FedRAMP 20x is the government's new way to clear a cloud service for federal agencies. Instead of a big point-in-time audit against a fixed control list, a provider sets its own security goals, measures them continuously, and shows agencies the evidence. FedRAMP says the full rules for FedRAMP 20x Certification are finalized for Class A, Class B and Class C, available now, and the program is in Phase 3. FedRAMP 20x.
The classes
| Class | For | Status |
|---|---|---|
| Class A | Cloud services with mature security and compliance programs entering the federal market. A small amount of information up front and a small subset of ongoing monitoring and reporting. | Available now (rules) |
| Class B | Common small-scale or light-use services an entire agency is unlikely to use for important work. | Available now (rules) |
| Class C | Common enterprise services likely used across an entire agency, or services that provide important government services. | Available now (rules) |
| Class D | To be developed. | Phase 4 |
What changed
- Evidence over paperwork. FedRAMP's principles: transparency, flexibility, accountability, accuracy and automatic validation. "Security should be continuously enforced, monitored, and reported," not staged for a point-in-time audit.
- Key Security Indicators. The pilot found they can show security posture in near real time, replacing static yearly manual assessments.
- Fit to the use. A public website and a medical records app need different things; 20x lets agencies match a service's security goals to the mission instead of one pass-or-fail verdict.
What the pilot showed
Phase 1 ran from April through September 2025. FedRAMP received 26 complete packages, completed 13 reviews in that phase, and issued the first pilot authorizations in late July 2025. Two lessons stand out for SaaS teams: providers needed deep engagement from their engineering teams, and no participant actively reused an existing framework assessment such as SOC 2. GRC tools were the largest group of submissions.
FedRAMP, FedRAMP 20x and the consolidated rules for 2026. Checked October 10, 2026. FedRAMP notes its future dates are estimates, so none are listed here.
Next steps for a SaaS team
- Read the class rules for the class that fits how agencies would use you, before buying anything.
- Continuous monitoring is the core of 20x: FedRAMP ConMon software compared.
- Already doing SOC 2? Compliance tool head-to-heads and the compliance hub.
Want a second set of eyes on which class and which tools? Text PJ, an operator in Solana Beach. He helps teams pick and set up tooling; he isn't a 3PAO or an assessor.
Need a human?
This page is built every morning from public data by SideGuy, run by PJ, a local in Solana Beach. If something looks off, or you want a hand with your plans, text PJ at 858-461-8054. A real person answers.
Local help, free to read: make your fix plan · senior benefits checkup · lower your SDG&E bill · Medicare Extra Help · every 2027 Medicare plan · is my medication recalled? · the next 90 days. Plans start as low as $25. Your parent lives here and you don't? The Parent Check-In Plan, $25 a month.
Questions people ask
What is FedRAMP 20x?
FedRAMP's new approach to clearing cloud services for federal agencies: providers set security goals, measure them continuously, and show evidence, instead of a point-in-time audit against a fixed control list.
Is FedRAMP 20x available now?
Yes. FedRAMP says the full rules for FedRAMP 20x Certification are finalized for Class A, Class B and Class C. Class D will be developed in Phase 4.
What is FedRAMP 20x Class A?
For cloud services with mature security and compliance programs entering the federal market, with a small amount of information up front and a small subset of ongoing monitoring and reporting.
Does SOC 2 count toward FedRAMP 20x?
In the Phase 1 pilot, FedRAMP reported that no participant actively reused an existing framework assessment such as SOC 2.
What are Key Security Indicators?
The measures 20x uses to show a service's security posture in near real time; the pilot found they can replace static yearly manual assessments.
Know someone who needs this?
Got a question about this? Ask PJ a question. A real person in Solana Beach texts you back.
Something changed here? Text PJ the fix: if it changes this page, you get $5. How it works.
Spotted something new around town? Text it in. What do you want to see here? Ask PJ for a page. No login, a real person reads it.
More free local tools: the North County toolkit.