How FedRAMP Authorization Has Changed Only Six Months After 20x Announced [+ What’s Still to Come in 2026]
Anna Fitzgerald
Senior Content Marketing Manager
Rob Gutierrez
Senior Cybersecurity and Compliance Manager, CISA, CCSK, CMMC RP
Six months ago, FedRAMP launched a bold modernization effort, FedRAMP 20x. It promised faster authorizations, modernized security, and a more accessible path to the federal market for all cloud service providers (CSPs).
Only six months into the FedRAMP 20x rollout, and the results are already impressive. The new program is delivering authorizations at record speed, helping to ensure more cloud services are secure and available to federal agencies. And, perhaps even more importantly, it’s changing how these cloud providers and federal agencies think about and approach security in the cloud.
Let’s take a closer look at the significant progress and changes that have taken place in the six months since FedRAMP 20x was announced.
Recommended reading
Introducing the FedRAMP Hub: 15+ Free Resources to Simplify Authorization
Recommended reading
FedRAMP 20x: Here’s What We Know About the Goals, Timeline & Results to Date
Recommended reading
Secureframe Achieves FedRAMP® 20x Low Authorization, Strengthening Our Federal Compliance Expertise
4. FedRAMP security standards are being updated as FedRAMP shifts away from “gatekeeper” to “concierge” between industry and government
In a Govcast interview, FedRAMP director Pete Waterman emphasized that the true goal of FedRAMP 20x is not just speed, but smarter, stronger security.
Waterman said the high-level vision of FedRAMP 20x is simple: “The government deserves and should have access to the same technology that every other business and person has.”
The problem is that historically, FedRAMP acted as a gatekeeper, slowing down the adoption of commercial tools by enforcing expensive audits, cumbersome rules, and policies that led many CSPs to either not pursue FedRAMP authorization—and therefore government contracts—or to create government-specific versions of their products that weren’t as regularly updated or feature-rich as the commercial versions.
To change this outcome, the new FedRAMP must act as a “translator” or “concierge” between the cloud services industry and government rather than a gatekeeper, Waterman said, by encouraging and enabling cloud services to use their own best-in-practice capabilities to provide innovative solutions to meeting and continuously validating FedRAMP requirements rather than saying “the government likes it this way so you have to do it that way.”
He elaborated on this point: “Conceptually, the current FedRAMP process is optimized for an established company that has successful revenue streams and is willing to take a risk on investing a significant amount of money upfront to go through a security process and build a separate product for the government such that, maybe, if they’re lucky, they might be able to get government business and it might take years to get a return on that investment. Whereas if you build FedRAMP [20x] around a process and architecture and best practices that make sense, then none of that investment is necessary.”
Doing so will empower CSPs, ranging from huge multibillion dollar companies to small startups that don’t necessarily have a lot of funding, to want to get FedRAMP authorized because it’s easier and simply “the right thing to do from a security perspective,” he said. This will help hundreds—if not thousands as M-24-15 urged—of cloud services to enter the federal market so agencies are able to use the same best-in-class, innovative, and continuously updated technologies available in the private sector in a secure and risk-informed way.
To achieve these outcomes and scale the FedRAMP Marketplace from a couple hundred to thousands, Waterman said they can’t just make incremental improvements to the existing program—they have to start from scratch.
That’s why one of FedRAMP’s major priorities at the time of the 20x launch was updating security standards. Six months later, we’re already seeing new standards in the 20x documentation repository of fedramp.gov. These include finalized standards:
- Key Security Indicators (KSIs)
- Minimum Assessment Scope
- Significant Change Notification Requirements (SCN)
- Authorization Data and Sharing Standard
- Vulnerability Detection and Response Standard (VDR)
These also include draft standards:
FedRAMP 20x Low Compliance Checklist
Cloud service providers seeking FedRAMP 20x Low authorization must apply all Key Security Indicators (KSIs) to all aspects of their cloud service offering. Use this checklist listing all KSIs and their underlying NIST 800-53 controls to evaluate your compliance status.
5. Moving closer to “true” continuous monitoring
Today’s FedRAMP “continuous monitoring” is anything but, according to Waterman, consisting of little more than annual assessments with periodic check-ins.
FedRAMP 20x is pushing toward true continuous monitoring, where systems automatically detect, remediate, and report security risks in real time, without humans involved. This will involve:
- Automated systems that detect security risks in real time
- Tools that can provide instant remediation without waiting on human reviews
- Dashboards and trust centers that provide continuous validation and reporting instead of point-in-time checks
The finalization of the new FedRAMP Authorization Data Sharing Standard represents major progress toward this last goal of continuous validation and reporting, enabling CSPs to store and share FedRAMP authorization data via Trust Centers on their preferred platform of choice if it meets certain requirements specified in this standard.
