FedRAMP 20x 3 min read

    Where do I start with FedRAMP 20X?

    The first step is to confirm that FedRAMP 20X is the right fit for the product, and then to work through FedRAMP's preparation steps before starting the actual security work. FedRAMP is the U.S. government's security program for cloud software, and FedRAMP 20X is its newest version, introduced in 2026. FedRAMP lays out the journey in two phases: a Preparation Phase, where a company makes its key decisions, and an Implementation Phase, where it does the work of meeting the requirements.

    Check that FedRAMP 20X fits:

    FedRAMP 20X is the recommended version for cloud-native products built on cloud platforms that are already FedRAMP certified. The older version, Rev5, is the only option for products that run on the company's own infrastructure, or that need Class D, the highest of FedRAMP's four certification levels. FedRAMP expects to pilot Class D under FedRAMP 20X in late 2026 and to make it a formal option in early 2027.

    The preparation steps:

    The Preparation Phase has five steps, in this order:

    1. Find an advisor: An advisor is a private firm that helps companies understand and work through federal security requirements.
    2. Choose a certification path: The path determines who grants the certification. FedRAMP 20X uses what FedRAMP calls Program Certification, which means FedRAMP certifies the product directly, without a federal agency having to sponsor it.
    3. Choose a certification class: FedRAMP's four classes, A through D, set how much proof of security a company gives federal agencies, from the least at Class A to the most at Class D. Most companies new to FedRAMP should start with Class A, and FedRAMP's advice is to "never plan to go straight to Class D."
    4. Choose a certification type: The type is the version of FedRAMP: FedRAMP 20X or the older Rev5.
    5. Move into the Implementation Phase: This is where a company confirms exactly which parts of its product the certification will cover, fixes any gaps and prepares evidence.

    Where Class A fits:

    Class A is designed for commercial products that already have a SOC 2 Type II report, a widely used commercial security audit, and a mature security program. To qualify, a company must have completed a SOC 2 Type II audit, a GovRAMP certification (a similar program for state and local governments) or a FedRAMP Rev5 certification within the past 12 months. Rev5's earlier FedRAMP Ready status, given to products that passed a formal readiness review, also counts.

    What comes next:

    The first step of the Implementation Phase is getting listed on the FedRAMP Marketplace, FedRAMP's public online directory of cloud products. A listing requires three things: a public web page with information about the product, a machine-readable JSON file (a structured data file that software can read) and a basic FedRAMP-compatible trust center. A trust center is a secure website, run by the company, where approved federal agencies can view the product's security and certification information.

    Sources

    1. FedRAMP.gov: Getting Started: The Preparation Phase
    2. FedRAMP.gov: Choose a Type
    3. FedRAMP.gov: Choose a Path
    4. FedRAMP.gov: Choose a Class
    5. FedRAMP.gov: FedRAMP Certification (20x rules)
    6. FedRAMP.gov: Getting Listed

    Related Articles