FedRAMP is in the middle of the biggest overhaul in its history, and that overhaul is no longer theoretical. FedRAMP 20x issued its first certifications this fall, and Rev5 stops taking new applications in June 2027. Much of the FedRAMP certification advice still circulating describes a process FedRAMP is actively retiring.
UberEther has spent years helping agencies and ISVs through federal compliance infrastructure and certification. This guide covers what FedRAMP Certification requires as of November 2026: the rules, the paths open now, the deadlines ahead, and what to budget. For a broader primer, see our guide to FedRAMP compliance requirements.
What is FedRAMP Certification?
FedRAMP standardizes security assessment and ongoing oversight for cloud services used by federal agencies. It became law through the FedRAMP Authorization Act in the FY2023 NDAA (December 23, 2022), and OMB Memorandum M-24-15 (July 25, 2024) rebuilt the program under that authority.
FedRAMP now says “Certification” rather than “Authorization” to separate its decision from an agency ATO. FedRAMP certifies your cloud service offering; each agency still issues its own ATO to use it. Procurement teams check your status on the FedRAMP Marketplace.
“FedRAMP compliant” without a certification won’t satisfy most federal procurement requirements. Agency requirements are starting to vary, though. The VA, for example, has told vendors they don’t need FedRAMP Certification to compete, but may have to report 20x Key Security Indicator status after award.
The 2026 Consolidated Rules (CR26) and key FedRAMP deadlines
FedRAMP’s Consolidated Rules for 2026 (CR26), released June 24, 2026, replace long narrative documents with short, plain-language rulesets. They took effect July 4, 2026. The dates that matter now:
| Date | What happens |
|---|---|
| November 17, 2026 | Legacy FedRAMP Ready holders must convert to Class A (or before their annual assessment expires, whichever is later). |
| December 1, 2026 | Deadline to hold 20x Class C to join the 20x Class D pilot. |
| December 7, 2026 | Vulnerability Detection and Response and Vulnerability Evaluation and Reporting rulesets become mandatory. |
| January 1, 2027 | All new Rev5 applications must follow the new rules. |
| June 11, 2027 | Last day for new Rev5 applications. A complete package must already be submitted and in active review. The Lost Sponsor and Ready Conversion pipelines also close. |
| February 1, 2028 | Grace periods end. Offerings not following the rules lose certification. |
| December 31, 2028 | Existing Rev5 Certifications stay active until at least this date. FedRAMP plans to publish Rev5-to-20x transition paths by the end of FY27. |
All of these dates are subject to change based on guidance from FedRAMP, so check the official CR26 timeline before you plan around them.
FedRAMP 20x is live: the first Class A and Class C certifications
FedRAMP granted the first 20x Class A Certification on August 25, 2026, and the first full CR26-compliant 20x Class C on October 29 (FedRAMP). FedScoop identified the Class C recipient as Perplexity. Nearly 100 more products have started the process, and agencies are already using 20x-certified services.
In FY26, FedRAMP issued 92 new certifications (66 Rev5, 26 20x), ending the year with 538 certified offerings and 760 new agency ATOs or ATUs (FY26 review).
FedRAMP classes, types, and paths explained
Classes replace Low, Moderate, and High. They loosely align with NIST SP 800-53B baselines, not exactly:
| Class | Replaces | Notes |
|---|---|---|
| Class A | FedRAMP Ready (new tier) | Entry tier for rapid Marketplace entry |
| Class B | Li-SaaS and Low | |
| Class C | Moderate | Historically about 80% of certifications |
| Class D | High | The highest assurance level |
Types describe how you get certified:
- 20x is the modern type, processed directly by FedRAMP with no agency sponsor. FedRAMP steers services built on certified infrastructure or platforms here. Class A pipelines opened August 3, 2026; Class B and C opened August 31 (20x certification rules).
- Rev5 is the legacy type, still the only option today for self-hosted services or Class D. That is changing: FedRAMP’s FY27 goals include 20x rules for self-hosted and hybrid services. FedRAMP now advises providers without significant Rev5 progress and a guaranteed sponsor to pivot to 20x immediately. For what the change means for your architecture, read FedRAMP Rev. 5 vs. 20x: the architecture shift you can’t ignore.
