FedRAMP 20x, Visually: Classes, KSIs, Deadlines and Cost
Published November 6, 2026
By Kelvin O. Medina
Last checked November 6, 2026 against fedramp.gov (Consolidated Rules for 2026, notice NTC-0014, RFC-0033 and RFC-0036). We update this page when the rules change.
FedRAMP changed more in 2026 than in the decade before it. Low, Moderate and High are now Classes A to D. “Authorized” is now “certified.” And the new 20x path lets a cloud company get certified without an agency sponsor.
This guide explains the new rules in seven visuals, with every requirement linked to its source on fedramp.gov.
Already certified? Jump to the deadlines: new vulnerability rules apply from December 7, 2026.
FedRAMP 20x vs Rev5: 20x proves security with measurements, not documents
Rev5 is now the legacy path. You find an agency sponsor, describe every NIST SP 800-53 control in a System Security Plan, and an assessor checks it at a point in time. It suits services that run their own infrastructure.
20x is for cloud-native services built on FedRAMP-certified infrastructure. You prove Key Security Indicators (KSIs) with measurements your own tools produce, publish them as JSON, and FedRAMP certifies you directly. No sponsor needed.
Figure 1
Same goal, different machine
The new vocabulary in one table
| You used to say | Under the 2026 rules |
|---|---|
| FedRAMP Authorized | FedRAMP Certified |
| Low / Moderate / High | Class B / Class C / Class D (plus a new entry-level Class A) |
| System Security Plan (SSP) | Security Decision Record (SDR), human-readable + JSON |
| Agency sponsor | Program path (no sponsor) for 20x; Agency path remains for Rev5 |
| FedRAMP Ready | Legacy since July 28, 2026; use 20x Class A instead |
| Monthly ConMon deliverables | Ongoing Certification Report every 3 months + persistent validation |
Source: Choose a Type · Certification Package Overview. Checked November 6, 2026.
Which FedRAMP class do you need? Usually the lowest one your customers accept
FedRAMP publishes its own decision workflow. Three questions get most companies to the right answer. Start with the first one: 20x isn’t available if you run your own infrastructure.
Figure 2
The FedRAMP class decision tree
FedRAMP’s own advice, in short
- No federal customer yet? Class A is “the simplest way to get FedRAMP Certified to obtain a customer.”
- Customers already asking? Pick the lowest class that meets their requirement.
- Thinking of C or D? Don’t go straight there unless an agency contract requires it.
Source: Choose a Class · 20x Class A rules · RFC-0033. Checked November 6, 2026.
FedRAMP 20x Classes A to D: your class sets how much you automate, not how secure you are
Your class sets how much you automate, how much you share and how fast you must react. It doesn’t rate how secure you are. Class C is highlighted because it’s the class most agencies will ask for.
| Requirement | Class AMarket entry · new | Class BReplaces Low | Class CReplaces Moderate | Class DReplaces High |
|---|---|---|---|---|
| Built for | Mature commercial products with SOC 2 Type II entering the federal market | Small-scale or light-use services | Common enterprise and important government services | Mission-critical services |
| Available as 20x? | Yes, since Aug 3, 2026 | Yes, since Aug 31, 2026 | Yes, since Aug 31, 2026 | Rev5 today; 20x pilot proposed (RFC-0036) |
| Entry requirement | SOC 2 Type II, GovRAMP or Rev5/Ready within 12 months | Fresh independent assessment | Fresh independent assessment | 20x Class C held 6 months with no corrective action; hosted on Class C or D IaaS/PaaS Proposed |
| KSIs required | 7 | 41 (5 more optional) | All 46 | 46 + 10 new Proposed |
| Automated checks per KSI | Not required | At least 1 Should | At least 2 Must | At least 4 Proposed |
| KSI history at application | Optional | 30-day + up to 1-year summary Should | 6 months minimum; daily data up to 1 year Must | Data every 4 hours, up to 1 year Proposed |
| Independent assessment | Optional at application; annual afterward | Within 3 months before applying | Within 3 months before applying | Rev5 assessment today |
| Package refresh | Every 3 months Should | Every month | Every 2 weeks | Every week |
| Quarterly review meeting | May | Should | Must | Must |
PROPOSED = from RFC-0036; may change. Rules: FRC-CLA-ASF FRC-CLA-MFR FRC-CSX-VVK FRC-CSX-MOT SDR-CSX-KMT FRC-APP-FIA IVV-CSX-AIA CPO-CSX-CPM CCM-QTR-MTG
Class D: what RFC-0036 proposes
Class D (the old High) is Rev5 only today. RFC-0036 proposes the rules for a 20x Class D pilot. Expect a high bar:
- Class C first. Hold 20x Class C for 6 months with no corrective action. Pilot applicants need Class C, but not the 6 months.
