FedRAMP 20x after 11 June 2027: Class A, B or C for SaaS vendors

Summary. FedRAMP says it will stop accepting new Rev5 certification applications on 11 June 2027, but its 20x page calls every future date an estimate. Under the Consolidated Rules for 2026 (CR26), launched on 24 June 2026, FedRAMP issues certifications rather than authorisations and sorts them by type (20x or Rev5) and class. 20x Class A opened on 3 August 2026 and Classes B and C on 31 August 2026, all on the Program Certification path with no agency sponsor. Class A needs a SOC 2 Type II, GovRAMP or Rev5 result from the past 12 months plus 24 mandatory FedRAMP rules, seven of them Key Security Indicators (KSIs). Class B lists 46 KSIs (five optional) and machine checks at least every 7 days; Class C makes all 46 mandatory and checks every 3 days, both with an annual independent assessment. FedRAMP granted the first 20x Class A on 25 August 2026 and the first full CR26 Class C on 29 October 2026. High (Class D) is Rev5-only today. Our verdict: a commercial SaaS on FedRAMP-certified infrastructure should start at Class A now and climb when an agency pays. Only vendors running their own infrastructure, or needing High now with a sponsor, should race to file Rev5.

About this article. For founders, CTOs and security leads at SaaS companies weighing a US federal sale. On 13 November 2026 we checked every rule, date and count against fedramp.gov rule pages, data files, notices and blog posts, the DFARS clause and the US Bureau of Labor Statistics. FedRAMP now releases rule updates monthly, so re-check before you commit. General information, not legal or procurement advice; no vendor paid for inclusion. Researched with AI assistance and reviewed by our editorial team.

What changed in 2026, and why 11 June 2027 matters

CR26 puts every FedRAMP requirement, definition and date on one public site, with machine-readable source files for tools and AI agents. Three changes reshape a SaaS vendor's federal plan.

The vocabulary moved. Authorisation became Certification, Low, Moderate and High became Classes A to D, continuous monitoring became Ongoing Certification, and the System Security Plan became a Certification Package Overview plus a Security Decision Record. FedRAMP says the classes align loosely with the NIST SP 800-53B baselines but do not correspond directly to impact levels.

The path moved. FedRAMP itself grants 20x certifications on the Program Certification path. Rev5 generally still needs an agency to authorise the service first and then sponsor it, which FedRAMP calls Agency Certification.

The calendar moved. These dates come from FedRAMP's dates, deadlines, path and changes pages, its notices and its blog.

How firm is 11 June 2027? FedRAMP's 20x page puts the cutoff in Phase 5, estimated for FY27 Q3 to Q4, and warns that future dates will shift as conditions change. The CR26 dates and deadlines pages list the same day without that caveat. On 13 November 2026 the 20x page still said Phase 3, although its estimated Phase 4 window (FY27 Q1 to Q2, October 2026 to March 2027) had begun. The page lags or the schedule is slipping; either way, do not plan on a Rev5 extension.

The four classes in plain terms

FedRAMP designed the classes to be taken in sequence, so that investment grows with agency interest. Its class guidance tells most newcomers to start with Class A and warns against going straight to Class C or D unless an existing agency contract already requires that commitment.

Class A: the entry ticket for mature commercial SaaS

Class A suits commercial products that already hold a SOC 2 Type II and run a mature security programme. It requires a completed result within the past 12 months from one of three frameworks: FedRAMP Rev5 (including FedRAMP Ready) at any impact level, SOC 2 Type II, or GovRAMP at any level. For SOC 2 you hand over the complete report, any bridge or gap letter, verified audit engagement documents and the schedule for your next report.

On top sits a mandatory list of 24 further FedRAMP rules: the certification package and JSON schemas, the pick-one rule, scope, public information, a FedRAMP-compatible trust centre, agency access denial, a monitored FedRAMP Security Inbox, incident reporting, vulnerability detection, the ongoing certification report, the 20x annual assessment rule, KSI documentation (added on 31 October 2026) and seven KSIs: logging changes, restricting network traffic, reviewing training, automating account management, adopting passwordless methods, reviewing incident response procedures and securing information.

Two details trip teams up. First, Class A's annual assessment rule is met by keeping your underlying framework's assessment current, so the recurring cost is your next SOC 2 audit; a FedRAMP-recognised assessor's review is optional. Second, pointing reviewers at the SOC 2 report is not enough: each FedRAMP rule needs its own summary. In the Phase 1 pilot, FedRAMP found that no participant actively reused an existing framework assessment such as SOC 2. The SOC 2 gets you through the door; it does not write the package.

Class B: light federal use and Low-type objectives

Class B is for common small-scale or light-use services that an entire agency is unlikely to rely on for important work. It brings in 15 rulesets. The Class B KSI list holds 46 indicators, five of them optional at this class: enforcing intended state, authorising log access, preventing residual risk, removing unwanted data and validating communications.

