Regulatory update
FedRAMP Confirms 11 June 2027 as the End of Rev5 Certification Processing
In its FY26 review, FedRAMP states it will stop processing legacy Rev5 applications on 11 June 2027, and says 20x Class B and C opened to all providers at the end of August 2026.
What changed?
On 8 October 2026, as the US government moved into fiscal year 2027, FedRAMP published a review of its previous year and its goals for the next. Three points matter for cloud providers.
- Rev5 wind-down. FedRAMP says it will stop processing legacy Rev5 certification applications on 11 June 2027. It expects to publish clear transition paths and timelines for all services to move to 20x by the end of FY27.
- 20x pipelines. Class B and Class C opened to all cloud service providers at the end of August 2026. FedRAMP says agencies are already using services certified under the 20x framework.
- Other changes. FedRAMP Ready was retired at the end of July. In August a limited Lost Sponsor and Ready Conversion pathway opened for eligible providers affected by changes in federal acquisitions. FedRAMP received 40 applications (17 Lost Sponsor, 23 Ready Conversion) and says it does not plan to expand eligibility before new Rev5 certifications end.
What are the numbers?
For FY26, FedRAMP reports 92 new certifications (66 Rev5 and 26 20x), 538 certified offerings at year end, and 760 new agency authorisations or authorisations to use.
Why does it matter?
Our earlier briefing on 20x described the 11 June 2027 date as FedRAMP’s estimate. This post states it more firmly. Providers still planning a new Rev5 route now have a defined deadline.
What should you do?
If you are planning a certification, compare the 20x class that fits your service against the Rev5 route. FedRAMP advises providers without significant Rev5 progress and a guaranteed sponsor to pivot to 20x immediately. Read the current rules on fedramp.gov. See our FedRAMP guide.
What to watch
- The Rev5 to 20x transition paths and timelines, promised by the end of FY27.
- The Class D certification option and 20x rules for self-hosted and hybrid-hosted services, both FY27 goals.
- Whether the limited Lost Sponsor pathway changes, given FedRAMP says it will not widen eligibility before the Rev5 cut-off.
Sources and official references
- From Foundation to Implementation: Scaling a Better Path to Cloud Security — US General Services Administration - FedRAMP (official source)
Links go to the publisher's own site. Where a standard is sold or copyrighted, MajorCyber™ summarises it in original words and links to the official listing instead of reproducing its text.
Listen to this page
Read aloud by your own device, in the most natural English voice it has. Nothing is sent anywhere. Pick another voice or speed if you prefer.
General educational information, not legal or professional advice. Check the official sources and take qualified advice before acting.