- Certified hosting. Run on Class C or D certified infrastructure.
- More automation. At least 4 automated checks per KSI, 10 new KSIs, and metrics every 4 hours.
- Data by API. The whole machine-readable package served through an API.
- Post-quantum status. Document where your encryption stands on post-quantum algorithms.
Pilot dates: apply December 1–4, 2026 (Class C already in hand, 10 places). Draft package due February 17, 2027; final package March 17, 2027.
Rules: FRC-CLD-PCD FRC-CLD-CCH SDR-CSX-KMT CDS-CSX-API CMU-CSO-PQS · Pilot: RFC-0033
Source: Class A and Class C certification rules · RFC-0036 (Class D, proposed). Checked November 6, 2026.
FedRAMP deadlines: the first hard date is December 7, 2026
The 20x pipelines are open. Three dates matter most from here:
- December 7, 2026: new vulnerability rules become mandatory for every certified offering.
- January 1, 2027: the 2026 rules become mandatory for everyone.
- June 11, 2027: last day to apply for a new Rev5 certification.
Figure 3
The FedRAMP transition timeline
Source: Important Dates · Notice NTC-0014 · RFC-0033. Checked November 6, 2026.
All 46 FedRAMP 20x KSIs: Class A needs 7, Class C needs all 46
A KSI is a security outcome you prove with live measurements instead of a written description. Each one maps back to NIST SP 800-53 controls. In the chart, each square is one KSI.
Figure 4
46 KSIs, 10 themes, and which class needs which
The 7 Class A KSIs
- Reviewing All Training
KSI-CED-RAT - Logging Changes
KSI-CMT-LMC - Restricting Network Traffic
KSI-CNA-RNT - Automating Account Management
KSI-IAM-AAM - Adopting Passwordless Methods
KSI-IAM-APM - Reviewing Incident Response Procedures
KSI-INR-RIR - Securing Information
KSI-SVC-SIN
The full list by theme
- Cybersecurity Education (1): Reviewing All Training
- Change Management (4): Logging Changes · Redeploying vs Modifying · Reviewing Change Procedures · Validating Throughout Deployment
- Cloud Native Architecture (8): Defining Functionality and Privileges · Enforcing Intended State* · Implementing Best Practices · Minimizing Attack Surface · Optimizing for Availability · Restricting Network Traffic · Reviewing Protections · Using Logical Networking
- Identity & Access Management (6): Automating Account Management · Adopting Passwordless Methods · Ensuring Least Privilege · Authorizing Just-in-Time · Securing Non-User Authentication · Responding to Suspicious Activity
- Incident Response (3): Generating After Action Reports · Reviewing Incident Response Procedures · Reviewing Past Incidents
- Monitoring, Logging & Auditing (5): Authorizing Log Access* · Evaluating Configurations · Logging Event Types · Operating SIEM Capability · Reviewing Logs
- Policy & Inventory (5): Generating Inventories · Reviewing Executive Support · Reviewing Investments in Security · Reviewing Security in the SDLC · Reviewing Vulnerability Disclosures
- Recovery Planning (4): Aligning Backups with Objectives · Aligning Recovery Plan · Reviewing Recovery Objectives · Testing Recovery Capabilities
- Supply Chain Risk (2): Mitigating Supply Chain Risk · Monitoring Supply Chain Risk
- Service Configuration (8): Automating Configuration Management · Automating Secret Management · Evaluating and Improving Security · Preventing Residual Risk* · Removing Unwanted Data* · Securing Information · Validating Communications* · Validating Resource Integrity
* Optional at Class B, required at Class C. Older articles quoting 56 or 61 KSIs are using 2025 pilot counts.
