The FedRAMP 20x Phase Two Moderate Pilot Explained and What’s Ahead
Emily Bonnie
Senior Content Marketing Manager
Rob Gutierrez
Senior Cybersecurity and Compliance Manager, CISA, CCSK, CMMC RP
FedRAMP 20x Phase Two marks a major milestone in modernizing federal cloud security. Building on the success of the 20x Low pilot, FedRAMP is now preparing to test these same concepts against the far more complex Moderate baseline. Phase Two will set the foundation for public 20x Low and Moderate authorizations in 2026 and reshape how cloud service providers approach assessment, validation, and continuous monitoring.
Here’s what cloud service providers need to know about the goals, requirements, and timeline of FedRAMP 20x Phase Two, and how to prepare for what’s next.
From pilot to progress: Where FedRAMP 20x stands today
When FedRAMP 20x was first announced, it signaled the start of a major shift in how the federal government assesses and authorizes cloud services. The 20x Phase One Pilot tested whether automated, machine-readable data could streamline much of the manual review and documentation that has long slowed down traditional FedRAMP authorizations.
Through this first phase, FedRAMP introduced several key innovations. Cloud service providers participating in the pilot used automated reporting, continuous validation, and measurable Key Security Indicators (KSIs) to prove that core controls were implemented and working in real time. FedRAMP’s goal wasn’t just faster reviews; it was to build a model that reflects how modern cloud environments actually operate.
While participation in Phase One was limited, it demonstrated that automation-based reviews could significantly accelerate the authorization timeline without compromising security. Lessons learned from those pilots directly shaped the standards and expectations for the next phase of the program.
With the Phase One pilot largely complete and Low authorizations underway, FedRAMP is moving into Phase Two, a limited pilot focused on Moderate-impact systems. This phase will test whether the automation-based approach can scale to more complex environments and lay the groundwork for full public adoption in 2026.
Recommended reading
The FedRAMP Compliance Hub
The goals of FedRAMP 20x Phase Two
FedRAMP 20x Phase Two builds on Phase One by expanding the model to include Moderate-impact systems and introducing more structured requirements. Each of its goals reflects a deliberate step toward making automation-driven authorization viable across the entire program.
Validate automation at the Moderate level
Phase Two will determine whether the efficiencies achieved at the Low baseline can be replicated for Moderate systems, where the number of controls, interdependencies, and data sensitivities increase substantially. The goal is to confirm that continuous, automated validation can provide the same or greater assurance than traditional manual assessment methods.
Refine and standardize the 20x framework
FedRAMP is using feedback from Phase One to finalize standards for automation, data exchange, and evidence collection. The agency wants a consistent, measurable framework that any CSP or assessor can apply, ensuring transparency and predictability across all authorizations.
Prove scalability and collaboration
A central aim of Phase Two is to test how multiple CSPs, 3PAOs, and agencies can operate within a shared, automated environment. By demonstrating interoperability between differing compliance and security tools as well as trust centers, FedRAMP can confirm that continuous authorization isn’t limited to a few early adopters; it can work across the entire ecosystem.
Prepare for the 2026 wide release
Finally, Phase Two is the bridge to public availability. FedRAMP will use the results to finalize the 2026 standards, address implementation challenges, and ensure federal agencies are ready to evaluate automated authorization data at scale.
Participation, standards, and requirements for the Phase Two Pilot
Phase Two will introduce a far more structured, demanding, and collaborative model than Phase One. The FedRAMP PMO has been candid that Phase Two will be the most difficult phase of the entire 20x program. While participation will remain limited, the lessons learned here will define the future of FedRAMP authorizations and shape how all CSPs pursue compliance in 2026 and beyond.
Strict participant cap and formal application
FedRAMP will now admit exactly 10 participants into the Moderate pilot. Providers must submit a detailed proposal describing how they will meet every Phase Two requirement, and demonstrating readiness across engineering, compliance, and automation capabilities.
Multi-cohort structure
To support a more hands-on process, Phase Two will be organized into cohorts.
- Cohort 1 applications open December 1
- Providers are encouraged to consider Cohort 2 for more preparation time and to avoid the holiday period
Mandatory collaborative workshops
Participants must join multiple workshops with the FedRAMP team to review their approach to every requirement before finalizing a package. These sessions replace a traditional document-first review cycle and emphasize real-time collaboration.
Engineering and assessor requirements
Providers should expect:
- A significant engineering lift across their environment
- Continuous involvement of a FedRAMP-recognized assessor
- 6–8 weeks of recurring assessment work, billed on a time-and-materials basis
FedRAMP has been clear that CSPs should fully evaluate their readiness before applying.
