Which FedRAMP path should a new cloud provider take? FedRAMP said 20x

In a February 2026 video, a FedRAMP speaker told providers choosing a path to go with FedRAMP 20x, because the Rev5 path was likely to be turned off the next year. FedRAMP now says it stops accepting applications for new Rev5 Certifications on June 11, 2027.

By FedXchange · February 5, 2026

FedRAMP's video, on its governance tracker page. The player loads from YouTube only when you press play.

On February 5, 2026, the Federal Risk and Authorization Management Program (FedRAMP) posted a short video, "Which FedRAMP Authorization Path Should You Take?" In it, a FedRAMP speaker gives cloud service providers a direct answer: choose FedRAMP 20x, the program's newer, automation-based path, rather than Rev5, the older path.

The video came out before the FedRAMP Consolidated Rules for 2026 (CR26). At the time, FedRAMP used the term "FedRAMP authorization," as the video's title does. Under CR26, FedRAMP calls its approval a "FedRAMP Certification," and a service that has one is "FedRAMP Certified," according to FedRAMP's definitions. This post uses the current terms except when it describes what FedRAMP said then.

In short:

What FedRAMP said. A provider deciding now which path to pursue should take 20x. The speaker said the Rev5 path was "very likely to be turned off next year."
Who it affects. Cloud service providers seeking their first FedRAMP Certification, and providers adding a new service to the FedRAMP Marketplace.
What FedRAMP advises. Plan for 20x. A provider that has already invested heavily in Rev5 can still apply for a new Rev5 Certification until June 11, 2027.
By when. FedRAMP's Important Dates page says that on June 11, 2027, "FedRAMP will no longer accept applications for new FedRAMP Rev5 Certifications."

FedRAMP dates for choosing between 20x and Rev5

Source: the video (February 5, 2026) and FedRAMP's Important Dates for the Consolidated Rules for 2026.

Read the steps as text

February 5, 2026. FedRAMP posts the video and tells providers choosing a path to go with 20x.
July 28, 2026. FedRAMP Ready goes legacy. FedRAMP accepts no FedRAMP Ready submissions after this date.
August 3, 2026. FedRAMP begins accepting applications for FedRAMP 20x Class A Certifications.
August 10, 2026. Temporary Rev5 Program Certification pipelines open, so some providers can apply for Rev5 Class B or C without an agency sponsor.
August 31, 2026. The FedRAMP 20x Class B and C pipeline opens.
January 1, 2027. The Consolidated Rules for 2026 become mandatory for everyone.
June 11, 2027. FedRAMP stops accepting applications for new Rev5 Certifications.

What did FedRAMP say about choosing a path?

The speaker's advice was short. In the video's words: "If you are right now making a decision about which path to pursue, you need to go the 20X path." The speaker said the Rev5 path was "very likely to be turned off next year," and added: "Like invest from now in 20x."

The video's description says the same thing: "FedRAMP 20x is authorization path you should start this year!"

Why does a Rev5 option still exist?

The speaker described an option for Rev5 as "very explicitly a short-term release valve for the fact that a bunch of people have already invested in Rev 5." The speaker said it would be expensive and time-consuming for those companies to convert to 20x right away, and "it's unfair for us to force them to do that when we have the ability to support a few companies through this."

The clip does not name the option. The video's description lists "Rev5 certifications (without a sponsor)" among the topics of the open requests for comment. RFC-0023, Rev5 Program Certifications (No Sponsor Required), proposed "a time-limited opportunity" for providers that had made significant progress toward a Rev5 Certification but could not find an agency sponsor. It called Rev5 "a legacy path that will be phased out over the next few years." FedRAMP's list of RFCs shows its comment period closed on February 26, 2026.

FedRAMP's dates page now lists that kind of option: on August 10, 2026, temporary Rev5 Program Certification pipelines opened, "allowing limited providers to apply for a Rev5 Class B or Class C Program Certification without an agency sponsor."

Which requests for comment did the video point to?

The description says FedRAMP had six open requests for comment (RFCs). It says they touched on assessment costs, authorization designations, Marketplace listings, external frameworks, Rev5 certifications without a sponsor, and machine-readable authorization packages. The description also called them "the last major modernization changes expected for a long time." Those topics match these RFCs:

FedRAMP's list of RFCs shows all six are now closed. Their comment periods ended between February 12 and March 11, 2026.

What should cloud providers and agencies do now?

A provider starting today should plan for 20x. CR26 offers 20x Classes A, B, and C, and Rev5 Classes B, C, and D, according to FedRAMP's ruleset reference. A provider that is still pursuing a new Rev5 Certification must have its application in before June 11, 2027.

For agency staff who sponsor or reuse cloud services, FedRAMP's dates point new services toward 20x. CR26 becomes mandatory for all stakeholders on January 1, 2027, with some areas on their own dates, so Rev5 Certified services must follow it too.

Sources

Share this post:LinkedIn X Email

A weekly email on Fridays, an alert on the day the watch finds something new, or both. Free.