FedRAMP 20x Compliance, Start to Finish: KSIs, Machine-Readable Evidence, and What Changed From Rev 5

FedRAMP 20x is the cloud-native way to earn a FedRAMP Certification under the Consolidated Rules for 2026, which took effect on July 4, 2026. Instead of a System Security Plan narrating hundreds of NIST SP 800-53 controls, you prove Key Security Indicators with automated, repeatable measurements, publish a Certification Package Overview and a Security Decision Record in JSON through a FedRAMP-compatible trust center, and apply directly to FedRAMP without an agency sponsor. Class A requires 7 of the 46 indicators plus a SOC 2 Type II, GovRAMP, or Rev5 assessment completed within the past 12 months. Class B requires 41 of them, with the other 5 optional, and Class C requires all 46. Both need an independent assessment by a FedRAMP Recognized assessor completed in the three months before applying. FedRAMP's goal is an initial decision within 30 days of receiving an application.

This guide follows a 20x project from the first decision to the first Ongoing Certification Report: the rule IDs FedRAMP uses, the machine-readable formats it expects, the full list of Key Security Indicators, what changed from Rev 5, what the work costs, and who should assess it. Every requirement cited here comes from FedRAMP's machine-readable rules dataset (version 2026.09.13.02, updated September 13, 2026) and the Consolidated Rules site. If you already hold a Rev 5 certification, skip to the section on moving from Rev 5, because your next deadline is December 7, 2026. Every acronym in this guide is defined in the acronyms and definitions section near the end.

What FedRAMP 20x is, in FedRAMP's own terms

GSA announced FedRAMP 20x on March 24, 2025, with the stated goal of approving new cloud services “in weeks instead of years” through automation and engineer-friendly requirements. FedRAMP ran it as public pilots. Phase 1 tested Low impact services from April to September 2025 and received 26 complete submissions. Phase 2 tested Moderate impact services from November 2025 through March 2026. FedRAMP's Marketplace data now lists 28 offerings certified at 20x Low or 20x Moderate, 14 of each, including offerings from OpenAI, Google, Perplexity, Confluent, and Vanta. FedRAMP then folded the approach into the Consolidated Rules for 2026 (CR26), launched on June 24, 2026, which now govern both 20x and Rev 5.

The legal footing is the FedRAMP Authorization Act, which Congress enacted on December 23, 2022, and OMB Memorandum M-24-15 of July 25, 2024. M-24-15 rescinded the 2011 policy memo that created the original program and directed FedRAMP to automate intake and review, grow the Marketplace, and stop pushing commercial providers to build separate government-only versions of their products. 20x is the program's answer to that memo.

CR26 also replaced the vocabulary, and FedRAMP treats the old words as a warning sign. Its guidance on choosing an advisor says that one who still offers help obtaining a “FedRAMP Authorization” or talks about Low, Moderate, and High impact levels is showing that it has not followed the changes. These are the terms used throughout this guide.

Choose your certification profile before you build anything

A Certification Profile is three choices: type, path, and class. Rule FRC-CSO-FCP requires you to name a target profile and apply every FedRAMP Practice that goes with it, so this decision sets the scope of the whole project.

Type: 20x or Rev5

FedRAMP says cloud services built on FedRAMP Certified infrastructure or platforms should choose 20x, and calls it “the fastest, cheapest, and best way to bring an existing commercial cloud service into the federal market.” Rev5 remains the only option for services that run their own infrastructure or need a Class D certification today. FedRAMP stops accepting new Rev5 applications on June 11, 2027, and describes Rev5 as a legacy type it is working to retire.

Path: Program or Agency

Program Certification comes directly from FedRAMP and needs no agency sponsor, and it is the path for every 20x certification. Agency Certification is the legacy route in which an agency completes an ATO first and then sponsors the service to FedRAMP, and it applies only to Rev5. You cannot seek Rev5 and 20x Program Certifications for the same offering (FRC-CSO-POP).

