# FedRAMP 20x Continuous Monitoring Requirements: What’s Changed, What Hasn’t, and Where Teams Can Get Stuck > The results of FedRAMP 20x Phase Two will shape the future of the new government-wide FedRAMP program. Here's what cloud service providers need to know to prepare for what’s next in federal cloud security. canonical: https://secureframe.com/blog/fedramp-20x-continuous-monitoring FedRAMP 20x has moved from pilot program to finalized standard. With the Consolidated Rules for 2026 (CR26) published in June 2026, the continuous monitoring model that was tested through the Phase One and Phase Two pilots is now a stable, mandatory ruleset, and most teams are either executing a transition or working out how different this model really is from their previous FedRAMP experience. That uncertainty is understandable. [FedRAMP 20x introduces meaningful changes](https://secureframe.com/blog/fedramp-20x) to how continuous monitoring operates day to day. While it doesn't discard existing FedRAMP controls or security principles, it moves away from point-in-time authorization cycles toward a more ongoing, evidence-driven approach. Some requirements feel familiar, others are new, and the biggest challenge for most teams is translating those expectations into repeatable operational processes. Below, we’ll break down what's actually changed under FedRAMP 20x when it comes to continuous monitoring and what's stayed the same. We’ll also highlight where teams commonly get stuck during the transition and how to realign monitoring, evidence collection, and reporting practices to fit this new operating model. ## Changes to continuous monitoring under FedRAMP 20x ## Changes to continuous monitoring under FedRAMP 20x FedRAMP 20x does not eliminate security expectations, or lower the bar for maintaining authorization. What it does change is how ongoing certification data is produced, shared, and reviewed.  [Under the legacy model](https://secureframe.com/hub/fedramp/what-is-fedramp), continuous monitoring often revolved around recurring artifact submissions, periodic vulnerability scans, and scheduled assessments that were largely evaluated in isolation. While this approach satisfied oversight requirements, it often resulted in duplicated effort across agencies and a heavy emphasis on documentation over operational clarity.  FedRAMP 20x shifts toward what it calls [collaborative continuous monitoring](fedramp.gov/2026/reference/collaborative-continuous-monitoring). CSPs are expected to publish standardized Ongoing Certification Reports (OCRs) every quarter that summarize what’s changed, any planned changes, which risks have been accepted, and whether any changes materially affect the system’s risk posture. Agencies then review that information according to their own Information Security Continuous Monitoring strategies rather than reopening the entire authorization package each time.  What hasn’t changed is the expectation that security controls are fully implemented, operating effectively, and supported by defensible evidence. The rigor is still there, it just shows up continuously instead of being concentrated around assessment milestones.  FedRAMP has been explicit that this new model is meant to reduce unnecessary documentation burden over time, not reduce accountability. ## Recommended reading How FedRAMP Authorization Has Changed Only Six Months After 20x Announced [+ What’s Still to Come in 2026] ## Finalized FedRAMP 20x continuous monitoring requirements ## What’s finalized in the FedRAMP 20x continuous monitoring requirements The continuous monitoring requirements are now formalized in the Consolidated Rules for 2026, published June 25, 2026, under the Collaborative Continuous Monitoring ruleset. These rules apply to providers with any type of FedRAMP Certification, on both the 20x and Rev5 paths, across Classes B, C, and D (the designations that replaced the Low, Moderate, and High impact levels under CR26). ### Quarterly Ongoing Certification Reports At the center of the new model is the Ongoing Certification Report (OCR), called the Ongoing Authorization Report during the pilot phase. Providers must supply this report to agency customers every three months in a consistent, human-readable format that covers the entire period since the previous report, and FedRAMP publishes a machine-readable schema for it. Each report must include high-level summaries of the following: - Changes to FedRAMP Certification Data since the last report - Planned changes during at least the next three months - Accepted vulnerabilities - Transformative changes to the service - Updated security, configuration, or usage recommendations - A list of all agencies directly using the product - FedRAMP Reportable Incidents, or an attestation that none occurred - Lessons learned and changes made as a result of any Reportable Incidents These reports are intentionally not control-by-control artifacts. The focus is on what changed, what is coming next, and how those changes impact risk. Providers are not expected to re-prove baseline implementation every quarter. In addition, CSPs must publicly state the target date for the next report and supply an asynchronous feedback mechanism so agencies can ask questions or raise concerns without triggering duplicative one-off conversations. A summary of that feedback, anonymized and desensitized, must accompany each report as an addendum or appear in the next one. ### Quarterly reviews for Class C and D systems Whether a synchronous Quarterly Review is required depends on