Source: Key Security Indicators · class views A, B, C. Checked November 6, 2026.
How to get FedRAMP 20x certified, step by step
The order we work in with clients preparing for Class B or C. The rule behind each step is listed under it.
Step 1: Confirm type, class and boundary
Pick 20x or Rev5, your target class, and what’s in scope. You can’t pursue both types for the same offering.
FRC-CSO-FCP · FRC-CSO-POP · MAS
Step 2: Get listed in the Marketplace
You must be listed before you apply. While listed, post progress every quarter and schedule an assessment within 2 years.
FRC-APP-MLF · MKT-IIP-DCP · MKT-IIP-DLA
Step 3: Map your tools to KSIs and automate
Line up cloud, identity, logging and CI/CD against each KSI, then automate the checks. Start now: Class C needs 6 months of history.
FRC-CSX-VVK · FRC-CSX-MOT
Step 4: Build the package and trust center
Write the Overview and Security Decision Record, in both readable form and valid JSON, and stand up a trust center.
FRC-CSO-PKG · FRC-CSO-JSN · CDS-CSO-UTC
Step 5: Independent assessment
A FedRAMP Recognized assessor finishes it within 3 months before you apply (B and C). Older ones can be refreshed up to 9 months.
FRC-APP-FIA · FRC-APP-USA
Step 6: Apply yourself
Submit the form with a package verified in the last 7 days. Advisors can help prepare, but can’t apply for you.
FRC-APP-AFC · FRC-APP-FCP · FRC-APP-NTP
Source: Marketplace Listing · 20x Class C certification rules. Checked November 6, 2026.
The 20x certification package replaces the SSP with three living documents
A 20x package has three parts: an overview of your service, a Security Decision Record showing how you meet each rule, and an Ongoing Certification Report. The Security Decision Record replaces the old System Security Plan, and you keep it current rather than rewriting it each year.
Figure 5
Anatomy of the package, and where it lives
You also publish basic listing details in readable form and JSON: your FedRAMP ID, service description, contacts, secure configuration guidance, next report date and current assessor.
Rules: FRC-CSO-PKG SDR-CSX-KSI CDS-CSO-PUB
Source: Certification Package Overview · Security Decision Record · Certification Data Sharing. Checked November 6, 2026.
Staying certified: the clocks tighten with every class
This is the part most teams underestimate. Certification comes with fixed deadlines, and they tighten as the class goes up. Shorter bars mean less time.
Figure 6
How long you have, by class
Changes need notice, not approval
Significant changes no longer wait for FedRAMP sign-off. You notify instead:
| Type of change | When to notify |
|---|---|
| Routine recurring | No notice needed |
| Adaptive | Within 10 business days after you finish |
| Transformative | 30 business days before you start, 10 before, and within 5 after |
Two more recurring obligations
- Every 3 months: verify non-machine resources such as policies and people processes, at every class.
- Every year: an independent assessment covering all applicable KSIs.
Rules: SCN-ADP-NTF SCN-TRF-NIP SCN-TRF-NFP SCN-TRF-NAF VDR-TFR-NMV IVV-CSX-AIA
Source: Incident Evaluation and Communication · Vulnerability Detection and Response · Significant Change Notification. Checked November 6, 2026.
FedRAMP 20x cost: the assessment is predictable, readiness is not
FedRAMP publishes no prices, but calls 20x the fastest and cheapest way into the federal market. Your budget has two parts:
- The independent assessment is fairly predictable by class.
- Readiness isn’t. It depends on how much of your product and infrastructure has to change.
Figure 7
Independent assessment: typical market ranges by class
Why readiness has no price on this page
Readiness is three kinds of work, and only the first is predictable.
