FedRAMP 20x Architecture: Class A, B, C and KSIs (2026)

Q: What is FedRAMP 20x?

FedRAMP 20x is the new assessment approach for cloud services sold to US federal agencies. Instead of a narrative security package sampled once a year, providers publish machine-readable records of their security decisions, validate them automatically and persistently, and report on a fixed cycle. Its rules were finalised in the Consolidated Rules for 2026 and the pipeline opened in August 2026.

Q: What is the difference between FedRAMP 20x Class A, Class B and Class C?

FedRAMP describes Class A as for services with mature security programmes entering the federal market, Class B for small-scale or light-use services, and Class C for enterprise services likely to be used across an entire agency. In programme shorthand these are pilot, Low and Moderate. Requirements for validation, reporting and metric history increase with each class. Class D for High is a future pilot.

Q: Can I use my SOC 2 Type II report for FedRAMP?

For Class A, yes. The Class A rules accept a SOC 2 Type II, a GovRAMP assessment or a prior FedRAMP Rev5 or Ready result completed within the past 12 months as the entry requirement. You must also follow a list of FedRAMP-specific rules and demonstrate seven Key Security Indicators. SOC 2 alone is not sufficient for Class B or Class C.

Q: Do I still need an agency sponsor for FedRAMP in 2026?

Not for a 20x programme certification. Removing the agency sponsorship barrier was one of the stated goals of FedRAMP 20x, and providers apply to FedRAMP directly. Certification does not oblige any agency to buy: each agency still makes its own risk decision and issues its own authorization to operate for the system that uses your service.

Q: When does FedRAMP Rev5 end?

FedRAMP's published timeline says it will stop accepting applications for new Rev5 certifications on 11 June 2027. The Consolidated Rules for 2026 take mandatory effect for all stakeholders on 1 January 2027. FedRAMP has said it will provide a transition path and timeline for existing Rev5 offerings; dates on the programme site are described as estimates and may shift.

Q: What are FedRAMP Key Security Indicators?

Key Security Indicators are outcome statements that replace control-by-control narrative as the basis of a 20x assessment. The Class C reference lists 46 across ten themes, such as change management, identity and access, and cloud-native architecture. For each one a provider supplies measures, a verification that they fit, and a validation that they are working, in both human-readable and JSON form.

Q: How often must evidence be validated under FedRAMP 20x Class C?

Class C providers must verify and validate the status of machine-based information resources at least once every three days. They also supply an Ongoing Certification Report every three months, host a quarterly review, and keep historical metrics for each indicator: a 30-day summary, a summary of up to a year, and the daily data including validation status.

Q: What should a SaaS company build first for FedRAMP 20x?

Start with a current SOC 2 Type II and identity: passwordless or phishing-resistant MFA and automated account lifecycle. Then stand up a trust centre and apply for Class A. In parallel build an evidence pipeline that collects from live systems, writes one measure per indicator daily to an append-only store, and treats a failed validation as a vulnerability.

Satyam Kumar

Back to Blog

architecture

FedRAMP 20x Is a Telemetry Contract, Not a Document: Architecting for Class A, B and C Certification in 2026

By Satyam KumarNovember 13, 202616 min read

fedramp 20x fedramp certification fedramp class c fedramp class a key security indicators security decision record consolidated rules for 2026 government cloud selling saas to federal agencies continuous compliance compliance automation grc engineering soc 2 type ii persistent validation fedramp rev5 trust center

FedRAMP 20x Is a Telemetry Contract, Not a Document: Architecting for Class A, B and C Certification in 2026

Frequently Asked Questions

Share this article

Twitter LinkedIn WhatsApp

Satyam Kumar

Founder & AI Architect, AppScale LLP

AI & Cloud Architect. Helping teams build systems that scale to millions.

LinkedIn GitHub

FedRAMP 20x Is a Telemetry Contract, Not a Document: Architecting for Class A, B and C Certification in 2026

Frequently Asked Questions

Share this article

Comments

Leave a comment