Paths: 20x Classes A to C use the Program path (FedRAMP certifies directly). Rev5 Class D requires the Agency path. Two limited Rev5 Program pipelines, Lost Sponsor and Ready Conversion, are open only to providers with qualifying 2025 to 2026 progress, and FedRAMP won’t expand them.
If your playbook still centers the JAB or FedRAMP Ready, it’s out of date. The JAB path is gone, and Ready became “Legacy FedRAMP Ready” in July 2026.
Where FedRAMP 20x Class D stands
Class D is moving from roadmap to rules. RFC-0036 (October 15, 2026) proposes the pilot requirements:
- Hold 20x Class C for six months without corrective action before applying, unless FedRAMP grants an urgent-need exemption.
- The pilot skips the wait but is capped at 10 participants.
- Cloud-hosted Class D services must run on Class C or Class D certified infrastructure.
- Rev5 Class D holders keep their certification, but reaching 20x Class D means going through 20x Class C.
- Final rules land in the Consolidated Rules for 2027.
Where to start: FedRAMP Class A or higher
FedRAMP recommends most new entrants start with Class A, which requires a strong security program plus an external assessment completed in the past 12 months: SOC 2 Type II, GovRAMP, or prior FedRAMP Rev5 work, including FedRAMP Ready. Once you have a federal customer, you have 12 months to begin moving to Class B or higher. If your agency contracts already require Class C or D, start there instead.
What goes into a FedRAMP certification package now
The System Security Plan and its attachments are being replaced. A Rev5 package now centers on three pieces:
- Certification Package Overview: a concise summary of your offering, replacing the base SSP.
- Security Decision Record: a continuously maintained record of the security decisions you make.
- Secure Configuration Guide: how customers configure your service securely.
Other changes to plan around:
- Formats: Word and Excel templates give way to JSON (or optional OSCAL), populated by automation from real system data. Our FedRAMP 20x OSCAL implementation guide covers the mechanics.
- Organizational requirements: most FedRAMP-defined ones are gone; providers define their own.
- POA&Ms: replaced by a list of Accepted Weaknesses.
- FIPS 140: providers document where they use FIPS 140-3 validated modules so agencies can judge fit. Crypto module rules are still being refined (RFC-0035).
If you’re starting Rev5 now, build to the new format, or you’ll do the documentation twice.
FedRAMP 20x Key Security Indicators and Ongoing Certification
20x assesses outcomes, not narratives. Providers supply metrics through Key Security Indicators (KSIs). FedRAMP’s example: hundreds of real SAST results, and the code changes they blocked, say more than a paragraph about your scanning plan. We cover the shift in more depth in how FedRAMP 20x will transform federal software compliance.
That evidence has to stay current. A 20x Class C package must be refreshed at least every two weeks, and FedRAMP’s renamed “Ongoing Certification” covers far more than monthly scans (see continuous monitoring in FedRAMP 20x). Missing those requirements can cost you your certification. An independent assessment still anchors the process, and a package that doesn’t match the system will come back to you.
How to choose a FedRAMP independent assessor
A FedRAMP Recognized assessor is required for Class B, C, and D. FedRAMP treats Recognition and A2LA accreditation as a minimum bar and recommends getting proposals from two or three firms. When you compare them:
- Ask which 20x assessments they’ve taken through to certification.
- Get named assessors, not a team commitment.
- Review sample assessment reports and pen tester credentials.
- Remember that an assessor that helped you prepare as a consultant can’t also assess you, so plan for that early.
FedRAMP certification timelines and costs
Rev5: In our experience, the Agency path runs 6 to 12 months at best and 9 to 18 months typically. Documentation gaps, remediation cycles, and sponsor responsiveness drive the difference. FedRAMP’s own review is no longer the bottleneck; its FY27 goal is initial decisions within 30 days of application.
20x: FedRAMP calls 20x the fastest, cheapest path for existing commercial services. With only a handful of certifications issued, treat any 20x estimate, including ours, as a planning range.
