%20(1).png)
- FedRAMP 20x replaces the Rev 5 documentation model with automation-based validation using Key Security Indicators (KSIs).
- Three classes now exist: Class A (mature programs, lightweight entry), Class B (low-risk small-scale services), Class C (enterprise or mission-critical). Class D (High) is still in development.
- Agency sponsorship is no longer required for Class A and Class B.
- Phase 1 of the pilot found that no participants reused existing SOC 2 framework assessments directly. Your security posture carries over; your audit evidence format does not.
- Rev 5 stops accepting new certifications by June 11, 2027. If you are currently in Rev 5 preparation, the transition clock is running.
FedRAMP 20x is a complete rebuild of the federal cloud authorization program. The Rev 5 process it replaces ran authorization timelines from months to years. System Security Plans ran to hundreds of pages.
A federal agency sponsor was required before most cloud providers could even begin. Many capable SaaS companies simply did not pursue federal authorization.
See FedRAMP for CISOs for what the old process involved.
FedRAMP 20x is the GSA's rebuild of the authorization framework, not a revision of it.
Announced in March 2025 under the authority of the FedRAMP Authorization Act 2022 and OMB Memorandum M-24-15, it replaces documentation-based attestation with continuous, machine-readable validation. It removes the agency sponsor requirement for lower-risk services. It targets authorization in weeks for most offerings.
Phase 1 (April to September 2025) and Phase 2 (November 2025 to March 2026) pilots proved feasibility. Phase 3, wide-scale adoption, opened in FY26 Q3. The submission pipeline was planned for July to September 2026.
Rev 5 new certifications stop on June 11, 2027. That date creates a real decision window for any company currently evaluating federal go-to-market.
From paperwork to proof: The five core changes in FedRAMP 20x
1. No agency sponsor for Class A and Class B. Rev 5 required a federal agency sponsor before a CSP could pursue authorization. 20x removes this for Class A and B.
2. Key Security Indicators replace control checklists. KSIs are machine-readable, automated signals of security outcomes. The assessment validates that controls are working, not that documentation about them exists. See the KSI section below for what this means operationally.
3. Continuous validation replaces point-in-time audits. 20x requires ongoing, automated evidence. Annual snapshots no longer satisfy the assessment standard. This is closer to continuous compliance monitoring than the traditional audit cycle. See continuous compliance for the operational model.
4. Context-sensitive requirements by class. The three classes calibrate scope, evidence burden, and reporting to the risk profile of the service.
5. Faster timelines as a design goal. GSA targets authorization in weeks for most offerings. Phase 1 demonstrated feasibility: 26 submissions, first authorizations by July 2025.
Rev 5 vs FedRAMP 20x: The Structural Comparison
Class A, B, and C: Which One Fits Your Cloud Service
Your class determines your evidence burden, ongoing reporting requirements, and timeline.
Class D (High impact) is still in development. Phase 4, which covers High, is estimated for FY27 Q1 to Q2. Any company with a use case requiring High-impact authorization cannot pursue 20x today. If your timeline requires High before FY27, Rev 5 may still be the only available path.
Key Security Indicators: What They Are and Why They Replace Your Evidence Binder
A Key Security Indicator is a defined, machine-readable signal that demonstrates a security control is operating as intended on an ongoing basis. The distinction from Rev 5 is concrete: Rev 5 required documentation that MFA was required for privileged access.
A 20x KSI requires continuous automated evidence that MFA is enforced at the IAM layer with zero exceptions, validated by an automated check running on every access event.
KSIs shift assessment from control existence to control effectiveness. A policy document and screenshot do not satisfy a KSI. Structured data, API-accessible evidence, and automated pass/fail do.
The Phase 1 pilot finding that matters most for planning: no participants actively reused existing framework assessments such as SOC 2. Your SOC 2 program builds the underlying security posture that KSIs measure. The evidence format is different. SOC 2 audit artifacts do not substitute for machine-readable KSI validation.
What this means operationally: your security program must be instrumented, not merely documented. MFA enforcement must be verified programmatically, not described in a policy.
Encryption must be confirmed by automated configuration checks, not asserted in an SSP. Vulnerability remediation must be tracked against machine-readable timelines, not manually compiled patch reports.
See automated controls testing and evidence management for the operational infrastructure that supports this kind of continuous, machine-readable evidence.
Where FedRAMP 20x Stands Today: The Phase Timeline
Three decision points:
- Mid-Rev 5 means decide now whether to complete or transition
- First-time 20x evaluators should target Phase 3
- High-impact authorization before FY27 means Rev 5 is still the only path
Is FedRAMP 20x Right for You? Five Questions to Answer First
1. Is this strategic or reactive? A single RFP response requires timeline realism: Phase 3 opens July to September 2026, and authorization in weeks is a goal, not a guarantee. A strategic federal play makes 20x worth serious evaluation if you hold SOC 2 Type II or ISO 27001.
2. Which class? Use the class table above. A Class B service has a materially lighter burden than Class C. If you cannot answer, ask: what would agency-wide failure of this service look like? That answer maps to class.
3. Instrumented or documented? KSIs require machine-readable, continuous evidence. If your program is documentation-based, budget for engineering instrumentation work, not GRC paperwork.
