FedRAMP's August 20x update: Class A opens, Classes B and C follow on August 31, and what reviewers want in a package

In August 2026, FedRAMP said 20x Class A was open, Classes B and C would open August 31, and every MUST and SHOULD rule belongs in the Security Decision Record. General questions now go to GitHub, not email. RFC-0032 on agency-run cloud services took comments until September 8.

By FedXchange · November 7, 2026

FedRAMP's video, on its governance tracker page. The player loads from YouTube only when you press play.

The Federal Risk and Authorization Management Program (FedRAMP) held its monthly 20x Community Update on August 12, 2026, and posted the video on August 13. FedRAMP 20x is the program's newer certification path, built on automated, machine-readable evidence. Rev5 is the older path, based on Revision 5 of the National Institute of Standards and Technology (NIST) control catalog. The meeting covered where to send questions, using artificial intelligence (AI) tools to read the rules, how to apply for 20x Class A, B, and C, and the requests for comment (RFCs) that were open or coming.

In short:

Class A is open. The FedRAMP timeline lists August 3, 2026 as the day the 20x Class A pipeline opened, and August 31, 2026 for Classes B and C. Staff said a Class B or C certification request sent before August 31 would be turned away automatically.
Complete packages move faster. Staff said the Security Decision Record (SDR) must cover every MUST and SHOULD rule and every Key Security Indicator (KSI) that applies, including the ones a provider does not meet.
Questions go to GitHub. FedRAMP asked people to post general questions in its community discussions or at the bottom of the Consolidated Rules for 2026 (CR26) site. Email to info@fedramp.gov is for sensitive or agency-specific matters.
Agencies running cloud services. RFC-0032, Offerings By Government, proposed a FedRAMP Certification path for cloud services that federal agencies run for other agencies. Comments closed September 8, 2026. FedRAMP's RFC list shows no outcome yet as of November 7.

How a 20x Class A certification works

Sources: the video and FedRAMP rule FRC-CLA-ASF (Approved Alternative Security Frameworks).

Read the steps as text

Hold an approved framework. The provider has a System and Organization Controls (SOC) 2 Type II report, a GovRAMP certification, or a FedRAMP Rev5 certification, including FedRAMP Ready, from the past 12 months.
Get listed. The service must be on the FedRAMP Marketplace in the Initial Implementation status, which gives it a FedRAMP ID.
Do the work. The provider sets up a trust center, changes its policies to meet the Class A rules, and builds the package. An independent check of the initial package is optional.
Request certification. The provider submits a separate form to ask for the certification review.
Program review. FedRAMP reviews the package and may ask questions or ask for changes.
Final disposition. FedRAMP decides. A certified provider then has ongoing duties.

What goes in a Class A package?

A FedRAMP staff member listed the parts in the video:

External assessment materials. For a SOC 2 Type II report, send every page, plus a bridge letter if there is one. Rule FRC-CLA-EAM lists what each framework requires.
A Certification Package Overview (CPO) in JavaScript Object Notation (JSON). FedRAMP uses it to fill in the Marketplace listing. It holds the FedRAMP ID the service received when it was listed.
A Security Decision Record that addresses each rule and KSI.
Sample reports in the required schemas, such as incident reports and the Ongoing Certification Report (OCR).

Staff said the CPO's assessor field caused confusion. Leave it blank unless an independent assessor did a separate assessment of the 20x Class A package itself. The firm that did a SOC 2 audit or a Rev5 readiness assessment report is not the assessor for this field. If an assessor did review the package, put the assessor's summary in the SDR for each rule and KSI, and an overall summary in the CPO.

Staff also answered common questions:

Other frameworks are not accepted. FedRAMP said it might add more in its 2027 rules, through an RFC.
No framework, no Class A. A provider without one should aim for Class B or C.
Hybrid and self-hosted services can use Class A. Classes B and C stay cloud-native only for now.
Agencies can use it. A FedRAMP staff member called Class A a real FedRAMP Certification, designed for limited, low-risk uses such as an agency trying a service before buying it.
Timing is not known yet. FedRAMP's service level target for all certifications is 30 business days, not counting time spent waiting for the provider.

How do we make the review go smoothly?

Staff named three things: completeness, accuracy, and an easy review.

