FedRAMP 20x Goes Mandatory January 1: What to Do Now

On October 8, FedRAMP opened fiscal year 2027 with a review of the year just finished and a plain message about the one ahead. FY26 delivered the first Consolidated Rules for 2026 (CR26), opened the new FedRAMP 20x certification pipelines, and produced 92 new certifications, 26 of them under 20x. FY27 is when the new model stops being optional. The rules take mandatory effect for all stakeholders on January 1, 2027, and FedRAMP stops accepting applications for new Rev5 certifications on June 11, 2027.

That leaves about two months before the first hard date. If you sell a cloud service to federal agencies, or you are an agency relying on one, here is what changed, which dates matter, and what to do before the end of the year.

What FedRAMP 20x changes

FedRAMP describes 20x as a move away from long narrative compliance documents toward short, declarative rules that a cloud service provider can follow one at a time. Following every applicable rule is what earns and keeps a FedRAMP Certification. The program's stated goal, in its October 8 post, is to bring thousands of cloud services into the FedRAMP Marketplace by building on the security investments companies have already made for commercial customers.

Three changes stand out for buyers and providers:

• Classes instead of impact levels. CR26 replaces the Low, Moderate and High labels with Certification Classes A through D. Class A is a transitional, program-certified tier for low-risk agency pilots; FedRAMP's notice on the topic names SOC 2 Type II as the first external framework accepted for 20x Class A and says there is no bridge from Class A to the higher classes. Classes B and C opened to all providers at the end of August, and FedRAMP plans to bring Class D under 20x during FY27.
• Key Security Indicators (KSIs). KSIs summarize the security capabilities a provider must prove and measure, grouped into themes such as change management, identity and access management, incident response, monitoring and logging, recovery planning, service configuration and supply chain risk. FedRAMP says KSI processes should continuously collect evidence, detect configuration drift and alert on deviations from security baselines, and that KSIs "aren't one-time requirements."
• Persistent assessment. Class B, C and D providers must include all KSIs in an independent FedRAMP assessment at least once a year, performed by a FedRAMP-recognized assessor listed on the Marketplace.

The dates that matter

FedRAMP's own timeline for the Consolidated Rules lists these milestones:

Date	What happens
July 4, 2026	Optional early adoption of the Consolidated Rules begins
July 28, 2026	FedRAMP Ready submissions are no longer accepted; providers are pointed to 20x Class A
August 3, 2026	20x Class A applications open
August 31, 2026	20x Class B and Class C applications open
December 7, 2026	Vulnerability Detection and Response rules apply to obtaining and maintaining 20x certification
January 1, 2027	Consolidated Rules take mandatory effect for all stakeholders
June 11, 2027	FedRAMP stops accepting applications for new Rev5 certifications

Two points are easy to miss. First, January 1 is the mandatory date, but FedRAMP notes that some areas carry their own effective dates and that over the following year all providers must follow them to keep their certification. Second, the vulnerability rules arrive earlier than the rest: the Vulnerability Detection and Response ruleset lists December 7, 2026 for both initial and ongoing 20x certification, with a grace period ending March 7, 2027, and cites CISA's BOD 26-04 as the mandate behind it.

For existing Rev5 certifications, FedRAMP says it expects to publish clear transition paths and timelines for all cloud services moving to 20x by the end of FY27. Until those land, Rev5 holders should treat the transition as coming rather than optional.

What the vulnerability rules actually ask for

The Vulnerability Detection and Response ruleset is where 20x becomes concrete for engineering teams. Among its provisions:

• Providers must systematically, persistently and promptly discover vulnerabilities, and track, evaluate, mitigate and remediate them.
• Failures in detection and response processes must themselves be treated as vulnerabilities.
• Providers should not launch new machine-based resources that carry Known Exploited Vulnerabilities, and should remediate KEVs by the due dates in CISA's KEV catalog.
• Detection frequency scales with class. For resources likely to drift, the recommended interval is at least every month for Class B, every 14 days for Class C and every 7 days for Class D. Persistent machine verification and validation must run at least every 7 days for Class B and every 3 days for Class C.
• Remediation timeframes depend on potential agency impact, internet reachability and likely exploitability. For the most severe, internet-reachable, likely-exploitable findings, the table allows 4 days at Class A and B, 2 days at Class C and 12 hours at Class D.

Those intervals are hard to hit with quarterly scans and a spreadsheet. They assume automated asset inventory, scanning that runs after every significant change, and a remediation pipeline that can push fixes through in days.

What it means for agencies

Agencies keep their core obligations under the Consolidated Rules: use FedRAMP-certified services where FedRAMP applies, follow the NIST Risk Management Framework, review certification materials, implement compensating controls where needed, authorize the system and notify FedRAMP, and keep monitoring. One line deserves attention from contracting teams: agencies must avoid contract terms that would prevent a provider from meeting its ongoing FedRAMP obligations.

FedRAMP's FY27 plan also includes an Agency Cloud Use Framework, built with the FedRAMP Board and Technical Advisory Group, to give agencies processes and policies for adopting 20x services quickly. Until it arrives, a sensible step, suggested in a July research note from the Cloud Security Alliance, is to ask each FedRAMP-authorized vendor whether it will move to 20x or stay on Rev5, and to track vendors with no stated plan as a continuity risk.

A checklist for the next 60 days

If you are a cloud service provider:

1. Pick your path now. FedRAMP's October post says providers without substantial Rev5 progress and a guaranteed sponsor "should pivot to FedRAMP 20x immediately." If you are on Rev5, plan backward from the June 11, 2027 cutoff.
2. Meet the December 7 vulnerability rules first. Map your current scanning cadence and remediation times against the ruleset's tables for your target class, and close the gaps.
3. Automate evidence. Inventory what you produce today (SSP sections, POA&Ms, scan reports) and identify which KSIs you can already prove from system data such as configuration state, identity logs and pipeline records.
4. Schedule your assessor. Annual independent assessment of all KSIs is required for Classes B through D, so line up a FedRAMP-recognized assessor early.
5. Make compliance a shared job. Engineering, security operations and the compliance team need to own the evidence together, because much of it now comes from the platform itself.

If you are an agency:

1. List the cloud services you depend on and their current FedRAMP status, Rev5 or 20x.
2. Ask each provider for its transition plan and target class.
3. Review contract language so nothing blocks a provider from meeting ongoing FedRAMP rules.
4. Check whether any services you rely on are Class A, and add compensating controls if use goes beyond a low-risk pilot.

Where to start

The Consolidated Rules are long, but the direction is clear: continuous, machine-verifiable security evidence instead of periodic paperwork. Providers that already run strong DevOps and cloud monitoring practices will find much of the work is wiring existing signals into the evidence FedRAMP expects. Baygramm helps cloud providers and agencies plan that move, from federal cloud architecture and cloud visibility to automated vulnerability management through our cybersecurity practice. If you want a second set of eyes on your 20x readiness before January 1, get in touch.