FedRAMP 20x Knowledge Authority

FedRAMP 20x status

Each figure is copied from a sourced record. Counts that are not in those records are left off.

Certification class availability

Class A: pilot; Class B: in transition; Class C: in transition; Class D: proposal-stage

Last verified 2026-09-27. FedRAMP Certification reference (classes, KSI metrics window)

Next major deadline

2027-01-01: Active 20x offerings must follow CR26 (or corrective action)

Last verified 2026-10-11. FedRAMP path & transition deadlines (Important Deadlines)

Rev5 transition deadline

2027-06-11: No new applications for FedRAMP Rev5 Certification

Last verified 2026-10-11. FedRAMP path & transition deadlines (Important Deadlines)

Most recent official update

2026-10-11: Official CR26 overall dates re-verified

Last verified 2026-10-11. FedRAMP path & transition deadlines

Recent certification activity

2026-06-24: Security Decision Record reference (replaces the SSP on the 20x path)

Last verified 2026-09-27. Security Decision Record (replaces the SSP)

What changed from Rev5

FedRAMP 20x keeps the underlying security expectations but changes how a cloud service demonstrates them:

• The Security Decision Record (SDR) is the core package artifact under 20x, in place of the traditional System Security Plan (SSP).
• Key Security Indicators (KSIs) — 10 families and 46 indicators under CR26 — express measurable security capabilities that are validated by automated methods.
• Authorization status is expressed through Certification and Classes A-D.
• Monitoring is collaborative and continuous, rather than only a monthly document delivery.

Certification classes at a glance

FedRAMP uses Certification and Classes A-D for package baselines. During the transition through December 31, 2026, Class B (Low), Class C (Moderate) and Class D (High) pair the new class with the earlier impact label; Class A is a pilot. Certification does not replace an agency's own authorization to operate (ATO). Class A and Class D specifics continue to evolve — confirm the current class definitions on FedRAMP.gov before relying on them.

How certification works

The path runs from determining applicability and the right class, to implementing requirements and KSIs, establishing the SDR and persistent validation, gathering evidence, an independent assessment by a FedRAMP Recognized Independent Assessor (the role formerly called a 3PAO) where required, resolving findings, and the certification decision. Each stage is covered in the Get Certified guides.

Assessor skills training

A separate self-serve catalog teaches people to read official 20x rules, grade labeled test evidence, and write replayable findings. Completing a course yields an scm.cc training certificate only. Official Recognition of an independent assessment service requires A2LA accreditation (REC-IAS-ACC) and a Marketplace listing — this portal cannot make someone an assessor.

Open the assessor-skills catalog

Explore the knowledge hub