certification class. Providers with Class C or Class D Certifications (the former Moderate and High baselines) must host one every three months, open to all necessary parties. Class B providers should host them, and Class A providers may. These reviews are intended to focus on the most relevant changes from the provider's perspective, rather than walking agencies through every line item. The rules also set a practical rhythm: providers must supply a registration link or calendar file and publicly post the date of the next review, and FedRAMP recommends scheduling each review between 3 and 10 business days after the corresponding Ongoing Certification Report is released, recording or transcribing sessions, and keeping third parties out unless they have specific relevance. This approach reflects a broader goal of prioritizing shared understanding over repeated scrutiny, with the expectation that increased transparency will reduce the need for constant revalidation. ### Clear limits on agency behavior One of the most consequential aspects of FedRAMP 20x continuous monitoring is the guidance directed at agencies. Agencies are required to review Ongoing Certification Reports and raise concerns when changes may exceed previously agreed-upon risk tolerance. At the same time, agencies are explicitly prohibited from imposing additional security requirements beyond FedRAMP unless the agency head or an authorized delegate makes a documented determination that there is a demonstrable need. This reinforces the [Presumption of Adequacy](https://www.fedramp.gov/docs/authority/m-24-15/process/) and is meant to prevent continuous monitoring from becoming a back door for re-scoping or bespoke compliance demands. ### What’s settled, and what's still evolving With CR26 published, the requirements themselves are stable: FedRAMP intends the ruleset to hold until it's replaced by the next annual consolidated release. The structure of an Ongoing Certification Report is also settled, with FedRAMP publishing a JSON schema that defines the machine-readable format alongside the required human-readable version. What continues to mature is practice. The required report categories are defined, but what a "good" report looks like, how detailed the summaries should be, and how agencies engage with them are still taking shape as real-world examples accumulate. Automation expectations have firmed up as well. CR26 requires machine-readable data in JSON validated against FedRAMP's schemas wherever a rule defines one, and providers must use automation to keep human-readable and machine-readable versions consistent. What FedRAMP does not prescribe is tooling: no specific platforms, scanners, or monitoring products are named. Teams need to define their own processes clearly enough to defend them quarter after quarter. ## FedRAMP Rev5 Baselines Spreadsheet Each traditional FedRAMP baseline includes a fixed set of required controls that must be implemented for authorization. This spreadsheet breaks down the number of required controls by control family across all four baselines (Low, LI-SaaS, Moderate, and High) to help contextualize how Rev. 5–based authorization differs from the streamlined, validation-driven approach introduced by FedRAMP 20x. ## Challenges under the new continuous monitoring model ## Why teams used to traditional FedRAMP assessments may find this shift difficult For teams navigating this transition, FedRAMP 20x can initially sound easier. Fewer one-off deliverables, fewer bespoke agency requests, and a predictable quarterly rhythm are likely welcome changes compared to traditional FedRAMP cycles. The challenge is that this model removes many of the buffers some teams relied on before. Under point-in-time assessments, it was often possible to compensate for unclear ownership, informal processes, or stale evidence by investing heavily in preparation during the months just before an assessment. Continuous monitoring brings day-to-day operations into direct view, which means gaps that were previously manageable are now harder to work around. This is where teams accustomed to the old model often struggle. Not because FedRAMP 20x is stricter, but because it’s less forgiving of operational shortcuts. ### Unclear control ownership becomes harder to ignore One of the first things continuous monitoring exposes is weak or assumed control ownership. In many environments, controls appeared to “work” under traditional FedRAMP because a small group of people understood how things operated and could step in when evidence or explanations were needed. That approach becomes risky under FedRAMP 20x, where changes, exceptions, and accepted risks must be explained consistently, quarter after quarter. Controls that depend on tribal knowledge or ad hoc effort may still exist on paper, but they become difficult to defend once they need to be demonstrated continuously. FedRAMP 20x makes this weakness visible sooner. ### Evidence quality matters more than evidence volume Another adjustment for teams transitioning to FedRAMP 20x is realizing that reporting itself is rarely the hardest part. The real constraint is whether underlying evidence remains current, accurate, and trustworthy over time. Ongoing Certification Reports are meant to summarize change, not revalidate every control. That only works if teams are confident that the evidence supporting those controls remains valid between reports. When evidence collection is manual or periodic, teams often spend more time verifying whether screenshots, logs, or