Regulatory update
FedRAMP 20x Moves Past Its Pilots; New Rev5 Submissions to Close in 2027
FedRAMP says 20x is now its standard path, with certification classes A to C available and a High-impact class in development. FedRAMP plans to stop accepting new Rev5 submissions on 11 June 2027.
What happened?
FedRAMP’s 20x initiative, announced in March 2025, aims to replace document-heavy authorisation packages with automated, machine-readable evidence. It ran a Low pilot from April to September 2025 and a Moderate pilot from November 2025 to March 2026. FedRAMP reported its first Moderate pilot authorisations in March 2026, and six more providers authorised by 27 April 2026. In Phase 3, FedRAMP describes 20x as its standard path rather than a pilot.
The class model
| Class | Intended for | Rough Rev5 equivalent |
|---|---|---|
| A | Providers with established security programmes entering the federal market | Pilot |
| B | Small-scale or light-use services | Low |
| C | Common enterprise services used across an agency | Moderate |
| D | High-impact services | High (in development) |
The Rev5 timeline
FedRAMP has said it will stop accepting new Rev5 submissions on 11 June 2027, and will publish a transition path for existing Rev5 offerings later. FedRAMP labels these future dates as estimates.
What should you do?
Cloud providers planning federal market entry should assess eligibility for 20x classes now and invest in automated evidence generation. Existing Rev5 holders should prepare for a transition and track FedRAMP announcements. See our FedRAMP guide.
What to watch
- The final Consolidated Rules for 2026 and the opening of class submission pipelines.
- The Class D (High) pilot, estimated for the first half of FY2027.
- The transition timeline for existing Rev5 authorizations.
Sources and official references
- FedRAMP 20x — US General Services Administration — FedRAMP (official source)
- FedRAMP (programme home) — US General Services Administration — FedRAMP (official source)
Links go to the publisher's own site. Where a standard is sold or copyrighted, MajorCyber™ summarises it in original words and links to the official listing instead of reproducing its text.
Listen to this page
Read aloud in UK English by your own device. Nothing is sent anywhere, and the voice is whichever one your browser provides.
General educational information, not legal or professional advice. Check the official sources and take qualified advice before acting.
