FedRAMP 20x has not reached the cloud services agencies use most

Agency security teams keep asking the same thing: are any of our cloud providers moving to FedRAMP 20x yet? For most agencies, the answer today is no. We checked the FedRAMP Marketplace data from October 6, 2026, against the services agencies use most. None of them has moved.

Key insights

• None of the 25 most-used services is on 20x. We ranked every listing by its number of agency authorizations. All of the top 25 are still on Rev5. They include Microsoft 365, ServiceNow, Azure, Amazon Web Services (AWS), Salesforce, Zoom, Okta, CrowdStrike, and Palo Alto Networks.
• 20x holds about 1 percent of agency authorizations. The 28 offerings on 20x have 33 agency authorizations between them. The 505 offerings on Rev5 have 3,170.
• No infrastructure provider is on 20x. All 28 offerings on 20x are software services. None of the 22 infrastructure-as-a-service (IaaS) offerings has moved. More than 400 software listings are built on a Rev5 infrastructure or platform service.
• The first movers sell compliance and AI tools. Vanta, Drata, Secureframe, Paramify, Anecdotes, and IntelliGRC are on 20x. So are three AI services: OpenAI's ChatGPT Enterprise and API Platform, Google's Gemini for Government, and Perplexity.
• The large providers have time. FedRAMP accepts new Rev5 applications until June 11, 2027, and has not set a date when existing Rev5 certifications end.

What the Marketplace data shows

The gap is wider than the offering count suggests. About 5 percent of offerings are on 20x, but they carry about 1 percent of agency authorizations. Most 20x offerings have one agency authorization. The busiest, OpenAI and Perplexity, have three each.

The ten services with the most agency authorizations are all on Rev5:

Why the large providers are waiting

FedRAMP's Consolidated Rules for 2026 opened 20x to every provider. Rev5 providers can keep their certifications while they follow the new rules, so the largest providers have no deadline that makes them move this year.

A large provider with many agency customers has a working Rev5 package and an established monitoring process. Moving to 20x means rebuilding how it proves its security, using automated evidence instead of a written package. We expect most to wait until FedRAMP's rules and tools are stable and their agency customers ask for 20x.

What agencies should do now

• Keep your current process. Your Rev5 authorizations and continuous monitoring work as they did before. Nothing changes for a service until its provider moves.
• Ask your major providers for their 20x plan. Raise it at the next contract renewal or annual review. Ask when they plan to apply, which class they will seek, and how the monitoring evidence they send you will change.
• Prepare your team for automated evidence. A 20x provider shows its security through Key Security Indicators that are checked by machine. Your reviewers will read data and dashboards instead of a long System Security Plan. Plan the training and tools now.
• Track the Marketplace. The Marketplace tracker on FedXchange marks each service as Rev5 or 20x. Bookmark the services your agency uses, and the bell will tell you when one of them changes.

Sources

• FedRAMP Marketplace data, synced October 6, 2026
• FedRAMP: Important deadlines in the Consolidated Rules for 2026
• FedRAMP 20x