FedRAMP 20x is changing how cloud service providers demonstrate security to the federal government. Building on existing assessment and continuous monitoring requirements, the modernized model places greater emphasis on measurable security outcomes, automation, machine-readable information and persistent validation.
For SaaS companies, independent software vendors (ISVs) and other cloud service providers looking to enter or expand within the federal market, that shift creates new opportunities – but it also changes how organizations should prepare.
And the transition is already underway. The FedRAMP 20x Class A pipeline opened in August 2026, followed by Class B and Class C later that month. The Consolidated Rules for 2026 become mandatory beginning January 1, 2027, subject to ruleset-specific effective dates and transition provisions, and FedRAMP plans to stop accepting applications for new Rev. 5 Certifications on June 11, 2027.
Before pursuing FedRAMP 20x, cloud service providers should evaluate five key areas:
- Confirm FedRAMP 20x is the right path for your offering.
- Build your plan around Key Security Indicators (KSIs).
- Define your scope and architecture early.
- Prepare to prove security continuously with machine-readable evidence.
- Plan for certification and the federal market – not just the assessment.
Getting these decisions right early can reduce unnecessary complexity and help establish a more sustainable path to FedRAMP certification.
FedRAMP 20x Changes How Cloud Providers Prove Security
FedRAMP 20x is more than an updated version of the traditional FedRAMP process. It represents a shift in how cloud security is demonstrated and maintained.
Traditional FedRAMP Rev. 5 combines control-based assessments, supporting documentation and continuous monitoring. FedRAMP 20x places greater emphasis on automation and persistent validation to demonstrate that security practices are implemented and operating effectively.
Three concepts are particularly important:
Key Security Indicators (KSIs) are measurable indicators used to demonstrate that security protections are operating effectively within a cloud environment.
Machine-readable evidence is structured security and compliance information that systems can automatically process, such as JSON-formatted certification information and data produced from security tooling.
Continuous monitoring and persistent validation mean security is demonstrated and maintained over time through ongoing monitoring and documented, recurring validation cycles.
The result is a model designed to make security evidence more current, reusable and transparent.
| Area | Traditional / Rev. 5-Oriented Approach | FedRAMP 20x |
| Security framework | Control-centric | Outcome- and KSI-driven |
| Evidence | Heavier reliance on documents and manually assembled evidence | Greater use of structured, machine-readable information and automated evidence |
| Certification package | Control framework and supporting documentation, with CR2026 updates to certification data | Persistently maintained certification data in human- and machine-readable forms |
| Validation | Periodic assessments and ongoing continuous monitoring | Increased emphasis on persistent verification and validation |
| Scope | Traditional authorization boundary; MAS also applies under CR2026 | Minimum Assessment Scope with defined inclusions and exclusions |
| Automation | Helpful to compliance | Increasingly central to demonstrating and maintaining security |
| Federal entry path | Often tied to agency sponsorship | 20x Program Certification does not require an agency sponsor |
“This is a long-overdue and very welcome change. FedRAMP 20x is a major step forward in making security assurance more useful to the agencies relying on it,” says Joshua Krueger, CISO at Project Hosts.
Under the current FedRAMP framework, 20x follows the Program Certification path, which means providers pursuing 20x do not need a federal agency to sponsor the service for certification. This can remove one of the historical barriers organizations faced when attempting to enter the federal market.
1. Confirm FedRAMP 20x Is the Right Path for Your Offering
The first question is not simply, “How do we get FedRAMP 20x certified?”
It is, “Does FedRAMP 20x make sense for our product, customers and federal strategy?”
FedRAMP’s new certification classes are designed to provide progressively greater levels of assurance and commitment to federal customers. For many first-time federal market entrants, Class A is the logical starting point.
FedRAMP describes Class A as an entry point for existing commercial products with mature security programs, particularly offerings that already have a current SOC 2 Type II report. Class A eligibility requires a qualifying assessment within the preceding 12 months and compliance with applicable FedRAMP requirements. Providers with existing agency customers and more established federal programs may need to evaluate higher classes based on agency requirements.
Before choosing a path, evaluate:
- Whether federal agencies have a realistic use case for your cloud service offering.
- The maturity of your existing security program.
- Whether you already serve federal customers or have active federal opportunities.
- What level of assurance prospective agency customers require.
- Whether your organization has the resources to support certification on an ongoing basis.
This is particularly important because the certification classes are not simply different labels. Higher classes can introduce greater expectations around assurance, automation, verification, validation and ongoing security information. As of October 2026, 20x Classes A, B and C are available; Class D is planned for 2027.
For many providers, pursuing the highest possible class immediately may therefore create cost and complexity without a corresponding business need.
FedRAMP also moved FedRAMP Ready to legacy status for new submissions on July 28, 2026, directing providers toward Class A as the new entry point.
The takeaway: start with your federal business case, then determine the certification strategy that supports it.
Learn more about Project Hosts’ FedRAMP compliance solutions.
2. Build Your Plan Around Key Security Indicators, Not a Control Checklist
One of the most significant changes with FedRAMP 20x is the role of Key Security Indicators (KSIs).
