FedRAMP 20x vs. Rev5: What Changed?

What the security requirements are written as. Rev5: NIST SP 800-53 Rev5 controls, in a baseline set by class. 20x: Key Security Indicators (KSIs), outcome statements such as KSI-IAM-AAM, "Automating Account Management", and KSI-CMT-LMC, "Logging Changes".

How certification is granted. Rev5: directly by FedRAMP (the Program path) or through an agency's Authorization to Operate (the Agency path, which FedRAMP now calls a legacy path available only for Rev5). 20x: Program path only. No agency sponsor is involved.

Which classes are available. Rev5: Class B, C and D (formerly Low, Moderate and High). 20x: Class A, B and C today. A 20x Class D is not yet available.

How evidence is kept. Under CR26 both record the provider's security decisions in a Security Decision Record (SDR), supplied in human-readable and JSON form. 20x adds automated validation of each KSI: at least two automated methods per KSI at Class C, with at least one recommended at Class B.

Whether new applications are accepted. 20x: yes, all three live classes. Rev5: until 11 June 2027, when FedRAMP stops accepting applications for new Rev5 certifications.

A FedRAMP certification from either process is a certification. What a buyer compares is the class, the status and the offering, not which process produced it.

CR26 replaced impact levels with certification classes, which FedRAMP defines as "the category of assurance that a cloud service offering supplies to federal government customers." FedRAMP's 20x page describes them like this:

Class A is for cloud services with mature security programs entering the federal market. It requires a small amount of information in advance and a small subset of ongoing monitoring and reporting. To use it, the offering must hold a certification under another framework completed within the past 12 months: FedRAMP Rev5 (including FedRAMP Ready), SOC 2 Type II, or GovRAMP. A fresh independent assessment is optional. Class A has no Rev5 equivalent.

Class B (formerly Low) is for common small-scale or light-use services, where an entire agency is unlikely to use the service for important work.

Class C (formerly Moderate) is for common enterprise services likely to be used across an agency, or that provide important government services.

Class D (formerly High) exists for Rev5. Through 20x it is not yet available: FedRAMP plans to develop it in a Phase 4 pilot, which it estimates for FY27 Q1–Q2.

Classes B, C and D require a fresh independent assessment completed within the three months before the package is submitted. The Marketplace shows the class alongside the old impact level during the transition, which is why this site writes "Moderate (Class C)".

FedRAMP's definitions name the source of a certification its certification path: either a federal agency's sponsored Authorization to Operate, or FedRAMP itself.

The Agency path is how most Rev5 authorizations were granted. A sponsoring agency reviews the package and issues a signed ATO letter, which it sends to FedRAMP. FedRAMP now describes this as a legacy path available only for Rev5.

The Program path is certification directly by FedRAMP. Every FedRAMP 20x certification uses it, and Rev5 offerings can use it too. Since August 2026 FedRAMP has also run temporary "Ready Conversion" and "Lost Sponsor" pipelines that let a limited set of providers apply for a Rev5 Class B or C Program Certification without an agency sponsor.

A provider cannot seek both a Rev5 Program Certification and a 20x Program Certification for the same offering. For a buyer the path is a detail worth recording, not a ranking: a certified offering is certified whichever path it took. Older listings still show a JAB P-ATO, the Joint Authorization Board path that preceded the Program path.

From FedRAMP's 2026 timeline and certification rules, as of 13 October 2026.

Already in effect:

4 July 2026. Optional early adoption of CR26 begins.

6 July 2026. Marketplace listings open for providers in the Initial Implementation phase.

28 July 2026. FedRAMP Ready becomes legacy and stops accepting submissions.

3 August 2026. The 20x Class A pipeline opens.

10 August 2026. Temporary Rev5 pipelines (Ready Conversion, Lost Sponsor) open for Class B and C.

31 August 2026. The 20x Class B and C pipeline opens.

Scheduled:

17 November 2026. Offerings with Ready status must convert to a certification by this date or by the expiry of their annual assessment, whichever is later. Those that do not are renamed Legacy FedRAMP Ready.

1 January 2027. Mandatory adoption. CR26 applies to all stakeholders, with some areas on their own dates, and providers must follow it to keep their certification.

11 June 2027. FedRAMP stops accepting applications for new Rev5 certifications.

31 December 2027. The Legacy FedRAMP Ready status is removed entirely.

Estimated, not scheduled: the 20x Class D pilot, FY27 Q1–Q2.

The FedRAMP Marketplace lists offerings in several statuses. Only one of them is a certification.

FedRAMP Certified ("Authorized" on older listings). The offering holds a certification at the class shown. This is the status a FedRAMP requirement asks for.

FedRAMP In Process and Agency Authorization In Process. A certification is under way, with FedRAMP or with an agency, and has not been granted.

Initial Implementation. The provider is early in preparing for certification. Under CR26 every provider must hold this listing before it can apply, must post progress at least quarterly, and must show within two years that a Class B, C or D assessment is scheduled, or the listing is removed. It is a statement of intent, not a certification.

Legacy FedRAMP Ready. A readiness designation FedRAMP no longer accepts. It was never an authorization.

You can check any vendor's listings by domain with the FedRAMP status lookup, which reads FedRAMP's own Marketplace data and dates each reading.

1. The exact cloud service offering. FedRAMP certifies "a specific, packaged cloud computing product or service," not a company. Match the product on your order form to the offering named on the Marketplace. A government edition is a separate offering from the commercial product.

2. The status. Certified, or something else. In Process, Initial Implementation and Legacy Ready are not certifications.

3. The class. Confirm it meets the requirement you are working to. Class B does not satisfy a Class C requirement, and Class C does not satisfy Class D. Class A is a distinct class with much less required up front; if a vendor holds Class A, confirm whether your contract or agency customer accepts it.

4. The date. Record when you read the listing. A status can change, and from 1 January 2027 providers must follow CR26 to keep their certification.

5. The boundary. Ask which environment your tenant will run in, and whether the integrations, regions and add-ons you plan to use sit inside the certified offering.

6. Everything FedRAMP does not cover. Ownership and sanctions exposure, breach and incident history, regulatory actions and privacy practices are outside a FedRAMP certification. A free vendor assessment gathers that public evidence for a vendor alongside its FedRAMP listing.

It establishes that a named cloud service offering met FedRAMP's requirements for its class, that (except for Class A, where it is optional) an independent assessor recognized by FedRAMP assessed it, and that the provider has committed to ongoing reporting to keep it.

It does not establish that every product the company sells is certified; that the offering suits a higher class than the one it holds; anything about a provider in Initial Implementation or with Legacy Ready status beyond the listing itself; or the company-level risks above. Treat FedRAMP as strong evidence about one offering's security, and the vendor decision as broader than that. See the FedRAMP authorized vendor list for named offerings, and how to check a vendor's FedRAMP claim for the verification steps.

Every statement above was checked against FedRAMP's own pages in October 2026: FedRAMP 20x, 2026 timeline, FedRAMP Certification rules, Security Decision Record rules, Initial Implementation listing rules, Class A Key Security Indicators and definitions. FedRAMP updates these rules; where this page and fedramp.gov disagree, fedramp.gov is right.