FedRAMP 20x is the automation-focused overhaul of the Federal Risk and Authorization Management Program, replacing slow, document-heavy cloud security reviews with continuous, machine-readable validation. Instead of narrative documents describing how each control is implemented, cloud service providers prove security through Key Security Indicators that systems report automatically and assessors verify.

One thing has changed since most published guidance was written. FedRAMP 20x is no longer a pilot. The Consolidated Rules for 2026 made it the program's ruleset in June 2026, the certification pipelines opened in August 2026, and the legacy path is closing on a published schedule.

Most government contractors buy cloud services rather than sell them, which makes the second half of this question the important one. Below we cover what 20x is, what changed, how long it takes and what drives the cost, whether it reaches your contracts, what it changes for a buyer rather than a provider, and how to verify a platform before you put federal data in it.

What Is FedRAMP 20x?

FedRAMP 20x is the General Services Administration's redesign of federal cloud authorization, built around automated, continuously validated evidence rather than written documentation reviewed once. The security expectations did not drop. What changed is how a provider proves them and how often that proof gets refreshed.

Proof is the whole shift. Under the legacy model a provider wrote a System Security Plan describing each control, an assessor reviewed the narrative, and an agency accepted the package. Under 20x the system reports its own configuration and the assessment confirms the reporting works. A written System Security Plan still has a place in federal security work, but it is no longer the primary vehicle for demonstrating that a cloud service is secure.

When Did FedRAMP 20x Start?

FedRAMP 20x started in March 2025, when GSA announced the initiative, and it became the program's operating ruleset in 2026. The sequence ran from pilot to rule in roughly fifteen months.

Phase 1 tested the approach on low-impact systems and authorized its first four cloud services under the new model. Phase 2 followed with 13 selected providers testing the Moderate approach alongside their assessors. Across the pilots, 29 cloud services entered the FedRAMP Marketplace. The Consolidated Rules for 2026 were released June 24, 2026, took effect July 4, 2026, and become mandatory for all stakeholders January 1, 2027. Certification pipelines opened in August 2026, with Class A on August 3 and Classes B and C on August 31.

Why Did FedRAMP Change?

FedRAMP changed because the legacy process was too slow and too expensive to supply federal agencies with the cloud services they needed. Across its first decade the program authorized roughly 350 cloud services, averaging under 50 a year toward the end of that period, while authorization commonly took 12 to 18 months and often longer.

The results since the redesign began make the case better than the announcement did. GSA reported 114 authorizations in fiscal year 2025, more than double the prior year, with average agency review time falling to roughly five weeks. The Marketplace listed 537 certified cloud service offerings as of October 5, 2026. Reuse compounds that growth, since fiscal year 2025 produced 350 reuse authorizations against 131 new ones, meaning one security package served agency after agency. For any compliance program that depends on authorized platforms, a larger Marketplace is the practical benefit.

What Are the Key Differences Between FedRAMP 20x and FedRAMP?

The key differences between FedRAMP 20x and legacy FedRAMP are automated evidence instead of narrative documentation, continuous validation instead of periodic review, lettered Certification Classes instead of impact levels, and self-initiated certification instead of mandatory agency sponsorship. The underlying security expectations stayed in place through all of it.

Both paths currently coexist, and the comparison below reflects the FedRAMP Consolidated Rules for 2026 and the program's published transition notices.

DimensionLegacy Rev5 PathFedRAMP 20x PathEvidence modelNarrative documentation describing control implementationMachine-readable evidence reported by the system itselfRequirements156 controls at Low, 323 at Moderate, 410 at High, across 17 control families56 Key Security Indicators at Class B and 61 at Class C, across eleven themesAssessmentThird-party assessment organization reviews the documentation packageThird-party assessment organization validates the automated reportingAgency sponsorRequired before the process beginsNot required at the lower classes through Program CertificationMonitoringPeriodic reporting against the authorized baselineContinuous validation, with drift visible between reviewsStatus labelFedRAMP AuthorizedFedRAMP Certified

New applications under the legacy path end June 11, 2027, and existing Rev5 certifications sunset December 31, 2028. That schedule turns the comparison above from background into a procurement question for anyone selecting a platform this year.

What Are Key Security Indicators?

Key Security Indicators are the measurable security capabilities a cloud service must demonstrate under FedRAMP 20x, reported automatically rather than described in prose. There are 56 at Class B and 61 at Class C, organized into eleven themes covering areas such as cloud-native architecture, identity and access management, configuration management, monitoring and logging, and third-party resources.

