FedRAMP's July 2026 20x update: the pilots end, CR26 sets the dates, and Class A opens to providers with a prior audit

FedRAMP ended the 20x pilots with 29 pilot certifications and told holders to meet the CR26 dates or lose them. It explained what “should” means, replaced templates with JSON schemas, and opened Class A on August 3, 2026, to providers with a Rev5, SOC 2 Type II, or GovRAMP audit.

By FedXchange · July 8, 2026

FedRAMP's video, on its governance tracker page. The player loads from YouTube only when you press play.

The Federal Risk and Authorization Management Program (FedRAMP) held its monthly 20x Community Update on Wednesday, July 8, 2026. FedRAMP 20x is the program's newer, automation-based path. This was the first update after FedRAMP released the FedRAMP Consolidated Rules for 2026 (CR26). Under CR26, FedRAMP's approval is a "FedRAMP Certification," the term this post uses.

In short:

The pilots are over. FedRAMP said Phase 2 is complete and no pilots are active. Phase 1 gave 15 offerings a Class B pilot certification, and Phase 2 gave 14 offerings a Class C pilot certification, for 29 in all.
Pilot holders must keep moving. They must invite FedRAMP to quarterly check-ins, show progress toward CR26, and meet the CR26 dates for their class. FedRAMP said it will revoke a pilot certification and remove the Marketplace listing if they do not.
CR26 is the rule book until the end of 2028. Adoption was optional from July 4, 2026, and becomes mandatory on January 1, 2027. The video's description says the rules stay valid until December 31, 2028.
Class A opened on August 3, 2026. A provider needs a prior audit under FedRAMP Rev5, SOC 2 Type II, or GovRAMP.
Templates are gone. Providers send JSON files that follow FedRAMP's schemas. The rules themselves are one JSON file on GitHub.

CR26 dates named in the July 2026 20x Community Update

Sources: FedRAMP's Important Dates page, Notice 0015, and the July 8, 2026 20x Community Update video and description.

Read the steps as text

July 4, 2026. Providers and agencies may start adopting CR26.
July 6, 2026. Providers in the Initial Implementation phase may list on the FedRAMP Marketplace.
August 3, 2026. The 20x Class A pipeline opens for applications.
August 10, 2026. The Rev5 Lost Sponsor and Ready Conversion pipelines open for Class B and C.
December 7, 2026. Providers must adopt the vulnerability detection and reporting rules.
January 1, 2027. CR26 becomes mandatory for everyone.
June 11, 2027. FedRAMP stops accepting applications for new Rev5 Certifications.
December 31, 2028. CR26 stops being valid, according to the video's description.

What must 20x pilot holders do now?

The pilot certifications are real certifications, but they come with conditions. In the video, a FedRAMP staff member gave three steps:

Hold quarterly check-ins. Invite FedRAMP to a meeting each quarter by writing to info@fedramp.gov. The staff member said the best choice for most providers is to invite FedRAMP to the quarterly continuous monitoring meeting they already hold with agency customers, so they do not report the same status twice.
Show progress and meet the dates. FedRAMP wants to see steady progress toward CR26 and the CR26 "maintain" dates for Class B or Class C.
Contact FedRAMP to submit. When the final package is ready, an annual review package or a package for a new class, write to info@fedramp.gov.

The staff member said that if progress is not shown or dates are missed, FedRAMP will revoke the pilot certification and remove the provider's Marketplace page. FedRAMP will mark pilot holders' Marketplace pages with their pilot status, and set their annual assessment dates to March 7, 2027, which the staff member said matched the latest CR26 grace dates at the time.

The staff member also said about 35% of the pilot offerings have governance, risk, and compliance (GRC) capabilities, the top service category.

How do the CR26 dates work?

