FedRAMP 20x Modernization & Consolidated Rules 2026 (CR26)

What Is FedRAMP 20x?

Key takeaway: FedRAMP 20x modernizes authorization around continuous validation (KSIs), machine-readable packages (OSCAL), and Certification Classes A through D under CR26. Use this page for the three foundational changes. Then pick class on certification classes, follow phases on the 20x roadmap, structure packages with OSCAL for FedRAMP and NISTcompliance.ai, and plan budget with FedRAMP certification cost.

FedRAMP 20x is the most significant restructuring of the Federal Risk and Authorization Management Program since its founding in 2011. This guide explains what 20x is, how it replaces narrative compliance with automated validation, the three foundational changes (Key Security Indicators, OSCAL machine-readable packages, continuous validation), the new Class A through D certification structure, and what cloud service providers should do now.

Federal Cloud Authorization, Rebuilt

FedRAMP 20x Defined

FedRAMP 20x is the operational name for the Federal Risk and Authorization Management Program's transition from narrative-driven, point-in-time compliance to automated, evidence-driven continuous validation. It is anchored by the FedRAMP Authorization Act of 2022 (44 U.S.C. Sec 3609) and OMB Memorandum M-24-15 (July 2024), which together direct the General Services Administration to modernize how cloud services are assessed and reused across federal agencies. The 20x program began with a Phase 1 pilot for the Low baseline (April to September 2025) and ran a closed Phase 2 Moderate pilot (November 2025 to March 2026). Phase 3, wide-scale adoption, is active now: Consolidated Rules 2026 (CR26) were released on June 24, 2026, optional early adoption opened July 4, 2026, and CR26 requirements become mandatory on January 1, 2027.

20x changes how security is proven, not whether it is required. Providers still meet the published requirements for the class they pursue, and under Consolidated Rules 2026 (CR26) FedRAMP organizes certification into Classes A, B, C, and D. FedRAMP describes the classes as loosely aligned with the Low, Moderate, and High baseline expectations, without a direct one-for-one correlation, so confirm the requirements for your target class on fedramp.gov rather than assuming a legacy baseline carries over.

Providers no longer write paragraphs describing how a control is implemented; they emit machine-readable evidence that the control is running, validated continuously through the assessment lifecycle.

This page covers what 20x is, the three foundational changes, class overview, and what CSPs should do now. For timeline see the 20x roadmap. For KSIs see Key Security Indicators. For classes in depth see Certification Classes A through D. For packages, cost, and ConMon see OSCAL for FedRAMP, the cost guide, automate ConMon, and NISTcompliance.ai.

From narrative to evidence

The Three Foundational Changes Under FedRAMP 20x

FedRAMP 20x rests on three interconnected changes. Each replaces a familiar legacy process with one engineered for the way modern cloud services actually operate.

Change 01

Key Security Indicators Replace Narrative Controls

Under Rev5, providers wrote paragraphs explaining how each control was implemented. Under 20x, providers emit machine-readable evidence that the control is running in production. Under CR26, effective June 24, 2026, the Key Security Indicators are organized into 10 themes with 46 indicators, including identity and access management (KSI-IAM), cloud-native architecture (KSI-CNA), monitoring, logging, and auditing (KSI-MLA), change management, incident response, recovery planning, supply chain risk, and service configuration. Class A uses a set of 7 of those indicators.

Change 02

Machine-Readable Data Replaces PDFs

CR26 moves authorization data from documents to data. The Certification Data Sharing (CDS) ruleset calls for human-readable data plus machine-readable JSON with programmatic access, and the Open Security Controls Assessment Language (OSCAL), the NIST standard for controls, system descriptions, assessment plans, results, and plans of action, is a FedRAMP-identified format. For 20x certifications, CDS applies to obtain certification from July 4, 2026 and to maintain it from January 1, 2027. For Rev5 certifications, CDS applies from January 1, 2027 to obtain and August 1, 2027 to maintain, with a grace period to February 1, 2028. RFC-0024 (January 13, 2026) had proposed a September 2026 date for Rev5 machine-readable packages; the final rules replaced it with the CR26 schedule above.

Change 03

Continuous Validation Replaces Annual Assessment

Rev5 relied on annual third-party assessments with monthly Plan of Action and Milestones updates. 20x validates Key Security Indicators continuously, with assessors moving from annual auditors to ongoing collaborative reviewers. Significant Change Notifications replace the legacy Significant Change Request process, shifting the operating model from prior approval to continuous notification with continuous evidence. The Significant Change Notification ruleset applies to Rev5 providers from January 1, 2027, with a grace period to June 1, 2027.