Providers must verify and validate machine-based resources at least every 7 days, and FedRAMP recommends scanning drift-prone resources at least monthly. The Class B vulnerability rules recommend mitigating the worst rating (PAIN-5, on FedRAMP's Potential Agency Impact N-rating scale) within 4 days when a flaw is likely exploitable and internet-reachable. A FedRAMP-recognised assessor, or FedRAMP itself, must assess all applicable rules, including every KSI, at least once a year.

Class C: agency-wide or important services

Class C is for services likely to be used agency-wide or that deliver important government services. The rulesets match Class B, but all 46 KSIs are mandatory. Machine checks must run at least every 3 days; FedRAMP recommends scanning drift-prone resources every 14 days and a 2-day target for a likely exploitable, internet-reachable PAIN-5 flaw. Assessors must review the measures at a technical level, including underlying code where appropriate, not just documents or screenshots. FedRAMP no longer asks for a separate Security Assessment Plan or Report; the assessor's summary goes into the provider's Security Decision Record.

Class D: High, and Rev5-only for now

20x Class D is marked as coming in 2027; Rev5 Class D requires agency certification. The type guidance expects a pilot in late 2026, a formal option in early 2027, and says a newcomer will usually reach 20x Class D via Class C faster than it could obtain Rev5 Class D.

RFC-0036, open for comment until 19 November 2026, proposes ten new KSIs, machine checks every 3 days, an API for the package, post-quantum cryptography status and hosting on Class C or D certified infrastructure. It would also require six months at 20x Class C without corrective action before applying (pilot participants need a full Class C but not the six months). If the post-quantum rule survives, our CNSA 2.0 post-quantum checklist for vendors covers much of the groundwork.

Class A vs B vs C vs D at a glance

Sources: FedRAMP's path and class guidance, the machine-readable rules and RFC-0036, as of 13 November 2026.

20x vs Rev5: the head-to-head

Sources: FedRAMP's type guidance and its 2026 changes page. One rule binds both columns: the pick-one rule (FRC-CSO-POP) bars a provider from seeking both a Rev5 and a 20x Program Certification for the same offering. Holding a Rev5 Agency Certification alongside a 20x Program Certification is allowed, but FedRAMP strongly discourages it.

Decision table: which path to choose

The pipeline criteria come from FedRAMP's path guidance. If the SOC 2 itself is missing, our Cyber Essentials vs ISO 27001 vs SOC 2 buyer guide compares what US and UK buyers ask for.

When to start: working back from 11 June 2027

If you need Rev5, the clock is short and the old shortcut has gone. From 1 January 2027 any new Rev5 application must follow CR26, and the vulnerability rules apply to anyone obtaining a certification from 7 December 2026. A spring 2027 Rev5 filer does most of the modern work anyway and still needs a sponsor. The two temporary Rev5 Program Certification pipelines also close on 11 June.

If you are going 20x, there is no announced cutoff, but three timers run. Your SOC 2 Type II (or other framework result) must be under 12 months old for Class A. Your package must show the offering as verified and validated within the previous 7 days. An initial independent assessment may be refreshed with a review of changes only if it is 9 months old or less. You must be listed on the FedRAMP Marketplace before applying, and no third party, including your assessor, may apply for you.

A realistic sequence for a vendor starting in December 2026:

1. December 2026 to January 2027: confirm your SOC 2 window, list on the Marketplace, stand up the security inbox and trust centre, and wire the seven Class A KSIs into your pipelines.

1. February to March 2027: generate the JSON package, test it against FedRAMP's schemas, and apply for Class A.

1. Before 11 June 2027: decide whether any buyer truly needs Rev5. If not, let the date pass.

1. When an agency asks for more: extend automation to all 46 KSIs and the 7-day or 3-day verification cadence, engage a FedRAMP-recognised assessor, and move to Class B or C.

FedRAMP is also chasing certified providers. NTC-0017 of 10 November 2026 says a Security Inbox test, likely sent between 1 and 10 December 2026 with replies likely due on 17 December, will collect each certified service's progress on the new vulnerability rules. Services planning to finish after 3 February 2027 go into an In Remediation status, and any service without an approved corrective action plan on 8 March 2027 loses its certification and is barred for a year.

Worked cost example: a 60-person SaaS company on AWS

FedRAMP charges no certification fee; it says it is not funded by fees. Assessor fees are private contracts, and in February 2026 FedRAMP dropped its plan to collect assessment costs. So the only number we can check is your own people's time. We use the US Bureau of Labor Statistics median pay for information security analysts: $129,180 a year, or $62.11 an hour, in May 2025. That is a wage, not a fully loaded cost, so treat the results as a floor.

The company: a 60-person B2B SaaS vendor on AWS commercial regions, with a SOC 2 Type II issued in September 2026 and Terraform for most infrastructure. The hours are our illustrative assumptions, not FedRAMP figures.

Add your next SOC 2 audit for Class A, and the assessor's quote for the annual assessment at Classes B and C. The shape matters more than the totals: Class A costs under a fifth of Class C in our model ($29,812.80 against $159,001.60, or 18.75%), and the gap is mostly automation. Pay for Class C only when an agency's contract pays you back.

