FedRAMP 20x is no longer a hypothetical alternative to FedRAMP Rev5. It’s now a widely available certification path for all cloud service providers (CSPs).

On June 25, 2026, the Federal Risk and Authorization Management Program (FedRAMP) finalized the Consolidated Rules for 2026 (CR26), a single ruleset that defines the FedRAMP 20x requirements for cloud providers, assessors, and agencies moving forward and establishes transition deadlines through 2028.

This milestone marks the end of a fast-moving 15 months, during which FedRAMP 20x was announced and piloted as a cloud-native, automation-first replacement for the traditional Rev5 process that had been too slow and too expensive for most cloud providers to even attempt. Now that it’s gone from pilot to formalized path, 20x is transforming federal cloud security compliance as we know it.

To help you navigate this transition to 20x, this article covers what FedRAMP 20x is and why it exists, what is changing under CR26, the full timeline from announcement to launch to transition deadlines, and what CSPs should do now.

What is FedRAMP 20x?

FedRAMP 20x is the modernized version of the FedRAMP program designed to reduce the cost and time of achieving and maintaining FedRAMP Authorization (now called “FedRAMP Certification”) and deliver better security outcomes through automation. It shifts away from a paperwork-heavy, point-in-time assessment model toward a cloud-native, automation-driven framework that validates security continuously and shares evidence as machine-readable data.

This new framework has two core objectives:

1. Reduce the compliance burden and extremely high costs for CSPs while improving security and communication about that security posture for agencies.
2. Make it easier for vendors to get into the program and for federal agencies to adopt secure cloud services.

Let’s take a closer look at why these objectives matter to the government and its missions.

What are the Consolidated Rules for 2026 (CR26)?

The Consolidated Rules for 2026 (CR26) is the stable ruleset that brings together all 20x requirements and makes the 20x certification path widely available to CSPs upon its release on June 26, 2026. 

CR26 replaces the patchwork of memos, templates, guides, Requests for Comment (RFCs), and FedRAMP Notices (NTCs) that had accumulated over a decade since the FedRAMP program was first established in 2011 and then enacted into law in 2022 with one “concise, declarative, plain-language” ruleset.

This ruleset also consolidates all the changes FedRAMP introduced and lessons learned since launching 20x in March 2025 based on feedback from the pilots (including the participants who generated 20x packages, the third-party assessment organizations who assessed them, and the agencies who reviewed them), public requests for comment, discussion forums with community working groups, and stakeholder outreach.

The most definitive features of CR26 are:

Plain-language rules

CR26 replaces hedged narrative guidance with direct MUST and MUST NOT statements, closing the gap between what FedRAMP requires and what providers and assessors think it requires.

Machine-readable structure

The requirements are published as structured, machine-readable JSON in a public GitHub repository so a GRC platform or other type of software can pull current requirements directly rather than parsing them out of a PDF written as narrative guidance.

A stable planning window for adoption

While FedRAMP will still issue notices and minor adjustments, the CR26 rules are meant to stay put to let agencies set expectations and cloud providers plan a clear roadmap to transition to or implement 20x before their applicable deadline.

While this is only the first major milestone for FedRAMP 20x and is expected to be replaced annually, CR26 will require every cloud provider to adjust and modernize their GRC processes, tools, capabilities, and methodologies in order to achieve and retain their FedRAMP Certification within the next two years.

To ensure you’re prepared, we cover the biggest changes below

What changed under CR26?

There are three key changes inside CR26 that matter most for how you talk about and pursue FedRAMP going forward:

• The end goal is now FedRAMP Certification not FedRAMP Authorization. 
• Classes A-D replaced the three impact levels (Low, Moderate, and High). 
• Rules and deadlines govern both the new 20x and legacy Rev5 paths.

We’ll dive deeper into each below.

1. FedRAMP Authorization is now FedRAMP Certification

Under CR26, "FedRAMP Authorization" and "FedRAMP Authorized" are retired and replaced by "FedRAMP Certification" and "FedRAMP Certified" as the single official label across every path. 

This doesn’t affect the status of cloud providers currently listed in the FedRAMP Marketplace. A provider that is FedRAMP Authorized today becomes FedRAMP Certified, with the same controls and the same Authorization boundary.

