FedRAMP 20x is FedRAMP's modern, cloud-native certification type, new in 2026, and it will replace Rev5. Rev5 is the legacy type, built on NIST SP 800-53 controls.
| FedRAMP 20x | FedRAMP Rev5 | |
|---|---|---|
| Best suited to | Cloud services built on FedRAMP-certified infrastructure or platforms | Standalone services the provider fully owns and operates |
| Agency sponsor | Not needed: FedRAMP certifies directly (Program Certification) | Typically needed (Agency Certification) |
| How security is shown | Key Security Indicators (KSIs), with more automated verification required at higher classes | Specified NIST SP 800-53 Rev. 5 controls |
| Classes available | A, B and C now; Class D expected in 2027 | B, C and D (no Class A) |
| Future | Becomes the standard path | No new certifications after June 11, 2027; existing ones active until at least December 31, 2028 |
- FedRAMP 20x
- Cloud services built on FedRAMP-certified infrastructure or platforms
- FedRAMP Rev5
- Standalone services the provider fully owns and operates
- FedRAMP 20x
- Not needed: FedRAMP certifies directly (Program Certification)
- FedRAMP Rev5
- Typically needed (Agency Certification)
- FedRAMP 20x
- Key Security Indicators (KSIs), with more automated verification required at higher classes
- FedRAMP Rev5
- Specified NIST SP 800-53 Rev. 5 controls
- FedRAMP 20x
- A, B and C now; Class D expected in 2027
- FedRAMP Rev5
- B, C and D (no Class A)
- FedRAMP 20x
- Becomes the standard path
- FedRAMP Rev5
- No new certifications after June 11, 2027; existing ones active until at least December 31, 2028
Class A is the entry point to 20x. It is open to providers that completed SOC 2 Type II, GovRAMP or FedRAMP Rev5 within the past 12 months, and who meet the Class A rules, including specified KSIs.
The 2026 rules also change the vocabulary for both types: "authorization" becomes Certification, impact levels (Low, Moderate, High) become Classes A to D, and "continuous monitoring" becomes Ongoing Certification.
Rev5 is changing too
Under the 2026 rules, Rev5 certification packages move from Word and Excel templates to machine-readable JSON. Vulnerability Detection and Response replaces traditional monthly scanning, and POA&Ms are replaced by a list of Accepted Weaknesses.
What it means for providers
Providers new to FedRAMP will usually look at 20x first, since it doesn't need an agency sponsor and Rev5 stops accepting new certifications on June 11, 2027. Rev5 remains the option for services that run their own infrastructure or need Class D, at least until 20x Class D becomes available in 2027. Providers already certified on Rev5 keep their certification until at least December 31, 2028, and FedRAMP advises them to start planning their move to 20x now.
Sources
Related Articles
- Does my SaaS company need FedRAMP to sell to federal agencies?
- What are FedRAMP 20X Classes A, B, C and D?
- Which FedRAMP 20X class does my product need?
- What are Key Security Indicators (KSIs) in FedRAMP 20X?
- What are the FedRAMP 2026 Consolidated Rules?
- What does continuous validation mean in FedRAMP 20X?
- What's the difference between FedRAMP and SOC 2?
- Does our SOC 2 or ISO 27001 work count toward FedRAMP?
- Do I need an agency sponsor for FedRAMP 20X?