Three examples show how concrete they are. The monitoring and logging indicator expects centralized, tamper-resistant logging plus persistent infrastructure and configuration scanning, which is the same discipline behind effective network monitoring in any environment. The third-party resources indicator requires a Software Bill of Materials for third-party commercial software components and confirmation that those providers hold a Secure Software Development Attestation with CISA. It also requires confirming that any subservice holding federal data is itself certified, which pushes verification down the supply chain rather than stopping at the vendor you contracted with.

What Replaced FedRAMP Low, Moderate, and High?

Certification Classes replaced FedRAMP Low, Moderate, and High. Class B covers what was Low, including the LI-SaaS variant, Class C covers what was Moderate, and Class D covers what was High, with a new Class A added as an entry tier. The change traces to a notice published February 25, 2026 and was finalized in the Consolidated Rules for 2026.

Vocabulary changed alongside the labels. FedRAMP Authorization is now FedRAMP Certification, and a service once described as Authorized is now Certified. Existing authorizations carry forward automatically at the matching class with the same control set, so nobody lost standing in the rename. A vendor still marketing itself with the retired wording is simply behind the program, which is worth noticing during a vendor review.

Does FedRAMP 20x Require a Sponsor?

No, FedRAMP 20x does not require an agency sponsor at the lower classes. A Program Certification path lets a provider submit directly to FedRAMP without a pre-committed agency partner, which removes the barrier that kept capable smaller providers out of the federal market entirely.

Sponsorship has not disappeared from the program. The highest class still runs through agency certification, and the sponsorless path applies to the classes below it. For most commercial software sold to federal buyers, that covers the relevant range.

Does FedRAMP 20x Still Require a 3PAO?

Yes, FedRAMP 20x still requires an independent assessor. A recognized third-party assessment organization validates that the automated evidence a provider reports is accurate and that the capabilities behind it work as claimed.

The assessor's job changed rather than disappeared. Under the legacy model the assessor tested controls and reviewed documents describing them. Under 20x the assessor confirms that the system produces trustworthy evidence on its own. That is a narrower task performed more often, which is part of why timelines compressed. The underlying control expectations still trace back to NIST, so NIST compliance work remains the foundation beneath both paths.

How Long Does FedRAMP 20x Take?

FedRAMP 20x takes weeks to a few months for providers whose systems can already produce automated evidence, compared with 12 to 18 months or longer under the legacy process. Pilot participants reported reaching authorization in as little as three weeks to three months, and GSA reported average agency review times of roughly five weeks.

Readiness decides which end of that range a provider lands on. The review got faster; the engineering did not get easier. A provider whose infrastructure already reports configuration state, logs centrally, and tracks its own software inventory can produce 20x evidence quickly. A provider that documented those things manually has real work ahead before the fast review helps it at all.

How Much Does FedRAMP 20x Cost?

FedRAMP 20x costs vary by provider, and the program publishes no fee that answers the question directly. The cost sits in four places: the independent assessment, the engineering work to make systems report their own evidence, continuous monitoring once certified, and the internal staff time to run the program.

Legacy FedRAMP earned its expensive reputation through the second and fourth of those. Writing and maintaining hundreds of pages of narrative documentation consumed specialist labor that produced no security improvement, and the long timeline meant carrying that cost for a year or more before any revenue arrived. FedRAMP 20x attacks exactly that overhead by replacing documentation labor with automation that most mature cloud providers already have reasons to build. The assessment and the monitoring remain real costs, and security engineering still costs what it costs.

Is FedRAMP Required for Government Contractors?

FedRAMP is required for government contractors indirectly. Your company does not get FedRAMP certified, but your contract requires that any cloud service holding federal data is certified or meets a recognized equivalent. The certification attaches to the platform; the duty to select and verify the platform attaches to you.

That distinction decides how 20x reaches you. If you sell a cloud product to federal buyers, 20x is a path you may travel. If you buy cloud products and run federal data through them, 20x changes the market you buy from and the evidence available to you. Most government contractors sit in the second group, including companies whose only cloud exposure is email, file storage, and a project tool.

What Is FedRAMP and When Is It Required?

FedRAMP is the government-wide program that standardizes security assessment, certification, and continuous monitoring for cloud products and services holding federal data, and it is required whenever a cloud service stores, processes, or transmits that data. One assessment serves every agency, which is why reuse figures so heavily in the program's output.

