FedRAMP 20x Explained: Key Security Indicators, Phases, and How Cloud Teams Get Ready

FedRAMP 20x is the current way the US government certifies cloud services for federal use. Instead of asking providers for a long System Security Plan, it measures security through Key Security Indicators (KSIs): 46 short, testable statements about how a cloud service is run, which providers back with evidence that is checked again and again, much of it automated, and delivered in machine-readable files. FedRAMP, the Federal Risk and Authorization Management Program, is run by the General Services Administration (GSA), and GSA states that FedRAMP "is required for all federal agency cloud services."

GSA announced 20x on March 24, 2025, with the goal that "new cloud services can be approved in weeks instead of years." After two pilots, FedRAMP published the Consolidated Rules for 2026 and announced on June 25, 2026 that "FedRAMP 20x is now widely available." Applications for Class B and Class C, the two classes most SaaS companies will look at, opened on August 31, 2026.

What FedRAMP Is and What 20x Changes

FedRAMP gives agencies one standard security review of a cloud product, so a service assessed once can be reused across the government instead of being reviewed from scratch by every agency. The older path, Rev5, is built on the NIST SP 800-53 Revision 5 control catalog and has relied on long narrative documents. Under the 2026 rules, FedRAMP calls what it grants a FedRAMP Certification. Each agency still makes its own Authority to Operate (ATO) decision, the formal approval to use a system, and FedRAMP's rules advise agencies to consider the security category in that ATO when they plan ongoing reviews.

What 20x changes for a provider, per the Consolidated Rules:

• Indicators replace control narratives. Security is expressed as 46 KSIs in 10 themes. Each KSI is one sentence about an outcome, such as "Modifications to the cloud service offering are logged and monitored," and each maps to NIST SP 800-53 controls in FedRAMP's rules data.

• Automation is required at Class C. Class B providers SHOULD use at least 1 automated method to verify and validate each KSI. Class C providers MUST use at least 2.

• Evidence stays current. The rules use the word "persistently" throughout. A Class C package must be brought up to date at least once every 2 weeks, a Class B package at least once a month, and the first package must show status verified within the previous 7 days.

• The SSP becomes a short overview. FedRAMP says the Certification Package Overview "replaces the historically required base System Security Plan for FedRAMP Rev5," and it must be supplied in human-readable and JSON formats.

• No sponsor needed. FedRAMP says 20x Certifications are processed directly by FedRAMP and "do not require an active agency contract or sponsor." It also says offerings "built on FedRAMP Certified infrastructure or platforms should choose FedRAMP 20x," while Rev5 is meant for "standalone services entirely owned and operated by the cloud service provider."

The 46 Key Security Indicators

The Consolidated Rules for 2026 (version 2026.10.13.01, the current release on FedRAMP's GitHub) define 46 KSIs across 10 themes. The table shows each theme, its KSI count, and where the evidence usually lives.

Five KSIs are optional at Class B and required at Class C: Enforcing Intended State, Authorizing Log Access, Preventing Residual Risk, Removing Unwanted Data, and Validating Communications. Themes such as Cybersecurity Education describe reviews by people, so back them with written statements and records.

FedRAMP 20x Phases and Status

FedRAMP runs 20x in phases measured in federal fiscal years, which start on October 1. As of October 2026, the FedRAMP 20x page lists:

• Phase 1, completed (FY25 Q3 to Q4): the Low pilot and proof of concept. FedRAMP received 26 complete packages between May 30 and August 18, 2025, and completed 13 reviews.

• Phase 2, completed (FY26 Q1 to Q2): the Moderate pilot. FedRAMP received 14 qualifying submissions. The first cohort received pilot authorizations on March 6, 2026, and six more providers had them by April 27, 2026.

• Phase 3, active (FY26 Q3 to Q4): wide-scale adoption. The Class A pipeline opened on August 3, 2026, and the Class B and Class C pipelines on August 31, 2026.

• Phase 4, estimated (FY27 Q1 to Q2): a Class D (High) pilot.

• Phase 5, estimated (FY27 Q3 to Q4): the end of new Rev5 Certifications.

Two dates on fedramp.gov matter for planning. On January 1, 2027, the Consolidated Rules become mandatory for all stakeholders, and existing Rev5 Certifications must adopt them. From June 11, 2027, FedRAMP will no longer accept applications for new Rev5 Certifications.

Low vs Moderate: Class B and Class C

The FedRAMP 20x page lists the initial classes as "Class A (Pilot), Class B (Low), and Class C (Moderate)." FedRAMP's Certification Classes page adds a caution: classes "indicate the level of assurance provided, not the level of security or protection provided," and agencies should not treat them as one-for-one replacements for Low, Moderate, or High impact levels. It presents Class B as adequate for "most Low impact agency information systems" and Class C for "most Low or Moderate impact agency information systems."

