Question · FedRAMP
What is FedRAMP 20x and how does it change the FedRAMP Certification path?
FedRAMP is the government-wide program for security assessment and authorization of cloud services; by statute a FedRAMP authorization package is presumed adequate for an agency's own ATO.
01 / The answer
The short answer
FedRAMP 20x is GSA's replacement for the document-heavy Rev5 process. It validates security through Key Security Indicators, machine-readable evidence and automated checks instead of long narrative packages. Rules are final for Class A, B and C certifications; the 20x Class B and C pipeline opened August 31, 2026, and a Class D (High) pilot is planned for FY27. The Consolidated Rules for 2026 become mandatory January 1, 2027, and FedRAMP stops accepting new Rev5 certifications on June 11, 2027. Agencies still issue their own ATOs.
02 / The rule
What FedRAMP requires
FedRAMP is the government-wide program for security assessment and authorization of cloud services; by statute a FedRAMP authorization package is presumed adequate for an agency's own ATO. FedRAMP 20x, now in Phase 3, replaces document-heavy Rev5 reviews with automated, machine-readable validation and Class A to D certifications, and FedRAMP prioritized several generative AI services in 2025-2026.
- 01Cloud providers must obtain FedRAMP certification at the class or impact level matching the agency data.
- 02Implement and evidence the required controls, or the 20x key security indicators, and pass independent assessment.
- 03Perform continuous monitoring and report vulnerabilities and changes to FedRAMP and agencies.
- 04Agencies must reuse existing FedRAMP assessments where practicable and still issue their own ATO.
03 / Records
Records to keep
- 01FedRAMP Marketplace listing and certification letter
- 02System security plan or 20x machine-readable package
- 03Independent assessment report
- 04Monthly continuous monitoring deliverables
Optional evidence · where Planisphere fits
Keep a record anyone can check
When your team meets a duty, Planisphere can seal the event it reports as a receipt.
A disclosure shown, a review signed, a model change approved: the event your system reports.
The event becomes a sealed receipt, dated and attributed to whoever is signed in.
Paste the receipt into Verify. No account or key.
A record supports your compliance evidence process. It is not a legal finding or a certification. Systems that call Planisphere's gate API can also hold or refuse an action before it runs.
SOURCES
Go back to the source
FedRAMP (GSA)
FedRAMP (GSA)
Legal Information Institute (Cornell)
FedRAMP (GSA)
RELATED
Related: FedRAMP: the full guide · How do I produce machine-readable KSI / continuous-monitoring evidence? · What's the difference between an agency ATO and FedRAMP Certification? · Is FedRAMP High enough for DoD, or do I also need an Impact Level?