Key takeaway: FedRAMP 20x is in Phase 3, wide-scale adoption, and the next hard date is December 7, 2026, when the Vulnerability Detection and Response and Vulnerability Evaluation and Reporting rulesets take effect. Consolidated Rules 2026 (CR26) become mandatory on January 1, 2027, FedRAMP stops accepting Rev5 Certification applications on June 11, 2027, and a 20x pilot for Class D (High) is proposed for Phase 4. Plan against those dates, then see What Is FedRAMP 20x, Certification Classes A through D, OSCAL for FedRAMP, and FedRAMP certification cost.
This roadmap tracks each phase, the CR26 rule dates that sit on top of them, and the Class D pilot proposed in RFC-0033. It is anchored by the FedRAMP Authorization Act of 2022 (44 U.S.C. 3609) and OMB Memorandum M-24-15 (July 2024).
Dates checked against fedramp.gov on October 14, 2026. Proposed dates are targets and may change.
Phases 1 and 2 are complete. Phase 3 is active, and Phase 4 is the proposed Class D (High) pilot.
April to September 2025
Tested whether compliance as code and Key Security Indicators could replace narrative documentation. FedRAMP received 26 complete packages between May 30 and August 18, 2025, and the first pilot authorizations came in late July 2025.
November 18, 2025 to March 2026
A closed pilot that tested whether automated validation scales to Moderate-level requirements. FedRAMP received 14 qualifying submissions, and the first pilot authorizations came on March 6, 2026.
FY26 Q3 to Q4, pipelines open since August 2026
Formalizes 20x requirements through CR26 and opens Program Certification pipelines for Class A (Pilot), Class B (Low) and Class C (Moderate). Class D is not part of Phase 3.
FY27 Q1 to Q2, estimated
Continues wide-scale adoption while piloting a 20x path for Class D. RFC-0033 proposes the pilot with a firm cap of 10 participants.
Quzara Cybertorch is FedRAMP Certified at Class D (High) on Azure Government, Marketplace ID FR2214150164. Class D has no 20x certification yet, so Cybertorch operates on the Rev5 path today, and customers can inherit its controls into their own 20x certifications at Class B or Class C.
Completed milestones are marked as such. Everything marked Next or Target is still ahead.
| Date | Milestone | What it means for a provider | Status |
|---|---|---|---|
| Apr 2025 | Phase 1, Low pilot opens | First test of compliance as code and Key Security Indicators in place of narrative documentation. | Complete |
| Nov 18, 2025 | Phase 2, Moderate pilot opens | A closed cohort extends the 20x model to Moderate-level requirements. No new entry. | Complete |
| Jan 13, 2026 | RFC-0024 issued | Proposed machine-readable packages for Rev5 providers with a September 2026 date. The date did not carry into the final rules. | Complete |
| Jun 16, 2026 | Notice NTC-0014 published | Responds to CISA Binding Operational Directive 26-04 (June 10, 2026) and sets the VDR and VER dates. | Complete |
| Jun 24, 2026 | CR26 released | The Consolidated Rules for 2026, valid through December 31, 2028. | Complete |
| Jul 4, 2026 | CR26 optional early adoption begins | Providers can adopt CR26 rulesets ahead of their mandatory dates. | Complete |
| Aug 3, 2026 | 20x Class A pipeline opens | Program Certification for existing commercial products with a SOC 2 Type II. | Complete |
| Aug 10, 2026 | Limited Rev5 pipeline opens | Lost Sponsor and Ready Conversion applicants at Class B and Class C. | Complete |
| Aug 31, 2026 | 20x Class B and Class C pipelines open | Program Certification without an agency sponsor. | Complete |
| Oct 9, 2026 | RFC-0033 comment period closes | Class D and the Phase 4 pilot proposal. | Complete |
| Oct 14, 2026 | Target: full Class D pilot requirements | RFC-0033 schedule target. Final requirements are targeted for November 18, 2026. | Target |
| Dec 7, 2026 | VDR and VER take effect | Applies to every offering obtaining or maintaining certification. The first CR26 date with a revocation clock attached. | Next |
| Jan 1, 2027 | CR26 mandatory | Rulesets including Significant Change Notification, Minimum Assessment Scope and Cryptographic Module Use apply. See the deadlines table below. | Next |
| Mar 7, 2027 | VDR and VER grace period ends | FedRAMP Certification can be revoked for providers that have not adopted the rulesets. | Next |
| Jun 11, 2027 | Rev5 Certification applications close | FedRAMP stops accepting Rev5 Certification applications. | Next |
| 2027 | 20x Class D Program Certification | FedRAMP lists it as coming in 2027 and gives no date. | Planned |
Target dates come from RFC-0033, which is a proposal. FedRAMP states that future dates are estimates and may shift.