In practice, Class C asks for more and asks more often. Compared with Class B, it needs at least 2 automated methods per KSI instead of 1, verification of machine-based resources at least every 3 days instead of every 7, and a package refresh every 2 weeks instead of monthly. If your buyers are agencies that run Moderate systems, plan for Class C from the start.

The Independent Assessor (Formerly the 3PAO)

FedRAMP has moved away from the term Third-Party Assessment Organization (3PAO). The 2026 rules say "FedRAMP Recognized independent assessment services" instead, to match the FedRAMP Authorization Act. Assessors must hold accreditation through the American Association for Laboratory Accreditation (A2LA), and FedRAMP will not accept verification or validation from an assessor that is not FedRAMP Recognized.

Under 20x, Class B and Class C providers must include all KSIs in an independent assessment at least once per year. The assessor verifies that what you run matches what you documented and validates that it works, then writes summaries that go into your package. One rule worth knowing early: an assessor cannot assess an offering within 2 years after advising or consulting on it. Pick your advisor and your assessor as two separate firms.

What a Machine-Readable Package Means

FedRAMP uses the federal definition of machine-readable: data "in a format that can be easily processed by a computer without human intervention while ensuring no semantic meaning is lost." For a 20x package, that means:

• A Certification Package Overview in human-readable and JSON formats.

• A Security Decision Record, also in both formats, explaining how each applicable FedRAMP rule is met.

• Significant Change Notifications and related audit records in human-readable and JSON formats.

• JSON that is valid against FedRAMP's published JSON schemas, with automation keeping the human and machine versions consistent.

FedRAMP publishes the rules themselves as JSON on GitHub. Agency tools must be able to read and produce formats that include JSON and OSCAL (Open Security Controls Assessment Language), NIST's open, machine-readable format for security control and assessment data.

FedRAMP 20x Readiness Checklist for Cloud Teams

• Pick a class. Choose Class B or Class C for the agencies you sell to, then read the rules for that class.

• Inventory (Policy and Inventory). Generate your inventory from cloud APIs, not a spreadsheet. KSI-PIY-GIV asks for real-time inventories from authoritative sources.

• Change control (Change Management, Service Configuration). Put infrastructure in code, ship changes through reviewed pull requests and pipelines, redeploy instead of editing live resources, and record who approved each change.

• Logging (Monitoring, Logging, and Auditing). Turn on audit trails and flow logs in every account, send them to a SIEM, write down which event types you log, and keep records of log reviews.

• Vulnerability management. Scan on a schedule that meets your class, every 3 days for Class C, and track each finding to a fix with dates. The rules also expect vulnerability history you can share.

• Identity (Identity and Access Management). Use phishing-resistant MFA or passwordless login, remove standing admin access in favor of -in-time grants, and review non-human credentials.

• Recovery (Recovery Planning). Set RTO and RPO targets, check that backups meet them, and test a restore.

• People and process. For training, incident reviews and executive reviews, write a short statement, name an owner, set a review date, and keep the records.

How ops0 Supports FedRAMP 20x Readiness

ops0 shows your readiness against the 46 FedRAMP 20x KSIs, scored continuously from your own cloud data, and builds the FedRAMP machine-readable package files for you to complete and submit. It is a readiness tool. ops0 is not FedRAMP authorized, submits nothing to FedRAMP or an agency, and does not replace your independent assessor.

• A KSI workspace. All 46 KSIs in 10 themes, shown with FedRAMP's official statements and pinned to rules version 2026.10.13.01, for Class B or Class C. Each KSI is Pass, Fail, Partial, Needs attestation, Attested, or Not applicable, with a score per theme and per cloud.

• Signals from your cloud. Least privilege results, monitors for identity, network, logging and drift, approval evidence, and cloud posture checks mapped to KSIs on AWS, Azure, and Google Cloud, with an ops0 mapping for Oracle Cloud. Evidence linked only through NIST controls can make a KSI Partial, never Pass.

• Freshness built in. Every signal carries a validated-at time. On Class C, posture data older than 3 days turns a pass into Partial until you scan again.

• Attestations for process KSIs. Statements with an owner, a review-by date and an optional file, kept as append-only versions so every change is on record.

• The package files. Exports include the certification package overview, vulnerability detail, ongoing certification report, significant change notifications, KSI results and OSCAL assessment results. The FedRAMP documents are checked against FedRAMP's published schemas, with a list of the fields you must complete, and ops0 leaves fields empty rather than guessing.

• Ongoing proof. Continuous compliance monitoring re-checks every account. The Security Hub tags issues with KSI ids and tracks owners and SLAs. The closed loop follows each finding from detected to fixed, guarded by policy, and proven. Sealed evidence packs carry KSI statuses and the attestation ledger under a signed, timestamped manifest your assessor can verify.

The same monitors and evidence runs also cover SOC 2 and ISO 27001. See compliance automation.