What FedRAMP 20x means for agencies

FedRAMP 20x is the new way a cloud service earns certification from the Federal Risk and Authorization Management Program (FedRAMP). It replaces long written security plans with measured outcomes and machine-readable evidence. Most of the talk about 20x is aimed at cloud providers. This post is for the agency side: what changes for you, what stays the same, and what you must do from first use through ongoing monitoring.

The short version

• A FedRAMP certification is still not your authorization to operate (ATO). Your agency must still authorize its own use of a cloud service.
• The names changed. Since February 25, 2026, every FedRAMP authorization is called a "FedRAMP Certification." Classes A, B, C, and D replace the old impact levels.
• You document only your own part. Your system security plan (SSP) covers what your agency configures and runs. It does not copy the provider's package.
• Monitoring moves to a steady rhythm. Providers send an Ongoing Certification Report every three months. Your agency must review it.
• Your agency now reports incidents to CISA, the Cybersecurity and Infrastructure Security Agency. Providers tell you which agencies an incident likely affects.

New words to know

FedRAMP warns that classes measure the level of assurance, not how secure a service is. Do not treat a class as a one-for-one stand-in for your system's FIPS 199 category. The notice that introduced the classes also says a certification "is not a guarantee" that a service meets every requirement for a given security category. (FedRAMP notice NTC-0004)

What 20x changes, and what it does not

20x changes how providers prove their security. Instead of a narrative plan, a 20x provider meets 46 Key Security Indicators in 10 themes, such as identity and access management, change management, and incident response. Each indicator is a short outcome statement mapped to National Institute of Standards and Technology (NIST) SP 800-53 controls, and the provider backs it with automated checks. (Key Security Indicators)

20x does not change your agency's duty to authorize and monitor its own systems. FedRAMP's guidance for agencies says it plainly: "Agencies are responsible for monitoring the federal information systems they authorize." (Ongoing use)

Starting to use a certified service

FedRAMP's guidance for agencies lists five steps. It opens with a warning: "Do not begin by copying a provider's security controls!" (Initial use)

Three rules from FedRAMP's Agency Use rules matter most at this stage. Each took effect July 4, 2026. (Agency Use rules)

• Your agency must complete its ATO before it uses a service, and must send FedRAMP a copy of the ATO letter.
• Your agency must review the provider's Secure Configuration Guide and configure the relevant security settings.
• Your agency must not ask a certified provider for more materials than FedRAMP requires, or demand a particular certification type or path. The exception is when your agency head finds a demonstrable need and tells FedRAMP.

One more rule needs work before you buy anything. Your agency must make sure its governance, risk, and compliance (GRC) and inventory tools can read and produce machine-readable files, such as Open Security Controls Assessment Language (OSCAL) and JSON files. 20x packages arrive in those formats.

Ongoing use: the monitoring cycle

After the ATO, your agency's work becomes a cycle. FedRAMP asks agencies to watch the provider's process, not to approve every change.

A few details are worth knowing:

• Reports and reviews. Providers must send an Ongoing Certification Report every three months. Class C and Class D providers must also host a live Quarterly Review, and Class B providers should. Your agency must review each report. (Collaborative Continuous Monitoring)
• Significant changes. A provider notifies you of significant changes on a schedule set by the type of change. You do not approve each one. A change of class needs a new assessment.
• Vulnerabilities. Providers report at least monthly. FedRAMP's vulnerability rules apply to every provider from December 7, 2026, with a grace period to March 7, 2027. (Notice NTC-0014)
• Incidents. Since June 3, 2026, FedRAMP no longer expects providers to report agency incidents to CISA. Your agency reports, based on the impact to its own services. The provider must name the agencies an incident likely affects. Some older contracts may still say otherwise, so check yours. (Notice NTC-0012)
• Third parties. Your agency should consider the outside services a provider relies on, both at first use and during monitoring.

Dates to plan for

Sources: FedRAMP deadlines, M-24-15 implementation, notice NTC-0013, and FedRAMP's October 8, 2026 update.

What to do this quarter

1. Name the official who will review Ongoing Certification Reports and attend Quarterly Reviews. FedRAMP recommends a senior security official.
2. Set up an agency liaison and a shared inbox that FedRAMP and providers can reach.
3. Confirm your GRC tool can read OSCAL and JSON packages.
4. Check your contracts for terms that would stop a provider from following FedRAMP's rules, and for old clauses that have the provider report incidents to CISA for you.
5. Update your incident procedure so your agency reports cloud incidents to CISA.
6. List your cloud services by certification type, Rev5 or 20x, so you can plan for the Rev5 transition.

FedXchange's governance tracker follows FedRAMP notices and rules as they change, and the Marketplace tracker shows which services are certified under 20x.

Sources

• FedRAMP, Initial agency use and Ongoing agency use.
• FedRAMP, Agency Use rules, Consolidated Rules for 2026, effective July 4, 2026.
• FedRAMP, Collaborative Continuous Monitoring rules.
• FedRAMP, Key Security Indicators.
• FedRAMP notices NTC-0004 (February 25, 2026, certification names and classes), NTC-0012 (June 3, 2026, incident reporting), NTC-0013 (June 16, 2026, Rev5 changes), and NTC-0014 (vulnerability rules).
• FedRAMP, Deadlines and M-24-15 implementation.
• FedRAMP, From foundation to implementation, October 8, 2026.