If the industry continues to provide solutions to automatically monitor and enforce requirements and FedRAMP continues to establish standards and guidelines for using these tools consistently and securely, 20x will fundamentally change how security is validated in government systems and set a new bar for compliance programs worldwide, such as CMMC.
Recommended reading
Navigating FedRAMP 20x: What The Changes Mean For Federal CSPs & How To Prepare
6. New tools and innovations from private sector for the government
FedRAMP 20x isn’t just about shortening authorization timelines and cutting paperwork with automation. Its ultimate goal is to expand the size, capabilities, effectiveness, and diversity of the Marketplace by making it more accessible to startups, smaller providers, and other vulnerable populations who want to sell to the government without years of upfront investment to get authorized.
To do so, FedRAMP is looking to the industry to provide technology and innovative solutions to improve the authorization process, rather than relying on the government to provide the answers. Already, according to Waterman, the Phase One pilot has spurred the development or customization of tools and products that didn’t exist six months ago.
If that pace continues, FedRAMP 20x could very well reach its vision of being not just an improved authorization program, but an engine of continuous improvement and stronger security that can help transform how organizations and customers—in both the public and private sector—approach and assess security.
Recommended reading
A FedRAMP Auditor Turned Compliance Automation Practitioner’s First-Hand Take on FedRAMP 20x’s Shift to Automation
Looking toward the future: What to expect under FedRAMP 20x in Q4 2025 and beyond
These results signal that FedRAMP 20x is already delivering on its promise of faster, smarter, more secure cloud adoption for the federal government.
Moving into Q4 2025 and 2026, we can expect even more progress against its core goals:
- The FedRAMP Marketplace to continue to grow at unprecedented speed.
- More FedRAMP Moderate authorized cloud services to enter the Marketplace under the 20x Phase Two Moderate Pilot (announced on September 24)
- 20x Low and Moderate standards to be finalized (expected early 2026).
- The industry to continue to embrace innovative tools to achieve and validate FedRAMP authorizations.
While the accuracy of the estimated dates in the FedRAMP 20x Roadmap will affect how quickly the FedRAMP Marketplace scales, it’s safe to say the FedRAMP authorization process will continue to transform at unprecedented speed.
Recommended reading
FedRAMP 20x Roadmap: Key Dates and Deliverables Expected Next in the Phased Rollout
How Secureframe automation can help you achieve FedRAMP authorization faster and with more confidence
At Secureframe, we’ve seen this transformation firsthand. As one of the first organizations to earn a FedRAMP 20x Low authorization, we know what it takes to succeed under the new model. Our platform is built to simplify compliance, automate monitoring, and give CSPs — from startups to enterprises — the tools they need to achieve and maintain FedRAMP authorization with confidence.
- First-hand FedRAMP 20x expertise: Former federal auditors who have undergone the FedRAMP 20x authorization process themselves can guide you through every step of the process.
- Federal cloud integrations: Automates monitoring and evidence collection with 300+ integrations to AWS GovCloud and other major federal cloud services as well as key tools in CSPs’ tech stacks.
- Continuous monitoring: 24/7 monitoring with customizable test intervals and task notifications to simplify continuous compliance.
- Risk management: Track, assess, and mitigate risks with our purpose-built POA&M Manager.
- Vendor management: Automate assessments to monitor and reduce third-party risk.
- User access reviews: Enforce least privilege with automated user access reviews and timely revocations.
- Vulnerability management: Integrates with leading scanners for continuous vulnerability monitoring to meet requirements in the newly finalized FedRAMP Vulnerability Detection and Response Standard.
- Cross-mapping: Map FedRAMP controls to 40+ frameworks to cut duplicate effort.
- Partner network: Access trusted 3PAOs, vCISOs, and MSSPs to streamline FedRAMP authorizations, from readiness to assessment to maintenance.
- Policy management: Templated, customizable policies with workflows for approvals and compliance.
- Trust Center: Share your FedRAMP authorization data in real time with a customizable Trust Center that meets FedRAMP requirements for standardized automated data sharing and validation within the FedRAMP ecosystem.
Request a demo today to see how we can help you achieve and maintain FedRAMP 20x compliance over time with confidence.
Use trust to accelerate growth