Class: A, B, or C

Classes rise in the assurance you commit to supply to agencies, and in cost. FedRAMP's advice is to start with Class A in most cases, to go straight to Class C only when an existing agency contract requires it, and never to plan a first certification at Class D. Treat Class A as a first step: FedRAMP says agencies should not authorize a Class A service for more than 12 months unless the provider is actively seeking Class B, C, or D (AGU-USE-CLA). Class D is not yet available under 20x. FedRAMP says it anticipates piloting 20x Class D in late 2026 and making it a formal option in early 2027. The table below shows what each available class requires, with the rule behind each line.

If a contract still says Low or Moderate, FedRAMP's own 20x program page says that in the current phase, 20x “will initially support Class A (Pilot), Class B (Low), and Class C (Moderate) Certifications,” which is the practical translation. Expect the agency to do its own categorization anyway. FedRAMP's agency guidance says a class indicates the level of assurance a provider supplies, warns agencies against reading it as a measure of how secure the service is, and leaves the agency to decide whether the service fits its system, data, and risk tolerance.

One boundary to settle early if you sell to defense: FedRAMP states that it “does not support or provide 'equivalency.'” If a DFARS 252.204-7012 contract calls for FedRAMP Moderate equivalency for a cloud service that stores, processes, or transmits covered defense information, FedRAMP directs those questions to the Department of War, and the question belongs to your CMMC program. Our CMMC consulting team scopes that side.

The FedRAMP 20x project, start to finish

FedRAMP organizes the journey into three phases: Preparation, Initial Implementation, and Ongoing Certification. Its sequencing advice is to build the Certification Package Overview first, then the Security Decision Record, then the assurance capabilities you will operate for as long as you hold the certification. The steps below follow that sequence.

1. Staff it as an engineering project

The strongest signal from the pilots is organizational. FedRAMP's KSI guidance notes that the most successful pilot organizations were led entirely by experienced engineering and product teams that treated certification like any other product, and its implementation guidance calls a separate compliance team without access to engineering resources “a guaranteed way” to make certification harder. Name an executive owner, give the program a product manager, and put platform, security, and site reliability engineers on it from the first week. Compliance staff own the rule mapping and the package. Engineers own the measurements.

2. Get listed in the Marketplace

Since July 6, 2026, providers early in the process can appear in the FedRAMP Marketplace in the Initial Implementation Phase, and you must be listed before you apply (FRC-APP-MLF). The listing is the first real test of the rules. You publish the public information in CDS-CSO-PUB on your website in human-readable and JSON form, including service and deployment model, UEI number, sales and security contacts, a service list with security categories, links to your secure configuration guidance and trust center, and your current assessor. You demonstrate a government-wide use case (MKT-IIP-AGU), stand up a basic FedRAMP-compatible trust center, post progress against your own milestones at least quarterly (MKT-IIP-DCP), and show that a Class B, C, or D assessment is scheduled within two years of listing, or FedRAMP removes the listing (MKT-IIP-DLA). FedRAMP rejects incomplete listing requests with only the minimum explanation, so validate the JSON against FedRAMP's schema before you submit.

3. Draw the Minimum Assessment Scope

The Minimum Assessment Scope replaces the legacy authorization boundary for both 20x and Rev 5. MAS-CSO-IIR puts in scope every information resource likely to handle federal customer data or affect its confidentiality, integrity, or availability, and that set is, by definition, your cloud service offering. You document information flows and security categories for all of it (MAS-CSO-FLO), include metadata about federal customer data (MAS-CSO-MDI), and explain each third-party resource the offering depends on: how you use and configure it, why, and the mitigations and compensating controls around it (MAS-CSO-TPR). Products outside the scope can go in a separate, marked supplement, and they are not certified. Your public service list (CDS-CSO-SVC) must be specific enough that a buyer can tell which features are in scope without asking you.

4. Build the Certification Package Overview

The Certification Package Overview is a short, structured summary of the offering, supplied in human-readable and JSON formats (CPO-CSO-OVR), and together with the Security Decision Record it takes the place of the System Security Plan. It carries your public information and service list, an inventory of every relevant policy and procedure with its summary, word count, version, and date, the assessment scope and third-party resources, your cryptographic module documentation, the assessor's overall summary for Class B and C, and the name and contact of the official accountable for the package. FedRAMP tells providers to build this first, and warns that a provider who finds the overview hard should expect a long road through the rest.

