FedRAMP Rev 5 Under FedRAMP 20x
## NIST SP 800-53 Rev 5 remains the control catalog. FedRAMP 20x changes how it is implemented. Talk to Quzara about your transition plan, KSI readiness, and OSCAL submission.Trusted Partners
Rev 5 Under FedRAMP 20x: What Changes, What Doesn't
NIST SP 800-53 Rev 5 remains the underlying control catalog FedRAMP applies, with no plans to retire or rewrite it. What FedRAMP 20x changes is how Rev 5 controls are implemented, proven, and submitted. The legacy model of paragraph-driven implementation descriptions, point-in-time annual assessments, and PDF submission packages is replaced by Key Security Indicators validating control posture continuously and Certification Classes A through D replacing the Low/Moderate/High impact labels. Machine-readable packages arrive through the 2026 Consolidated Rules, not one September 2026 deadline. For Rev5, the Certification Package Overview applies to new certifications from January 1, 2027 and to existing ones by July 1, 2027.
Cloud service providers operating today on Rev 5 are not exempt from the 20x transition. FedRAMP stops accepting new Rev5 certification applications on June 11, 2027. Existing Rev5 certifications remain active until at least December 31, 2028.
Quzara provides advisory across both paths. Whether your service is in continuous monitoring under an existing Rev 5 authorization, in active 3PAO assessment under Rev 5 templates, or planning the move into FedRAMP 20x now that the Class A, B and C pipelines are open, the engagement covers gap assessment against current expectations, OSCAL submission package preparation, KSI instrumentation readiness, Significant Change Notice workflow alignment, and the inheritance architecture that compresses the path to authorization.
Quzara Cybertorch operates as a FedRAMP Certified Class D platform on Azure Government, Marketplace ID FR2214150164. NISTCompliance.AI generates OSCAL packages and SSPs from observed control evidence. Both products are operational today, used by Quzara on Rev 5 authorizations now and engineered for the 20x model as it phases in.
If you are staying on the Rev5 path, NISTcompliance.ai is FedRAMP Rev5 compliance software that keeps your SSP, POA&M and evidence in one record.
From Rev 5 to FedRAMP 20x
The 20x Transition Roadmap
The FedRAMP 20x program rolls out in phases that began in April 2025. The roadmap below tracks where the program is today, what is locked in, and what is scheduled. RFC-0024 (January 13, 2026) proposed a September 2026 date for Rev5 machine-readable packages. The final rules, released June 24, 2026, replaced it with the Rev5 deadlines FedRAMP publishes. FedRAMP stops accepting new Rev5 certification applications on June 11, 2027. Existing Rev5 certifications remain active until at least December 31, 2028.
Phase 1: 20x Low Pilot (April 2025 to September 2025, complete)
The public Phase 1 pilot validated KSI and OSCAL as substitutes for narrative SSPs at the Low baseline. FedRAMP received 26 complete submission packages in just under three months, with the first organizations authorized by late July 2025. The pilot demonstrated that the path from kickoff to authorization could be compressed from 18-plus months to weeks for cloud-native providers operating on FedRAMP-authorized infrastructure.
Phase 2: 20x Moderate pilot (opened November 18, 2025; complete)
A closed cohort of 13 cloud service providers selected from the Phase 1 group worked with FedRAMP and assessors to extend 20x to the Moderate baseline. The cohort tested Key Security Indicators for Moderate, validation by third-party assessors, and the operational mechanics of continuous validation.
RFC-0024 Issued (January 13, 2026)
The Request for Comment proposing machine-readable submission packages was published alongside five other RFCs covering assessment cost reporting, authorization designations, marketplace expansion, external framework leverage, and Rev 5 Program Certifications. Quzara filed an eight-comment public response to RFC-0024 within days of release.
CR26 released (June 24, 2026)
FedRAMP released the Consolidated Rules for 2026 on June 24, 2026. They replaced the September 2026 date proposed in RFC-0024 with phased Rev5 deadlines starting January 1, 2027. Cloud providers that have not yet adopted OSCAL tooling should be planning that adoption now.
Phase 3: Wide-scale adoption (active; Class A pipeline opened August 3, 2026, Classes B and C on August 31, 2026)
Phase 3 opens 20x to all qualifying cloud service providers for Classes A through C. In Phase 3, any cloud-native provider running on FedRAMP-authorized infrastructure can pursue a 20x authorization through either the Agency path or the new Program Certification path. Class D (the former High baseline) is not in scope for Phase 3 and remains on the Rev 5 path.
Consolidated Rules for 2026 (CR26)
Released June 24, 2026, optional from July 4, 2026, and required for new applications from January 1, 2027. CR26 formalizes the Certification Classes A through D taxonomy and the FedRAMP Authorized to FedRAMP Certified terminology shift.
Phase 4: Class D (High) pilot, proposed in RFC-0033 (dates may shift)
FedRAMP proposed a Class D (High) pilot for 20x in RFC-0033. Dates may shift.
Rev5 applications close (June 11, 2027)
FedRAMP stops accepting new Rev5 certification applications on June 11, 2027. Existing Rev5 certifications remain active until at least December 31, 2028.
Read More on Our Blog Posts
Our blog posts provide detailed information on FedRAMP and how it can benefit your organization. We encourage you to read more on our blog posts to learn about this important program.