Scope has limits worth knowing. Federal policy names categories outside FedRAMP, including search engines, social media platforms used under agency policy, single-agency systems not offered as shared services, and low-risk ancillary services. Everything else touching federal data in the cloud falls inside, which covers most SaaS platforms a contractor would use day to day.

Does FedRAMP Apply to DoD Contracts?

Yes, FedRAMP applies to DoD contracts through DFARS 252.204-7012. That clause requires a contractor using an external cloud service provider to store, process, or transmit covered defense information to require that the provider meets security requirements equivalent to the FedRAMP Moderate baseline, now designated Class C.

Defense suppliers carry a second layer on top. A CMMC assessment examines everywhere Controlled Unclassified Information lives, and any cloud platform inside that boundary has to demonstrate it meets the applicable security requirements. A certified platform supplies that demonstration directly. A platform without one hands the burden back to you, which is the expensive outcome.

Boundary mapping is where that work begins. Documented DFARS compliance starts with knowing which platforms sit inside that boundary at all.

Why FedRAMP 20x Matters for Government Contractors

FedRAMP 20x matters for government contractors because it changes the cloud market you buy from, the vocabulary you have to recognize, and how often you can verify the platforms holding your federal data. Six consequences land on buyers rather than providers:

• A larger set of real options. The Marketplace grew from roughly 350 services across the program's first decade to 537 certified offerings by October 2026, which means fewer projects forced onto a platform that fits the contract but not the work.
• New vocabulary in vendor claims. Certification Classes B, C, and D have replaced Low, Moderate, and High, and Authorized has become Certified. A vendor using retired terms is not automatically wrong, but the gap is worth asking about.
• Evidence you can re-check. Continuous validation means a provider's standing reflects current state rather than its condition on an assessment date a year ago.
• A migration behind any Rev5 platform you pick now. New legacy applications end June 11, 2027 and existing Rev5 certifications sunset December 31, 2028, so a vendor's transition plan is a fair procurement question today.
• Tighter vulnerability response from providers. New vulnerability reporting and remediation rules become mandatory December 7, 2026 for offerings obtaining or maintaining certification.
• More small and specialized vendors. Removing the sponsorship barrier brought providers into the federal market who previously could not justify the entry cost, which matters most for niche tools.

Huntsville's concentration of defense suppliers makes the fourth point concrete, because contract terms here routinely outlive the platform decisions made at kickoff.

Platform longevity is the lesson in all six. The practical answer is to treat cloud systems selection as a decision with a maintenance schedule rather than a one-time procurement.

How Does FedRAMP 20x Affect Existing Authorizations?

Existing authorizations carry forward automatically as FedRAMP Certifications at the matching Certification Class, with the same controls and the same boundary. A service authorized at Moderate becomes Class C and faces no new control set because of the rename.

The transition arrives later rather than never. All providers face machine-readable package requirements, and legacy certifications sunset at the end of 2028, so every Rev5 holder has migration work ahead on a published timeline. Asking a vendor where it sits on that timeline costs one email and belongs in any vendor risk assessment.

When Does Rev5 End?

Rev5 ends in two stages. FedRAMP stops accepting new Rev5 applications on June 11, 2027, and existing Rev5 certifications sunset December 31, 2028. The Consolidated Rules for 2026 become mandatory for all stakeholders on January 1, 2027, ahead of both dates.

That runway is long enough to plan around and short enough to matter. A multi-year contract signed today on a legacy-certified platform will cross at least one of those dates during performance.

How to Comply With FedRAMP

For a contractor, complying with FedRAMP means inventorying every cloud service that touches federal data, confirming each one's certification and class against what your contract requires, documenting the verification, and re-checking on a schedule. Certification is the provider's job. Proof is yours.

Cloud service providers follow a different path entirely, choosing between the closing legacy route and the 20x pipelines, building automated evidence, engaging a recognized assessor, and maintaining continuous validation afterward. Both groups share one requirement: evidence has to exist before anyone asks for it, which is where ongoing compliance support earns its place.

How Do You Check If a Cloud Service Is FedRAMP Certified?