Completeness. The SDR must cover all MUST and SHOULD rules and all KSIs that apply, even unmet ones. Explain why a SHOULD rule is not met. MAY rules are optional, but FedRAMP reviews any rule in the SDR. A MAY rule marked as implemented with no artifacts will get questions. The force of the rule section of CR26 says the same: providers must explain how they handle SHOULD rules.
Accuracy. Check every file with FedRAMP's JSON schema validator before submitting. Mark a rule or KSI as partially implemented when it is. Staff said reviewers can tell when a partial answer is presented as complete, and will ask for a change.
An easy review. Build the trust center so a reviewer can log in and find things. It should not be an unsorted set of files. Link from the SDR directly to each artifact in the trust center.

For Classes B and C, staff added three points. Write clear, short implementation statements. Say who, what, when, where, why, and how, and how each test and its evidence relate to the rule. For a gap, give a date to fix it, or say plainly that you will not. Attach only evidence and metrics that relate to the KSI or rule they sit under.

A FedRAMP staff member said reviewers will spot-check technical details and question any implementation that does not make sense.

What changes at Classes B and C?

Automation and historical metrics apply at these classes. Staff said they are a SHOULD at Class B and a MUST at Class C. Rule SDR-CSX-KMT (Key Security Indicator Metrics) now makes historical metrics a SHOULD at Class B and a MUST at Class C. FedRAMP changed it from MUST to SHOULD for Class B on October 8, 2026. For an initial certification, a provider needs the tools in place and must agree to meet the metrics rule. It does not need six months of past data first.

How FedRAMP reviews a 20x Class B or C package

Source: the video.

Read the steps as text

Intake. FedRAMP checks that the package is complete, updates the Marketplace, and adds it to the review queue.
Kickoff. Reviewers get access to the trust center, and the provider walks them through the service and the package.
Internal review. The FedRAMP team reviews the package on its own.
Collaborative review. FedRAMP meets the provider and its assessor to ask how they approached certain rules and KSIs.
Determination. FedRAMP writes its certification report and makes a final decision, or works with the provider on next steps.
Certified. The provider gets a certification letter with the report and posts it in its trust center.

Participants in the earlier 20x pilot no longer have a 12-month window to convert. Their timeline now follows the CR26 dates for maintaining a certification. They must keep holding quarterly check-ins, show steady progress toward CR26, and send meeting invitations to info@fedramp.gov. They can finish through an annual assessment or a new certification package.

Do we still need an agency sponsor?

No. A FedRAMP staff member said a 20x provider submits directly to FedRAMP, and agencies come after. Because some agencies cannot yet read machine-readable files, providers should show the same information in human-readable form.

Monthly sponsor meetings also end. The Collaborative Continuous Monitoring rules set a Quarterly Review every 3 months: a MUST at Classes C and D, a SHOULD at Class B, and a MAY at Class A. An agency may ask for more meetings. That is between the agency and the provider.

A FedRAMP staff member said the law gives FedRAMP packages a presumption of adequacy. Agencies may still ask for more controls. The staff member said agencies are supposed to report such requests to FedRAMP. Providers can tell FedRAMP when an agency asks for more.

Can AI tools help read the rules?

Yes, with limits. A FedRAMP staff member described two GitHub repositories named in the video description. FedRAMP/rules holds the current rules and KSIs as JSON. FedRAMP/2026-markdown holds the full CR26 site as plain Markdown, with the context around each rule. The staff member said the Markdown version is the better one to give an AI agent.

The staff member also showed a proof-of-concept Model Context Protocol (MCP) server, fedramp-rules-mcp, that lets an AI assistant search those rules. It is not a FedRAMP product, and the staff member said no one should rely on it. In the demo, an AI turned a made-up SDR into a readable report with a list of risks. Staff said this can help an agency without a governance, risk, and compliance (GRC) tool, but it does not replace human review. Ask your AI provider how it handles security data before you send any to it.

What requests for comment were coming?

RFC-0032, Offerings By Government. Agency-run services would follow their own agency's authorization process. The proposal maps a Low impact authorization to operate (ATO) to Class B, Moderate to Class C, and High to Class D. The agency must still supply a CPO and Marketplace data, and should hold quarterly meetings with customer agencies.
LI-SaaS retirement. Staff said FedRAMP plans to stop accepting FedRAMP Tailored for Low-Impact Software-as-a-Service (LI-SaaS) after January 1, 2027. Providers would move to Rev5 Class B or 20x Class B or C. As of November 7, 2026, FedRAMP's RFC list shows no LI-SaaS request for comment.
Phase 4 pilot. This pilot focuses on 20x Class D, including self-hosted infrastructure and infrastructure providers. FedRAMP later posted related requests for comment: RFC-0033, closed October 9, 2026, and RFC-0036, open until November 19, 2026.

Sources

Share this post:LinkedIn X Email

A weekly email on Fridays, an alert on the day the watch finds something new, or both. Free.