Skip to main content

🔔 Notifications Hub: See compliance updates in one place

FedRAMP 20x Compliance Checklist

FedRAMP 20x replaces control narratives and point-in-time audits with 46 Key Security Indicators, automated evidence, and a machine-readable certification package under the Consolidated Rules for 2026 (CR26). In addition to implementing KSIs, providers also need validation methods, a Security Decision Record, an assessment scope, and the quarterly reporting rhythm certification requires. CSPs can use this checklist to assess their readiness for a 20x Class B or Class C certification and track their progress.

What you'll get:

  • Work through all 46 Key Security Indicators organized by capability area, with the five class-varying KSIs flagged so you know exactly what Class B and Class C require
  • Map each KSI to its related NIST 800-53 controls so existing compliance work counts toward your 20x evidence
  • Track readiness beyond the KSIs, including your Security Decision Record, marketplace listing, annual assessment, and ongoing reporting obligations