GUIDE / FEDRAMP

FedRAMP 20x explained: classes, KSIs and the 2027 dates.

FedRAMP 20x certifies cloud services against 46 Key Security Indicators (KSIs) that are validated by machine, not by a document review. Under the Consolidated Rules for 2026, certification Classes A to D replace Low, Moderate and High, the rules become mandatory on January 1, 2027, and FedRAMP stops accepting new Rev5 certifications on June 11, 2027.

Last updated November 9, 2026

FedRAMP 20x dates at a glance

Date	What happens
June 24, 2026	FedRAMP publishes the Consolidated Rules for 2026, with 20x certification rules for Classes A, B and C
July 28, 2026	FedRAMP Ready closes to new submissions; providers are pointed to 20x Class A instead
August 3, 2026	20x Class A applications open
August 31, 2026	20x Class B and Class C applications open
January 1, 2027	The Consolidated Rules for 2026 become mandatory for all stakeholders
June 11, 2027	FedRAMP stops accepting applications for new Rev5 certifications

What FedRAMP 20x changes

Certification Classes replace impact levels. Class A is for mature programs entering the federal market, Class B for common light-use services, Class C for enterprise services used across an agency, and Class D (high impact) is being developed in Phase 4.
Key Security Indicators replace a control-by-control document review. Each KSI is an outcome, such as network traffic being persistently reviewed, and maps to NIST SP 800-53 controls.
Evidence is checked by machine and kept current. Machine-based resources are validated at least every 3 days for Class C and every 7 days for Class B, and monthly is the expectation for Class A. An Ongoing Certification Report goes to agencies every 3 months.
There are two certification types: Rev5 and 20x. Rev5 remains available for new certifications until June 11, 2027.

The 46 Key Security Indicators, by family

Family	KSIs	Examples
Identity and Access Management (IAM)	6	Adopting passwordless methods, automating account management, least privilege, just-in-time access
Cloud Native Architecture (CNA)	8	Restricting network traffic, minimizing attack surface, logical networking, availability
Service Configuration (SVC)	8	Securing information (encryption), automating secret management, automating configuration management
Monitoring, Logging and Auditing (MLA)	5	Logging event types, operating a SIEM capability, evaluating configurations, reviewing logs
Change Management (CMT)	4	Logging changes, validating throughout deployment, reviewing change procedures
Policy and Inventory (PIY)	5	Generating inventories, reviewing security in the SDLC, vulnerability disclosure
Recovery Planning (RPL)	4	Aligning backups with objectives, testing recovery capabilities
Incident Response (INR)	3	Reviewing incident response procedures, after-action reports
Supply Chain Risk (SCR)	2	Monitoring and mitigating supply chain risk
Cybersecurity Education (CED)	1	Reviewing all training

Counts are from FedRAMP’s Consolidated Rules data, version 2026.11.02.01. Older articles cite 56 or 61 KSIs with numbered IDs such as KSI-IAM-01; those come from the 2025 pilots and were replaced by the current IDs such as KSI-IAM-APM.

Have a SOC 2 Type II? It is a path into Class A

To seek a Class A certification, a provider must have completed a FedRAMP Rev5 (including FedRAMP Ready), SOC 2 Type II or GovRAMP certification within the past 12 months (FedRAMP rule FRC-CLA-ASF). A SOC 2 Type II provider supplies the full report, a bridge letter if needed, and a summary of how it meets each FedRAMP rule. FedRAMP notes that "see SOC 2 report" alone is not enough.

Class A then uses only 7 of the 46 KSIs: reviewing all training (CED-RAT), logging changes (CMT-LMC), restricting network traffic (CNA-RNT), automating account management (IAM-AAM), adopting passwordless methods (IAM-APM), reviewing incident response procedures (INR-RIR) and securing information (SVC-SIN).

What KSIs look like as cloud checks

Cloud check	Key Security Indicator
Phishing-resistant MFA or passwordless sign-in for all users, especially admins	KSI-IAM-APM, Adopting Passwordless Methods
Stale and disabled accounts removed automatically	KSI-IAM-AAM, Automating Account Management
No standing admin roles; privileged roles activated just in time	KSI-IAM-JIT, Authorizing Just-in-Time
No admin ports open to the internet; default-deny network rules	KSI-CNA-RNT, Restricting Network Traffic
No public storage; private endpoints for data services	KSI-CNA-MAT, Minimizing Attack Surface
Encryption at rest and TLS 1.2+ in transit	KSI-SVC-SIN, Securing Information
Keys and secrets in a vault with rotation	KSI-SVC-ASM, Automating Secret Management
Activity and audit logs on for defined event types	KSI-MLA-LET, Logging Event Types
Configuration changes recorded and monitored	KSI-CMT-LMC, Logging Changes
Backups on, with tested restores	KSI-RPL-ABO and KSI-RPL-TRC, backups and recovery testing

These pairings are our examples of checks that support each indicator, not an official FedRAMP mapping. FedRAMP publishes the indicator text and its related NIST SP 800-53 controls.

Rev5 or 20x?

New providers can choose until June 11, 2027, when FedRAMP stops accepting new Rev5 certification applications. 20x suits cloud-native services that can show their security through automated, machine-readable evidence. Class D, for high-impact systems, is still in its Phase 4 pilot and keeps an agency-sponsored path in the meantime.

The first full Class C certification went to Perplexity in November 2026, with seven Class A and twelve Class B certifications also listed (FedScoop, November 3, 2026).

How Obsinto helps with FedRAMP 20x

FedRAMP 20x rewards exactly what Obsinto does: it checks your cloud, identity and code continuously against NIST SP 800-53, the controls each KSI maps to, fixes gaps with your approval, re-checks them, and keeps dated, machine-readable evidence. If you already have a SOC 2 Type II, Obsinto keeps that evidence current for both frameworks without doing the work twice.

Frequently asked questions

What is FedRAMP 20x?

FedRAMP 20x is FedRAMP’s automation-first certification path. Instead of a control-by-control document review, a cloud service shows it meets Key Security Indicators with machine-validated evidence that stays current.

When does FedRAMP 20x become mandatory?

The Consolidated Rules for 2026, which define 20x and the Certification Classes, become mandatory for all stakeholders on January 1, 2027. Rev5 is not removed that day: FedRAMP stops accepting new Rev5 certification applications on June 11, 2027.

How many Key Security Indicators are there?

There are 46 KSIs in 10 families in the Consolidated Rules for 2026. Class A uses 7 of them. The 56 and 61 counts in older articles come from the 2025 pilots.

Does a SOC 2 Type II count toward FedRAMP?

Yes, for Class A. A provider seeking Class A must have completed a FedRAMP Rev5, SOC 2 Type II or GovRAMP certification within the past 12 months, and supplies that report with a summary of how it meets FedRAMP’s rules.

Is FedRAMP Ready still available?

No. FedRAMP stopped accepting Ready submissions after July 28, 2026 and points those providers to 20x Class A.

Do I need OSCAL for FedRAMP 20x?

The 2026 rules ask providers for human-readable and machine-readable (JSON) information, and require agencies’ tools to handle formats including OSCAL and JSON. They do not require providers to submit OSCAL for 20x.

Turn your SOC 2 evidence into FedRAMP 20x evidence.

Sources

Changelog

November 9, 2026: page published.