- The Federal Risk and Authorization Management Program’s FedRAMP 20x cloud certification went live after the program released the Consolidated Rules for 2026
- FedRAMP 20x will eventually replace FedRAMP Rev5 and the FedRAMP Readiness Assessment
- The new authorization path is part of FedRAMP’s efforts to modernize cloud service certification
The Federal Risk and Authorization Management Program announced Thursday that it has released its Consolidated Rules for 2026 and formally launched the FedRAMP 20x certification path specifically for the cloud community.
The new rules were based on data and lessons from the FedRAMP 20x pilot, which sought feedback from cloud service providers, government agencies and independent assessors to finalize certification rules.
What Is FedRAMP 20x?
FedRAMP 20x is the newest cloud security assessment that enables organizations to establish their own security goals. Class A certifications are for services that have mature compliance and security offerings for government customers. Applicants are required to submit some data in advance as well as information for ongoing monitoring and reporting. Class B targets cloud services that offer light-use or small scale services that may not be used by agencies for essential work. Class C certifies common enterprise services that may be implemented agency-wide or are used in systems that are part of important government services.
What Will Happen to the FedRAMP Rev5 Certification?
The existing FedRAMP Rev5 Agency Authorization Path for CSPs will remain valid until it is completely phased out on June 11, 2027. The Consolidated Rules for 2026 includes instructions to be adopted by current Rev5 certified systems by January 1, 2027. The FedRAMP Readiness Assessment for CSPs will become legacy on July 28, 2026.
What’s Next for FedRAMP 20x?
On July 6, FedRAMP will open marketplace listings for initial implementation stage enrollment. FedRAMP 20x Class A will open on August 3, followed by the class B and C pipelines on August 31. The program also plans to launch a phase 4 class D pilot.
