FedRAMP 20x Knowledge Authority

FedRAMP 20x status

Each figure is copied from a sourced record. Counts that are not in those records are left off.

Certification class availability

Class A: pilot; Class B: in transition; Class C: in transition; Class D: proposal-stage

Last verified 2026-09-27. FedRAMP Certification reference (classes, KSI metrics window)

Next major deadline

2027-01-01: Active 20x offerings must follow CR26 (or corrective action)

Last verified 2026-10-11. FedRAMP path & transition deadlines (Important Deadlines)

Rev5 transition deadline

2027-06-11: No new applications for FedRAMP Rev5 Certification

Last verified 2026-10-11. FedRAMP path & transition deadlines (Important Deadlines)

Most recent official update

2026-10-11: Official CR26 overall dates re-verified

Last verified 2026-10-11. FedRAMP path & transition deadlines

Recent certification activity

2026-06-24: Security Decision Record reference (replaces the SSP on the 20x path)

Last verified 2026-09-27. Security Decision Record (replaces the SSP)

Latest FedRAMP 20x updates

• 2026-10-11 · deadline

  Official CR26 overall dates re-verified

  The published overall table still lists 2026-07-04 CR26 widespread effect, 2027-01-01 Rev5 new-app and 20x maintain cliffs, 2027-06-11 Rev5 application close, 2028-02-01 default grace end, and 2028-12-31 CR26 practice expiry. Per-ruleset obtain/maintain rows remain on FedRAMP.gov only.

• 2026-09-27 · rule-change

  CR26 Key Security Indicators pinned (46 indicators / 10 families)

  Ten families and 46 indicators (ids, names, statements, Class C markers, related SP 800-53 citations) are treated as official text. scm.cc family titles remain authored display labels.

• 2026-06-25 · announcement

  FedRAMP launches Consolidated Rules for 2026

  20x practices (SDR, KSIs, CCM/OCR, VDR) are collected as consolidated rules rather than a Rev5-only control baseline.

See all updates (RSS/Atom available)

What changed from Rev5

FedRAMP 20x keeps the underlying security expectations but changes how a cloud service demonstrates them:

• The Security Decision Record (SDR) is the core package artifact under 20x, in place of the traditional System Security Plan (SSP).
• Key Security Indicators (KSIs) — 10 families and 46 indicators under CR26 — express measurable security capabilities that are validated by automated methods.
• Authorization status is expressed through Certification and Classes A-D.
• Monitoring is collaborative and continuous, rather than only a monthly document delivery.

Certification classes at a glance

FedRAMP uses Certification and Classes A-D for package baselines. During the transition through December 31, 2026, Class B (Low), Class C (Moderate) and Class D (High) pair the new class with the earlier impact label; Class A is a pilot. Certification does not replace an agency's own authorization to operate (ATO). Class A and Class D specifics continue to evolve — confirm the current class definitions on FedRAMP.gov before relying on them.

How certification works

The path runs from determining applicability and the right class, to implementing requirements and KSIs, establishing the SDR and persistent validation, gathering evidence, an independent assessment by a FedRAMP Recognized Independent Assessor (the role formerly called a 3PAO) where required, resolving findings, and the certification decision. Each stage is covered in the Get Certified guides.

Assessor skills training

A separate self-serve catalog teaches people to read official 20x rules, grade labeled test evidence, and write replayable findings. Completing a course yields an scm.cc training certificate only. Official Recognition of an independent assessment service requires A2LA accreditation (REC-IAS-ACC) and a Marketplace listing — this portal cannot make someone an assessor.

Open the assessor-skills catalog

Explore the knowledge hub