FedRAMP 20x widely available to cloud services with release of 2026 consolidated rules

The Federal Risk and Authorization Management Program finalized its 2026 consolidated rules for cloud services authorization on Thursday, officially making FedRAMP 20x certification widely available.

Following a push to modernize and expedite the process by which cloud service providers can obtain clearance to work with the government through 2028, the new package of rules was posted for public inspection earlier this year.

“Incremental operational changes helped but were not enough to deliver the speed, clarity, and scalability that agencies and cloud service providers need,” the FedRAMP blog post said. “Now the work shifts to adoption: helping stakeholders understand the rules, improving supporting tools and resources, automating workflows, and continuing to make FedRAMP clearer, faster, more transparent, and more reusable.”

Optional early adoption of the rules will begin on July 4 and will become mandatory on Jan. 1, 2027, the post said.

The new rules include moving from impact levels (low, moderate, high) to “certification classes” (A, B, C, D) and expecting cloud service producers to continuously update their certification packages “using automation as changes occur to ensure they are never out of date.” The rules this year are also built in a machine-readable format.

FedRAMP Rev5, the legacy certification framework, will remain available until June 11, 2027, but “Rev5 providers should not wait to understand the new rules,” as the consolidated 2026 rules are “now the central reference point for how FedRAMP will evaluate certification submissions and manage ongoing requirements,” it said.

The blog said FedRAMP will continue to release updates, highlighting more structured email forms and a new brand guide coming this summer. FedRAMP 20x will enter its next phase with a 20x Class D (High) pilot in the first or second quarter of fiscal 2027, the FedRAMP site said.