But the change is not just semantics. It is meant to correct a pervasive misunderstanding that a FedRAMP Authorization is the same thing as a government-wide ATO or agency Authorization.

As Dan Chandler of FedRAMP explained at the Secureframe National Cybersecurity Summit 2026, “FedRAMP Certification is not a blanket approval that this service is secure enough for the entire federal government to use for whatever they want."

Instead, it is simply an indicator that FedRAMP has packaged essential security information from a CSP. Individual agencies can then use that information to decide whether that provider’s risk profile fits its use case. 

What this means for cloud providers

Existing Authorizations carry over automatically, so there is no re-Authorization event required (yet—we’ll discuss the transition timeline below). 

For cloud providers, the task is just housekeeping with a deadline: audit customer-facing materials, proposal templates, website copy, and contract boilerplate that hard-code "FedRAMP Authorized" and update the language to “FedRAMP Certified.”

2. FedRAMP impact levels are now Certification Classes B through D

CR26 retires the impact-level labels (Low, Moderate, High) based on Federal Information Processing Standards (FIPS) 199 security objectives and replaces them with Class B-D labels for baselines.

The table below shows the mapping between baselines.

*Note that FedRAMP 20x Class A certification does not map to one of the FIPS 199 impact levels. But it does map to a Marketplace designation, FedRAMP Ready. We’ll discuss it more below. 

The reason for the change is similar to the Authorization designation. The Low, Moderate, and High labels overlapped with the Department of Defense and Department of the Navy Impact Levels (IL2 through IL6), which use similar words to mean different things. The lettered classes remove that overlap, but they also correct another common misunderstanding.

A class describes the scope and depth of the assessment. It does not make a universal judgment about how secure a system is. Only an Agency Authorizing official can identify the necessary security category of a cloud offering for their specific use case.

What this means for cloud providers

For most providers this is a relabeling. The classes map closely to the old baselines, with only small control-set adjustments, and existing Authorizations carry over. A provider authorized at Moderate today becomes FedRAMP Certified at Class C without re-authorizing. (The same is true of providers authorized at High, despite the 20x path not being available yet for applications.)

For defense contractors and CUI-adjacent SaaS, Class C is the one to watch. Class C is the former Moderate baseline, where most of the Marketplace lives and where systems handling Controlled Unclassified Information (CUI) under Department of Defense (DoD) contracts typically need to land. If your customers or contracts reference FedRAMP Moderate today, they may eventually reference Class C under CR26.

2. Class A Certification is a time-limited new entry point

Unlike Classes B-D, Class A Certification is a genuinely new tier introduced under CR26. It is designed for two reasons:

• To be a transitional designation available for organizations with a current FedRAMP Rev5 status (including FedRAMP Ready) at any historical Impact Level.
• To be an entry point for providers who have completed an “equivalent process” to FedRAMP Certification within the past 12 months, defined as SOC 2 Type II or GovRAMP.

Class A is time-limited though for the first group. Providers with a FedRAMP Rev5 Ready status must convert to Class A Certification before the expiration of their annual assessment or by November 17, 2026 (whichever is later).

On July 28, 2026, this status will be relabelled “Legacy FedRAMP Ready.”

Cloud services that do not wish to or do not meet the requirements for conversion will be renamed “Legacy FedRAMP Ready” until this status is entirely removed on December 31, 2027.

Additionally, some organizations will have the option to apply to convert their FedRAMP Rev5 Ready status into a Class B or Class C Certification instead starting on August 10, 2026. 

4. Rev5 and 20x are two defined and acceptable paths that you can pick from (for now)

CR26 publishes rules for both the 20x path and a modified version of the legacy Rev5 path. While FedRAMP recommends choosing 20x, providers can choose Rev5 for now. Below we provide an overview and key dates for each path.

FedRAMP Rev5 certification path

Rev5 is the legacy process, now governed by CR26 rules. New Rev5 Certification applications will stop being accepted on June 11, 2027.

Before that date, a CSP may still choose to apply for Rev5 certification if:

• They’re already working through a sponsored Authorization.
• They run their own infrastructure, instead of cloud-native.
• They require a FedRAMP Class D certification (since a 20x path is not yet available).

While CSPs with a current Rev5 Certifications will remain active until at least December 31, 2028 (unless FedRAMP is otherwise directed), they must begin planning to transition to FedRAMP 20x as quickly as possible.