The new alphabetical structure

Certification Classes A Through D Under CR26

Under Consolidated Rules 2026, FedRAMP organizes certification into Classes A, B, C, and D. Class A is a pilot on-ramp for existing commercial products. FedRAMP describes the other classes as loosely aligned with the Low, Moderate, and High baseline expectations in NIST SP 800-53B, and states that there is not a direct correlation, so the legacy labels do not map one for one onto the new classes. The Department of Defense Impact Levels (IL2 through IL6) are a separate scheme. Under CR26 the program's vocabulary moves from FedRAMP Authorized to FedRAMP Certified, and certification is either Program Certification, issued by FedRAMP, or Agency Certification.

Class A

Pilot On-Ramp

SOC 2 Type II
Pilot class
20x Program Certification only

Class A (Pilot) is designed for existing commercial products that already hold a SOC 2 Type II and run a mature security program. It is available only through 20x Program Certification, issued by FedRAMP with no agency sponsor required, and the 20x Class A pipeline opened on August 3, 2026. It is not offered on the Rev5 path. After a federal customer begins using the service, the provider has 12 months to start moving to Class B or higher.

Class B

Loosely aligned to Low

20x pipeline open since Aug 31, 2026
Rev5: Agency Certification

FedRAMP describes Class B as adequate for most Low security objectives and some Moderate or High objectives. On the 20x path it is available through Program Certification, and the 20x Class B and Class C pipeline opened on August 31, 2026. On the Rev5 path Agency Certification is generally required, with a limited Program Certification pipeline for Lost Sponsor and Ready Conversion applicants that opened August 10, 2026.

Class C

Loosely aligned to Low and Moderate

20x pipeline open since Aug 31, 2026
Rev5: Agency Certification

FedRAMP describes Class C as adequate for most Low and Moderate security objectives and some High objectives. Availability matches Class B: 20x Program Certification, with the pipeline open since August 31, 2026, or Rev5 Agency Certification. FedRAMP advises providers not to go straight to Class C or Class D unless they have an existing government contract that requires that commitment.

Class D

Most use cases

Excludes classified systems
Rev5: Agency Certification
20x Program Certification: coming in 2027

FedRAMP describes Class D as adequate for most use cases regardless of security objective, excluding systems that process classified information. Today Class D is available on the Rev5 path, which requires Agency Certification with no Program Certification route. FedRAMP lists 20x Class D Program Certification as coming in 2027 and plans a 20x Class D pilot in Phase 4 (estimated FY27 Q1 to Q2). The pilot is proposed in RFC-0033, which closed for comment on October 9, 2026, and its dates are targets that may change.

Quzara Cybertorch is FedRAMP Certified at Class D on Azure Government, Marketplace ID FR2214150164. A cloud service built on a FedRAMP Certified Class D platform can reference the controls the platform implements in its own package, which reduces what the service has to implement and document itself. How much a customer can claim depends on the platform's responsibility matrix.

FedRAMP Certified Class D (High)
Azure Government
Marketplace ID FR2214150164
DoD IL-4

The December 7, 2026 clock

What Cloud Service Providers Should Do Now

Whether a cloud provider pursues Rev5 or 20x, the operational requirements below apply now. The nearest hard date is December 7, 2026, when the Vulnerability Detection and Response and Vulnerability Evaluation and Reporting rulesets take effect, and CR26 becomes mandatory on January 1, 2027. The other items position a provider to meet those dates and to move within the 20x model as Phase 3 pipelines are open.

Adopt Machine-Readable Tooling Before the CR26 Dates

Certification Data Sharing and Collaborative Continuous Monitoring move authorization data into machine-readable form, and OSCAL is a FedRAMP-identified format. A full SSP in OSCAL JSON is large, densely cross-referenced, and strictly schema-validated, and hand-writing OSCAL does not scale. NISTCompliance.AI generates OSCAL packages from underlying control evidence across 800-plus NIST SP 800-53 Rev 5 controls, with cross-framework mapping to CMMC Level 2 and FISMA Moderate from a single evidence base.

Instrument Continuous Validation Telemetry

KSIs require continuous evidence that controls are running, not periodic snapshots. Producing that evidence at the cadence 20x expects requires centralized identity, infrastructure-as-code, centralized logging, a SIEM, and automated configuration management. Cybertorch operates a FedRAMP Certified Class D SIEM, log collection, and 24/7 incident response on Azure Government with U.S.-citizen analysts, producing telemetry that supports KSI-MLA and the related themes. Vulnerability Detection and Response and Vulnerability Evaluation and Reporting, effective December 7, 2026, draw on that same telemetry.