Defence buyers: where FedRAMP meets CMMC

Many SaaS vendors meet FedRAMP through a defence contractor. DFARS 252.204-7012 (May 2024) still requires a contractor whose external cloud provider stores, processes or transmits covered defense information to ensure that provider meets security requirements equivalent to the FedRAMP Moderate baseline. The provider must also follow the clause's duties on cyber incident reporting within 72 hours, malicious software, media preservation and access for forensic analysis.

FedRAMP, meanwhile, says classes do not map directly to impact levels. Until the clause or guidance changes, we expect primes to ask Class C holders for a mapping to Moderate controls. Each 20x KSI already lists related NIST SP 800-53 controls, which helps. Our CMMC Level 1 vs Level 2 guide covers the prime's own duties, and our Vanta vs Drata vs Secureframe comparison covers platforms teams use to collect this evidence.

Implementation checklist for engineering teams

1. Draw the boundary first. List every information resource, including third-party ones, likely to handle federal customer data or affect its security.

1. Treat KSIs as code. Map each indicator to a scheduled test that stores its result, not to a policy PDF.

1. Serve public JSON that browsers can read. The JSON rule asks for cross-origin access plus correct content-type and nosniff headers.

1. Run the security inbox like on-call. FedRAMP tests it every quarter and has used it for a real emergency directive.

1. Rate vulnerabilities in PAIN terms. Map scanner output to PAIN, reachability and exploitability, then alert on your class's timeframes.

1. Follow the KEV catalogue. The rules recommend remediating Known Exploited Vulnerabilities by the CISA catalogue due dates, even when you have already mitigated the flaw.

1. Keep the Security Decision Record current. FedRAMP counts an out-of-date control statement as a vulnerability.

1. Log significant changes. Classes B and C carry a 17-rule significant change notification ruleset.

1. List your cryptographic modules. NIST-validated modules are optional at Classes A and B and recommended at Class C.

For item 3, a minimal nginx block looks like this; use the wildcard origin on public data only.

            location /fedramp/ {
    default_type application/json;
    add_header Access-Control-Allow-Origin "*" always;
    add_header X-Content-Type-Options "nosniff" always;
}
          

How eCorpIT can help

eCorpIT is a Gurugram-based technology organisation, founded in 2021, assessed at CMMI Level 5 and MSME certified, with senior-led engineering teams working across AWS, Microsoft and Google platforms. Our cybersecurity services team builds the automation 20x assumes, such as KSI checks as code and machine-readable evidence feeds, while certification decisions stay with FedRAMP. Talk to us at /contact-us/.

Last updated: 13 November 2026.

References

1. FedRAMP 20x — FedRAMP, US General Services Administration

1. What's Changing in 2026 — FedRAMP Consolidated Rules for 2026

1. 20x Class A: FedRAMP Certification rules — FedRAMP Consolidated Rules for 2026

1. Important Dates for the Consolidated Rules for 2026 — FedRAMP

1. FedRAMP Consolidated Rules for 2026, machine-readable data, version 2026.11.02.01 — FedRAMP on GitHub

1. Memo to Milestone: FedRAMP Grants the First Full FedRAMP 20x Class C Certification, 2 November 2026 — FedRAMP

1. Consolidated Rules for 2026 changelog — FedRAMP

1. FedRAMP Consolidated Rules for 2026 — FedRAMP

1. Choosing a Certification Class — FedRAMP Consolidated Rules for 2026

1. Choosing a Certification Path — FedRAMP Consolidated Rules for 2026

1. Important Deadlines for providers — FedRAMP Consolidated Rules for 2026

1. NTC-0014 FedRAMP Response to CISA BOD 26-04, 16 June 2026 — FedRAMP

1. 20x Class B Ruleset Reference — FedRAMP Consolidated Rules for 2026

1. 20x Class B Key Security Indicators — FedRAMP Consolidated Rules for 2026

1. 20x Class B Vulnerability Detection and Response — FedRAMP Consolidated Rules for 2026

1. 20x Class B Independent Verification and Validation — FedRAMP Consolidated Rules for 2026

1. 20x Class C Key Security Indicators — FedRAMP Consolidated Rules for 2026

1. 20x Class C Vulnerability Detection and Response — FedRAMP Consolidated Rules for 2026

1. 20x Class C Independent Verification and Validation — FedRAMP Consolidated Rules for 2026

1. Choosing a Certification Type — FedRAMP Consolidated Rules for 2026

1. RFC-0036 FedRAMP 20x Class D Cloud-Hosted Pilot Requirements — FedRAMP

1. FedRAMP Requests for Comment (open and closed RFCs) — FedRAMP

1. NTC-0017 VDR/VER Migration Progress Reporting and Upcoming FY27 Q1 FedRAMP Security Inbox Test, 10 November 2026 — FedRAMP

1. NTC-0002 Outcome from RFC-0019 Reporting Assessment Costs, 18 February 2026 — FedRAMP

1. Information Security Analysts, Occupational Outlook Handbook — US Bureau of Labor Statistics

1. DFARS 252.204-7012 Safeguarding Covered Defense Information and Cyber Incident Reporting (May 2024) — Acquisition.gov

1. FedRAMP Public Notices — FedRAMP