Memo to Milestone: FedRAMP Grants the First Full FedRAMP 20x Class C Certification
November 2, 2026
On July 25, 2024, the Office of Management and Budget published OMB Memorandum M-24-15: Modernizing the Federal Risk and Authorization Management Program (FedRAMP). Section II, Vision, opened this government-wide guidance with the following critical directive:
“FedRAMP has provided significant value to date, but the program must change to meet the needs of Federal agencies and the evolving cloud marketplace. The FedRAMP Marketplace must scale dramatically to enable Federal agencies to work with many thousands of different cloud-based services that accelerate key agency operations while allowing agencies to reduce the footprint of the information technology (IT) infrastructure that they directly manage.”
Eight months later, on March 24, 2025, FedRAMP announced a strategic plan to implement the changes necessary to meet this vision: FedRAMP 20x. The proposed changes included:
- Eliminating unnecessary but highly intrusive business requirements that encouraged the development of inferior government-specific offerings without feature parity to commercial offerings
- Removing the agency sponsorship barrier
- Transitioning the entire process to machine-readable interactions
- Reducing the burden of assessment while improving its accuracy and quality
- Enabling and encouraging the use of automation that would enforce security decisions and accountability
FedRAMP 20x included the announcement of intent to develop a new approach to assessing the security of commercial cloud services that could provide the assurance agencies need to understand the risks of placing federal information into those external services without mandating a new government-specific architecture. Over the next 19 months, FedRAMP worked collaboratively with agencies and the public to develop and pilot this new assessment framework across 3 different phases. 26 companies received limited pilot certifications during this time based on their participation in the pilot, with an agreement to incorporate the (much more complicated) final rules once they were completed.
The FedRAMP Consolidated Rules for 2026 (CR26) were published in June 2026, officially implementing many of the proposed changes developed and piloted over the previous year. These rules introduced a new FedRAMP 20x Class A Certification to accelerate entry into the FedRAMP Marketplace for companies with a high quality security program and an external SOC 2 Type II or GovRAMP assessment. They also established the official rules for a CR26-compliant FedRAMP 20x Class B and Class C Certification, with much stricter requirements than the pilot but significantly improved assurance expectations. The pipeline for FedRAMP 20x officially opened in August 2026.
The First FedRAMP 20x Class A
On August 25, 2026, FedRAMP granted the first ever FedRAMP 20x Class A Certification, finally delivering on an explicit directive from OMB in M-24-15 supported by an entire subsection within Section V, Automation and Efficiency:
“FedRAMP will establish criteria for accepting widely-recognized external security frameworks and certifications applicable to cloud products and services, based on FedRAMP’s assessment of relevant risks and the needs of Federal agencies.”
The First Full CR26-Compliant FedRAMP 20x Class C
On October 29, 2026, FedRAMP granted the first ever CR26-compliant FedRAMP 20x Class C Certification to the first cloud service offering that addressed all of the rules developed over the 19 months since the public launch of FedRAMP 20x. This product is already used by agencies based on its pilot 20x Class C Certification, demonstrating the demand and value of FedRAMP 20x.
The FedRAMP 20x assessment is based on the idea of assessing the security capabilities by measuring outcome metrics supplied by the cloud service provider through Key Security Indicators. For example, seeing the results of hundreds of SAST scans and resulting denials or approvals for code changes is far more informative about the security of a cloud service’s operations than reading a paragraph of narrative text that describes how they plan to incorporate such scans into their testing. This approach directly addresses the fourth strategic goal and responsibility set by OMB, to leverage shared infrastructure between the federal government and private sector by enabling providers to assess their current environment against universally applicable security outcomes:
“FedRAMP should not incentivize or require commercial cloud providers to create separate, dedicated offerings for Federal use, whether through its application of Federal security frameworks or other program operations. The Federal Government benefits from the investment, security maintenance, and rapid feature development that commercial cloud providers give to their core products to succeed in the marketplace.”
Products with Limited Pilot FedRAMP 20x Certification earned before the release of the Consolidated Rules for 2026 have already seen wide-scale usage across government, although FedRAMP unfortunately lacks the necessary data at this time to properly demonstrate this in the FedRAMP Marketplace. Agencies are using FedRAMP 20x Certified products because they increase the efficiency of procurement and assessment while opening up access to previously impossible-to-use capabilities, following Risk Management guidance in OMB M-24-15 Section V, Automation and Efficiency:
“In accordance with guidance provided by FedRAMP, agencies may make risk management decisions regarding acceptable controls, which may include allowing compensating controls or risk-acceptance for certain situations or types of cloud offerings where there are gaps or misalignments between Federal and external security frameworks. FedRAMP may also justify acceptance of a given level of security risk to support broader interoperability with industry security processes, reduced burden on providers, or further streamlining of FedRAMP authorizations and processes.”
The First Two Years of a Long Journey
To many stakeholders, especially those in government, the progress of FedRAMP’s 20x initiative has at times felt overwhelmingly fast… and yet, it took over two years from the release of M-24-15 by OMB and over 17 months from the announcement of the FedRAMP 20x initiative for the first FedRAMP 20x Class A Certification to happen.
It took a ton of work to get here, and a ton of collaboration with inspired stakeholders both government and industry-wide. Everything up until now has been development, piloting, training, preparing. These milestones, the first FedRAMP 20x Certifications, especially the first FedRAMP 20x Class C Certification, marks the actual beginning of the race to expand the marketplace to enable federal agencies to work with many thousands of different cloud-based services that accelerate key agency operations to reduce the footprint of the information technology infrastructure that they directly manage.
FedRAMP has built a lot of momentum developing FedRAMP 20x over the past two years, but that momentum will need to scale dramatically to meet our shared vision with OMB. FedRAMP 20x will need to be expanded and improved continuously to open access to more technology companies in different industries. Agencies will need more guidance and support from FedRAMP, especially the FedRAMP Board. FedRAMP will need to continue to operate openly, transparently, with maximum engagement with industry. And industry will need to continue to participate, supporting improvements that benefit all stakeholders, educating and training their customers, and shifting compliance operations closer to engineering where appropriate.
Nearly a hundred companies have already stepped across that starting line. Each of them marks a critical milestone of their own. Every FedRAMP Certification, every agency ATO, one at a time, FedRAMP will run with them until we are running with thousands. And then the real fun begins.