5. Design the measures and build the Security Decision Record

The Security Decision Record is where most of the time goes. For every applicable rule, SDR-CSO-FRR asks for how you follow it (or why you do not, and the resulting risk to customers), verification that the implementation fits the rule, validation that it works, the independent verification and validation, and any rule-specific artifacts. For every applicable KSI, SDR-CSX-KSI asks for the measures that demonstrate it and their objectives, the cycle each persistent measure runs on, verification that the measures and the automation behind them are accurate and sufficient, and validation that they work as intended. Class B and C providers also keep historical metrics for every KSI in the record (SDR-CSX-KMT).

Two class rules set the engineering bar. Class C must run at least two automated methods per KSI to verify and validate its accuracy and completeness, where Class B should run at least one (FRC-CSX-VVK). Class C must supply at least six months of historical KSI metrics, and a new service without that history can apply with the mechanisms in place and an agreement to meet the requirement (FRC-CSX-MOT). FedRAMP also says providers should apply every KSI to every part of the offering inside the assessment scope (FRC-CSX-MAS), so a measure that checks only your primary cloud account falls short.

6. Prove the assurance machinery before you apply

FedRAMP will not certify a service that can only describe how it will operate. Its implementation guidance says you must prove you are ready to meet every Ongoing Certification requirement in order to obtain the initial certification, and for most providers these are new capabilities:

• A monitored FedRAMP Security Inbox that receives FedRAMP email without disruption and routes Emergency messages to a senior security official (AFC-CSO-INB, AFC-CSO-RCV, AFC-CSO-EMR).
• Vulnerability detection that runs persistently and treats a failure in the detection or response process as a vulnerability (VDR-CSO-DET, VDR-CSO-FAV).
• Vulnerability evaluation that rates every finding for exploitability, internet reachability, and a Potential Agency Impact N-rating from N1 to N5, with a monthly human-readable activity report (VER-EVA-ELX, VER-EVA-EIR, VER-EVA-EPA, VER-TFR-MHR).
• A significant change process that sorts each change into routine recurring, adaptive, or transformative, with notices sent on FedRAMP's timelines (SCN-CSO-EVA).
• Incident reporting to fedramp_security@fedramp.gov and affected agencies, from the initial report through the final report (IEC-CSO-IIR, IEC-CSO-FIR).
• A Secure Configuration Guide for top-level administrative accounts, and an Ongoing Certification Report your team can produce every three months (SCG-CSO-RSC, CCM-OCR-AVL).

The package must include a real or example Ongoing Certification Report (FRC-CSO-PKG), and incident reports used as evidence can come from real or simulated incidents.

7. Commission the independent assessment

Class B and C require a FedRAMP Recognized assessor, and the assessment must be completed within three months before you apply (FRC-APP-FIA). If it goes stale, the assessor can review what changed in place of a full reassessment, unless the original is more than nine months old (FRC-APP-USA). Expect a different engagement from a Rev 5 audit. FedRAMP's guidance to assessors tells them to trace each important validation from its source data through the code, queries, and thresholds that produce the result, down to what counts as failure, and warns that “a green status can hide missing accounts, incomplete inventory, faulty integrations, or a manual step that never happened.” That work can include code review, API testing, and cloud architecture analysis. FedRAMP encourages early and frequent contact so you can explain your validation design and the assessor can test it while unclear evidence can still be fixed. The section on choosing an assessor below covers who we recommend.

8. Apply and get through review

You apply through FedRAMP's Certification Application Form yourself (FRC-APP-AFC), because FedRAMP no longer accepts applications submitted by assessors or any other third party (FRC-APP-NTP). The package must show the offering as you verified and validated it within the previous seven days (FRC-APP-FCP). FedRAMP scans the submission for completeness, assigns a Review Team that requests access to your trust center, reviews the Certification Package Overview, and for 20x usually schedules a Deep Dive on the overview and the Security Decision Record. FedRAMP's internal goal is an initial decision within 30 days, and the clock stops whenever it is waiting on you. The first two 20x Class A Certifications, Bland AI and Files.com, moved from In Process to Certified in 19 and 17 days in August 2026, according to FedRAMP's Marketplace status data.