For both new and current Rev5 Certified CSPS, most rulesets in CR26 are expected to be adopted before or by January 1, 2027.

FedRAMP 20x certification path

20x is the streamlined path built around automation, Key Security Indicators (KSIs), and machine-readable evidence that will eventually replace the legacy Rev5 path entirely.

While 20x paths are available to Classes A, B, and C, Class D is not yet available and is expected to be developed during FedRAMP 20x Phase 4. While this means FedRAMP Rev5 is the only available path to Class D Certification, FedRAMP recommends that a provider pursue 20x Class C now and plan for 20x Class D when it becomes available rather than trying to get an agency sponsor and go down the Rev5 path.

New 20x Certification applications must follow the CR26 rules starting July 4, 2026 (with the exception of two rulesets, which become mandatory later in the year). CSPs with a current 20x Certification have more runway. 

Regardless of which pathway they chose or whether they’re seeking to obtain or maintain Certification, CSPs are expected to follow all applicable CR26 rulesets by January 1, 2027. However, this is a default grace period. Meaning, at this time, FedRAMP will request corrective action. 

Any CSPs that still aren’t following these rules by February 1, 2028 will lose their FedRAMP 20x or FedRAMP Rev5 Certification.

Timeline for FedRAMP 20x

FedRAMP 20x moved from announcement to a finalized ruleset in about 15 months. The milestones below trace that path, followed by the key dates still ahead.

March 24, 2025: FedRAMP 20x announced

FedRAMP director Pete Waterman announced the new model at an industry event in Washington, D.C., and published a program page on its website with details about Community Working Groups and 20x FAQs.

March 31-April 10, 2025: Community working groups launched

FedRAMP stood up its initial working groups to define standards, automation approaches, and monitoring strategies, developing the program in public through GitHub, public calls, and industry forums.

FedRAMP initially launched four groups focused on key goals related to FedRAMP 20x incrementally:

• Group 1 launched March 31, 2025 to work on Rev5 Continuous Monitoring
• Group 2 launched April 2, 2025 to work on Automating Assessments
• Group 3 launched April 8, 2025 to work on Applying Existing Frameworks
• Group 4 launched April 10, 2025 to work on Continuous Reporting

April 24, 2025: Rev5 Authorization backlog reduced significantly 

Since the existing Agency Authorization path based on FedRAMP Rev5 baselines was the only active path to FedRAMP Authorization at this time, FedRAMP was still responsible for reviewing agency authorized FedRAMP packages

On April 24, 2025, one month after GSA announced FedRAMP 20x, FedRAMP began reporting the monthly progress of their review team in working through the backlog of pending Rev5 Authorizations. 

Notable takeaways from this announcement included clearing their review queue down to 25 Authorization packages, the smallest it had been since July 2022.

May 29, 2025: 20x and Rev5 working groups established

Next month, on May 29, 2025, FedRAMP announced that they were consolidating the four community working groups into two larger groups focused on specific sub-communities:

• FedRAMP 20x focuses on making the 20x Authorization process faster and more efficient using automated validation and existing best practices from commercial security frameworks
• FedRAMP Rev5 focuses on improving and modernizing the existing Rev5 Authorization and monitoring processes

May 30, 2025: Phase One pilot opened

FedRAMP opened the 20x Phase One pilot to the public to test a streamlined FedRAMP Low Authorization built on a reduced set of Key Security Indicators in place of traditional FedRAMP Rev5 baselines as indicators of a CSP’s security posture and readiness. 

Successful participants in Phase One would receive a 12-month FedRAMP 20x Low Authorization and be prioritized for Moderate Authorization in future phases of the pilot program.

To support the Authorization of cloud services during 20xP1, FedRAMP published two formal FedRAMP Standards which integrated hundreds of public comments. One was the Key Security Indicators (KSIs) and the other was Minimum Assessment Scope, which provides guidance for CSPs to narrowly define information resource boundaries while still including all necessary components.

June 26, 2025: FedRAMP Roadmap released

FedRAMP released a FedRAMP Roadmap to transparently share what activities they have planned, in progress, or recently completed.

In June, FedRAMP also announced that they successfully reduced the Rev5 Authorization life cycle to 30 days or less from submission to Authorization.