Map Control Inheritance From Certified Platforms

A cloud service operating on top of a FedRAMP Certified platform inherits controls from that platform, reducing the surface area of the service's own certification. Inheritance from a FedRAMP Certified platform lets a provider reference controls the platform already implements instead of re-implementing them. Ask the platform for its responsibility matrix, and record in the provider's SSP which controls are inherited, which are shared, and which remain the provider's own. Where the platform publishes OSCAL component definitions, the provider's OSCAL SSP can reference them directly.

Plan for Significant Change Notices, Not Requests

The legacy Significant Change Request process required prior approval before implementing material changes. Under 20x, Significant Change Notices replace SCRs: providers notify the agency of the change and provide evidence the security posture is maintained. SCNs are themselves machine-readable artifacts integrated with the OSCAL package, so the SSP update, control re-validation, and notification all flow from the same evidence pipeline. The Significant Change Notification ruleset applies from January 1, 2027, with a grace period to June 1, 2027.

Choose the Right Class for Your Customer Mission

The class follows the security objectives of the agencies you serve, not provider preference. FedRAMP positions Class A as the entry point for existing commercial products that already hold a SOC 2 Type II and run a mature security program, and advises against going directly to Class C or Class D unless the provider has an existing government contract that requires that level or an active customer base with a federal compliance program.

Track RFCs Within Days of Each Drop

The FedRAMP PMO publishes proposed policy changes as Requests for Comment with structured public-comment windows. The cadence accelerated through 2025 and 2026. The January 13, 2026 release alone published six RFCs covering assessment cost reporting, authorization designations, marketplace expansion, external framework leverage, Rev5 Program Certifications, and OSCAL machine-readable packages. RFC-0033, which proposes the Phase 4 Class D pilot, closed for comment on October 9, 2026. Its schedule targets a full set of pilot requirements on October 14, 2026 and final requirements on November 18, 2026. Quzara's RFC and notice tracker lists every RFC and public notice with its status.

From pilot to general availability and Rev5 sunset

FedRAMP 20x Phase Timeline

FedRAMP 20x is rolling out in phases that began in April 2025 and run through 2027. The phase structure narrows scope, validates approach, and progressively expands the population of eligible cloud service providers. The timeline below tracks where the program is today, what is finalized, and what is coming. Dates and class descriptions were checked against fedramp.gov on October 14, 2026 (20x phases, CR26 timeline, Choose a class, Choose a path, and Rev5 deadlines). Future dates are targets and may change.

Phase 1: 20x Low Pilot

COMPLETED

April 2025 to September 2025

The Phase 1 pilot ran from April 2025 through September 2025. It was open to the public and focused on Low-impact cloud service offerings. The pilot tested whether compliance-as-code and Key Security Indicators could substitute for narrative documentation, and whether automated assessments could replace manual evidence collection. FedRAMP received 26 complete submission packages between May 30 and August 18, 2025, and the first pilot authorizations came in late July 2025.

Phase 2: 20x Moderate Pilot

COMPLETED

November 18, 2025 to March 2026

Phase 2 extended the 20x model to Moderate-level requirements to test whether automated validation could scale to a higher impact level. Participation was closed. FedRAMP received 14 qualifying submissions, the first pilot authorizations came on March 6, 2026, and six more providers were authorized as of April 27, 2026.

Phase 3: Wide-Scale Adoption

ACTIVE NOW

FY26 Q3 to Q4, pipelines open since August 2026

Phase 3 formalizes 20x requirements and opens Program Certification pipelines to qualifying providers. The initial 20x certification types are Class A (Pilot), Class B (Low), and Class C (Moderate). The 20x Class A pipeline opened on August 3, 2026 and the 20x Class B and Class C pipeline on August 31, 2026. FedRAMP Ready became a legacy designation on July 28, 2026, and a limited Rev5 pipeline for Lost Sponsor and Ready Conversion applicants at Class B and Class C opened on August 10, 2026. Class D is not part of Phase 3.

Consolidated Rules 2026 (CR26)

IN EFFECT

Released June 24, 2026, mandatory January 1, 2027

CR26 is the policy package that finalizes the 20x rule set. It was released on June 24, 2026, optional early adoption opened July 4, 2026, and its requirements take mandatory effect for all stakeholders on January 1, 2027, subject to the applicability dates within individual rulesets. Rev5 rulesets carry their own dates: Significant Change Notification, Minimum Assessment Scope, and Cryptographic Module Use on January 1, 2027; Collaborative Continuous Monitoring from April 2, 2027; Certification Data Sharing from August 1, 2027 to maintain certification. Each has its own grace period on the Rev5 deadlines page. CR26 also formalizes the Class A through D structure and the shift from FedRAMP Authorized to FedRAMP Certified terminology.