You check whether a cloud service is FedRAMP certified through the FedRAMP Marketplace rather than through a vendor's marketing page. Work through these steps in order:

1. Find the exact cloud service offering by name, remembering that certification attaches to a specific offering and most vendors certify a government edition rather than the commercial product.
2. Confirm the listing shows a live certification rather than an in-process or ready designation, neither of which satisfies a contract requirement.
3. Match the Certification Class against what your contract needs, since a Class B listing does not cover a Class C obligation.
4. Verify that the specific modules and features you plan to use fall inside the certified boundary, because partial-product certifications are common.
5. Capture the evidence, including the listing, the certification date, and written vendor confirmation that your tenant runs in the certified environment.

Three patterns should stop a procurement. A vendor claiming equivalency without the supporting documentation package, a vendor working toward certification rather than holding one, and a certification covering a different product than the one being sold to you. Each reads as reassuring in a sales conversation and fails under assessor review. Continuous control operation and evidence collection is what our managed cybersecurity model exists to maintain, because a preemptive approach produces proof while a reactive one produces explanations.

Can SOC 2 or ISO 27001 Work Count Toward FedRAMP 20x?

SOC 2 and ISO 27001 work reduces FedRAMP 20x effort without substituting for it. The program was designed to align with commercial security frameworks so providers can reuse existing policies, controls, and evidence rather than rebuilding a parallel program from scratch.

Reuse has a limit. Certification still requires validated evidence against the Key Security Indicators specifically, so commercial attestations shorten the preparation rather than the assessment. For a contractor evaluating vendors, a provider holding SOC 2 or ISO 27001 but no FedRAMP certification has demonstrated security maturity and nothing about federal eligibility.

Frequently Asked Questions

Who Runs FedRAMP?

FedRAMP is run by the General Services Administration, through the FedRAMP Program Management Office. GSA sets the program rules, publishes the standards and transition notices, operates the Marketplace, and recognizes the assessment organizations that validate cloud services.

What Is the FedRAMP Marketplace?

The FedRAMP Marketplace is the official public directory of cloud service offerings assessed against FedRAMP requirements, along with the recognized assessors and the agencies that have issued authorizations. It is the authoritative place to confirm a provider's status, class, and certification date, and it listed 537 certified offerings as of October 5, 2026.

Which Companies Are Approved by FedRAMP?

Companies are not approved by FedRAMP; specific cloud service offerings are. A vendor appearing on the Marketplace does not mean every product it sells is certified, since certification attaches to one named offering, usually a government edition. The Marketplace lists every certified offering and is the only reliable place to check.

Is FedRAMP Only for US Government Use?

FedRAMP governs cloud services holding U.S. federal data, so its legal force is limited to federal use. Its influence runs wider. State and local governments often reference FedRAMP standards in procurement or use parallel programs modeled on it, and private organizations sometimes treat certification as a security benchmark. Those uses come from contracts and policy choices rather than from FedRAMP itself.

Is FedRAMP Authorized the Same as FedRAMP Certified?

FedRAMP Authorized and FedRAMP Certified describe the same standing under different vocabulary. The Consolidated Rules for 2026 retired Authorization in favor of Certification, and existing authorizations carried forward with the same controls and boundary. A service marketed as Authorized today is using retired wording rather than claiming something different.

Is FedRAMP Still a Thing?

Yes, FedRAMP is still a thing, and it is more active than it has been in years. The program grew from roughly 350 cloud services across its first decade to 537 certified offerings by October 2026, completed 114 authorizations in fiscal year 2025, and rebuilt its own ruleset in June 2026. What changed is the method, not the mandate.

The Bottom Line

FedRAMP 20x replaced written descriptions of security with evidence that systems produce themselves, and it did so on a timeline that is already past the pilot stage. Certification Classes replaced impact levels, Authorization became Certification, sponsorless certification opened at the lower classes, and the legacy path closes to new applications in June 2027 with existing certifications sunsetting at the end of 2028.

For contractors the practical work has not changed shape, only improved. Know which cloud services hold federal data, confirm each one's certification and class against what the contract requires, ask vendors where they sit on the transition timeline, and re-check rather than assume. That discipline looks the same whether the framework in question is FedRAMP, CMMC, HIPAA, or PCI, which is why the government contractors, manufacturers, healthcare organizations, and financial firms we work with throughout Huntsville and North Alabama tend to solve it once rather than once per regulation.

If you want help sorting out which of your platforms fall inside a federal data boundary and whether their standing holds up, the team at Interweave Technologies is glad to work through it with you. Give us a call at 256.837.2300.

‍