DIY year-one costs for Rev5:
| Baseline | Year-one cost | Assessment fees alone | Ongoing annual cost |
|---|---|---|---|
| Class C (Moderate) | $500K to $1.5M | $100K to $300K | $200K to $500K |
| Class D (High) | $1M to $3M or more | $200K to $500K | $500K to $1M |
Year-one figures include internal labor, assessment, consulting, tooling, and remediation. Fully loaded Moderate programs often land between $925K and $2.9M.
Internal labor is the most underestimated line, regularly 40 to 60 percent of year-one cost in our experience. The new rules add another category: building the automation that keeps package data and KSIs current.
Pitfalls that stall FedRAMP programs
- Starting Rev5 without an exit plan. If you need Rev5 today (for Class D, say), plan your move to 20x from day one.
- Missing December 7. The vulnerability rulesets need evidence pipelines and detection and response processes that take months to build. If you haven’t started, start now.
- Maintaining documents by hand. FedRAMP expects package data and KSIs generated from real system data (see FedRAMP 20x at machine speed with OSCAL). Boilerplate that could describe any system still draws findings that add weeks or months.
- Assuming findings will be minor. Higher-class assessments often surface architectural gaps, commonly incomplete MFA coverage and unclear encryption documentation. Each must be fixed and re-evidenced, which can add two to six months.
- Waiting on Class D. If customers will need 20x Class D, the six-month Class C clock is the long pole. Waiting for final Class D rules before starting Class C adds six months.
- Under-resourced sponsors. On the Rev5 Agency path, a strong package can still stall with a stretched Authorizing Official. Secure a well-resourced sponsor early and keep them engaged.
FedRAMP 20x FAQ
Is FedRAMP 20x replacing Rev5?
For new certifications, yes. FedRAMP stops accepting new Rev5 applications on June 11, 2027. Existing Rev5 Certifications stay active until at least December 31, 2028, and FedRAMP plans to publish transition paths to 20x by the end of FY27.
Do I need an agency sponsor for FedRAMP 20x?
No. 20x Classes A through C use the Program path, where FedRAMP certifies your offering directly. Rev5 Class D still requires an agency sponsor on the Agency path.
What is the difference between FedRAMP Class C and Moderate?
Class C replaced the Moderate baseline, which historically covered about 80% of certifications. Under 20x, Class C is assessed on Key Security Indicators, and the package must be refreshed at least every two weeks.
How long does FedRAMP certification take?
On the Rev5 Agency path, 9 to 18 months is typical in our experience. 20x is designed to be faster, but with only a handful of certifications issued, treat any 20x timeline as a planning range.
How much does FedRAMP certification cost?
A DIY Rev5 Class C (Moderate) program typically costs $500K to $1.5M in year one. Class D (High) runs $1M to $3M or more. Internal labor is usually the largest and most underestimated share.
Can I get FedRAMP 20x Class D today?
Not yet. RFC-0036 proposes a pilot capped at 10 participants, with final rules expected in the Consolidated Rules for 2027. Until then, Class D runs through the Rev5 Agency path.
Plan your FedRAMP path for 2027
The calendar now does much of the deciding. A Rev5 package started today has about seven months to be complete and in active review before June 11, 2027. A team that will need 20x Class D has to hold 20x Class C for six months first. The vulnerability rulesets due December 7 take months of pipeline work to evidence, and every one of these clocks starts well before an assessor arrives.
The right path differs by offering. A SaaS product on certified infrastructure may reach the Marketplace fastest through 20x Class A, then move to Class C once a federal customer signs. A self-hosted service, or one whose buyers need Class D now, may still belong on the Rev5 Agency path, with a move to 20x planned from the start. ISVs that also need DoD Impact Level authorizations face a different order of work again.
Three questions settle most of it:
- Which class do your agency customers need, and when?
- Will you build from scratch or inherit from a certified platform?
- Can your team produce the automated evidence 20x expects?
UberEther runs its own FedRAMP High and DoD IL5 environment, and our FedRAMP advisory team helps ISVs answer those questions for their specific offering. We help providers choose between 20x and Rev5, build the automation behind Key Security Indicators, and prepare for 20x Class C and Class D.
If you’re weighing your options before the 2027 deadlines, book a FedRAMP path consultation. We’ll work through the class, type, and path that fit your offering and build a timeline backward from the dates that apply to you.