9. Run Ongoing Certification

Certification starts the recurring work, and the cadence depends on class.

Rev 5 providers will recognize the monthly vulnerability reporting and the annual assessment. The three-day and seven-day resource validation cycles, the quarterly reports and reviews, and the availability status service are new.

Machine-readable controls: what FedRAMP means and what to build

Machine-readable has a legal definition in the rules. FedRAMP adopts 44 U.S.C. § 3502(18): data “in a format that can be easily processed by a computer without human intervention while ensuring no semantic meaning is lost.” Four rules turn that definition into engineering work. FRC-CSO-JSN applies to every class and requires JSON documents that validate against the matching FedRAMP schema whenever a rule names one, unless that rule says otherwise. CDS-CSO-CBF requires automation to keep the human-readable and machine-readable versions of your certification data consistent, so a PDF your team edits by hand next to a JSON file generated from a different source will not pass. CDS-TRC-PAC requires your trust center to give documented programmatic access to all certification data, including the human-readable materials, and CDS-TRC-ACL requires it to log all access to certification data and keep access summaries for at least six months. Those three data-sharing rules apply to Classes B, C, and D.

FedRAMP publishes the schemas at fedramp.gov/schemas and in the FedRAMP/schemas repository: the Certification Package Overview, Security Decision Record, Ongoing Certification Report, incident report, significant change notification, vulnerability detail report, accepted vulnerability information, historical vulnerability activity, advisor information, and assessor information, plus shared definitions. The repository labels them drafts, and each schema carries its own version number, so pin the versions you build against. FedRAMP calls the schemas “lightweight and flexible” minimums that providers can extend. For provider packages, OSCAL is now optional. CR26 moves Rev 5 packages from Word and Excel templates to “simplified JSON documents or (in some cases) optional OSCAL,” and 20x packages use FedRAMP's JSON schemas. Agencies still need governance, risk, and compliance tools that can produce and ingest both OSCAL and JSON (AGU-AGC-GRC).

FedRAMP publishes its own rules the same way. The fedramp-consolidated-rules.json file in the FedRAMP/rules repository holds every definition, rule, and KSI by ID, with class variants where they apply, ruleset effective dates, and each KSI's related NIST SP 800-53 controls. FedRAMP tells automation services and AI agents to skip its website and process the source data directly, and it names this repository the source of truth for structured rules. Build your rule mapping from the file, pin the version you mapped against, and diff it when FedRAMP ships an update, because FedRAMP has revised the rules several times since launch, most recently on September 13, 2026.

What a KSI validation looks like

A KSI is an outcome claim, and at Class C the measurement behind it is code with a data source, a cadence, and a failure condition. Take KSI-IAM-APM, which requires passwordless authentication where feasible and otherwise strong passwords with phishing-resistant MFA. A Class C implementation needs at least two automated methods (FRC-CSX-VVK). The first is a daily query of the identity provider confirming that every active human account is bound to a FIDO2 or passkey authentication policy, failing on any exception. The second is a daily query of authentication logs for any successful sign-in completed without a phishing-resistant factor, failing on any match. Each run writes a timestamped result to the evidence store, a failure opens a ticket and pages the identity team, and the pass rate over time becomes the historical metric. The Security Decision Record entry for that KSI then looks like the example below, which validates against FedRAMP's Security Decision Record schema, version 1.1.1.

The schema requires, for each indicator, the KSI ID and arrays for implementation, validation, assessment, tests, and evidence. An optional implementation status accepts Implemented, Partially Implemented, or Not Implemented. Each evidence entry can carry a type (log, report, screenshot, configuration, policy, procedure, or audit record), a description, a location URI, inline text, and a last-updated date, and the schema requires none of those fields, so decide your own minimum and hold every entry to it. The assessment statements come from your assessor and stay theirs, because FedRAMP requires assessment results in the package “without inappropriate modification” (IVV-CSO-ICP). The same record also holds a fedRampRequirements array with an entry for each of the more than 150 provider rules that apply to Class B and C.