Predictable
Compliance engineering
Mapping your tools to KSIs, automating the checks, writing the package and setting up the trust center. Grows with class: 7 KSIs at A, 41 at B, 46 at C.
The swing factor
Remediation
Code and infrastructure changes where a KSI can’t be met today, like passwordless login or central change logging. A few tickets, or a quarter of engineering.
Often forgotten
Tooling and upkeep
Higher-tier tool plans for API access, MFA priced per seat, and the recurring work after certification.
Any readiness price given before someone looks at your code and tooling is a guess. A gap assessment turns it into a list of what must change, by KSI, and a real quote.
Basis: FedRAMP publishes no prices. Ranges are ControlSolid planning estimates for the independent assessment, not quotes · Checked November 6, 2026
What this means for your starting point
You have SOC 2 Type II
Class A is built for you
Your report must be under 12 months old. You’ll share the full report and any bridge letter. Then plan the climb to B or C.
You were FedRAMP Ready
Ready still counts, for now
Ready is closed to new submissions, but a designation from the last 12 months qualifies you for Class A.
You hold Rev5
20x is a new program, not an edit
First, the December 7 vulnerability rules. Moving to 20x later means building KSI validation from scratch, not converting your SSP.
You’re starting from zero
Pick the fastest prerequisite
Class A needs a qualifying certification. Earn SOC 2 Type II first, or go straight to Class B with a full assessment.
Source: 20x Class A rules (FRC-CLA-ASF) · Important Dates. Checked November 6, 2026.
Objections we hear about FedRAMP 20x, answered
These are the assumptions that cost companies months. Each answer points to the rule behind it.
| What people say | What the rules say |
|---|---|
| “20x is just a faster Rev5” | It is a different machine. There is no sponsor, KSIs are proven by automated measurements, and the package is JSON. It is not always faster: Class C needs 6 months of KSI history and an assessment within 3 months of applying, and 20x isn’t available if you run your own infrastructure.FRC-CSX-MOT · FRC-APP-FIA |
| “We have ISO 27001, so we qualify for Class A” | No. Class A accepts SOC 2 Type II, GovRAMP, or FedRAMP Rev5 (including Ready) completed within the past 12 months.FRC-CLA-ASF |
| “Our consultant or assessor can file the application” | No. You must apply yourself. Advisors and assessors can help prepare the materials, but not submit them for you.FRC-APP-NTP |
| “We’re already Rev5 certified, so 20x doesn’t affect us” | The December 7, 2026 vulnerability rules apply to every certified offering, Rev5 included. Moving to 20x later means building KSI validation from scratch, not converting your SSP.NTC-0014 |
| “Let’s go straight to Class C to be safe” | FedRAMP advises against it unless an agency contract requires it. Class C needs all 46 KSIs, at least 2 automated checks per KSI, and 6 months of history. Start at the lowest class your customers accept.Choose a Class · FRC-CSX-VVK |
Source: Choose a Class · Choose a Type · Notice NTC-0014. Checked November 6, 2026.
FedRAMP 20x FAQ
Official references
Rules and references checked November 6, 2026. Applicability and revisions are rechecked for each engagement.
- Consolidated Rules for 2026: Important Dates
- Notice NTC-0014: VDR and VER mandatory December 7, 2026 (CISA BOD 26-04)
- RFC-0036: 20x Class D Cloud-Hosted Pilot Requirements and RFC-0033: Phase 4 tracks and pilot timeline
- Choose a Class and Choose a Type (20x vs Rev5)
- 20x Class A certification rules (FRC-CLA) and 20x Class C certification rules
- Key Security Indicators with class views A, B and C
- Certification Package Overview, Security Decision Record and Certification Data Sharing
- Collaborative Continuous Monitoring, Incident Evaluation and Communication, Vulnerability Detection and Response and Significant Change Notification
- Marketplace Listing
Find your gaps before your assessor does
Our gap assessment maps your controls, tools and code to your target class and shows exactly what has to change. Already certified? We can check your vulnerability program before December 7.
Related service: FedRAMP 20x Readiness & GRC Engineering →