A FedRAMP leader explained the three kinds of dates that each CR26 ruleset lists. Each ruleset now gives them in its Effective Dates section, and FedRAMP's Important Deadlines pages list them for each path:

Obtain dates apply to a provider seeking a new FedRAMP Certification or upgrading to a higher class.
Maintain dates apply to a provider keeping its current class. By that date, the package must follow the CR26 rules.
Grace period end dates are the last day a provider can keep its certification without following the rules. The leader said FedRAMP will revoke certifications the day after.

The leader said FedRAMP will still fix typos and unclear wording in CR26, but will make no major changes. A binding operational directive from the Cybersecurity and Infrastructure Security Agency (CISA) is the exception. Binding Operational Directive 26-04 already moved FedRAMP's vulnerability rules forward, as Notice 0014 explains. FedRAMP will start on the 2027 rules (CR27) during Phase 4 of 20x, which will define Class D. Providers may move to CR27 when it comes out, but do not have to until CR26 expires.

The Rev5 Lost Sponsor and Ready Conversion pipelines, for providers that lost an agency sponsor or hold FedRAMP Ready, opened August 10, 2026. FedRAMP's Choosing a Certification Path page says applicants must agree to follow the updated Rev5 rules by February 19, 2027.

Did providers have to answer the July security inbox test?

Yes. Notice 0015, issued July 7, 2026, was an emergency test of every provider's security inbox. Providers had to answer by 5:00 p.m. Eastern Time on Tuesday, July 14, 2026, through the Emergency Test Form. They had to confirm they will adopt the Vulnerability Detection and Response (VDR) and Vulnerability Evaluation and Reporting (VER) rules by December 7, 2026, and that they know the CR26 deadlines. The notice says a provider that fails to respond loses its FedRAMP Certification.

In the video, a FedRAMP staff member said a mix-up in FedRAMP's tracking spreadsheet sent the wrong security inbox addresses to some providers whose addresses are private, and that FedRAMP was sending corrected notices. Only providers actively listed on the Marketplace got the test. FedRAMP Ready and In Process listings can expire and drop off the Marketplace automatically.

Notice 0016, published July 22, 2026, gave the result: 652 offerings (99%) responded, and 10 FedRAMP Certified offerings (1%) failed and went into remediation pending revocation.

Is a "should" rule optional?

No. A FedRAMP leader said "should" is much stronger than it sounds. CR26's Force of the Rule section uses the key words from the Internet Engineering Task Force's RFC 2119:

Word	What it means in CR26
Must	An absolute requirement. Failure may lead to corrective action or loss of certification.
Must not	An absolute prohibition.
Should	Required unless a valid reason applies. The provider must explain in its security documentation how it handles the rule.
Should not	Prohibited unless a valid reason applies. The provider must explain how it handles the rule.
May	Optional. The provider should explain its decision.

The leader said FedRAMP wrote "should" when it could think of at least one valid reason not to follow a rule, and "must" when it could think of none. In the question period, the leader added that a provider must address every "should" rule that applies to its class in its Security Decision Record.

A FedRAMP staff member then showed sample implementation statements for a made-up pizza delivery rule. A blank statement, or one that says only "we don't do this," is not acceptable. A good statement explains who does what, with which tools, how often, and what passing looks like. A statement that does not meet a rule must give the reason and, where there is one, the plan and date to fix it.

Who can apply for Class A, and for how long?

The Initial Implementation Marketplace listing opened July 6, 2026, and the Class A pipeline opened August 3, 2026. A FedRAMP staff member said listing is now the first step toward any certification.

The CR26 FedRAMP Certification rules for Class A (rule FRC-CLA-ASF) require a certification or equivalent process within the past 12 months under one of these frameworks:

FedRAMP Rev5, including FedRAMP Ready, at any impact level.
SOC 2 Type II.
GovRAMP at any impact level.

The staff member said a mix of other audits, such as HIPAA, ISO, and CMMC together, does not count. FedRAMP may consider other frameworks for CR27. For SOC 2, FedRAMP has not said which trust services criteria it needs. It asks providers to map the mandatory rules to related work in the audit, and will push back if that becomes a problem.