Core standards required for submission
To submit for Phase Two, CSPs and assessors must address every requirement and recommendation in the finalized 20x Phase Two standards. They must either show how each is implemented, share a plan to complete it within six months, or explain why a recommendation does not apply.
The required standards include:
- A Minimum Assessment Standard (MAS) document providing a concise summary of control implementation and supporting evidence for initial review.
- Validation of Key Security Indicators (KSIs), with at least 70% verified automatically from the production environment. Policy documents alone are not acceptable.
- Demonstrations of Significant Change Notifications (SCNs), showing how the provider will alert FedRAMP and agencies to major updates or incidents.
- Evidence of alignment with the Authorization Data and Sharing Standard, ensuring 20x package data is stored and shared according to FedRAMP’s security and transparency requirements.
- A Vulnerability Detection and Response (VDR) report from the production environment, plus a sample report demonstrating how vulnerabilities are discovered, categorized, and remediated.
One of the most substantial changes is the elimination of the traditional Plan of Action and Milestones (POA&M). In its place, providers will label any unresolved issues as accepted weaknesses, which agencies can integrate into their own risk management plans. This update is part of the new Vulnerability Detection and Response (VDR) Standard, which also supersedes all existing FedRAMP requirements, control statements, and guidelines related to vulnerability scanning or formal POA&Ms. Providers that have adopted this new standard with FedRAMP approval may treat these legacy requirements as superseded for the purposes of their vulnerability management and reporting obligations.
New KSI theme: “Authorization by FedRAMP”
FedRAMP has added a new KSI theme that significantly expands the scope of validation. This category increases the number of requirements and recommendations by more than five times compared to the 20x Low pilot.
Collectively, these changes represent a broader shift from static, document-based compliance toward a new model built on collaborative, ongoing risk transparency.
FedRAMP Baselines Control Allocation Spreadsheet
Each FedRAMP baseline—Low, LI-SaaS, Moderate, and High—includes a fixed set of required controls that must be implemented for authorization. This spreadsheet breaks down the number of required controls by control family across all four baselines.
What’s next: Updated timeline, cohorts, and public comment
Following the historic government shutdown, FedRAMP has released updated guidance for the 20x Phase Two pilot. FedRAMP now expects to finalize Phase Two requirements and open the submission window approximately three to four weeks after the shutdown ends.
Instead of a general submission period, cloud service providers will apply to join a specific Phase Two cohort. Cohort 1 applications are expected to open on December 1, with additional cohorts following on a schedule determined by FedRAMP.
Once Phase Two concludes, FedRAMP will finalize the 2026 20x standards and begin Phase Three, which focuses on scaling the model, refining documentation, and preparing federal agencies for automated authorization reviews. Phase Four, expected in 2026, will open FedRAMP 20x Low and Moderate authorizations to all cloud service providers.
FedRAMP emphasizes that all dates are estimates and subject to change. Providers can track real-time updates on the FedRAMP Public Roadmap and the Phase Two Q&A and discussion threads on GitHub.
Ongoing compliance requirements after authorization
CSPs that earn a 20x authorization will need to maintain compliance through monthly or quarterly automated evidence submissions, including Ongoing Authorization Reports (OARs) that summarize risk, key system changes, and performance against KSIs. Continuous validation data will flow directly from providers to FedRAMP and participating agencies, supporting year-round visibility into system posture.
Public comment and upcoming standards
Several standards remain open for public comment and are expected to be finalized shortly before Phase Two opens:
- RFC-0014: Phase Two Key Security Indicators (adds five new Moderate KSIs).
- RFC-0015: Recommended Secure Configuration Standard (defines secure configuration practices consistent with FedRAMP baselines).
- RFC-0016: Collaborative Continuous Monitoring Standard (outlines joint monitoring between CSPs and agencies).
- RFC-0017: Persistent Validation and Assessment Standard (expands on continuous validation using automation).
Despite recent delays, the trajectory of the FedRAMP program is unchanged: by 2026, continuous, data-driven authorization will be the new standard for federal cloud security.
Our take: What to expect for FedRAMP 20x Moderate and how to prepare
While Phase Two standards are still being finalized, several trends are clear from public drafts and roadmap discussions. Providers pursuing 20x Moderate should prepare for:
Greater control depth and automation coverage
Where 20x Low focused on proof-of-concept automation, Moderate systems will require more automation and broader evidence collection across technical controls, especially those tied to configuration management, vulnerability remediation, and identity assurance.
Integration of AI and data governance expectations
Cloud services that use AI will need to demonstrate compliance with FedRAMP’s AI Prioritization criteria, including model security, data integrity, and human oversight. Expect alignment with OMB M-24-15 and emerging AI risk management guidance.