How to produce the records: the technical build

Producing FedRAMP's machine-readable records is a data pipeline. You pull facts from the systems that run the service, test them in code on a schedule, keep every result with a timestamp, generate the JSON documents from those stored results, validate each document against FedRAMP's schema, and publish the documents through a trust center that agencies and FedRAMP can query. FedRAMP does not prescribe tools. You can build the pipeline from your cloud provider's APIs, the security tools you already run, and a GRC platform, your own code, or both.

Start with FedRAMP's source files. Clone the FedRAMP/schemas repository, or download each schema from the fedramp.gov/schemas address in its $id field, which is the schema's official identifier, and keep the copies you build against in your own version control. The date in each file name identifies the CR26 ruleset and stays fixed, while the $schemaVersion field inside the file changes when FedRAMP edits the schema. FedRAMP moved the Security Decision Record schema to version 1.1.1 on September 1, 2026, and it issued new major versions of the assessor and advisor schemas on September 23, 2026, so record the version you build against and rerun your validation when it changes. The rules dataset tells you which schema each rule expects: 24 rules carry a schema field with the schema's name and address. Generate the fedRampRequirements list in your Security Decision Record from the same file by filtering rules on the type, path, class, and affected party in each subset's applicability block and writing one entry per applicable rule, keyed by its rule ID.

Validate every document before it leaves your pipeline. All eleven schemas use JSON Schema draft 2020-12, so use a validator that supports that draft, such as the jsonschema library for Python or Ajv for JavaScript, and run it as a build step that blocks publication on any error. Nine of the ten document schemas reuse shared definitions from the common-definitions schema and reference it by its fedramp.gov address. Load that file into the validator next to the schema you are checking, because a validator that cannot resolve the reference stops with an error instead of validating. The Security Decision Record and every report also require a certificationPackageOverviewUri field that points back to your Certification Package Overview, so publish that document first at a stable address.

Here is how the KSI-IAM-APM example above moves through that pipeline. A scheduled job calls the identity provider's API with a read-only credential and saves the raw response. The validation code checks each active account's authentication policy and writes a pass or fail result with a timestamp to the evidence store. The generator reads the latest result and the 30-day and one-year metric summaries that SDR-CSX-KMT requires, writes them into that KSI's Security Decision Record entry with an evidence location pointing to the stored result, renders the human-readable page from the same data, validates the JSON, and publishes both versions to the trust center.

Vulnerability records follow the same pattern with one extra step. Each finding becomes a vulnerabilityDetail entry that requires your tracking ID, the detection time and source, and a description, and that carries the VER evaluation: whether the vulnerability is internet-reachable and likely exploitable, its current PAIN rating as an integer from 1 to 5, the time the evaluation finished, which starts the 192-day clock for accepted vulnerabilities, and its final disposition. Scanners do not produce PAIN ratings or FedRAMP's reachability and exploitability judgments, so the generator has to join each scanner finding with your team's evaluation record before it writes the Vulnerability Detail Report.

Agencies and FedRAMP pull data from you as well. CDS-TRC-PAC requires documented programmatic access to all certification data, so publish an API reference for the trust center, issue a credential to each agency user or system, and log every request: CDS-TRC-ACL requires access summaries kept for at least six months, and CDS-TRC-AAI requires an inventory and history of the agency users and systems with access. VER-TFR-MRH asks Class B providers to keep recent vulnerability history available in JSON for automated retrieval, updated at least monthly, and asks Class C providers to update it at least every 14 days. Separately, CDS-CSO-AVR requires Class B, C, and D providers to run a web service that shows current availability and the past 30 days of availability for core services, in human-readable and machine-readable form, and that stays up when the offering itself is down.

