FedRAMP 20x deadlines: who has moved, who has not, and why it matters

The Federal Risk and Authorization Management Program (FedRAMP) has set an end date for Rev5, its older way of certifying cloud services. New Rev5 applications stop on June 11, 2027. Existing Rev5 certifications are likely to end no later than 2029. We looked at the public FedRAMP Marketplace data to see how many services have moved to FedRAMP 20x so far, which kinds are moving, and which are not. The short answer: software is moving first, and the platforms it runs on have not started.

The deadlines

Sources: FedRAMP deadlines, notice NTC-0013, notice NTC-0014, RFC-0033, and FedRAMP's October 8, 2026 update.

How many services have moved

On October 11, 2026, the Marketplace data listed 533 certified offerings. Of those, 28 were certified under 20x and 505 under Rev5. The first 20x certifications came from the Phase One pilot in July 2025.

Two things stand out. Growth came in steps that match the pilot cohorts. And the Marketplace data shows no new 20x certification since June 23, 2026. That gap is probably not a stall. FedRAMP opened Class B and Class C to every provider only on August 31, 2026, and applications take time to reach a decision.

The public listing also runs behind FedRAMP's own count. FedRAMP reported 26 new 20x certifications in fiscal year 2026, while the Marketplace data lists 22 with certification dates in that year. We use the Marketplace data because anyone can check it, but the real number may be a little higher.

Over the same months, Rev5 kept growing. Between April 14 and October 11, 2026, the Marketplace data added 23 Rev5 certified offerings and 4 at 20x.

Who has moved, and who has not

The split by service model is stark. Every one of the 22 certified infrastructure-as-a-service (IaaS) offerings is still on Rev5. Of 51 platform-as-a-service (PaaS) offerings, 3 are on 20x, and each of those also lists itself as software. Of 460 software-as-a-service (SaaS) offerings, 25 are on 20x.

This is not surprising. The 20x pilots were open to Low and Moderate services, and the first cohorts favored software such as governance tools, trust centers, and AI services. FedRAMP's plans for fiscal year 2027 include "FedRAMP 20x Class C or D Certifications for hyperscale cloud service providers." The Class D pilot that would reach the large platforms is still a proposal.

Why the platforms matter more than their numbers

IaaS and PaaS are a small share of listings, but much of the market sits on them. Marketplace listings record which other certified offerings are built on a platform. Here are the platforms with the most offerings built on them. Every one is certified under Rev5.

Across all Rev5 IaaS and PaaS listings, 415 different offerings are listed as built on at least one of them. Only one of those 415 is certified under 20x. The platforms also carry heavy agency use: the 22 IaaS listings show 389 agency authorizations between them, a median of 4.5 per listing, against a median of 2 for software.

The risk in the order of moves

Software is moving first, and the platforms under it are moving last. That order has costs.

Evidence that does not match. A 20x software service proves its security with Key Security Indicators and automated, machine-readable checks. Many of the controls it inherits from its platform are still described in a Rev5 narrative plan. An agency reviewing that software service gets modern evidence for the top layer and older, document-based evidence for the layer underneath.

A dependency that could become a rule. FedRAMP's proposed Class D pilot says a cloud-hosted Class D service "must be deployed on a Class D Certified IaaS/PaaS." (RFC-0033) That is a proposal, and only for Class D. But if FedRAMP applies the same idea to other classes, a software provider could not finish its move until its platform has moved. Its schedule would then depend on a company it does not control.

Two change processes at once. A software provider on 20x reports significant changes under the 20x rules. Its platform may still report under Rev5. When the platform changes something, the software provider and its agency customers must translate between the two.

Many moves at the end. If the large platforms certify under 20x late in fiscal year 2027 or in 2028, hundreds of software services will rush to update their packages against the new platform evidence before Rev5 certifications end. FedRAMP has promised decisions within 30 days of application. That promise will face many applications at once, not a steady flow.

Extrapolating the pace

Here is a simple projection. It is not a forecast, and it rests on assumptions stated below the chart.

At the pace the Marketplace data shows over the last twelve months, about 1.8 new 20x offerings a month, 20x would reach about 98 listings by the end of 2029. Moving all 505 current Rev5 offerings by then would take about 13 a month, seven times the current pace.

The current pace will not hold, and it should not. Class B and Class C only opened to every provider on August 31, 2026. FedRAMP plans to bring Class D and the hyperscale platforms into 20x in fiscal year 2027, and to publish transition paths by the end of that year. If the platforms move in 2027, the software built on them can follow quickly. If they slip into 2028, the end-of-2029 date leaves little room. Even at FedRAMP's own fiscal year 2026 count of 26 20x certifications, the pace is about 2 a month.

What this means for agencies

• Inventory by layer. For each cloud service you use, note whether it is on Rev5 or 20x, and what platform it runs on. A service that is on 20x but sits on a Rev5 platform still depends on that platform's move.
• Ask about the platform. When a software provider tells you it is on 20x, ask what its platform plans are, and how it will update its package when the platform moves.
• Plan reviews for 2027 and 2028. Most of your services will change certification type in that window. Each change means new evidence formats to review, and your governance, risk, and compliance (GRC) tools must read them.
• Watch the Class D pilot. Its rule on hosting is the best early signal of how FedRAMP will treat dependencies in other classes.

The FedXchange Marketplace tracker lists every 20x certified offering and updates daily from the same public data used here.

Sources

• FedRAMP Marketplace data, github.com/FedRAMP/marketplace-fedramp-gov-data, file data.json: snapshots of April 14, 2026 through October 11, 2026. Counts are of listings with status "FedRAMP Authorized"; 20x listings are those whose impact level begins with "20x."
• FedRAMP, Deadlines.
• FedRAMP notices NTC-0013 (June 16, 2026) and NTC-0014.
• FedRAMP, RFC-0033, Class D pilot (proposed).
• FedRAMP, FedRAMP 20x and From foundation to implementation, October 8, 2026.
• The projection is FedXchange's own arithmetic from the Marketplace data, as described under the chart.