If your company sells cloud software to the federal government, the rules just changed in a big way. On June 25, 2026, FedRAMP published the Consolidated Rules for 2026, the largest overhaul of the program in years. FedRAMP 20x is no longer a pilot. It is now the widely available path to work with federal agencies, and it comes with new terminology, new certification classes, and firm deadlines for the legacy process. Here is what changed and what it means for cloud providers and government contractors.
What is FedRAMP 20x?
FedRAMP 20x is the modernized version of the Federal Risk and Authorization Management Program. It grew out of the FedRAMP Authorization Act and the Office of Management and Budget memo M-24-15, which directed the program to become faster, more automated, and easier to reuse across agencies. After a year of public pilots and requests for comment, FedRAMP finalized the Consolidated Rules for 2026 as the single ruleset that now governs how cloud providers earn and keep their status.
The headline idea is simple. Instead of assembling a package from a web of memos, templates, and FAQs, providers now work from one authoritative set of rules that FedRAMP intends to keep stable through the end of 2028. That clarity may be the most valuable change of all.
What the 2026 Consolidated Rules actually change
One ruleset instead of scattered guidance
Everything from terminology to technical requirements, stakeholder responsibilities, and timelines now lives in one structured framework. FedRAMP even publishes the rules in machine-readable JSON so tools can consume them directly. This is meant to end the old scavenger hunt across dozens of documents.
“Certification” replaces “Authorization”
FedRAMP now issues a FedRAMP Certification rather than a FedRAMP Authorization. The change is not just cosmetic. A FedRAMP Certification means the program has confirmed a cloud service meets its requirements. An Authorization to Operate, or ATO, is still a separate risk decision made by an individual federal agency. Splitting the two terms makes it clear where the program’s job ends and where an agency’s decision begins.
New certification classes A, B, C, and D
Rather than framing offerings mainly as Low, Moderate, or High, FedRAMP now sorts certifications into Classes A, B, C, and D. Class A is the new on-ramp. It gives a provider a way to show alignment with FedRAMP requirements as a starting point, and FedRAMP recommends most providers begin there before progressing higher once federal agencies show interest. Classes B, C, and D carry progressively higher assurance expectations and apply across both the legacy and 20x paths.
Automation and machine-readable evidence
The new model leans hard into automation. Instead of manually assembled documents, FedRAMP increasingly expects structured evidence that can be validated and exchanged electronically. For mature providers this can cut repetitive compliance work, but it also raises the bar. You still need trustworthy security operations and governance around the systems that generate that evidence. Automation changes how you prove security, it does not replace it.
The Rev5 deadlines you cannot ignore
The legacy Rev5 process is not disappearing overnight, but the clock is running. If you hold or are pursuing a Rev5 certification, these dates matter most:
- January 1, 2027: The Consolidated Rules for 2026 become mandatory for all stakeholders, and current Rev5 certifications must adopt the new rules.
- June 11, 2027: FedRAMP stops accepting applications for new Rev5 certifications.
- December 31, 2028: Existing Rev5 certifications are expected to remain active until at least this date, unless FedRAMP is directed otherwise.
Several near-term 2026 milestones are already in motion, including marketplace listings opening on July 6, the 20x Class A pipeline opening on August 3, and the Class B and C pipelines opening on August 31. The practical message from FedRAMP is the same for everyone: do not wait to learn the new rules.
What cloud providers should do now
This is the moment to move from watching FedRAMP evolve to planning your own path. A few questions frame the work:
- Who are you selling to: civilian agencies, the Department of Defense, or both?
- Which certification path and class fit your business goals, and does Class A make sense as a starting point?
- How much of your existing security program, such as SOC 2 or a broader compliance foundation, can you build on?
- Are your security operations and evidence collection ready for an automation-first review?
If you also serve the defense supply chain, the direction lines up with what we cover in our CMMC and FedRAMP guide for government contractors, and the assessment mechanics still echo the third-party assessment process. If you are weighing which level of rigor you need, our comparison of FedRAMP Moderate versus High is a useful starting point.
Frequently asked questions
Is FedRAMP 20x replacing traditional FedRAMP?
Yes, over time. FedRAMP has made clear that 20x is the future of the program, but the transition is phased. The legacy Rev5 path remains available during the transition, with new Rev5 applications ending June 11, 2027, and existing certifications expected to stay active until at least December 31, 2028.
Why did FedRAMP change “Authorization” to “Certification”?
The new language separates two things that were often confused. A FedRAMP Certification means the program has confirmed a cloud service meets FedRAMP requirements. An Authorization to Operate is still a risk decision made by an individual agency, which can rely on the certification as part of its own process.
What are the new certification classes?
FedRAMP now organizes certifications into Classes A, B, C, and D instead of leading with Low, Moderate, and High. Class A is an entry point that FedRAMP recommends most providers start with, while B, C, and D carry progressively higher assurance expectations.
Does the automation focus make FedRAMP easier?
Not necessarily easier, but different. Machine-readable evidence can reduce repetitive documentation for mature providers, yet it demands reliable security operations and governance around the systems producing that evidence. The providers who do best will be the ones with the most trustworthy security, not the most paperwork.
When did the 2026 Consolidated Rules take effect?
FedRAMP published the Consolidated Rules for 2026 on June 25, 2026. They become mandatory for all stakeholders on January 1, 2027, with early adoption available immediately for providers who want to get ahead of the transition.
Get ahead of the FedRAMP transition
The FedRAMP 20x shift rewards organizations that start early and treat security as an operating discipline, not a document drill. Atlantic Computer Systems helps cloud providers and government contractors build the security operations, evidence, and compliance foundation these programs now expect. If you want a clear read on where you stand and a practical roadmap for your certification path, book a free IT and security consultation at https://calendly.com/glewis-acs-tech/free-it-security-assessment or call us at 1-650-300-7557. We will help you turn the new rules into a plan.