KSIs focus on measurable security outcomes. Instead of relying solely on documentation describing how a security requirement should be met, organizations must increasingly demonstrate that the relevant security practices are actually implemented and working within the live environment.
FedRAMP’s KSI framework addresses areas including:
- Change Management
- Cloud Native Architecture
- Cybersecurity Education
- Identity and Access Management
- Incident Response
- Monitoring, Logging and Auditing
- Policy and Inventory
- Recovery Planning
- Service Configuration
- Supply Chain Risk
That changes how organizations should approach readiness.
Rather than beginning with, “Who can write our compliance documentation?” teams should be asking questions such as:
Where does the evidence for each KSI exist today?
Which system produces that information?
Who owns that system and its data?
Can we verify that the security measure is working as intended?
Can that evidence be generated and maintained consistently?
These questions bring engineering, security, product and compliance teams together much earlier in the certification process.
A common mistake will be treating KSIs as another compliance checklist. An organization may technically have a security practice in place but lack the telemetry, automation or processes necessary to demonstrate it consistently.
Finding those gaps late can create significant rework.
The better approach is to map each applicable KSI to your existing architecture, security tooling, owners and evidence sources before the formal certification process begins.
“The value of automation is the time it gives our teams to investigate issues, fix weaknesses and make informed security decisions. Keeping the evidence current helps us spend more time acting on what it tells us,” Krueger says.
3. Define Your Scope and Architecture Before You Start
Scope has always mattered in FedRAMP. Under the Consolidated Rules for 2026, the concept of a Minimum Assessment Scope (MAS) gives providers a clearer framework for determining what actually needs to be assessed.
The objective is straightforward: include the information resources likely to handle federal customer data or affect the confidentiality, integrity or availability of federal customer data without unnecessarily bringing unrelated components into the assessment. Providers should apply FedRAMP’s stated scope exclusions when making that determination.
That makes architecture one of the most important early FedRAMP 20x decisions.
Before moving forward, determine:
- Which systems, services and data flows are actually part of the cloud service offering.
- Where federal customer data is stored, processed and transmitted.
- Which third-party services interact with the environment.
- Which security responsibilities can be inherited from your underlying platform.
- Whether architectural decisions unnecessarily expand your assessment scope.
- Which cryptographic, identity, logging and security services are supporting the environment.
Why does this matter?
Because scope drives effort.
Every unnecessary component brought into the assessment boundary can potentially introduce additional evidence, dependencies, security responsibilities and ongoing maintenance.
At the same time, defining the boundary too narrowly can be just as problematic. If a component meets the MAS inclusion criteria but is excluded without a valid scope exception, that decision may need to be revisited later.
The goal should not simply be to create the smallest possible boundary. It should be to create the right boundary—one that accurately represents the offering while minimizing unnecessary compliance overhead.
This is also where inherited controls and a purpose-built compliant platform can significantly affect the amount of work placed on an internal team. Project Hosts’ approach to cloud security and compliance is designed around reducing that burden by providing a secure foundation and managed expertise rather than requiring providers to build every component of a compliant environment themselves. Providers should clearly document which responsibilities are inherited and which remain with their own teams.
4. Get Ready to Prove Security Continuously with Machine-Readable Evidence
One of the clearest themes in FedRAMP 20x is the greater emphasis on demonstrating security through current, repeatable evidence.
Machine-readable information is a major part of that transition.
FedRAMP’s current rules require JSON information that follows the applicable schema when a rule specifies one, unless the rule states otherwise, allowing certification information to be consumed by FedRAMP, agencies and governance, risk and compliance tools.
In practice, relevant security evidence may come from areas such as:
- Vulnerability management.
- Identity and access activity.
- Encryption configuration.
- Asset inventories.
- Logging coverage.
- Configuration changes and drift.
- Patch and remediation performance.
- Security monitoring.
For organizations preparing for FedRAMP 20x, a useful readiness question is:
Can we prove this security outcome continuously without relying on someone to manually assemble evidence every time it is needed?
That question can expose weaknesses that a traditional assessment-readiness exercise may miss.
For example, a team may be able to produce a spreadsheet showing its current assets. But can it maintain an accurate inventory as infrastructure changes?
It may be able to show an assessor that logging is enabled. But can it continuously demonstrate appropriate logging coverage?
It may be able to document an access-control policy. But can it produce reliable evidence showing that access is actually being managed according to that policy?
FedRAMP’s 20x requirements become progressively more demanding as certification classes increase. Under the current rules, Class C providers, for example, must implement at least two automated methods for persistent verification and validation of each KSI and maintain historical KSI metrics.
The operational implication is significant: automation should be designed into your FedRAMP strategy, not added at the end of it.
Engineering, security and compliance teams need shared processes and tooling capable of supporting the program long after the initial certification is complete.
For a deeper assessment of these questions, see the FedRAMP 20x readiness guide.
5. Plan for Certification and the Federal Market, Not Just the Assessment
FedRAMP certification is an important milestone, but it is not the ultimate business objective.
The objective is to successfully serve the federal market.
That distinction should influence your strategy from day one.
As you plan for FedRAMP 20x, consider what happens both during and after certification:
- How will your certification package be maintained?