Build the pipeline so an assessor can test it. FedRAMP tells assessors to trace validations end to end, from the source data through collection, transformation, and the code, queries, or thresholds that produce each result, and to review code, test APIs, and analyze cloud architecture instead of stopping at a dashboard. Keep collectors and validation code in source control with peer review, keep the pipeline's own run logs, and make every result reproducible from its stored inputs. If a GRC platform supplies part of the pipeline, confirm that its JSON export validates against the current FedRAMP schemas and that it keeps your assessor's statements separate from yours, because IVV-CSO-ICP requires assessment results in the package without inappropriate modification.

The 46 Key Security Indicators

CR26 organizes the indicators into 10 themes. Class A requires the 7 marked below. Class B requires 41 and makes the other 5 optional, and Class C requires all 46. FedRAMP's dataset maps 44 of the 46 KSIs to related NIST SP 800-53 controls, and some summarize a lot of ground: KSI-IAM-JIT maps to 38 controls and KSI-IAM-ELP to 34. Thirty-five of the 46 statements use FedRAMP's defined term “persistently” or its form “persistent.” FedRAMP defines it as activity repeated in cycles over a long period, where any irregularity or gap between cycles is intentional, understood, and documented, and the status is always known. A measure that runs when someone remembers to run it does not meet that definition.

The statements below are FedRAMP's official wording from the rules dataset, also published on the Key Security Indicators pages. The KSI workbook carries the same statements with their control mappings and columns for planning each measure.

What changes from Rev 5

Rev 5 and 20x expect similar security. They differ in what counts as proof, who reviews it, and how often it moves. The table compares the legacy Rev 5 process most current providers went through with 20x under CR26.

Rev 5 does not stand still under CR26. FedRAMP calls it a legacy type that “will be retired,” and it applies the same modernization to it: JSON packages in place of Word and Excel templates, most FedRAMP-defined organizational parameters removed so providers set their own values, FIPS 140 expected only where data is sensitive, vulnerability detection “scaled widely beyond traditional monthly vulnerability scanning,” and POA&Ms eliminated in favor of a list of accepted weaknesses. The CR26 Rev5 baselines list 155 controls for Class B, 322 for Class C, and 409 for Class D, each documented in a Security Decision Record.

If you already hold a Rev 5 certification

Existing Rev 5 certifications remain active until at least December 31, 2028, unless FedRAMP is directed otherwise, but the rules under them change on a schedule, and FedRAMP warns that providers who do not adjust “will lose their FedRAMP Certification.” Grace periods are hard deadlines with no extensions. A provider that misses one loses its certification with public notice and can regain it by following the rules.

The next deadline is December 7, 2026, when the Vulnerability Detection and Response (VDR) and Vulnerability Evaluation and Reporting (VER) rulesets become required for every Class B, C, and D provider, Rev5 and 20x, under CISA Binding Operational Directive 26-04. A certified provider that has not adopted them by then needs a corrective action plan, and FedRAMP revokes certification if they are not in place by March 7, 2027. Class A providers must follow VDR-CSO-DET, and FedRAMP recommends the timeframe rules. Every detected vulnerability needs an evaluation of exploitability and internet reachability and a Potential Agency Impact N-rating (PAIN), from N1, minimal effects on agency customers, to N5, a debilitating effect on more than one agency. FedRAMP's remediation expectations run on those three facts. The table shows the number of days after evaluation within which FedRAMP expects partial mitigation, full mitigation, or remediation to a lower rating (VDR-TFR-PVR), for Class B and Class C.

N1 carries no timeframe. FedRAMP expects Known Exploited Vulnerabilities to be remediated by the due dates in CISA's KEV catalog even after full mitigation (VDR-TFR-KEV), and any vulnerability not fully mitigated or remediated within 192 days of evaluation must be categorized as an accepted vulnerability (VER-TFR-MAV).