A FedRAMP leader said Class A is a starting point, mostly for agency pilot uses, and not a place to stay. Agencies will ask for more information before wide use. The leader said a provider cannot hold Class A for more than two years, and must move to Class B or Class C.

What replaces the FedRAMP templates?

JSON schemas. A FedRAMP staff member said templates forced providers to use FedRAMP's layout, while the schemas ask for the same information and let the provider choose how to present it. Every submission must be a JSON file. Many fields accept Markdown, so a statement can be paragraphs, a table, or a link.

Two schemas come first:

Certification Package Overview. Public facts about the provider and the offering: names, services, sales email, logo, and product categories. FedRAMP uses it to fill the Marketplace. Every other schema points to its address, so a change made here appears everywhere. It must hold no sensitive information.
Security Decision Record. How the offering meets each rule, Key Security Indicator (KSI), or Rev5 control. For Rev5, it holds the parts of the old System Security Plan that are not in the overview. A provider may keep one public copy and one behind a sign-in.

The staff member asked providers to add fields if they want, but not to replace the fields FedRAMP asks for, so FedRAMP can check packages automatically. The schemas may grow stricter over time.

FedRAMP publishes every rule, KSI, and Rev5 control in one JSON file in its rules repository on GitHub. In the video, the staff member said: "If it's not in this file, you are not required to do it." A second repository, 2026-markdown, holds the CR26 web pages as Markdown for AI tools. The staff member said the JSON file is the source of truth, and the Markdown adds no rules.

What changes for agencies?

A FedRAMP staff member said the new agency section of the CR26 site sets out agencies' roles. It follows OMB Memorandum M-24-15, other federal policy, and the FedRAMP Authorization Act, in plain language.

The staff member said FedRAMP is telling agencies to send new providers to 20x. FedRAMP will keep agency sponsorship for about a year for providers close to finishing Rev5. The Important Dates page says FedRAMP stops accepting applications for new Rev5 Certifications on June 11, 2027.

Rev5 packages sat in a FedRAMP repository. Under 20x, each provider keeps its package in its own trust center, so agencies ask the provider directly. FedRAMP plans to add trust center links to the Marketplace later. To get the Initial Implementation listing, a provider does not need a finished trust center.

FedRAMP holds monthly support groups for agencies and a separate meeting for 20x questions. Providers whose agency customers push back on the new rules should tell FedRAMP the agency and the person by name, so FedRAMP can meet them. A FedRAMP staff member said the Federal Chief Information Officer's office has told agencies they must adjust their policies to match FedRAMP's guidance. When an agency still wants human-readable reports, providers should produce them from their machine-readable data.

What else came up in the questions?

Subprocessors. A provider and its subprocessor do not need the same type of certification. In the video, a FedRAMP leader said: "Any FedRAMP certification is a FedRAMP certification." A provider may even use a subprocessor without one, if the package says so and explains the compensating controls.
Vulnerabilities and incidents. The VDR and VER rules set what to report, by class and by how the provider rates each vulnerability. A FedRAMP staff member said a vulnerability that may have been exploited can also be an incident, so the incident reporting rules apply too. One that was not exploited and is patched can go in the monthly report.
Known exploited vulnerabilities. A FedRAMP leader said FedRAMP asks providers to judge whether a vulnerability is likely to be exploited. CISA's Known Exploited Vulnerabilities catalog lists only those it has seen exploited, a higher bar. A provider should be very sure before it calls a vulnerability on that list unlikely to be exploited.

What has happened since?

As of November 8, 2026:

The Important Dates page shows that the 20x Class B and Class C pipeline opened August 31, 2026, and that FedRAMP Ready stopped taking new submissions on July 28, 2026.
FedRAMP's November 2, 2026 post announced the first full FedRAMP 20x Class C Certification.
Phase 4 of 20x appeared as RFC-0033, a request for comment on development tracks for Class D.

Sources

Share this post:LinkedIn X Email

A weekly email on Fridays, an alert on the day the watch finds something new, or both. Free.