A different model for cloud assurance
FedRAMP 20x
A new approach to cloud security assessment and authorization that moves beyond traditional compliance to focus on the security decisions that matter most.
We designed FedRAMP 20x for businesses to set their own security goals, continuously measure the effectiveness of their decisions, and assure federal government agencies through progressively increasing commitments to addressing government-specific needs.
“ ” — OMB Memorandum M-24-15 on FedRAMP's purpose
FedRAMP 20x is here
Available Now
The full rules for FedRAMP 20x Certification are now finalized for Class A, Class B, and Class C.
Class A
Available nowClass A Certifications are for cloud services with mature security and compliance programs that are looking to enter the federal marketplace. Class A requires a small amount of information in advance and a small subset of initial ongoing monitoring and reporting requirements.
Class B
Available nowClass B Certifications are for cloud services that provide fairly common small-scale or light use services where an entire agency is unlikely to use the service for important work so considerable additional investment in ongoing maintenance and reporting activities is not expected.
Class C
Available nowClass C Certifications are for cloud services that provide common enterprise services that are likely to be used in systems across an entire agency or that provide important government services.
Class D
Phase 4Class D Certifications will be developed during FedRAMP 20x Phase 4.
“ ” — OMB Memorandum M-24-15 on Class A Certifications
What guides the work
Core Principles
Five ideas move assurance away from paperwork and toward evidence.
Transparency
Cloud service providers should share honest information about their security decisions without worrying about whether they meet an arbitrary bar or set of requirements that might not apply or make sense for them.
Flexibility
Informed engineering decisions that produce secure outcomes appropriate to a specific provider’s environment and goals are strongly encouraged. The effective security posture of a cloud service should never be reduced to meet a security control.
Accountability
Instead of compliance-focused audits to check a box, assessments provide direct business value by clarifying the effectiveness of chosen measures. Security should be continuously enforced, monitored, and reported—not staged for a point-in-time audit.
Accuracy
Assessments based on reviewing the effectiveness of security decisions instead of questioning the validity of each decision are more likely to lead to accurate reporting of a provider’s approach to security.
Automatic Validation
Once a goal and its measures are defined, status, progress, and outcomes should be automatically enforced and validated whenever possible. Continuous evidence of what is happening is stronger than a policy saying it should happen.
“ ” — OMB Memorandum M-24-15 on Commercial Services
Why This Works
Context Matters
Security decisions are complex. The right expectations for a cloud service depend on the agency use case and mission—not a single, binary verdict that a provider is either “secure” or “not secure.”
“ ” — OMB Memorandum M-24-15 on Decision Making
The government has many needs for many types of services, each with different requirements for confidentiality, integrity, and availability. Some systems carry little risk regardless of their security posture; a failure in another could threaten an agency's operational effectiveness.
Requiring every service to meet requirements designed for the highest-risk systems is not fair to agencies or the cloud services they want to use.
Instead of deciding if a cloud service is “good enough” for every government-wide use case, the FedRAMP assessment process ensures agencies have sufficient, accurate information to make the right security-based decisions.
Two services, different needs
A public website might need high availability, moderate integrity, and low confidentiality. A medical records application might need moderate availability, high integrity, and high confidentiality.
The 20x approach lets agencies understand those tradeoffs and select the service whose security goals match the mission.
Built in public, delivered in increments
Phased Implementation
Each phase responds to measurable impact and lessons from providers, assessors, agencies, and the public.
FedRAMP 20x is currently in Phase 3. Future dates are estimates for public awareness, not firm commitments, and will shift as real-world conditions change.
Delivery goal
Test the concepts behind FedRAMP 20x with industry and demonstrate the feasibility of automation-based assessment and validation for potential Low impact cloud services.
Outcome
Demonstrated feasibility and demand with substantial industry interest and support.
Delivery goal
Add the requirements needed for FedRAMP Moderate and test whether automated validation could scale to a higher impact level.
Outcome
Expanded capabilities and coverage and completed initial Moderate testing.
Delivery goal
Formalize FedRAMP 20x requirements from the Phase 1 and 2 outcomes and provide wide-scale agency support and training for the new Certification types.
Delivery goal
Continue wide-scale adoption while piloting a path for 20x Class D (High) services.
Delivery goal
FedRAMP will stop accepting new Rev5 Certifications on June 11, 2027, and provide a clear transition path and timeline for existing Rev5 offerings by the end of Phase 5.
The path to FedRAMP 20x
Timeline
The policy, pilot, and delivery milestones that shaped FedRAMP 20x and what comes next.
Get in the FedRAMP Game
Let's Go!
FedRAMP 20x simplifies the path to federal cloud adoption. Follow along with FedRAMP as we continue to build and evolve the program to meet the needs of federal agencies and cloud service providers.