4. Engineering bandwidth for ongoing monitoring? Continuous validation is sustained engineering ownership, not a one-time implementation. Factor this into resourcing.
5. Does your timeline fit? High-impact authorization before FY27 Q1: 20x cannot help yet. Any FedRAMP authorization after June 2027: Rev 5 new certifications end. Plan for 20x.
Who should pursue FedRAMP 20x now?
SaaS companies with SOC 2 Type II or ISO 27001, federal sales as a strategic priority, Class A or B fit, and engineering bandwidth for instrumentation. Wait: if you need Class D (High), if your timeline is under six months, or if your security program is documentation-based and you have not budgeted for instrumentation work. Revisit Rev 5: if you need High-impact authorization before FY27 Q1.
See compliance risk assessment for how to frame the investment decision against your current compliance roadmap.
If You Have SOC 2 or ISO 27001: What Carries Over and What Does Not
The Phase 1 finding that matters most: no participants actively reused existing framework assessments such as SOC 2. Your existing security work is not wasted. The format is wrong.
Budget for instrumentation work, not starting from zero on security controls. This is engineering work, not GRC documentation.
FedRAMP 20x Impact Matrix: Who Needs to Act on What
FedRAMP 20x creates five distinct action items by function. GRC and security teams audit which controls produce machine-readable outputs and build new evidence pipelines for those that do not. Engineering owns sustained instrumentation; continuous validation is not a one-time setup. Business development and legal revisit the federal sales strategy now that agency sponsorship is no longer a prerequisite for Class A and B. CISOs determine which class fits the service, since that decision sets the evidence scope and timeline. Everyone in a Rev 5 process faces one choice: complete before June 2027 or transition to 20x. Both paths require active planning now.
See the GRC automation guide for the platform-level infrastructure that supports KSI-ready evidence collection.
What FedRAMP 20x Does Not Yet Solve, and How to Start
FedRAMP 20x is still maturing. Class D (High) does not exist yet; Phase 4 is estimated for FY27 Q1 to Q2. Implementation quality varied widely in Phase 1, 3PAOs are still developing KSI testing guidance, and the Consolidated Rules for 2026 were still being finalized as of Phase 3. Authorization also does not guarantee agency adoption. Check fedramp.gov before treating any summary as final.
Honest gaps to know before you commit
- Class D (High) does not yet exist. Phase 4 is estimated for FY27 Q1 to Q2. National security-adjacent services cannot pursue 20x today.
- Implementation quality varied widely in Phase 1. The official recap notes 'a fully open pilot with minimal guardrails produces a very wide range of implementation quality.' The program is still maturing.
- 3PAOs are adapting. Phase 2 flagged that assessors needed clearer KSI testing guidance. Ask prospective 3PAOs about their 20x experience before engaging them.
- The Consolidated Rules for 2026 were still being finalized as of Phase 3. Check fedramp.gov for current status before treating any third-party summary as final.
- Authorization does not guarantee federal agency adoption. Agencies still choose whether to use 20x-authorized services.
Three practical first steps
1. Classify your service. Use the class matrix above. If you cannot classify internally, ask: what would agency-wide failure of this service look like? That answer maps to class.
2. Assess your instrumentation gap. For each critical control in your current SOC 2 or ISO 27001 program, ask: is this machine-readable and continuously validated, or is it a policy document and a screenshot? The gap between those two answers is your 20x readiness gap.
3. Track the submission pipeline. Phase 3 planned the public submission pipeline for July to September 2026. Monitor fedramp.gov and the FedRAMP Community Discussions on GitHub. Do not rely on third-party summaries for a decision of this consequence.
Building your FedRAMP 20x foundation with Scrut
Scrut's compliance automation platform supports the security program foundation that 20x will require: automated evidence collection from live integrations, continuous control monitoring, and GRC workflows that keep evidence current without manual assembly.
A solid compliance foundation means the instrumentation work for 20x starts from a defensible position.
You can read more on automated controls testing and compliance automation platforms for supporting infrastructure.
See how Scrut helps compliance teams build the continuous evidence foundation that FedRAMP 20x requires. Request a demo.
Rev 5 required documentation packages, point-in-time 3PAO audits, and an agency sponsor. 20x replaces documentation with continuous KSIs, removes the sponsor requirement for Class A and B, an
A KSI is a defined, machine-readable signal that a security control is operating as intended on an ongoing basis. Where Rev 5 required a policy document stating that MFA was required, a KSI requires continuous automated evidence that MFA is enforced at the IAM layer with no exceptions. KSIs shift the focus from control existence to control effectiveness.
No, for Class A and B. Phases 1 and 2 accepted submissions without agency sponsorship. Class D (High) requirements, including sponsorship, are still in development.
Yes, but not in the way you might expect. Phase 1 found no participants reused existing framework assessments. Your SOC 2 builds the security posture KSIs measure; audit documentation does not substitute for machine-readable KSI validation. Plan for instrumentation work beyond current artifacts.
FedRAMP will stop accepting new Rev 5 certifications on June 11, 2027 (Phase 5, currently estimated for FY27 Q3 to Q4). Organizations pursuing FedRAMP authorization after that date must use the 20x pathway. Existing Rev 5 certified providers will receive a transition path before the cutoff. Check fedramp.gov for the latest timeline.
%201.png){kind=icon}
.png)
