The latest FedRAMP 20x updates: August 2026

On June 25, 2026, FedRAMP launched the Consolidated Rules for 2026 (CR26), a single stable ruleset that formalizes the FedRAMP 20x requirements, resolves the January Requests for Comment, and makes 20x a widely available certification path for any cloud service provider.

Two changes from CR26 reshape the vocabulary of everything below. "FedRAMP Authorization" is now "FedRAMP Certification," and the Low, Moderate, and High impact levels became Certification Classes B, C, and D, joined by Class A, a new time-limited entry tier. For the full breakdown of what changed, read our guide to FedRAMP 20x and the 2026 Consolidated Rules.

The rollout now runs on published dates:

As of this update, FedRAMP Ready has retired, the Class A pipeline is open, and the Class B and C pipelines open at the end of August. The window that matters most for planning is January 1, 2027, when CR26 becomes mandatory for every provider, including current Rev5 certifications.

For the canonical schedule, refer to the official CR26 timeline on FedRAMP.gov.

The January 2026 RFCs and their outcomes

On January 13, 2026, FedRAMP released six Requests for Comment, along with new program updates and Phase Two pilot announcements.

Each RFC targeted a specific friction point that had historically slowed or complicated FedRAMP adoption. All six were resolved through outcome notices and the Consolidated Rules for 2026, and here's where each landed.

RFC-0019 focused on reporting assessment costs, proposing requirements to give FedRAMP better visibility into assessment pricing without publicly exposing sensitive cost data. This is the one proposal without a clear landing spot: the CR26 ruleset contains no cost-reporting requirements, so this effort appears to have been deferred or absorbed elsewhere.

RFC-0020 addressed authorization designations, and its outcome reshaped the program's vocabulary. Rather than the multi-level designation system originally floated, FedRAMP confirmed in February 2026 that "FedRAMP Certification" would replace "FedRAMP Authorization" as the single official label, and that four Certification Classes (A through D) would replace the Low, Moderate, and High impact levels. Class B maps to the former Low baseline, Class C to Moderate, and Class D to High, while Class A is a new time-limited entry tier. For CSPs, the core message stands: certification is no longer a milestone you reach once, but a security posture you sustain continuously.

RFC-0021 proposed expanding the FedRAMP Marketplace, and most of it became CR26 rules. Providers can now be listed early through the Initial Implementation Phase, where they must document continuous progress toward certification at least quarterly and schedule a Class B, C, or D assessment within two years of listing. Assessors and advisory firms are now formally listed in the Marketplace with their own recognition and listing requirements. The pricing transparency piece of the proposal did not make it into the consolidated rules.

RFC-0022 outlined how FedRAMP would leverage external frameworks, and the outcome was narrower than the proposal. CR26 formalized Class A Certification as the external-framework entry point, initially accepting SOC 2 Type II as the most widely used framework, with GovRAMP added as a second approved option. Other candidates discussed during the comment period, including ISO 27001 and CMMC Level 2, were not adopted, and FedRAMP has said additional frameworks will be considered incrementally based on demand. FedRAMP has also been explicit that Class A grants no reciprocity: it is a transitory entry point, not a bridge to a full Class B, C, or D Certification.

RFC-0023 introduced a sponsorless path for certain Rev5 authorizations. That concept is reflected in the temporary Rev5 certification pipelines that opened August 10, 2026, giving eligible Class B and C providers a way forward through the Ready Conversion and Lost Sponsor paths without an agency sponsor.

RFC-0024 proposed mandatory machine-readable authorization packages for Rev5, and CR26 codified the direction broadly: the rules themselves are published as machine-readable JSON, provider submissions must validate against FedRAMP's published JSON schemas wherever a rule defines one, and agencies are required to maintain tooling that can produce and ingest machine-readable artifacts.

These RFCs marked the shift from planning to locking in how the modernized program functions in practice. Faster reviews assume cleaner submissions, continuous validation assumes operational discipline, and marketplace visibility reflects demonstrable progress. CR26 made all three of those assumptions enforceable.

How the FedRAMP 20x rollout is structured

The program rollout was structured in two major phases, supported by parallel updates to public tooling and targeted adjustments to legacy Rev5 requirements.

Phase One focused on FedRAMP Low and served as the proving ground for new standards and processes. Phase Two expanded those lessons to FedRAMP Moderate and introduced higher expectations around continuous validation, cryptography, and remediation discipline. At the same time, Marketplace and Rev5 updates reshaped how CSPs signal progress and maintain their status over time. All of this work fed into the Consolidated Rules for 2026.

Rev5 balance improvements for a smoother transition

For CSPs already authorized under Rev5, the 20x rollout may feel like a major shift. To manage that transition, FedRAMP introduced a series of balance improvement releases. 

These targeted updates allow CSPs to adopt certain 20x elements without undergoing a full reauthorization, simplifying the path forward and ensuring compliance remains manageable. The improvements also help agencies adjust to new expectations while still working with services already in use.

Key efforts include:

• October 31, 2025: R5.SCN Significant Change Notification BIR
  Tests a streamlined process for reporting significant changes.
• October 31, 2025: Consolidated R5 Continuous Monitoring Standard
  Clarifies and consolidates existing continuous monitoring requirements.
• November 30, 2025: Establish DISA ILx One-Way Reciprocity
  Enables services authorized by DISA to be recognized under FedRAMP without duplicating effort.
• December 19, 2025: R5.ADS Authorization Data Sharing Standard BIR
  Beta test for applying the Authorization Data Sharing Standard to Rev5 authorizations.
• January 16, 2026: R5.MAS Minimum Assessment Standard BIR
  Tests adoption of the Minimum Assessment Scope for Rev5 authorizations, with FedRAMP signaling potential changes in approach based on limited pilot participation.
• January 23, 2026: R5.CRS Continuous Vulnerability Management Standard BIR
  Beta test for the Rev5-aligned Continuous Vulnerability Management Standard, which has been reprioritized to align with broader 20x vulnerability management requirements.

The lessons from these releases were carried into CR26, which now governs Rev5 requirements alongside 20x.

What these updates mean if you're already FedRAMP Certified at Class C

If you hold what was a FedRAMP Moderate authorization, now a Class C Certification, CR26 is a signal to reassess how sustainable your current program is. The designation changes are no longer proposals: your certification carries a new label, machine-readable expectations are codified with deadlines, and the January 1, 2027 mandatory adoption date reduces tolerance for static, manually assembled packages.

This is a good moment to evaluate whether your current tooling and processes can support ongoing validation without quarterly scrambles, or whether they rely on institutional knowledge that won't scale under 20x.

What these updates mean if you’re starting from scratch

For CSPs just entering the federal market, FedRAMP 20x narrows the margin for trial and error. Faster paths exist, but they assume operational readiness. Teams that lack clean asset inventory, repeatable evidence collection, or ownership clarity often experience delays that feel surprising given the promise of 20x.