VDR and VER Rulesets Take Effect

NEXT HARD DEADLINE

December 7, 2026

NTC-0014, issued June 16, 2026 in response to CISA Binding Operational Directive 26-04, sets December 7, 2026 as the date the Vulnerability Detection and Response (VDR) and Vulnerability Evaluation and Reporting (VER) rulesets take effect. Providers that have not adopted them have a grace period to March 7, 2027, after which FedRAMP Certification can be revoked.

Phase 4: 20x Class D (High) Pilot

PLANNED

FY27 Q1 to Q2 (estimated)

Phase 4 continues wide-scale adoption while piloting a 20x path for Class D (High) services. RFC-0033, which closed for comment on October 9, 2026, proposes a pilot capped at 10 participants. Its target schedule is full pilot requirements on October 14, 2026, final requirements on November 18, 2026, applications on December 1 to 4, 2026, draft packages on February 17, 2027, and final packages on March 17, 2027. Applicants must hold a CR26-compliant 20x Class C Certification before December 1, 2026. These are proposed targets and may change.

Rev5 Application Pipelines Close

REV5 SUNSET

June 11, 2027

FedRAMP stops accepting Rev5 Certification applications on June 11, 2027. Services with active Rev5 certifications continue under the Rev5 deadlines in CR26. Rev5 Class D requires Agency Certification, and FedRAMP lists 20x Class D Program Certification as coming in 2027.

Next hard deadline

December 7, 2026: VDR and VER Take Effect

NTC-0014 (June 16, 2026) makes the Vulnerability Detection and Response and Vulnerability Evaluation and Reporting rulesets effective on December 7, 2026, with a grace period to March 7, 2027. CR26 as a whole becomes mandatory on January 1, 2027. The September 2026 date proposed in RFC-0024 for Rev5 machine-readable packages was not carried into the final rules, so providers should plan against the CR26 schedule on this page. Providers that have not yet adopted machine-readable tooling should be planning that adoption now.

Pursuing FedRAMP 20x or Migrating from Rev5?

Quzara operates both sides of the 20x equation. Quzara Cybertorch is FedRAMP Certified Class D on Azure Government with U.S.-citizen 24/7 SOC, producing telemetry that supports continuous validation. NISTCompliance.AI generates the OSCAL machine-readable packages that the CR26 data-sharing rules call for. The two work together: Cybertorch produces evidence; NISTCompliance.AI structures evidence into the OSCAL package the program requires. Request a consultation to map your path.

Schedule a Consultation

Common Questions About FedRAMP 20x

What does the 20x in FedRAMP 20x stand for?

20x is the program's name for its modernization effort: replacing document-heavy assessment with automated, continuously validated evidence. The name is not a promise of a specific timeline or speed-up, and FedRAMP does not publish a fixed time to certification for any path. Plan against the published CR26 dates.

Is FedRAMP 20x replacing Rev5 entirely?

For new certifications, that is the direction. FedRAMP is moving new certifications to 20x: limited Rev5 Program Certification pipelines opened in August 2026, and FedRAMP stops accepting Rev5 Certification applications on June 11, 2027. Services with active Rev5 certifications continue under the Rev5 deadlines in CR26. Class D has no 20x certification yet: a pilot is proposed for Phase 4 (RFC-0033) and fedramp.gov lists 20x Class D Program Certification as coming in 2027. Until then, Rev5 Class D requires Agency Certification. For existing Rev5 certifications, NTC-0013 says the end date has not been finalized and is likely no later than 2029.

What is a Key Security Indicator (KSI)?

A KSI is a specific, measurable security outcome a cloud system has or does not have, validated automatically against the running infrastructure rather than asserted in a written narrative. Under CR26, effective June 24, 2026, KSIs are organized into 10 themes with 46 indicators, including identity and access management (KSI-IAM), cloud-native architecture (KSI-CNA), and monitoring, logging, and auditing (KSI-MLA); Class A uses a set of 7 of them. Each KSI is validated when a continuous validation pipeline emits evidence that the indicator's expected state holds in production.

What is OSCAL and why does it matter under 20x?

The Open Security Controls Assessment Language is a NIST-developed standard for expressing security controls, system descriptions, assessment plans, results, and plans of action in machine-readable JSON, XML, or YAML. Under CR26, Certification Data Sharing calls for human-readable data plus machine-readable JSON with programmatic access, and OSCAL is a FedRAMP-identified format. For 20x certifications the rule applies from July 4, 2026 to obtain and January 1, 2027 to maintain; for Rev5 it applies from January 1, 2027 to obtain and August 1, 2027 to maintain, with a grace period to February 1, 2028.

