09/01/2026
Big FedRAMP news just dropped 🚨
As of August 31, FedRAMP officially opened the 20x Class B and Class C submission pipelines, the next major milestone in the program's shift away from the traditional Rev5 process.
Here's what changed:
The old impact-level system, Low, Moderate, High, is being fully replaced with a new class structure:
Class A → entry-level path for the Marketplace, opened back on August 3
Class B → replaces the old Low impact level
Class C → replaces the old Moderate impact level
Class D → will eventually replace High, still pending, expected to pilot sometime in FY27
But the real shift isn't the renaming. It's how certification itself now works.
No agency sponsor required anymore. Under the legacy Rev5 process, providers needed an agency to sponsor their authorization before they could even begin. FedRAMP 20x removes that requirement entirely, which opens the door for a lot more cloud providers to pursue certification on their own timeline instead of waiting on a sponsor to move first.
Manual document review is being replaced with automated validation đź“Š Instead of the traditional, document-heavy audit process everyone associates with FedRAMP, 20x relies on Key Security Indicators, KSIs, 56 of them for the Class B baseline, 61 for Class C, validated through automation and machine-readable evidence rather than long narrative control write-ups.
If you're a cloud service provider who's been waiting on the sidelines for 20x to prove itself past the pilot stage before committing real resources to it, this is that moment. Class B and C are no longer limited or experimental. They're now the path forward for most providers who were previously targeting Low or Moderate impact authorizations under the old system.
A few dates worth keeping on your radar đź“…
August 31, 2026 - Class B and C pipelines officially open (today)
January 1, 2027 - CR26 becomes mandatory for all stakeholders, no more optional adoption
June 11, 2027 - FedRAMP stops accepting brand new Rev5 certification applications entirely
We'll be watching closely how agencies respond to this first real wave of 20x-certified providers under the new class structure. This is one of the more consequential shifts FedRAMP has made since the program began, worth understanding now rather than catching up on later ⏳
