FedRAMP Guide (2026): 20x Certification Classes, Rev5 Sunset and How to Get Certified

Who it applies to

FedRAMP applies to cloud service providers (CSPs) whose services federal agencies use. It also involves the agencies that authorise those services and the recognised independent assessors (3PAOs).

The Marketplace lists certified services, authorising agencies and recognised assessors. As of 23 October 2026 it showed 547 certified services, 33 of them certified under 20x (FedRAMP).

A FedRAMP Certification counts as "FedRAMP authorized" for statutory and regulatory purposes. However, each agency still makes its own risk decision and issues its own ATO, and it may use a package at a different security category than the Certification class (FedRAMP NTC-0004).

Key requirements

Certification Classes

Mapping to the historical baselines (FedRAMP NTC-0004; FedRAMP NTC-0008):

• Class A: a new, time-limited pilot or entry tier.
• Class B: the former Low and LI-SaaS baselines.
• Class C: the former Moderate baseline.
• Class D: the former High baseline.

FedRAMP says a class reflects "the depth and complexity of the information provided," not the overall security of a system (FedRAMP NTC-0004).

FedRAMP 20x

20x is built on five principles (FedRAMP):

• transparency
• flexibility
• accountability
• accuracy
• automatic validation

Providers define their security goals and demonstrate them through Key Security Indicators that are validated continuously rather than "staged for a point-in-time audit." Certification types (FedRAMP; FedRAMP):

• Class A: for mature security programmes entering the market. You can submit with a complete Readiness Assessment Report or a SOC 2 Type II. Once a federal customer uses the service, you have 12 months to begin moving to Class B or higher.
• Class B: light-use or small-scale services.
• Class C: common enterprise services used across an entire agency, or important government services.
• Class D: being developed in Phase 4. A pilot is planned, with RFC-0036 published 14–15 October 2026 (FedRAMP).

Rev5

Rev5 is the legacy path built on control baselines. In March 2026, FedRAMP opened RFCs to update baselines across the control families (AC, AU, CM, CP, IA, IR, RA, SC, SI, SR and others), followed by an initial outcome notice in June (FedRAMP). Rev5 providers must also adopt machine-readable packages (RFC-0024) (FedRAMP).

Continuous obligations

The Marketplace now shows the following for each service (FedRAMP):

• the lifecycle phase (Initial Implementation or Ongoing Certification)
• a "FedRAMP Certified (In Remediation)" status
• a Corrective Action Plan indicator
• a Certification History event log

FedRAMP also runs quarterly Security Inbox tests and issues notices in response to CISA directives, such as BOD 26-04 (FedRAMP).

Certification process and timeline

The 20x route has four steps:

1. Initial Implementation listing on the Marketplace. FedRAMP added 71 services in FY26 (FedRAMP).
2. Class A submission, using a RAR or SOC 2 Type II (FedRAMP).
3. Class B or C submission with Key Security Indicator evidence (FedRAMP).
4. Ongoing Certification through continuous validation (FedRAMP).

How 20x developed:

• Phase 1 (Low pilot): ran from April to September 2025 and received 26 complete packages.
• Phase 2 (Moderate pilot): ran from November 2025 to March 2026, with the first pilot authorizations on 6 March 2026.

FedRAMP's lessons learned were that Key Security Indicators can show security posture in near real time, and that the approach adapts readily to higher levels of security (FedRAMP).

FedRAMP aims to "deliver initial assessment decisions within 30 days of application" (FedRAMP).

Rev5 routes:

• the traditional agency sponsor path
• limited, temporary Rev5 Program Certification pipelines (Lost Sponsor and Ready Conversion), opened on 10 August 2026. FedRAMP does not plan to expand eligibility (FedRAMP; FedRAMP).

FedRAMP Ready was retired at the end of July 2026 and became "Legacy FedRAMP Ready" (FedRAMP).

FY26 by the numbers (FedRAMP):

• 92 new Certifications (66 Rev5 and 26 20x)
• 538 certified offerings at year end
• 760 new agency ATOs or ATUs

Costs

FedRAMP doesn't publish assessment costs. It dropped a proposal to collect them, noting that costs vary widely with scope and complexity (FedRAMP NTC-0002).

Penalties

FedRAMP doesn't impose fines. The risks are commercial:

• losing federal eligibility
• a Marketplace status of "In Remediation"
• a visible Corrective Action Plan (FedRAMP)

Agencies also make their own ATO decisions (FedRAMP NTC-0004).

Mapping to related frameworks

• SOC 2 Type II: can support a Class A submission (FedRAMP).
• NIST 800-53 and NIST CSF: Rev5 baselines are organised by control family (FedRAMP).
• CMMC and NIST 800-171: relevant to defence contractors using cloud services.
• ISO 27001 and CSA STAR: commercial evidence that 20x aims to reuse instead of mandating "a specific government-focused approach" (FedRAMP).

Readiness checklist

1. Choose a target class (A, B or C) based on how agencies will use your service.
2. If you already have one, use a SOC 2 Type II report or RAR to pursue Class A.
3. Define security goals and automate Key Security Indicator validation.
4. Produce machine-readable packages that follow the CR26 JSON schemas (FedRAMP).
5. Engage a FedRAMP-recognised assessor.
6. Rev5 providers: plan migration before the 11 June 2027 cutoff.
7. Monitor RFCs, public notices and the Security Inbox requirements.

Common pitfalls

• Still using Low, Moderate and High labels in sales and contracts.
• Starting a new Rev5 effort without a guaranteed sponsor. FedRAMP advises pivoting to 20x "immediately" (FedRAMP).
• Treating Certification as an agency ATO.
• Missing Class A's 12-month transition clock once you have a federal customer.
• Manual evidence that can't support continuous validation.

How AssureCore helps

• Cross-framework Mapping reuses SOC 2 and ISO 27001 controls for FedRAMP.
• The Controls Register and Evidence Management, with expiry alerts, keep evidence current.
• The Risk Register and action plans track corrective actions.
• Audit Reports (PDF/CSV) support assessor review.

Frequently asked questions

Official references

• FedRAMP – FedRAMP 20x
• FedRAMP – Home and Marketplace summary
• FedRAMP – Changelog
• FedRAMP – From Foundation to Implementation (8 Oct 2026)
• FedRAMP – NTC-0004 Authorization Designations outcome
• FedRAMP – NTC-0008 Rev5 Program Certifications outcome
• FedRAMP – NTC-0002 Reporting Assessment Costs outcome
• FedRAMP – Certification Paths are Heating Up (30 Jul 2026)

Related frameworks

• CMMC guide
• NIST 800-171 guide
• NIST CSF guide
• ISO 27001 guide