FedRAMP 20x Explained for Agencies: Classes, Key Dates and Your ATO

FedRAMP 20x is the new certification path from FedRAMP, the General Services Administration (GSA) program that authorizes cloud services for federal use. Instead of a large document package reviewed at one point in time, providers show their security through Key Security Indicators (KSIs) that can be validated by machine and reported continuously. In FedRAMP's words, "Continuous evidence of what is happening is stronger than a policy saying it should happen."

The direction comes from Office of Management and Budget (OMB) Memorandum M-24-15, issued July 25, 2024 under the FedRAMP Authorization Act. FedRAMP announced the Consolidated Rules for 2026 on June 25, 2026, which made 20x widely available rather than a pilot. The rollout has five phases: two pilots in 2025 and early 2026, wide-scale adoption now under way, a Class D pilot and the end of new Rev5 certifications. FedRAMP notes that its future dates are estimates, "not firm commitments."

A certification class describes how much assurance information a provider commits to give federal customers, not how secure the service is. "Certification Classes indicate the level of assurance provided, not the level of security or protection provided." Classes apply to both Rev5 and 20x certifications; the type (Rev5 or 20x) and the class are separate labels.

This is the point vendor-focused summaries skip, and it is the one that matters for an authorizing official. FedRAMP's agency guidance says agencies "should not treat Certification Classes as one-for-one replacements for Low, Moderate, or High impact levels," and should "categorize their own information system first, then review the FedRAMP Certification Package."

Cost is part of the design. FedRAMP's agency guidance says lower classes will generally be cheaper to procure and operate, and that many providers with strong security programs choose to invest only in Class A or B to keep government pricing aligned with commercial pricing. A reflexive Class C minimum can narrow competition without matching the system's actual risk.

Under 20x, Classes A, B and C are open now: the Class A pipeline opened August 3, 2026 and Classes B and C followed at the end of August. Class D is planned for a Phase 4 pilot. The proposed pilot requirements, RFC-0036, would require a full, non-pilot 20x Class C certification to join, would add documentation of post-quantum cryptography status and would introduce foreign ownership, control or influence (FOCI) indicators. On FOCI, FedRAMP "will make no determinations on FOCI itself"; that judgment stays with agencies.

The risk decision. FedRAMP's Agency Use rules state that agencies "MUST complete the Authorization to Operate process for federal information systems" that use FedRAMP certified services (AGU-USE-ABU). A 20x certification is evidence for your Authorization to Operate (ATO), not a substitute for it.

The rules add obligations an authorizing official should put on a checklist. Agencies must notify FedRAMP when they authorize a certified service (AGU-AGC-NAA), review the provider's Secure Configuration Guides and set the relevant security settings (AGU-USE-RSG), and collaborate with FedRAMP when an agency security determination conflicts with the certification package (AGU-USE-RCF). If an Ongoing Certification Report or quarterly review raises concerns serious enough that they would likely lead to rescinding the ATO, agencies must tell FedRAMP (AGU-USE-NFC). Agencies should review each Ongoing Certification Report and designate a senior information security official to do it, and their compliance tools must be able to produce and ingest machine-readable artifacts, at minimum OSCAL and JSON.

Two limits will surprise some reviewers. Agencies must not require additional information or materials from a certified offering unless the agency head or a delegate determines there is a demonstrable need and notifies FedRAMP; clarifying questions are exempt (AGU-AGC-NAR). And agencies should not authorize a Class A service for more than 12 months unless the provider is actively pursuing Class B, C or D (AGU-USE-CLA).

From our delivery teams: Before award, have the person who will review Ongoing Certification Reports read the latest one in the provider's certification package. How a provider reports changes and open findings tells you more about the years ahead than the certification letter does.

These dates bind providers and their certifications, but each one changes what agencies will see in proposals and packages. From FedRAMP's deadlines page and launch announcement:

FedRAMP's October 8, 2026 review of fiscal year 2026 reported 92 new certifications (66 Rev5 and 26 20x), 538 certified offerings in total and 760 new agency ATOs or authorizations to use. Its goals for fiscal year 2027 include initial assessment decisions "within 30 days of application" and a published Agency Cloud Use Framework, built by the FedRAMP Board and Technical Advisory Group, to guide agency adoption under 20x.

Wording written around impact levels needs a second look. Many templates ask for a service that is, for example, FedRAMP Moderate authorized. Under the new rules a provider may answer with a type and a class, and the class alone does not tell you whether it fits your system's categorization.

FedRAMP's Agency Use rules also say agencies must not require cloud offerings to obtain or maintain a specific FedRAMP Certification Type (Rev5 or 20x) or Certification Path unless the agency head or an authorized delegate determines there is a demonstrable need and notifies FedRAMP (AGU-AGC-TPP). How that applies to a given solicitation, and how to phrase the requirement, is for the contracting officer and the agency's security and legal reviewers to decide. Raise it before the next cloud buy, not during evaluation.

Start with the work tied to provider deadlines. First, inventory your cloud authorizations: each service, its certification type and class, and the categorization of the agency system that uses it. That list shows which Rev5 providers you depend on, and those are the vendors to ask about their transition plans; FedRAMP has told providers without significant Rev5 progress and a secured agency sponsor to pivot to 20x "immediately."

Then work with your contracting and security offices on solicitation language, review checklists and ATO templates that still treat Low, Moderate or High as FedRAMP designations. Name who will read Ongoing Certification Reports and attend quarterly reviews, confirm your compliance tools can ingest OSCAL and JSON, and flag any Class A authorization approaching the 12-month mark.

Keeping agency-side evidence current matters as much as the provider's; our post on accelerating federal ATO with DevSecOps covers that work, and this overview of federal cloud adoption gives the broader policy context. Pyramid's cloud services team supports agencies with cloud migrations and FedRAMP compliance work.