Each ruleset has its own obtain, maintain and grace dates. The list below is the FedRAMP deadlines table for Rev5 providers, with VDR and VER highlighted as the nearest hard date.
| Ruleset | Obtain | Maintain | Grace period ends |
|---|---|---|---|
| Addressing FedRAMP Communication (AFC) | Jan 5, 2026 | Jan 5, 2026 | Jul 1, 2026 |
| Secure Configuration Guide (SCG) | Mar 1, 2026 | Mar 1, 2026 | Jul 1, 2026 |
| Marketplace Listing (MKT) | Jul 4, 2026 | Jul 4, 2026 | Jul 4, 2026 |
| Vulnerability Detection and Response (VDR) | Dec 7, 2026 | Dec 7, 2026 | Mar 7, 2027 |
| Vulnerability Evaluation and Reporting (VER) | Dec 7, 2026 | Dec 7, 2026 | Mar 7, 2027 |
| Cryptographic Module Use (CMU) | Jan 1, 2027 | Jan 1, 2027 | Jun 1, 2027 |
| FedRAMP Certification (FRC) | Jan 1, 2027 | Jan 1, 2027 | First independent assessment started after Jan 1, 2027 |
| Incident Evaluation and Communication (IEC) | Jan 1, 2027 | Jan 1, 2027 | Jun 1, 2027 |
| Independent Verification and Validation (IVV) | Jan 1, 2027 | Jan 1, 2027 | First independent assessment started after Jan 1, 2027 |
| Minimum Assessment Scope (MAS) | Jan 1, 2027 | Jan 1, 2027 | First independent assessment started after Jan 1, 2027 |
| Significant Change Notification (SCN) | Jan 1, 2027 | Jan 1, 2027 | Jun 1, 2027 |
| Collaborative Continuous Monitoring (CCM) | Jan 1, 2027 | Apr 2, 2027 | Oct 1, 2027 |
| Certification Package Overview (CPO) | Jan 1, 2027 | Jul 1, 2027 | First independent assessment started after Jul 1, 2027 |
| Certification Data Sharing (CDS) | Jan 1, 2027 | Aug 1, 2027 | Feb 1, 2028 |
| Security Decision Record (SDR) | Jan 1, 2027 | Aug 1, 2027 | First independent assessment started after Aug 1, 2027 |
The grace date is firm: a provider must adopt the ruleset by then or FedRAMP Certification will be revoked. Maintain dates are the dates a provider should adopt the ruleset, and a corrective action plan may be required after them. 20x certifications carry earlier obtain dates for several rulesets, for example Significant Change Notification from July 4, 2026.
Primary sources CR26 Rev5 deadlines, Notice NTC-0014, SCN rules, 20x, SCN rules, Rev5.
RFC-0033 closed for comment on October 9, 2026. FedRAMP expects finalized 20x Class D requirements to provide a greater level of assurance than a legacy Rev5 Class D.
Target for the RFC with the full Class D pilot requirements.
Target for final pilot requirements to be published.
Application window. Applicants must hold a CR26-compliant 20x Class C Certification before December 1.
Mandatory draft package submission and initial progress review.
Final pilot package deadline.
RFC-0033 is a proposal, and FedRAMP calls its dates targets. The pilot is capped at 10 participants, and participants engage a FedRAMP Recognized Independent Assessment Service. Phase 2 pilot participants are excluded unless they hold a full CR26-compliant Class C Certification by December 1, 2026. Under Rev5, Class D requires Agency Certification, and FedRAMP lists 20x Class D Program Certification as coming in 2027.
Primary sources RFC-0033, FedRAMP 20x phases, Choose a path.
Whether a provider is on Rev5 or 20x, these six items are the work in front of you.
Vulnerability Detection and Response and Vulnerability Evaluation and Reporting take effect on December 7, 2026, with a grace period to March 7, 2027. They are an operating program, not a scanner. Cybertorch runs vulnerability management as a service, and NISTcompliance.ai lets you run the 20x rules as a daily operation, including ingesting vulnerability data for VDR and VER reporting. See the VDR and VER guide.
Significant Change Notification applies to Rev5 providers from January 1, 2027, with a grace period to June 1, 2027. Classify each change as routine recurring, adaptive or transformative, and notify instead of asking. See the SCN guide.
Certification Data Sharing calls for human-readable and machine-readable JSON data with programmatic access, and OSCAL is a FedRAMP-identified format. For Rev5 it applies from January 1, 2027 to obtain and August 1, 2027 to maintain. NISTcompliance.ai generates OSCAL packages inside the Cybertorch FedRAMP boundary. See OSCAL for FedRAMP.
The 20x pipelines for Class A, B and C are open, a limited Rev5 pipeline is open for Lost Sponsor and Ready Conversion applicants, and Rev5 Certification applications close on June 11, 2027. Choose a class from the agencies you serve. See Certification Classes A through D.
CR26 organizes Key Security Indicators into 10 themes with 46 indicators, effective June 24, 2026, and five are optional for Class B and Class C. Centralized identity, logging, a SIEM and automated configuration management produce the evidence. See the KSI hub.
FedRAMP publishes proposed changes as Requests for Comment and final decisions as notices. RFC-0033 on the Class D pilot closed on October 9, 2026, and its schedule targets full pilot requirements on October 14, 2026. See the RFC and Policy Tracker.
Quzara operates both sides of the roadmap. Cybertorch is FedRAMP Certified Class D (High) on Azure Government with a 24/7 U.S. citizen SOC, and NISTcompliance.ai automates the machine-readable package and continuous assurance work. Engage Quzara through our GSA HACS vehicle or directly.
