20x community update, April 2026: first Moderate pilot certifications, classes A to D, and a program-only path for 20x

In its April 8, 2026, 20x update, FedRAMP named the first three Phase Two pilot authorizations, said 20x would be a program path only with no Class D for now, and said the classes show how much information a provider shares, not how secure a service is.

By FedXchange · April 8, 2026

FedRAMP's video, on its governance tracker page. The player loads from YouTube only when you press play.

On April 8, 2026, the Federal Risk and Authorization Management Program (FedRAMP) held its monthly 20x community working group. FedRAMP 20x is the newer path built for cloud-native services and automated validation. Rev5 is the older path, built on Revision 5 of the National Institute of Standards and Technology (NIST) Special Publication 800-53 controls. FedRAMP staff gave pilot results, previewed the Consolidated Rules for 2026 (CR26), and explained new labels for certifications.

In short:

What FedRAMP said. Three cloud services had received Phase Two (Moderate) pilot authorizations. 20x would be offered only through the FedRAMP program path, at Classes A, B, and C first. Classes show how much information is in a package, not how secure a service is.
Who it affects. Cloud service providers choosing between 20x and Rev5, and agencies that use FedRAMP Certified services.
What they can do. A FedRAMP speaker said 20x is designed for cloud-native services and Rev5 suits providers with other infrastructure, which may help a provider choose a path.
By when. FedRAMP said CR26 would come in the May to June 2026 time frame, with enforcement at the start of 2027.

What each 20x class shows agencies, as FedRAMP described it in April 2026

Source: FedRAMP 20x Community Update video (April 8, 2026). A FedRAMP speaker said these examples were not final.

Read the steps as text

Class A. A small, partial set of Key Security Indicators, mapped to an existing security framework.
Class B. A yes-or-no status for many Key Security Indicators, including whether automated evidence shows each one is met.
Class C. Metrics over time that show how the service has performed against its Key Security Indicators.
Class D. No 20x Class D yet. FedRAMP plans a Class D pilot in a later phase.

Who received the first Phase Two pilot authorizations?

The video's description lists three: Confluent Cloud for Government, Meridian LMS, and Paramify Cloud. A FedRAMP speaker said they had received Moderate pilot authorizations, and that 10 more from the second cohort were in final review. FedRAMP's 20x page says the Phase Two pilot ran from November 18, 2025, through March 2026, and the first pilot authorizations were issued on March 6, 2026.

When do the Consolidated Rules for 2026 arrive, and when are they enforced?

A FedRAMP speaker said FedRAMP would gather its requests for comment (RFCs) and pilots into one rule set in the May to June time frame. The speaker said the rules would be "effective immediately" but enforced at the beginning of the next calendar year. The rules would list phased dates and any corrective action for missing them. A speaker added that CR26 would also say when FedRAMP will start accepting each class.

A speaker said FedRAMP would release one more RFC that week, on incident communication procedures. FedRAMP's Notice 0012 shows that RFC-0031, Updated Incident Communications Procedures, came out on April 8, 2026. The speaker said higher classes would face faster reporting and more corrective action. RFC-0031 uses the definition of incident in Title 44 of the United States Code (U.S.C.), section 3552(b)(2). It proposed that a provider report an incident only when it affects, or is likely to affect, the confidentiality or integrity of federal customer data.

What do "certification" and the classes mean?

In February 2026, Notice 0004, the outcome of RFC-0020, said FedRAMP Certification would be the single label in place of FedRAMP authorization. FedRAMP Certification is the current term. In the video, a FedRAMP speaker said FedRAMP would start calling FedRAMP authorizations FedRAMP certifications. A speaker said: "This is literally a label. Fun fact, the law defines a FedRAMP authorization as a certification from FedRAMP." The speakers said FedRAMP would also use "agency certification" and "program certification" in place of agency authorization and program authorization.

A speaker said Classes A, B, C, and D would replace FedRAMP Ready, Low-Impact Software as a Service (LI-SaaS), Low, Moderate, and High. The speaker said a class is the amount of information available to an agency in a package. Another speaker said a Class D service "is not necessarily more secure" than a Class A service; the provider has shared more and committed to share more over time. That speaker said agencies set their own impact levels, and pointed to Office of Management and Budget (OMB) memo M-24-15.

Which path can a provider take?

20x. A speaker said there would be no agency path into 20x; it would be a program certification only. Classes A, B, and C would come with CR26. There would be no 20x Class D in the next year or so. The 20x page lists a Class D (High) pilot as Phase 4, estimated for fiscal year 2027.
Rev5. A speaker said Rev5 keeps agency paths for Classes B, C, and D, and Class D is agency-only. Notice 0008 confirms that Class D still requires an agency sponsor. A speaker said limited Rev5 program certifications at Classes A, B, and C are meant for providers who lost a sponsor. Notice 0008 says Class A replaces FedRAMP Ready. Classes B and C require adopting the Balance Improvement Releases and meeting one of four criteria between January 1, 2025, and March 1, 2026.

A speaker said FedRAMP intended, at some point, to stop accepting new Rev5 submissions for systems that would be better off on the 20x path, but did not intend to take away current Rev5 certifications. FedRAMP has since set that date: the 20x page says it will stop accepting new Rev5 certifications on June 11, 2027.

How should agencies use a FedRAMP Certified service?

A speaker said an agency information system is how the agency uses one or more services for its own use case with its own data. The agency follows the NIST Risk Management Framework (RMF) for that system, then chooses cloud services that meet its needs. The speaker said agencies should not copy a provider's controls into their own system security plan. Instead, the plan should say what the agency verified about the provider. The speaker said a cloud service is not itself the federal information system unless the government owns and operates it.

The speakers asked providers to bring FedRAMP into conversations with agencies that struggle with 20x, without sending proprietary material.

What else did FedRAMP say?

Hiring. A speaker described the FedRAMP Cybersecurity Service and pointed to fedramp.gov/join. The speaker said the roles are for people who have built or assessed cloud services.
Stability. A speaker said CR26 is intended to last until the end of 2028. Notice 0004 says the rules will be valid until December 31, 2028.

Sources

Share this post:LinkedIn X Email

A weekly email on Fridays, an alert on the day the watch finds something new, or both. Free.