Phased Implementation of FedRAMP 20x

FedRAMP 20x is being delivered in phases, with specific inputs and outcomes expected for each phase. This phased approach enables agile delivery of policy and technology improvements based on the measurable impact to cloud service providers, assessors, agencies, and other stakeholders. The details of each phase will be responsive to learnings from prior phases and within each phase such that the final delivery of 20x will look different than expected originally while being a far better product.

FedRAMP 20x is currently in Phase 2.

All future timelines on this page are estimated goals at the time of the latest update. These estimated timelines are available for the awareness of the public and do not represent a firm commitment by FedRAMP or GSA. Timelines will shift based on real-world impact and changes in the operating environment throughout each phase. You can view bi-weekly updates about how work is progressing through each phase on the public FedRAMP Roadmap.

20x - PHASE 1

COMPLETED

20x Low Pilot and Proof of Concept

Timeline

FY25 Q3 to FY25 Q4

Delivery Goal

Test the concepts behind FedRAMP 20x with industry to demonstrate the feasibility of a true automation-based approach to assessment and validation with potential Low impact cloud services.

Outcome

Demonstrated feasibility and demand with massive industry interest and support.

20x - PHASE 2

COMPLETED

20x Moderate Pilot

Timeline

FY26 Q1 to FY26 Q2

Delivery Goal

Include additional requirements for FedRAMP Moderate to ensure effective adoption and implementation based on the outcomes from Phase 1 with a goal of demonstrating the additional automated validation required for Moderate.

Outcome

Expanded capabilities and coverage and completed initial testing.

20x - PHASE 3

ACTIVE

Wide-scale Adoption of FedRAMP 20x

Timeline

FY26 Q3 to FY26 Q4

Delivery Goal

Formalize all FedRAMP 20x requirements for cloud service providers based on the outcome from the Phase 1 and Phase 2 pilots; provide wide-scale agency support and training for adoption of the new FedRAMP 20x Certification type.

20x - PHASE 4

FUTURE

20x Class D (High) Pilot

Timeline

FY27 Q1 to FY27 Q2

Delivery Goal

Continued wide-scale adoption of FedRAMP 20x while piloting a path for 20x Class D (High) cloud-native services; determine the future of FedRAMP Certification for platform services that are not cloud-native.

20x - PHASE 5

FUTURE

End of Life for Cloud-Native Rev5 Certifications

Timeline

FY27 Q3 to FY27 Q4

Delivery Goal

FedRAMP will stop accepting new Rev5 Certifications for cloud-native services at the end of this phase and provide a clear path and timeline for ensuring all legacy Rev5 Certified cloud-native service offerings can successfully transition to FedRAMP 20x Certification. This is likely to include multi-year deadlines.