FedRAMP 20x Readiness
Scoping, KSI Validation Engineering & Ongoing Certification Support
- Home
- FedRAMP 20x Readiness
“You own the certification. We engineer the evidence.”
FedRAMP 20x Readiness, Engineered as Code
FedRAMP 20x replaces narrative security documentation with Key Security Indicators (KSIs) that your cloud service proves with automated validation. VIS helps cloud service providers prepare for FedRAMP Certification under the Consolidated Rules for 2026 (CR26): we define the scope, build the validations as code, and help you prepare the package your independent assessor reviews.
You own the certification and every record behind it. VIS is an advisor only — we never assess — so every FedRAMP Recognized assessor stays available to you.
What Changed in 2026
The dates that matter, as of 14 October 2026:
| Date | What happens | Who it affects |
|---|---|---|
| 25 Jun 2026 | FedRAMP published the Consolidated Rules for 2026 (CR26). Classes A, B, C and D replace FedRAMP Ready and the Low, Moderate and High baselines. | Every cloud service provider |
| 28 Jul 2026 | FedRAMP Ready retired. Existing Ready listings became Legacy. | Ready listings: consider Class A |
| 3 Aug 2026 | The Class A pipeline opened. | Providers with a recent SOC 2 Type II, GovRAMP or Rev5 result |
| 31 Aug 2026 | Class B and Class C pipelines opened to all providers. 20x certifications need no agency sponsor or contract. | Cloud-native services on FedRAMP Certified infrastructure |
| 7 Dec 2026 | The vulnerability rules (VDR and VER) become mandatory. About the sprint | Every certified service, Rev5 and 20x |
| 1 Jan 2027 | CR26 becomes mandatory for everyone, including current Rev5 certifications. | Existing Rev5 providers |
| 11 Jun 2027 | FedRAMP stops accepting applications for new Rev5 certifications. | Providers still planning Rev5 |
Which Class Do You Need?
Each class sets how you qualify and how much of your evidence must be automated.
| Class | How you qualify | Automated validation per KSI |
|---|---|---|
| Class A formerly FedRAMP Ready | A Rev5 certification (including FedRAMP Ready), SOC 2 Type II or GovRAMP result from the past 12 months | May use automation |
| Class B formerly Low | A fresh independent assessment by a FedRAMP Recognized assessor, completed within the previous 3 months | Should use at least 1 |
| Class C formerly Moderate | Same as Class B | Must use at least 2 |
| Class D formerly High | Rev5 today. FedRAMP expects to pilot 20x Class D in late 2026 and offer it formally in early 2027 | Must use at least 4 |
Your initial package must reflect status you verified and validated within the previous 7 days. FedRAMP 20x is for cloud-native services built on FedRAMP Certified infrastructure or platforms; services that run their own infrastructure still use Rev5. CR26 defines 46 Key Security Indicators in 10 themes.
How VIS Helps
Six services, from the first scoping call to ongoing certification. Start with whichever one you need.
20x Readiness Review and Minimum Assessment Scope
We confirm the right path and class, then define your Minimum Assessment Scope: every resource likely to handle federal customer data or affect its security. If you hold a SOC 2 Type II or GovRAMP result, we check whether Class A is the faster first step.
KSI Validation Engineering
We build automated validations for each Key Security Indicator on Azure Government, Microsoft 365 GCC High and AWS GovCloud, as policy and infrastructure as code, so evidence refreshes itself instead of being collected by hand.
VDR/VER Readiness Sprint
A fixed-scope sprint to meet FedRAMP’s vulnerability rules before they become mandatory on 7 December 2026.
Package and Assessment Preparation
We help your team prepare the Security Decision Record, the Certification Package Overview and the machine-readable data CR26 requires, then support you through the independent assessment. You submit the application yourself, as FedRAMP requires.
Ongoing Certification Support
An annual subscription: we review and tune your validations, help you classify significant changes, review your ongoing certification reports before they go out, and prepare you for each annual assessment. Your team stays accountable for the record.
Rev5 to CR26 Transition
For services with a Rev5 certification: a plan to adopt CR26 by 1 January 2027 and the 2027 rule dates that follow, and a move to FedRAMP 20x where it fits.
How It Works
- 20x Path CheckFree 30-minute call
- ScopeClass, path and Minimum Assessment Scope
- EngineerKSI validations as code
- PreparePackage and assessor readiness
- MaintainOngoing certification support
Why Cloud Providers Choose VIS
Advisor only, never assessor
Recognized assessors can’t assess a service they advised in the previous two years. VIS doesn’t assess, so every recognized assessor stays open to you.
Microsoft government cloud depth
We design and build CUI environments on Microsoft 365 GCC High and Azure Government for defense contractors, and we’re a Microsoft partner.
Evidence that stays current
Immutable infrastructure means the validated configuration is the running configuration, so evidence stays fresh between assessments.
One team for FedRAMP and CMMC
If you sell to defense contractors, the same team helps you answer their CMMC and DFARS 252.204-7012 questions.
What we don’t do
- We don’t assess or certify. Assessments come from a FedRAMP Recognized assessor you choose; certification decisions come from FedRAMP.
- We don’t apply on your behalf. FedRAMP requires providers to submit their own application. We help you prepare it.
- We don’t run your security program for you. Your team owns the validations, reports and decisions. We engineer, coach and review.
- We don’t host your service. VIS isn’t a cloud provider or an accelerator, so your boundary and your certification stay yours.
Frequently Asked Questions
Do we need an agency sponsor for FedRAMP 20x?
No. FedRAMP processes 20x certifications directly, without an agency contract or sponsor. Each agency still decides whether to use your service. Rev5 certifications typically need a sponsor in advance.
Is FedRAMP 20x the right path for our service?
FedRAMP says cloud-native services built on FedRAMP Certified infrastructure or platforms should choose 20x. Services that run their own infrastructure, or need Class D today, use Rev5. A free 20x Path Check confirms which applies to you.
Does VIS perform the FedRAMP assessment?
No. VIS is an advisor, not an independent assessment service. Your assessment comes from a FedRAMP Recognized assessor you choose, and because we never assess, every recognized assessor stays available to you.
Which compliance platform do we need?
Usually the one you already have. We build validations that feed your existing compliance automation platform, or a lightweight evidence pipeline if you don’t use one.
How is FedRAMP work priced?
Readiness, engineering and transition work are projects, quoted per project after a scoping call. Ongoing Certification Support is an annual subscription. We don’t publish a price list.
We sell to defense contractors. How does this relate to CMMC?
DFARS 252.204-7012 requires cloud services that handle covered defense information to meet FedRAMP Moderate or equivalent requirements. As of 14 October 2026, DoD hasn’t published how the new classes map to its FedRAMP Moderate equivalency memo, so we document your status against both.
Find your path to FedRAMP 20x
Book a free 30-minute 20x Path Check: your path, your class and the first engineering steps.
Primary sources
VIS LLC is an independent advisory firm. It is not a FedRAMP Recognized assessor, does not perform FedRAMP assessments, and isn’t affiliated with or endorsed by GSA or the FedRAMP program. Dates and rules are as of 14 October 2026; always confirm against current FedRAMP guidance.