Why FedRAMP 20x Exists

FedRAMP helped standardize federal cloud security, but traditional certification often became difficult for smaller SaaS providers and fast-moving cloud companies to pursue.

Large documentation packages, manual screenshots, repeated spreadsheets, lengthy reviews, assessment coordination, and package maintenance could require significant time and money.

At the same time, modern cloud services operate continuously. Infrastructure changes through code. Security tools generate telemetry throughout the day. Vulnerability scanners, identity platforms, logging systems, deployment pipelines, containers, APIs, and configuration-management tools constantly produce operational data.

A static document may accurately describe the cloud service when written but become outdated as the environment changes.

FedRAMP 20x is intended to better connect certification information to the cloud service’s actual operating state.

The FedRAMP 20x Mindset Shift

Traditional compliance projects often begin by asking what documents must be collected for an assessment.

FedRAMP 20x encourages providers to ask a more useful question: how can the cloud service continuously prove that its security decisions are being implemented?

That changes compliance from a separate documentation project into part of cloud engineering, security operations, identity management, vulnerability response, configuration management, deployment, monitoring, and incident response.

Core Pillars of FedRAMP 20x

What Is a Security Decision Record?

The Security Decision Record, or SDR, is a central component of the FedRAMP 20x certification package.

It is a maintained record explaining how the cloud service provider follows applicable FedRAMP rules and makes important security decisions.

The SDR can include implementation information, verification and validation, independent assessment details, clarifications, related artifacts, KSI information, security metrics, and other certification records required by the provider’s class.

Higher certification classes may require historical metrics, giving agencies and assessors visibility into security performance over time rather than only on the day evidence was collected.

What Are FedRAMP 20x Key Security Indicators?

Key Security Indicators are summaries and measures showing how the provider demonstrates important security outcomes.

Instead of requiring agencies to interpret hundreds of disconnected pieces of information, KSIs create a clearer way to understand major capabilities across identity, secure development, vulnerability management, infrastructure, recovery, incident response, monitoring, and other security areas.

A KSI is not merely a checklist item. The provider should be able to explain the decision, measure the outcome, identify the evidence source, validate the result, and respond when the expected security state is not maintained.

Higher certification classes require stronger assurance, more validation, additional assessment information, historical measures, and greater automation.

Machine-Readable Evidence in FedRAMP 20x

Every FedRAMP 20x certification package is expected to include machine-readable certification data across the package lifecycle.

This can include structured information supporting initial certification, security decisions, KSIs, secure configurations, vulnerabilities, significant changes, ongoing reporting, assessment, validation, and remediation.

Evidence may originate from cloud platforms, asset inventories, identity systems, vulnerability scanners, configuration tools, ticketing platforms, source-code repositories, deployment pipelines, logging systems, SIEM platforms, and incident-management tools.

The benefit is not simply that software can read the file. The evidence can be compared, validated, reproduced, searched, updated, and reused more efficiently.

What Is Persistent Validation?

Persistent validation is the practice of repeatedly confirming that documented security decisions and policies are being implemented throughout the cloud service offering.

The objective is for the provider’s operational state to remain intentional, understood, documented, and known.

Machine-based information resources may be checked automatically, while human-managed procedures may be reviewed on appropriate recurring schedules.

Failed validation should create action. The organization should investigate the condition, identify affected resources, determine risk, assign remediation, preserve evidence, and verify restoration of the expected state.

This prevents compliance from becoming a series of successful screenshots that hide declining security performance between assessments.

FedRAMP 20x Classes A Through D

A FedRAMP Certification Class describes the level of assurance information a provider supplies for its cloud service offering.

The classes do not merely rename the old Low, Moderate, and High baselines. They define package, validation, assessment, historical-information, monitoring, and certification requirements under the current program rules.

Does FedRAMP 20x Eliminate Third-Party Assessment?

No. FedRAMP 20x does not allow cloud providers to replace all external assessment with their own automated tools.

Independent verification and validation remain important, particularly for Classes B and C and for certification requirements requiring assessor review.

Assessors may evaluate the service boundary, provider decisions, KSIs, evidence sources, automation logic, historical metrics, security configurations, vulnerabilities, assessment procedures, and remediation processes.

The assessor also needs confidence that automated data can be trusted. That means understanding where the data originates, which resources it covers, how frequently it is generated, and what occurs when the result fails.

What Happens to FedRAMP Rev. 5?

FedRAMP Rev. 5 is not disappearing immediately.

Existing certifications remain part of the program, and selected temporary Rev. 5 certification paths continue during the transition.

However, FedRAMP has identified 20x as the new direction. The Consolidated Rules establish updated expectations and a defined timeline for ending new Rev. 5 applications.

FedRAMP plans to stop accepting applications for new Rev. 5 Certifications on June 11, 2027. Existing Rev. 5 providers will receive transition guidance for maintaining or moving their certifications.

Why Cloud-Native Providers Should Care

FedRAMP 20x may be particularly valuable for providers already operating modern engineering and security environments.

SaaS companies using infrastructure as code, automated deployments, cloud-native identity, centralized logging, security telemetry, vulnerability scanning, APIs, DevSecOps workflows, and automated configuration validation may already possess many of the systems needed to produce 20x evidence.

Under traditional FedRAMP, those capabilities often had to be translated into screenshots, spreadsheets, narrative descriptions, and manually assembled reports.

FedRAMP 20x creates an opportunity to use operational security information more directly. This can reduce repetitive work, improve evidence quality, speed review, and help smaller providers compete for federal opportunities.

However, providers with weak asset inventory, inconsistent security operations, limited automation, or unreliable telemetry may need significant engineering work before benefiting from the model.

Common FedRAMP 20x Misconceptions

How Cloud Providers Can Prepare for FedRAMP 20x

FedRAMP 20x Readiness Checklist

Frequently Asked Questions