July 30, 2025: First 20x Authorizations announced

FedRAMP authorized the first four cloud services under the 20x Phase One Low pilot, proving the model could deliver Authorizations faster without sacrificing security.

They also achieved major milestones for Rev5 that same month. FedRAMP authorized 114 cloud services within six months (more than double the number completed in the entire fiscal year 2024), bringing down the average agency Authorization review time to approximately five weeks.

August 28, 2025: A record year and Secureframe's Authorization

By the end of August, 26 CSPs had achieved 20x Low Authorization through the Phase One pilot, including Secureframe. 

Early 2026: Phase Two scales to Moderate

Launched in late 2025 and concluding in early 2026, FedRAMP ran the Phase Two pilot to test whether the 20x model could handle Moderate-impact systems, with their higher complexity and assurance requirements. Participation was limited to 14 selected CSPs, roughly half the Phase One cohort, so FedRAMP could work closely with each.

Secureframe was among the 14 participants, and successfully met the FedRAMP 20x Moderate security requirements.

The outcomes from this pilot fed the formal 20x standards for both Low and Moderate.

February 25, 2026: NTC-0004 sets the rename and class structure

FedRAMP published the initial outcome of RFC-0020 FedRAMP Authorization Designations as NTC-0004, confirming that "FedRAMP Certification" would become the single official label and that Certification Classes A through D would replace the FIPS 199 impact levels.

May 4, 2026: CR26 public preview opens

FedRAMP opened a public preview of the Consolidated Rules for 2026, publishing draft rules for real-time community comment through GitHub Discussions rather than the traditional Federal Register process.

June 25, 2026: CR26 launches

FedRAMP finalized and launched CR26, moved Rev5 and 20x pilot documentation to a legacy section, stood up a centralized rules website, and updated the Marketplace for the new class structure. Upon the release of CR26, FedRAMP 20x became a widely available certification path to cloud providers, not just to a select few pilot participants.

Let’s take a closer look at the phased rollout plan for CR26.

The CR26 phased adoption

While the Consolidated Rules for 2026 take effect on July 4, 2026, and are immediately applicable to all cloud service offerings seeking to obtain or maintain a FedRAMP Certification, they aren’t mandatory for all.

Below we explain key deadlines of the phased mandatory adoption of CR26. 

What FedRAMP 20x and CR26 mean for CSPs right now

What you should do next depends on your current cybersecurity program and FedRAMP status, but every provider has near-term housekeeping because the terminology and labels have changed.

If you hold a current FedRAMP Rev5 or 20x Certification

If you have a current FedRAMP Rev5 Authorization, your ATO stays valid and your baseline carries over to the matching class (Moderate becomes Class C, High becomes Class D). Same goes for organizations that got 20x Certifications through the pilots.

Immediate next step is to map your existing documentation to the class structure, and update any materials that hard-code "FedRAMP Authorized" or an impact-level label. 

It’s also important to start understanding and implementing CR26 rules as soon as possible so you’re ready by January 1, 2027, when CR26 becomes mandatory.

If you are pursuing Certification now

Decide between the Rev5 and 20x paths to obtain FedRAMP Certification. If you are already in the process of a sponsored Rev5 Authorization, confirm your adoption timeline. If you are starting fresh, prioritize the 20x path, which is built for automation and machine-readable evidence and will eventually be the only pathway available.

If you are entering the federal market for the first time 

Class A gives you an entry point through Program Certification (meaning no agency sponsor is required), using evidence of existing SOC 2 Type II or GovRAMP compliance.

If you rely on FedRAMP Ready as a credential

Treat July 28, 2026 as a hard deadline. Ready becomes "Legacy FedRAMP Ready" on that date and the assurance it provides will fade. Consider converting to Class A Certification, or applying to Class B or C Certification, as soon as possible.

The bottom line for any cloud provider: CR26 requires providers to produce continuous, machine-readable evidence. The closer your compliance program already runs to real-time monitoring and structured output, the smoother the transition.

