FedRAMP's February 2026 20x update: the first look at the Consolidated Rules, and what the open RFCs meant

In February 2026, FedRAMP previewed one set of rules for 20x and Rev5, said a request for comment sets no deadline, and said sponsors stop approving changes under Significant Change Notifications. The rules came out in June 2026 and are mandatory on January 1, 2027.

By FedXchange · February 11, 2026

FedRAMP's video, on its governance tracker page. The player loads from YouTube only when you press play.

On February 11, 2026, the Federal Risk and Authorization Management Program (FedRAMP) held its monthly 20x Community Update, the meeting it used to call the 20x Working Group. FedRAMP is the program in the General Services Administration (GSA) that sets security rules for cloud services that agencies use. Rev5 is FedRAMP's existing path, and 20x is its newer one. The meeting gave a status report on the 20x pilot, a first look at the Consolidated Rules for 2026, and answers to questions on open requests for comment (RFCs).

The meeting came two weeks before FedRAMP changed its terms. In February 2026, FedRAMP still said "authorization," "FedRAMP Ready," and "agency sponsor." Notice 0004, issued February 25, 2026, made "FedRAMP Certification" the single official label, used as "FedRAMP Certification or FedRAMP Certified." Those are the current terms under the Consolidated Rules for 2026.

In short:

What FedRAMP said. FedRAMP planned one release, the Consolidated Rules for 2026, with the updated Rev5 rules, the balance improvement releases, and the final 20x rules for low and moderate. A speaker said FedRAMP was targeting May 2026. Rev5 providers would then have about six months to adopt the rules.
Who it affects. Every cloud service provider with a FedRAMP authorization (now a FedRAMP Certification), every provider seeking one, and the agencies that use their services.
What speakers advised. Speakers urged providers to read the open RFCs and comment, and to start budgeting for tools that keep security packages current. Adopting the optional Significant Change Notification process was up to each provider.
By when. FedRAMP launched the Consolidated Rules on June 25, 2026. Optional adoption began July 4, 2026. The rules are mandatory for all stakeholders on January 1, 2027, according to FedRAMP's important dates page.

From the February 2026 update to the Consolidated Rules

Sources: the February 11, 2026, video, FedRAMP notices, FedRAMP's blog, and FedRAMP's important dates page.

Read the steps as text

February 11, 2026. In the video, FedRAMP previews the Consolidated Rules for 2026 and targets a May release.
February 25, 2026. Notice 0004 makes FedRAMP Certification the single official label.
February 26, 2026. FedRAMP announces wide release of the optional Significant Change Notification process.
March 2026. Notices 0007, 0008, and 0009 give the initial outcomes of RFC-0022, RFC-0023, and RFC-0024.
June 25, 2026. FedRAMP announces the launch of the Consolidated Rules for 2026.
July 4, 2026. Optional early adoption of the Consolidated Rules begins.
January 1, 2027. The Consolidated Rules become mandatory for all stakeholders.

What are the Consolidated Rules for 2026?

A FedRAMP speaker explained where the name 20x came from. It began as "202x": FedRAMP would publish a full set of requirements each year, and each set would stay valid for two years, like a software release. The name became 20x after someone asked what would happen in 2030.

The speaker said FedRAMP was targeting a release in May 2026 that would hold all of the updated Rev5 rules, the RFCs then open, the balance improvement releases, and the 20x rules for low and moderate. Rev5 providers would have about six months to adopt it, and some parts would take effect later. The speaker said that once the rules came out, providers would know "for the next two and a half years what your life generally looks like." (Words from the video.) FedRAMP would then build the next release, which the speaker called CR27, and providers could choose when to move to it.

Asked whether the rules would apply to existing Rev5 services in continuous monitoring, a speaker said yes: they would set the expectations for all Rev5 services through 2027 and 2028, as well as for 20x.

The speaker also said high would not be in the 2026 release for 20x. FedRAMP's 20x page now lists a Class D (High) pilot in Phase 4, estimated for fiscal year 2027, quarters one and two.