- Who owns ongoing compliance operations?
- How will your team work with an independent assessor?
- How will agencies access the security information they need?
- What is your strategy for your FedRAMP Marketplace presence?
- How will your sales team engage federal buyers?
- Can your engineering organization sustain the required security processes while continuing to develop the product?
Under FedRAMP 20x, certification packages are not intended to become static folders that are assembled once and forgotten. FedRAMP describes them as certification data that providers maintain over time and make available in current, understandable formats.
That makes ongoing operations part of certification readiness itself.
Agencies still authorize their own federal information systems and accept risk for their specific use of a certified service. Reusable FedRAMP evidence supports that decision.
“Our job is to manage risk and help agencies manage theirs. Giving them a clearer, more current picture of how a service is secured helps them make those decisions with confidence,” Krueger says.
There is also a business consideration that is easy to overlook: what will maintaining FedRAMP cost your internal teams?
Pulling engineers and security leaders away from product development to manually manage compliance processes may technically get an organization through an assessment, but it can create a significant long-term burden.
A managed approach can shift much of that work away from internal product teams.
For example, OnePlan accelerated its path to federal markets with Project Hosts by leveraging an established secure cloud and compliance environment rather than building and managing every aspect of its federal infrastructure independently.
The goal should be a FedRAMP program that supports your federal growth strategy—not one that becomes an obstacle to it.
FedRAMP 20x FAQs
How is FedRAMP 20x different from Rev. 5?
FedRAMP 20x places greater emphasis on measurable security outcomes, Key Security Indicators, automation, machine-readable certification information and persistent verification and validation. Rev. 5 uses the more traditional FedRAMP control framework and supporting documentation model, together with ongoing continuous monitoring.
Another important difference is the certification path. FedRAMP 20x uses Program Certification and does not require an agency sponsor, while Rev. 5 Agency Certification generally requires an agency authorization and sponsorship.
FedRAMP plans to stop accepting applications for new Rev. 5 Certifications on June 11, 2027.
What does machine-readable evidence mean in practice?
Machine-readable evidence is structured security and certification information that software systems can process automatically rather than information that exists only in unstructured narrative documents or screenshots.
FedRAMP 20x uses JSON schemas for applicable portions of the certification package so security information can be consumed more efficiently by FedRAMP, agencies and other authorized tools and systems.
How do impact levels affect a FedRAMP 20x strategy?
Federal agencies still categorize their information systems based on the potential impact of a loss of confidentiality, integrity or availability. However, FedRAMP 20x introduces Certification Classes that provide progressively greater assurance. These classes inform agency risk decisions and do not replace the agency’s FIPS 199 system categorization.
According to current FedRAMP guidance, Class A can support many non-sensitive use cases; Class B generally provides greater assurance for Low use cases; Class C is designed to provide sufficient information for most Low and Moderate security objectives and some High objectives; and Class D is intended to support most use cases regardless of security objective, excluding classified systems.
Organizations should therefore align their target certification class with the needs of their actual and prospective federal customers rather than automatically pursuing the highest class available.
Do you need an agency sponsor for FedRAMP 20x?
FedRAMP 20x does not require an agency sponsor under the Program Certification path. However, organizations pursuing FedRAMP through other pathways may still face the challenge of securing agency sponsorship.
For providers pursuing the Rev. 5 Agency Certification path, Project Hosts’ FasTrack allows you to leverage Project Hosts’ existing agency sponsor, removing one of the biggest barriers to getting started and providing a faster, more predictable path toward FedRAMP certification. For 20x, Project Hosts’ value is the secure platform, inherited security capabilities and ongoing operational support.
Five FedRAMP 20x Considerations to Remember
FedRAMP 20x may create a more modern path into the federal marketplace, but a faster and more automated model does not eliminate the need for careful planning.
Before beginning, remember these five principles:
- Choose the right path. Align your certification class and strategy with your product maturity, customer requirements and federal business goals.
- Start with KSIs. Determine how your live environment demonstrates measurable security outcomes.
- Control your scope. Design an assessment boundary that protects federal customer data without creating unnecessary compliance work.
- Build for continuous evidence. Make automation, machine-readable information and persistent validation part of the architecture from the beginning.
- Think beyond certification. Build an operating model capable of maintaining compliance and supporting federal customers after certification.
The organizations best positioned for FedRAMP 20x will not simply be those that can pass an assessment. They will be those that can make security assurance a sustainable part of how their cloud service operates.
Get Expert Help Pursuing FedRAMP 20x
Whether you’re determining your initial scope, evaluating 20x against Rev. 5 or preparing to pursue certification, Project Hosts can help you build a path that fits your technology and federal market strategy.
With more than 20 years of experience supporting organizations in highly regulated cloud environments, Project Hosts helps SaaS providers reduce the internal burden, uncertainty and cost associated with federal cloud compliance.
For organizations ready to move quickly, FasTrack provides an accelerated, fully managed path designed to streamline the journey to FedRAMP while allowing internal teams to stay focused on their product and customers.
Ready to determine your path to FedRAMP 20x? Contact Project Hosts to speak with a FedRAMP expert today!