What is the difference between FedRAMP Authorized and FedRAMP Certified?

Under CR26 the program's vocabulary moves from authorization to certification: Program Certification is issued by FedRAMP under 20x, and Agency Certification applies on the Rev5 path. Existing Rev5 offerings move to the CR26 rules on the schedule in the Rev5 deadlines, and for several rulesets that is tied to the first independent assessment after January 1, 2027 (NTC-0013 and the CR26 Rev5 deadlines page).

What are the new Certification Classes A through D?

Class A (Pilot) is for existing commercial products that already hold a SOC 2 Type II and run a mature security program, and it is available through 20x Program Certification. FedRAMP describes the classes as loosely aligned with the Low, Moderate, and High baseline expectations in NIST SP 800-53B, with no direct correlation. Class B is adequate for most Low security objectives, and Class C for most Low and Moderate objectives. Class D is adequate for most use cases regardless of security objective, excluding systems that process classified information. Rev5 Class D requires Agency Certification, and a 20x Class D pilot is planned for Phase 4.

What is a Significant Change Notice (SCN)?

Under Rev5, providers submitted Significant Change Requests and waited for authorizing-official approval before implementing material changes. Under 20x, that becomes a Significant Change Notice: providers notify the agency of the change and provide the evidence demonstrating the security posture is maintained. The SCN is itself a machine-readable artifact integrated with the OSCAL package. The model shifts from prior approval to continuous notification with continuous validation.

Has FedRAMP 20x Phase 3 opened?

Yes. Phase 3, wide-scale adoption, is active. The 20x Class A pipeline opened on August 3, 2026 and the 20x Class B and Class C pipeline on August 31, 2026, so qualifying cloud service providers can now pursue a 20x certification at those classes through Program Certification. Class D is not part of Phase 3; the 20x Class D pilot is planned for Phase 4.

Does FedRAMP 20x relax the security requirements?

FedRAMP does not present 20x as a lower bar. Requirements for each class are published on fedramp.gov as rulesets and Key Security Indicators, and the classes are only loosely aligned with the legacy Low, Moderate, and High baselines, so do not assume a one-for-one control match. What changes is how compliance is proven: Key Security Indicators are validated continuously rather than at a single point in time. Confirm the requirements for your target class on fedramp.gov before you plan. 20x validates Key Security Indicators continuously rather than at a single point in time, which is more rigorous than the legacy point-in-time assessment model in many respects.

Is there a September 2026 OSCAL deadline?

No. RFC-0024, issued January 13, 2026, proposed machine-readable packages for Rev5 providers by September 2026. The outcome, announced in NTC-0009 on March 25, 2026 and finalized in CR26, changed that schedule. The dates providers work to now are December 7, 2026 for Vulnerability Detection and Response and Vulnerability Evaluation and Reporting (NTC-0014); January 1, 2027 for Significant Change Notification, Minimum Assessment Scope, and Cryptographic Module Use; April 2, 2027 for Collaborative Continuous Monitoring; and August 1, 2027 for Certification Data Sharing. Providers that have not yet adopted OSCAL tooling should plan that adoption against those dates.

How does CMMC Level 2 relate to FedRAMP under 20x?

CMMC Level 2 and FedRAMP are separate programs. Under DFARS 252.204-7012, a cloud service provider that stores, processes, or transmits Controlled Unclassified Information for a defense contractor must meet security requirements equivalent to the FedRAMP Moderate baseline (the DFARS text uses the legacy Moderate label). A defense contractor that inherits controls from a FedRAMP Certified platform can reduce the scope of its own CMMC assessment. NISTCompliance.AI handles the cross-framework mapping so a single evidence base supports FedRAMP, CMMC Level 2, and FISMA Moderate.

How do Quzara Cybertorch and NISTCompliance.AI fit together under 20x?

Cybertorch and NISTCompliance.AI cover the two halves of the 20x equation. Cybertorch is the FedRAMP Certified Class D platform that emits the continuous-validation telemetry KSIs require: 24/7 U.S.-citizen SOC on Azure Government, SIEM, log collection, incident response, and inheritable controls documented in the platform's responsibility matrix. NISTCompliance.AI is the platform that structures evidence into the OSCAL package the program requires: AI-driven SSP and POA&M generation across 800-plus NIST SP 800-53 Rev 5 controls, with cross-framework mapping to CMMC Level 2 and FISMA Moderate, and an Auditor Co-Pilot capability for 3PAO and C3PAO evidence walkthroughs. The two work together: Cybertorch produces evidence; NISTCompliance.AI structures evidence into the OSCAL package.