the cloud services in your CUI environment are in scope for this. Audit your SaaS stack against the new labels and record what each tool claims today against what it becomes under CR26.
Pay particular attention to any vendor relying on "Moderate Equivalency." That construct originates from a December 2023 DoD memo, and FedRAMP does not recognize it. It carries no standing toward a FedRAMP Certification and is not a substitute where a contract or a C3PAO assessor requires official Marketplace status. Resolve those before your next assessment or customer security review.
Talk to Our Assessment Team
FedRAMP 20x changes what "ready" looks like. Sera Brynn's assessors work inside FedRAMP baselines and NIST 800-53 controls every day. We are a FedRAMP Recognized Independent Assessor (formerly 3PAO), a GovRAMP 3PAO, and an Authorized C3PAO under CyberAB (CPN 59175).
Contact Sera Brynn to discuss where your cloud service stands against the current requirements.
Frequently Asked Questions
What is FedRAMP 20x?
FedRAMP 20x is GSA's modernized path to federal cloud Certification, announced in March 2025 and formalized in the Consolidated Rules for 2026. It replaces narrative documentation and point-in-time review with Key Security Indicators validated through machine-readable evidence, and it allows providers to pursue Certification without a federal agency sponsor.
Is FedRAMP 20x available now?
Yes. The rules for Class A, Class B, and Class C Certification are final and took force on July 4, 2026. Class D is scheduled for development in Phase 4. The public submission pipeline is opening during FY26 Q4.
Does FedRAMP 20x replace the traditional FedRAMP process?
Eventually. Rev5 remains available, but FedRAMP stops accepting new Rev5 Certifications on June 11, 2027. Existing Rev5 Certifications continue under updated CR26 requirements. FedRAMP has indicated Rev5 remains the better fit for non-cloud-native services and, for now, Class D.
Can I pursue both 20x and Rev5?
Not for Program Certification. You commit to one path. A provider could separately pursue an agency-sponsored authorization, but maintaining both is complex and likely to confuse agency customers.
Do SOC 2 or ISO 27001 count toward FedRAMP 20x?
At Class A, a SOC 2 Type II report is a defined input, submitted with any bridge or gap letter and verified audit engagement documentation. Legacy FedRAMP Ready and GovRAMP readiness materials are also recognized. At other Classes, external framework evidence supports your case but does not substitute for FedRAMP requirements.
When does CR26 become mandatory?
January 1, 2027 for all stakeholders. Some individual rules carry later effective dates. CR26 remains the baseline through December 31, 2028.
How should a CSP prepare for FedRAMP 20x?
Confirm which Class your offering maps to. Choose your path before the Rev5 window closes. Build evidence collection that produces continuous, machine-readable output validated against FedRAMP's published schemas. Verify your assessor holds current CR26 recognition and is independent of your advisory firm.
What is FedRAMP Class A, and who is it for?
Class A is the entry point into FedRAMP 20x for providers with an existing commercial certification. It accepts a completed FedRAMP Rev5 (including Ready), SOC 2 Type II, or GovRAMP certification finished within the past 12 months in place of a full FedRAMP package, then layers on a short list of FedRAMP-specific requirements. No agency sponsor is required.
Class A fits providers with an active SOC 2 or GovRAMP program who want a federal foothold without committing to a full Class B or C build-out yet. It's transitional by design: providers must show a scheduled assessment for Class B, C, or D within two years of their initial Marketplace listing, or FedRAMP suspends the listing until one is scheduled.
