No. FedRAMP 20x certifications are processed directly by FedRAMP and do not require an active agency contract or sponsor.
How it works
An agency sponsor is a federal agency that backs a provider's certification by authorizing the service first. Under 20x, providers automatically follow the Program Certification path, where FedRAMP itself grants certification. The older Agency Certification path, which needs a sponsor, is available only for Rev5.
What still applies
Providers must be listed on the FedRAMP Marketplace, FedRAMP's public directory of cloud services, before applying. Listing includes identifying agency use cases and showing continuous progress. Each agency must also complete its own Authorization to Operate (ATO), its internal approval to use a system, before using a certified service.
Rev5 for comparison
| Type | Classes A, B, C | Class D |
|---|---|---|
| 20x | Program Certification, no sponsor | Program Certification coming in 2027 |
| Rev5 | Class A unavailable; B and C generally need a sponsor | Agency sponsor required |
- Classes A, B, C
- Program Certification, no sponsor
- Class D
- Program Certification coming in 2027
- Classes A, B, C
- Class A unavailable; B and C generally need a sponsor
- Class D
- Agency sponsor required
FedRAMP will not grant Program Certifications for both 20x and Rev5 for the same offering, so providers must pick one.
Sources
Related Articles
- What is FedRAMP 20X, and how is it different from Rev5?
- Does my SaaS company need FedRAMP to sell to federal agencies?
- What are FedRAMP 20X Classes A, B, C and D?
- Which FedRAMP 20X class does my product need?
- What are Key Security Indicators (KSIs) in FedRAMP 20X?
- What are the FedRAMP 2026 Consolidated Rules?
- What does continuous validation mean in FedRAMP 20X?
- What's the difference between FedRAMP and SOC 2?
- Does our SOC 2 or ISO 27001 work count toward FedRAMP?