configurations are still accurate than evaluating how risk is changing. This is a familiar challenge for organizations navigating CMMC as well. Evidence that looks solid during an assessment window can quietly degrade between reviews. Continuous monitoring shortens the feedback loop and makes gaps harder to ignore. ### Automation is key, but it doesn’t replace discipline FedRAMP 20x strongly encourages automation as a way to reduce burden and improve visibility. For teams mid-transition, it can be tempting to treat automation as the sole solution to continuous monitoring requirements. In practice, automation works best when it’s layered on top of a strong security foundation and clearly defined processes. Teams still need to decide who reviews changes, how accepted vulnerabilities are evaluated, how exceptions are documented, and how context is added before information is shared with agencies. With the right foundation in place, automation becomes an enabler rather than just another source of noise. ## Recommended reading A FedRAMP Auditor Turned Compliance Automation Practitioner’s First-Hand Take on FedRAMP 20x’s Shift to Automation ## How FedRAMP 20x continuous monitoring reinforces broader federal compliance trends FedRAMP 20x continuous monitoring represents a structural shift toward ongoing certification by default, built on transparency, reuse, and risk-based decision-making. Federal compliance more broadly is moving in the same direction, rewarding organizations that can demonstrate consistent operational discipline rather than point-in-time readiness. For teams preparing for this new reality, the most valuable work often happens before the first Ongoing Certification Report is ever published. Clarifying control ownership, stabilizing evidence collection, and defining how changes are reviewed and communicated are foundational steps. Without that groundwork, continuous monitoring quickly becomes reactive and harder to sustain. This is also where automation platforms like Secureframe start to make practical sense, not as a shortcut, but as a way to support the operating model FedRAMP 20x expects. When evidence collection, control status, and system changes are continuously captured and centrally visible, teams spend less time validating whether information is current and more time explaining what changed and why it matters. Automation reinforces good processes by making them repeatable, auditable, and easier to maintain over time. *Note: This post was originally published in February 2026 and has been updated for accuracy. * ### Streamline federal compliance ### Is FedRAMP 20x fully finalized, or still evolving? FedRAMP 20x is active, but it is still evolving. Core continuous monitoring requirements are in place, while implementation details are being refined through pilot feedback and real-world adoption. This phased approach is intentional and reflects a shift to a long-term operating model rather than a one-time policy update. ### What is the FedRAMP 20x Phase 2 Pilot, and who does it apply to? The Phase 2 Pilot tests how FedRAMP 20x requirements work in practice, especially for Moderate and High systems. Participants must show meaningful progress toward collaborative continuous monitoring before authorization review. Even for non-participants, Phase 2 outcomes will influence future guidance and expectations. ### What role do FedRAMP 20x working groups play? Working groups help FedRAMP gather feedback on how 20x requirements function in real environments. They surface operational challenges, inform clarifications, and shape future guidance. Participation isn’t required, but the outputs often influence how continuous monitoring is interpreted and applied. ### Does FedRAMP 20x reduce evidence requirements? No. Evidence requirements remain. What changes is how evidence is surfaced and discussed. FedRAMP 20x emphasizes durable, up-to-date evidence supported by clear summaries of change, rather than repeated submission of large artifact packages. ### Are Ongoing Certification Reports replacing monthly continuous monitoring artifacts? Not entirely. Ongoing Certification Reports provide quarterly summaries of changes and risk posture, and they replace much of the legacy artifact submission cycle. But vulnerability detection and response activity must still be reported at least monthly, and providers are expected to maintain the underlying monitoring data and evidence behind every summary. The report communicates impact and context rather than serving as a raw evidence dump. ### Can agencies still request additional security requirements? Agencies must review Ongoing Certification Reports and raise concerns when risk tolerance may be affected. However, they may not impose additional security requirements beyond FedRAMP unless a documented, demonstrable need is approved at the agency leadership level and reported to FedRAMP. ### How is FedRAMP 20x different from traditional FedRAMP reassessments? Traditional FedRAMP focused on periodic reassessments. FedRAMP 20x shifts to continuous transparency and ongoing risk communication. The rigor remains, but it is distributed across time instead of concentrated around audit events. ### How does FedRAMP 20x align with other federal frameworks like CMMC? FedRAMP 20x aligns with broader federal trends toward continuous authorization and operational maturity. Many of the same challenges, such as evidence durability and control ownership, also appear under frameworks like CMMC, reinforcing the move away from point-in-time compliance.