Continuous monitoring as default
Rather than annual reporting cycles, providers will be expected to produce ongoing validation data that can be automatically reviewed by agencies. The Persistent Validation and Assessment standard will formalize how this data flows between CSPs and the FedRAMP repository and introduce more frequent touchpoints for review.
Authorized providers will also be required to submit quarterly Ongoing Authorization Reports, summarizing key changes, risk findings, and system performance against KSIs. Along with periodic review meetings, these reports will help maintain real-time insight into each system’s security posture and ensure agencies can make informed risk-based decisions throughout the authorization lifecycle.
Collaboration through trust centers
FedRAMP 20x encourages the use of secure trust centers for authorization data sharing, aligned with 20x’s machine-readable authorization data model. These portals will enable agencies to view current security posture and remediation activity directly, reducing reliance on email-based document exchanges.
Preparing for full FedRAMP 20x implementation in 2026
Phase Two marks a turning point for FedRAMP. Automation, transparency, and collaboration are no longer optional—they’re becoming the foundation of how federal cloud security will operate. For cloud service providers, that means security can’t be a point-in-time exercise anymore. It has to be measurable, continuous, and provable every day.
CSPs that invest early in automation and visibility will be best positioned to meet these expectations. The ability to produce live data showing control health, configuration state, and vulnerability remediation will distinguish leading providers from those still relying on static documentation.
At Secureframe, we’ve experienced this transformation firsthand. As one of the first organizations to achieve FedRAMP 20x Low authorization and preparing for the Phase Two Moderate pilot, we’ve built our GRC platform to help CSPs modernize compliance in step with this new FedRAMP model.
Our automation platform streamlines every stage of the authorization lifecycle, from readiness through continuous monitoring. With more than 300 integrations across AWS GovCloud, Azure Government, Microsoft GCC High, and Intune GCC, Secureframe automates evidence collection, vulnerability detection, and control testing to simplify compliance and speed up authorization. Our continuous monitoring ensures you always have a real-time view of your security posture, while built-in tools for risk, vendor, and policy management keep your compliance operations connected and efficient.
Secureframe also includes a customizable Trust Center designed for the 20x era, enabling CSPs to securely share live authorization data with agencies in a standardized, machine-readable format that meets FedRAMP’s data-sharing access requirements.
Whether you’re just beginning your FedRAMP journey or preparing for 20x Moderate, Secureframe gives you the automation, visibility, and expertise to move faster toward authorization. Request a demo to see how Secureframe can help you achieve and maintain FedRAMP 20x compliance.
Streamline federal compliance
FAQs
When will FedRAMP 20x Moderate become available to everyone?
The public rollout of 20x Moderate authorizations is expected in early 2026, following the completion and analysis of Phase Two.
Can new CSPs apply for the FedRAMP Phase Two pilot?
Not at this time. Participation is limited to qualifying providers, primarily those who participated in Phase One or meet strict automation and AI criteria.
What happens to existing FedRAMP authorizations?
Traditional FedRAMP authorizations remain valid. However, future renewals and reauthorizations are likely to incorporate 20x standards as the program transitions.
Will assessors and 3PAOs need to change their processes?
Yes. Assessors participating in Phase Two will be required to perform validation in accordance with the Persistent Validation and Assessment Standard and using automated data feeds and continuous monitoring tools instead of relying solely on static documentation.
Where can I track updates about FedRAMP Phase Two?
FedRAMP maintains a public GitHub roadmap and hosts Community Working Groups where providers can review new standards, RFCs, and pilot updates.
Emily Bonnie
Senior Content Marketing Manager
Emily Bonnie is a seasoned digital marketing strategist with over ten years of experience creating content that attracts, engages, and converts for leading SaaS companies. At Secureframe, she helps demystify complex governance, risk, and compliance (GRC) topics, turning technical frameworks and regulations into accessible, actionable guidance. Her work aims to empower organizations of all sizes to strengthen their security posture, streamline compliance, and build lasting trust with customers.
Rob Gutierrez
Senior Cybersecurity and Compliance Manager, CISA, CCSK, CMMC RP
Rob Gutierrez is an information security leader with nearly a decade of experience in GRC, IT audit, cybersecurity, FedRAMP, cloud, and supply chain assessments. As a former auditor and security consultant, Rob performed and managed CMMC, FedRAMP, FISMA, and other security and regulatory audits. At Secureframe, he’s helped hundreds of customers achieve compliance with federal and commercial frameworks, including NIST 800-171, NIST 800-53, FedRAMP, CMMC, SOC 2, and ISO 27001.