FedRAMP 20x results and progress so far

Less than a year and a half after launch, FedRAMP 20x is already showing measurable impact. Some of the clearest outcomes to date are:

• A record number of Rev5 Authorizations in record time. FedRAMP completed 114 Authorizations by July FY25, more than double the amount in the entire FY24. Average agency Authorization review timelines fell from over a year to roughly five weeks.
• 20x pilots introduced more cloud services in the market. 29 cloud services, including the Secureframe platform, entered the FedRAMP Marketplace through the 20x pilots. This number was more than the rescinded Joint Authorization Board processed in its final four years combined. 
• Secure AI-based cloud services available. In August, FedRAMP began prioritizing the Authorization of certain AI-based cloud services designed for routine and repeated use by federal workers. In April, OpenAI announced its FedRAMP 20x Moderate Authorization⁠ for ChatGPT Enterprise and API Platform, marking an important milestone in making frontier AI available to U.S. government agencies. To date, 13 AI services are now listed. 
• Explosive growth in the FedRAMP Marketplace. As of July 2024, FedRAMP had authorized less than 350 cloud services in ten years, averaging under 50 Authorizations per year for the last five years. As of July 2025, they had authorized 100+ cloud services in the past six months, more than doubling their average in half the time. As of July 2026, the Marketplace has nearly doubled in the past two years, with over 650 cloud services listed.
• Finalized requirements for 20x and a modernized Rev5 pathway. With CR26, providers now have a single, plain-language ruleset and a 30-month planning horizon, replacing the run of RFCs and notices that made long-range planning difficult.

These results point in one direction: a larger, more diverse Marketplace that smaller providers can realistically enter, without the multi-year upfront investment the legacy model demanded.

How Secureframe helps you get and stay FedRAMP certified

Keeping up with changes like CR26 is exactly what a compliance automation platform is for. Secureframe maps FedRAMP requirements, controls, and tests out of the box and updates them as the program evolves, so your team is not tracking every notice by hand.

Secureframe supports FedRAMP Rev5 and 20x compliance with:

• Government and federal compliance expertise: Our team includes former FedRAMP, FISMA, and CMMC auditors who provide expert guidance at every step, from readiness work before an audit to maintaining compliance and continuous monitoring after the audit.
• Integrations with federal cloud products: Secureframe automates continuous monitoring and evidence collection with integrations for AWS GovCloud and other federal cloud services.
• Continuous monitoring: Our platform continuously monitors your tech stack 24/7 to alert you of non-conformities, making it easier to maintain continuous compliance and a strong security posture. You can specify test intervals and notifications for required regular tasks to maintain FedRAMP compliance. 
• Risk Management: Our Risk Register and Risk Management capabilities enable you to track, assess, and mitigate security risks while ensuring proper documentation and ongoing Plan of Action and Milestones (POA&M) maintenance to maintain a FedRAMP compliant-risk management program.
• Vendor Management: Manage third-party risk with automated vendor assessments and due diligence tracking. Secureframe ensures you continuously evaluate vendors' security postures to meet FedRAMP’s supply chain risk management requirements.
• User Access Reviews (UAR): Enforce least privilege and access control best practices with automated user access reviews. Secureframe helps ensure you meet FedRAMP requirements to conduct access reviews regularly and revoke unnecessary access in a timely manner.
• Vulnerability Management: Secureframe integrates with leading vulnerability scanning tools so you can continuously monitor your systems for vulnerabilities and ensure compliance with FedRAMP’s security assessment and remediation requirements. 
• Cross-mapping across frameworks: Secureframe simplifies compliance by mapping FedRAMP controls to over 40+ other frameworks like NIST 800-53, NIST 800-171, and CJIS—reducing duplicate efforts.
• Trusted partner network: Our relationships with 3PAOs, vCISOs, MSSPs, and other trusted service partners can help further streamline FedRAMP readiness and audits. 
• Easier document and policy management: Templated policies, procedures, and SSPs written by former federal auditors can be fully customized to meet your needs. Our enterprise policy management capabilities include POA&M documents, impact assessments, and readiness reports. We're also adding a review and approval workflow for policies, which is a FedRAMP requirement.
• Customizable Trust Center: Showcase your security and compliance posture in real-time to establish transparency and trust and differentiate yourself from competitors through a fully customized Trust Center. Check out ours as an example.

Request a demo today to see how we can help you achieve and maintain FedRAMP 20x compliance over time with confidence.

This post was originally published in March 2025 and has been updated for accuracy and comprehensiveness