For a Rev 5 provider, the decision is sequencing. The CR26 changes to Rev 5 are mandatory either way, and several of them are the same capabilities 20x requires: JSON packages, delivery through a trust center, persistent vulnerability detection, accepted-vulnerability reporting, and notification-based change management. Build them once to the 20x standard, and a later move to 20x reuses them. Three details matter. A Rev 5 certification or FedRAMP Ready status completed within the past 12 months satisfies the prerequisite for a 20x Class A Certification (FRC-CLA-ASF), so a Rev 5 Agency Certification holder can pursue Class A without a new independent assessment when an agency wants a Program Certification. You cannot hold Rev 5 and 20x Program Certifications for the same offering, and FedRAMP allows a Rev 5 Agency Certification alongside a 20x Program Certification but strongly discourages it (FRC-CSO-POP). And if the offering runs on your own infrastructure or needs Class D, Rev 5 is currently the only option; FedRAMP expects to offer 20x Class D in early 2027.

What FedRAMP 20x costs and how long it takes

FedRAMP's review is the fast part. Its goal is 30 days, and the first two Class A Certifications moved from In Process to Certified in 19 and 17 days. Preparation sets the calendar and the budget, and three things drive both: how much of your security program already produces measurable, automatable evidence; how many services and third-party resources sit inside the Minimum Assessment Scope; and the class. The largest cost for most providers is internal engineering time to build validations and reporting. Workstreet calls engineering and development “the biggest cost,” and the ranges below cover only external spend on the assessment and readiness work.

We recommend budgeting 1.5 to 2 times the published estimates for this work, and the table applies that multiplier. Where you land within each range depends on the size of the business.

A provider with one product, a small engineering team, one production environment, and a current SOC 2 Type II report should plan near the low end. Costs rise with the number of people and accounts your identity and access measures have to cover, with the number of services, environments, and third-party resources inside the Minimum Assessment Scope, and with the number of engineering teams whose pipelines have to produce evidence. A company with several product lines or hundreds of engineers should plan at the top of the range, and the largest offerings can exceed it.

The published estimates behind these ranges are Workstreet's August 2026 estimate for the 20x rows, which describes a provider starting from a SOC 2 baseline, and Secureframe, which cites Coalfire and Schellman, together with Workstreet for the Rev 5 row. Workstreet is a FedRAMP Marketplace-listed advisor. Budget for tooling on its own line: a trust center with API access, a GRC platform that can generate JSON, identity and endpoint tiers that expose the data your validations need, and penetration testing, which VDR-CSO-DET names as an example detection technique.

Choosing the independent assessor

We recommend Schellman for the independent assessment, and the public record supports it. In FedRAMP's Marketplace data as of September 23, 2026, Schellman is the independent assessor of record for 144 of the 532 FedRAMP Authorized offerings, about 27 percent and well ahead of Coalfire at 81. Of the 28 20x Low and Moderate authorizations in the same data, Schellman assessed 6, more than any other assessor, including OpenAI's ChatGPT Enterprise and API Platform at 20x Moderate, both of Vanta's 20x offerings, Drata, Spectro Cloud, and Anecdotes. Schellman has been accredited since July 2012, announced in April 2026 that it had become the first assessor to reach 200 assessed offerings on the FedRAMP Marketplace, and states in its Marketplace listing that it “only performs assessment services, and no consulting services.” That last point matters, because the firm testing your KSIs has no stake in how they were built.

One rule and one FedRAMP recommendation shape the choice. An assessor may not assess an offering within two years of providing advisory or consulting services for it (REC-IAS-SEP), so your advisor and your assessor should be different firms from the start. FedRAMP also calls it good practice to interview several FedRAMP Recognized assessors and get proposals from at least two or three, and it warns separately that recognition and the A2LA requirements behind it set “a minimum bar” and that neither reviews technical expertise in depth. Ask each firm how it tests automated validations, whether its team can review your validation code and query your APIs, and which 20x assessments it has completed. Schellman answers those questions with a track record. Get the other proposals anyway, as FedRAMP advises.

Frequently asked questions

What is FedRAMP 20x? FedRAMP 20x is the cloud-native FedRAMP Certification type under the Consolidated Rules for 2026. Providers prove Key Security Indicators with automated, machine-readable evidence and receive a Program Certification directly from FedRAMP. It is designed for services built on FedRAMP Certified infrastructure or platforms.

Does FedRAMP 20x require an agency sponsor? No. Every 20x certification is a Program Certification issued by FedRAMP, so no agency sponsor or prior ATO is required. Each agency still issues its own Authorization to Operate before it uses your service.