The release came later than the May target. FedRAMP's February 26 blog post gave a new target, the end of June 2026, and FedRAMP announced the launch on June 25.

Does an RFC set a deadline?

No. One question asked about a "hard deadline" of September 2027 in RFC-0024, Rev5 Machine-Readable Packages. A FedRAMP speaker said an RFC "does not establish any deadlines" and added, "Nothing is established in an RFC." (Words from the video.) An RFC proposes a date so FedRAMP can learn its effect. Another speaker said that if a date seems impossible, the RFC is the place to say why.

The speaker said FedRAMP would not provide a service to convert legacy Rev5 system security plans. FedRAMP expects industry to fill that gap. The speaker said the change is not really about Open Security Controls Assessment Language (OSCAL). It is about using tools to keep security plans current, with export to any format as a side effect. The speaker pointed to two proposals that many providers had missed: a recommendation to keep separate authorization data for each service that agencies buy separately, and an updated machine-readable package by the end of the month after a significant change is completed.

FedRAMP's later Notice 0009 (March 25, 2026) changed the proposal after public comment. It retired Word (DOCX) and Excel (XLSX) files, required only some machine-readable data for Classes A, B, and C, and said FedRAMP will not build tools itself.

What happens to agency sponsors under Significant Change Notifications?

A question asked how a sponsor's role changes. A FedRAMP speaker said an agency sponsor makes the first investment in reviewing a provider's security. Under the older process, that agency also approves significant change requests. Once a provider adopts the Significant Change Notification process, the speaker said, "you do not have a sponsor for ongoing monitoring at all anymore." (Words from the video.) The provider must work with all of its agency customers. Each agency decides about its own use of the service.

The speaker said the beta was set to end on February 27, 2026, with wide release after that. FedRAMP announced the wide release on February 26, 2026. The process was optional, and FedRAMP's goal was for most Rev5 providers to adopt it by the end of 2026.

A speaker said a provider whose contract with an agency requires advance change requests must work that out with the agency. Provider staff should ask their lawyers, and agency staff should ask their acquisition office. A speaker said agencies that do not take part in continuous monitoring accept that risk, but the provider must still offer every agency customer the chance to take part.

What did FedRAMP say about FedRAMP Ready and outside audits?

On RFC-0023, Rev5 Program Certifications (No Sponsor Required), a speaker said services then listed as FedRAMP Ready would keep a "legacy" status for a time, and urged them to move to the program path instead. Notice 0008 later retired FedRAMP Ready on July 28, 2026, with a path to convert to a Rev5 Class A Certification.

On RFC-0022, Leveraging External Frameworks, a question, which the moderator thought came from an agency, asked whether audits such as System and Organization Controls (SOC) 2 Type 2 and International Organization for Standardization (ISO) 27001 could count toward Key Security Indicators (KSIs). A speaker said FedRAMP does not grant reciprocity with any outside framework, and that public feedback so far had shown little support for the proposal. Notice 0007 later said there will be no reciprocity and no bridge from outside frameworks to other certification classes.

What else did the update cover?

The pilot. All three cohort one participants in Phase 2 were in final review. The top kind of service in Phase 2 was governance, risk, and compliance (GRC) tools.
Machine-readable documents. FedRAMP had released a beta of its machine-readable rules. Each requirement and KSI now has a name that forms its ID, instead of a number. A speaker linked the work to Executive Order 14306 (June 6, 2025), which calls for a pilot of machine-readable cybersecurity rules.
Getting a 20x certification in 2026. A speaker said a well-built cloud-native service could reach a 20x moderate equivalent within six months of the rules' release, and that FedRAMP was turning reviews around in 30 days.
Closing Rev5 paths. Speaking about high and the end of Rev5 for new packages, a speaker said FedRAMP "will never block a path without having another path available to it." (Words from the video.)

Sources

Share this post:LinkedIn X Email

A weekly email on Fridays, an alert on the day the watch finds something new, or both. Free.