FedRAMP 20x Class C: Full vs. Pilot, and How to Tell in the Marketplace

FedRAMP says it granted "the first ever CR26-compliant FedRAMP 20x Class C Certification" on October 29, 2026, to the first offering "that addressed all of the rules" developed since 20x launched. The announcement doesn't name the product. The Marketplace shows it as the one Class C listing with type 20x, on the Program path, with General Services Administration (GSA) and Department of Agriculture authorizations listed.

FedRAMP adds that the product was already in agency use on a pilot Class C certification, so this is one offering moving from pilot to full status.

Most certified offerings are still Rev5, and full 20x certifications are a small group. We counted these from the Marketplace's own listing data on November 4, 2026.

Another 98 20x listings were in earlier stages, 95 of them in Initial Implementation. That matches FedRAMP's "nearly a hundred."

All 26 pilot listings show the same status as full ones, FedRAMP Certified. The Marketplace began displaying pilot certifications publicly on October 21, 2026 to separate them, so the type field is the one to read. Don't confuse it with "Class A (Pilot)," a label FedRAMP's Marketplace guide uses for a class that has no 20x Pilot listings in the table above.

The agency count won't show adoption. Every pilot listing names GSA as its only authorization, while FedRAMP says pilot products have "already seen wide-scale usage across government" and that it "lacks the necessary data at this time" to show that in the Marketplace.

The difference is which rules apply and what assurance comes with them. FedRAMP's post doesn't say any pilot offering is less secure, and it describes the CR26 rules as bringing "significantly improved assurance expectations." It says separately that classes "are not aligned to how secure a cloud service offering is," so the Class C label doesn't settle that either.

On the pilot side, FedRAMP's 20x page says Phase 1 "focused nearly entirely on Key Security Indicators," and Phase 2 tested those indicators for Moderate. Participants received limited certifications "with an agreement to incorporate the (much more complicated) final rules once they were completed."

On the full side, a new Class C application must meet all applicable CR26 rules. Those include at least 2 automated methods for each indicator (FRC-CSX-VVK), an independent assessment from the previous 3 months (FRC-APP-FIA) and another at least once a year (IVV-CSO-FIA). That doesn't mean a given pilot provider lacks these. We didn't find a published comparison by provider, so the answer sits in each certification package.

FedRAMP says "all active FedRAMP Certified cloud service offerings MUST follow all applicable Consolidated Rules for 2026 or corrective action will be requested" by January 1, 2027. We found no separate schedule for pilot listings, so as we read it the dates below include them; we also didn't find the pilot agreements published, so confirm with FedRAMP if it matters to your decision. Missing an adoption date means a corrective action plan, and missing the end of a grace period means losing certification, with public notice, until the provider follows the rules.

Three other rulesets (Addressing FedRAMP Communication, Secure Configuration Guide and Marketplace Listing) have dates that have already passed.

February 2028 is the outer limit, not the date to plan around. On an annual assessment cycle, the first assessment after January 1, 2027 could arrive during 2027. The 20x listings' Marketplace data didn't show an annual assessment date on November 4, so look for it in the package.

Start with the package, because FedRAMP limits what agencies can demand on top of it. AGU-AGC-NAR says agencies "MUST NOT require additional information or materials" beyond FedRAMP's requirements unless the agency head or a delegate determines a demonstrable need and notifies FedRAMP, though it "does not apply to seeking clarification or asking general questions about FedRAMP Certification Data." AGU-AGC-NAI requires notifying FedRAMP after requesting anything additional. Where a question crosses that line is for counsel.

1. Categorize your system first. FedRAMP says classes aren't one-for-one replacements for impact levels, even though Marketplace pages show "Class C (Moderate)." Our FedRAMP 20x explainer covers how classes work.
2. Record the type you reviewed in your Authorization to Operate (ATO) file: 20x or 20x Pilot.
3. Get the package. The upper-right corner of a listing shows how: a trust center, a contact, or a request form your authorizing official signs. Look for the last assessment date and which rulesets have been adopted, and ask clarifying questions about what you find.
4. Read the Third-Party Resources tab, added November 2, 2026. It separates FedRAMP Certified resources from others and gives a use case for each. Only 6 of the 34 certified 20x listings carried entries on November 4, and the MAS ruleset's January 1, 2027 date hasn't arrived, so an empty tab doesn't tell you either way. MAS-CSO-TPR is the rule on documenting those resources.
5. Finish the ATO. AGU-USE-ABU says agencies "MUST complete the Authorization to Operate process" for systems that use certified offerings. Our post on how long an ATO takes shows where that time goes.

The rules don't settle it. AGU-AGC-TPP says agencies "MUST NOT require" offerings to obtain or maintain a specific Certification Type or Path unless the agency head or a delegate determines a demonstrable need and notifies FedRAMP. FedRAMP defines Certification Type as "either Rev5 or 20x," yet the Marketplace displays "20x Pilot" in its Type field, and proposed RFC-0036 would require "a full non-pilot 20x Class C Certification" to join the Class D pilot. So the requirement may raise AGU-AGC-TPP, AGU-AGC-NAR or both. Whether it does is for the contracting officer and agency counsel to decide, so raise it before the solicitation is drafted.