How long does FedRAMP 20x take? FedRAMP's goal is an initial decision within 30 days of receiving an application, and the first two Class A Certifications moved from In Process to Certified in 19 and 17 days in August 2026. Preparation takes longer: a published estimate puts Class A readiness at 90 to 120 days from a SOC 2 Type II baseline, and Class B and C take longer because 41 or all 46 indicators apply.

What is the difference between FedRAMP 20x and Rev 5? Rev 5 certifies a documented implementation of NIST SP 800-53 baselines and usually requires an agency sponsor. 20x certifies measured outcomes against Key Security Indicators, uses JSON packages shared through a trust center, and requires no sponsor. FedRAMP stops accepting new Rev 5 applications on June 11, 2027.

Do I need a 3PAO for FedRAMP 20x? Class B and Class C require an independent assessment by a FedRAMP Recognized assessor, the current term for a 3PAO, completed within three months before you apply. Class A makes the assessment optional because it relies on a SOC 2 Type II, GovRAMP, or Rev 5 assessment from the past 12 months.

How many Key Security Indicators are there? The Consolidated Rules for 2026 define 46 Key Security Indicators across 10 themes. Class A requires 7, Class B requires 41 and makes 5 optional, and Class C requires all 46.

Is OSCAL required for FedRAMP 20x? No. 20x requires JSON documents that validate against FedRAMP's published schemas, such as the Security Decision Record and Certification Package Overview schemas. FedRAMP describes OSCAL as optional in some Rev 5 cases.

Can a Rev 5 provider move to FedRAMP 20x? Yes, and FedRAMP asks Rev 5 providers to plan the move. A Rev 5 certification assessed in the past 12 months satisfies the prerequisite for 20x Class A, existing Rev 5 certifications stay active until at least December 31, 2028, and many of the CR26 changes Rev 5 providers must make by February 1, 2028 are capabilities 20x also requires.

Where BD Emerson fits

BD Emerson advises cloud service providers on FedRAMP. We are not a FedRAMP Recognized assessor, and we do not perform the assessment that results in your certification. FedRAMP defines an advisor as an entity that helps a provider prepare “without replacing the provider's responsibility or the assessor's independence,” and it warns that an advisor who claims to produce your artifacts and meet ongoing requirements on your behalf misrepresents the program. We work within that line. Our FedRAMP 20x readiness team helps you choose the profile, draws the Minimum Assessment Scope with your architects, designs KSI measures and failure conditions with your engineers, reviews the validation code and the JSON your pipelines generate, and helps your team put VDR and VER reporting in place ahead of December 7, 2026. Your team owns and runs the program, and we test it before the assessor and FedRAMP see it.

If you plan to use a SOC 2 Type II as your Class A prerequisite, our SOC 2 readiness practice can prepare you for the examination. For the testing that feeds vulnerability detection, see FedRAMP penetration testing. The FedRAMP 20x KSI workbook (Excel) lists all 46 indicators with their official statements, class requirements, and control mappings, with columns for owner, data source, automated methods, cadence, and failure condition, plus the ongoing cadence by class and the sample Security Decision Record. For the Rev 5 requirements under the 2026 rules, see FedRAMP requirements explained. When you want a second set of eyes on your profile or your first KSI designs, talk to us.

Acronyms and definitions

This section defines every acronym in this guide. FedRAMP terms follow the definitions in the Consolidated Rules for 2026, and the ruleset names come from FedRAMP's rules dataset.

Codes inside rule IDs and KSI IDs

A FedRAMP rule ID has three parts. The first names the ruleset, the second names the section of that ruleset, and the third is a short label for the individual rule. In VDR-TFR-MVX, VDR is Vulnerability Detection and Response, TFR is its Timeframes section, and MVX is the rule for persistent machine verification and validation on 20x. KSI IDs follow the same pattern: KSI-IAM-JIT is the Authorizing Just-in-Time indicator in the Identity and Access Management theme. The ruleset codes are defined in the table above, and the section and theme codes are below.

FedRAMP primary sources