Why FedRAMP asked cloud providers to join the 20x pilot, and what changed after

In a February 2026 video, a FedRAMP speaker said the 20x pilot let companies that had shown a commitment to security get onto the FedRAMP Marketplace and work with agencies. The pilot has ended, and 20x Certification now runs under the 2026 Consolidated Rules.

By FedXchange · February 5, 2026

FedRAMP's video, on its governance tracker page. The player loads from YouTube only when you press play.

On February 5, 2026, the Federal Risk and Authorization Management Program (FedRAMP) posted a short video, "The Benefits of Participating in a FedRAMP Pilot." In it, a FedRAMP speaker who once worked at an agency explained why the FedRAMP 20x pilot matters to agencies and to small cloud companies. FedRAMP 20x is FedRAMP's newer approach to assessment, which relies on Key Security Indicators (KSIs) and automatically validated evidence.

The video came out before FedRAMP issued the FedRAMP Consolidated Rules for 2026 in June 2026. At the time, FedRAMP and the speaker used the word "authorization" for FedRAMP's approval of a cloud service, and pilot participants received "pilot authorizations." The current terms are "FedRAMP Certification" and "FedRAMP Certified."

In short:

What FedRAMP said. The 20x pilot is a way for companies that have already shown a commitment to security to get onto the FedRAMP Marketplace. There they can work with agencies to find their strengths and weaknesses and learn what changes they might need to make to meet agency needs.
Who it affects. Cloud service providers, especially small companies, and agency staff who want to try a cloud product for real but non-critical, non-sensitive work.
What FedRAMP asked. The video's description asked companies to consider joining the 20x pilot, and to comment on six open requests for comment (RFCs).
By when. Comments on those six RFCs closed between February 12 and March 11, 2026, according to FedRAMP's RFC page. The pilot phases have since ended. FedRAMP's 20x page now lists Phase 3, wide-scale adoption, as active.

How a FedRAMP speaker described the value of the 20x pilot

Source: The Benefits of Participating in a FedRAMP Pilot (FedRAMP video, February 5, 2026). This is a speaker's description, not a FedRAMP rule.

Read the steps as text

An agency need. Agency staff want to try a product for real work that is not critical or sensitive.
The old barrier. It is hard to ask a small company to pay for a full FedRAMP review before the agency tries the product.
The pilot. A company that has shown a commitment to security gets onto the FedRAMP Marketplace.
Working together. The company and agencies find its strengths and weaknesses and how it can add value.
Improvement. The company learns what changes to its security posture agencies might need.

Why did FedRAMP want companies to join the pilot?

In the video, the speaker described an agency problem. When the speaker worked at an agency, staff often wanted to try a product. They did not want only to experiment. They wanted to use it for real work that was not critical or sensitive.

The speaker said it was hard to go to a small business, one with a few employees, and ask it to invest about $2 million in a FedRAMP review before the agency even knew whether it liked the product. That figure is the speaker's example, not a FedRAMP estimate.

The speaker said the pilot is "a really good way for these companies that have already demonstrated a commitment to security to be able to get onto the marketplace." (Words from the video.) The speaker said the pilot lets companies work with agencies to learn:

where their strengths and weaknesses are;
how they can add value; and
what changes or enhancements they might need to make to their security posture to meet agency needs.

The speaker said both agencies and industry would be excited about the pilot and benefit from it.

Why did FedRAMP make this video?

The video's description gives the reason. FedRAMP's Community Working Groups had returned in January 2026 after a pause caused by the government shutdown. FedRAMP's 20x page says that shutdown ran from October 1 to November 13, 2025.

FedRAMP noticed a gap in attendance at the January sessions. FedRAMP runs separate sessions for 20x and for Rev5, its existing certification path, which 20x is set to replace for new applicants. The description says the Rev5 session had "well over 450 attendees at its peak," and the 20x session had about half that. FedRAMP wrote that this could reflect "some skepticism around 20x and taking a chance on participating in a pilot as whole."

Which requests for comment did FedRAMP name?

The description said FedRAMP had six open RFCs, and called them "the last major modernization changes expected for a long time." It said they touched on assessment costs, authorization designations, Marketplace listings, external frameworks, Rev5 certifications without a sponsor, and machine-readable packages. Those six are:

RFC-0019, Reporting Assessment Costs, which proposed that cloud service providers report what assessments cost, and that independent assessors attest to the figures;
RFC-0020, FedRAMP Authorization Designations;
RFC-0021, Expanding the FedRAMP Marketplace;
RFC-0022, Leveraging External Frameworks;
RFC-0023, Rev5 Program Certifications (No Sponsor Required); and
RFC-0024, FedRAMP Rev5 Machine-Readable Packages.

FedRAMP's RFC page lists all six as closed. Their comment periods ended on February 12 (RFC-0019), February 19 (RFC-0020 and RFC-0021), February 26 (RFC-0022 and RFC-0023), and March 11, 2026 (RFC-0024).

What happened to the pilot after the video?

FedRAMP's 20x page gives the rest of the story:

Phase 1, a Low pilot, ran from April through September 2025. It was open to the public, and qualifying participants received a 20x Low pilot authorization.
Phase 2, a Moderate pilot, ran from November 18, 2025, through March 2026. It was limited to providers that passed Phase 1, offerings that use artificial intelligence (AI) and that FedRAMP prioritized, and services of critical need, such as trust centers and governance, risk, and compliance tools. The first cohort received pilot authorizations on March 6, 2026.
Phase 3, wide-scale adoption, is now active. The 2026 Consolidated Rules support 20x Certification at Classes A, B, and C at first.
Phase 4, a Class D pilot, and Phase 5, the end of new Rev5 Certifications, are estimated for fiscal year 2027. FedRAMP will stop accepting new Rev5 Certifications on June 11, 2027.

What does this mean for agencies and cloud providers now?

The pilot the video described is over. A cloud provider that wants a 20x Certification now follows the 2026 Consolidated Rules. The rules took effect on July 4, 2026, and become mandatory for all FedRAMP stakeholders on January 1, 2027. FedRAMP's What's Changing in 2026 page explains the change in terms: "Using FedRAMP Certification avoids conflating a FedRAMP authorization with an agency authorization to operate..." The page says an agency authorization to operate has its own meaning under Office of Management and Budget (OMB) Circular A-130.

The same page says agencies use FedRAMP Certified services "as a third-party information resource" for their own risk assessment.

Sources

Share this post:LinkedIn X Email

A weekly email on Fridays, an alert on the day the watch finds something new, or both. Free.