Skip to main content
Thread: #147 20x questions and discussion on the Consolidated Rules for 2026, opened by pete-gov on 2026-06-24 and still open. It has 33 staff posts through 2026-10-16. Last reviewed: 2026-10-24 against upstream release 2026.10.14.01. Staff answers are paraphrased. Follow each link for the exact wording. Staff statements don’t change the published rules. Where they conflict, the official rules govern.

​
Bottom line

20x is currently for cloud-native services built on a FedRAMP-certified IaaS or PaaS. Self-hosted and on-premises services can get a 20x Class A certification, then move to Rev5 Class B or higher until 20x rules for self-hosted services exist. You can get a Class A certification without an independent assessment. You can’t hold both a 20x certification and a Rev5 program certification. FedRAMP doesn’t prescribe secure configuration benchmarks such as STIG or CIS. You choose a defensible approach and document it.

​
Certification paths and classes

pete-gov, 2026-07-08 (comment): 20x is for cloud-native services built on a FedRAMP-certified IaaS or PaaS. Phase 4 will explore on-premises and hosted services, including Class D. A 20x on-premises option should be widely available before new Rev5 certifications stop.
emu-gov, 2026-07-09 (comment) and pete-gov, 2026-10-13 (comment): Class A is open to services with hybrid, on-premises or self-run infrastructure. Those services can’t move to 20x Class B or higher until rules for self-hosted services exist, but they can move to Rev5 Class B or higher. This matches the tip on the upstream Choosing a Certification Path page.
pete-gov, 2026-07-17 (comment): Staff don’t expect a “conversion” from Rev5 to 20x. You apply for a 20x certification, get it, then stop maintaining your Rev5 package. For the temporary Rev5 program certification path, you must agree to follow all updated rules by February 19, 2027 (path page).
pete-gov, 2026-07-24 (comment, form, sponsor):
  • Converting from FedRAMP Ready to a Rev5 Class B or higher program certification still needs a full assessment and package, plus a commitment to all CR26 Rev5 rules by February 2027.
  • You can’t convert until you meet all requirements.
  • You can’t hold both a 20x certification and a Rev5 program certification. See FRC-CSO-POP.
  • Rev5 always needs a sponsor, except through the temporary Class B and C program path.
nicole-gov, 2026-08-06 (comment) and 2026-08-07 (comment, comment):
  • Class A is a real FedRAMP certification. FedRAMP Ready isn’t.
  • CR26 already defines every path from Class A through Class C.
  • After Class A, you can apply for any Class B or C path you qualify for, or skip Class A entirely.
  • The windows staff gave: Class A from 2026-08-03, Rev5 program Class B and C from 2026-08-10 (lost sponsor or ready conversion only), and 20x Class B and C from 2026-08-31.
pete-gov, 2026-06-25 (comment): Legacy 20x pilot materials aren’t on the legacy site because they no longer apply.

​
Class A specifics

emu-gov, 2026-09-09 (comment) and pete-gov, 2026-09-09 (comment): You can get a Class A certification and a Marketplace listing without an independent assessment, and two certified providers did. Staff say MAY really means MAY. Having an assessor check your work first is allowed and might go more smoothly, but it’s “100% not expected.” For reference, the published Class A variant of IVV-CSX-AIA says providers MUST meet the expectations of their underlying alternative security framework.
emu-gov, 2026-09-02 (comment, follow-up): If you hold Class A and apply for Class C, the Class C review is still your “initial certification.” The note about six months of KSI metrics carries over: you need mechanisms in place and an agreement to meet the requirement. Class A certification reports include feedback for moving up to Class B or C.
Rule ID changed. emu-gov answered about FRC-CSX-MOT. Release 2026.10.08.01 removed that rule as a duplicate of SDR-CSX-KMT. SDR-CSX-KMT carries the same initial-certification note. It is MUST for Class C, and changed from MUST to SHOULD for Class B. The answer still holds under SDR-CSX-KMT. See Security decision record.
For a Class A SOC 2 Type II boundary and subservice organizations, see the staff answers in #184 in Notable staff answers.

​
Secure configuration

Rules page: Secure configuration guide.
pete-gov, 2026-07-17 (comment) and 2026-09-02 (comment, follow-up): FedRAMP doesn’t prescribe CIS benchmarks or DISA STIGs. The CR26 Rev5 control guidance has no SA-04 guidance requiring them. For certification, there’s no FedRAMP minimum tier. You pick a risk-based configuration, apply it, and document why it meets the control. Agencies may still write such requirements into contracts. Closed RFCs don’t apply. Read the linked outcome, such as NTC-0013, instead.
nicole-gov, 2026-09-02 (comment) and dan-fedramp, 2026-09-03 (comment): The guide required by SCG-CSO-RSC tells agency customers how to configure your service securely, with settings specific to your offering. Leave out OS configuration unless agencies configure the OS themselves.

​
Adopting rulesets and showing compliance

paulagosta, 2026-07-23 (comment): Paul was answering a Rev5 provider whose grace date falls before its annual assessment.
  • Moving to a ruleset needs no third-party validation first. You just follow the rules.
  • Some rulesets require notice. For example, CDS-CSF-TCM requires notice to FedRAMP at info@fedramp.gov.
  • FedRAMP asks for status through FSI and at your annual assessment.
  • Your monthly ConMon should show the change. For example, your POA&M becomes a monthly activity report.
nicole-gov, 2026-07-24 (comment): Adopting new FedRAMP rules that change your processes will almost certainly be a significant change. Follow the significant change notification rules and notify customers.

​
Security decision record

Rules page: Security decision record.
dan-fedramp, 2026-08-17 (comment): In SDR-CSO-MTD, “Source of update” tells the reviewer whether an update is routine or prompted by an unusual event, such as continuous monitoring, an SCN or incident response. There are no prescribed values.
paulagosta, 2026-08-18 (comment) and emu-gov, 2026-08-24 (comment): The SDR JSON can reference artifacts, but only to support real machine-readable answers. Every field pointing to an SRTM link isn’t acceptable. When artifacts such as screenshots aren’t in the SDR, use direct links and explain why each one matters. If reviewers have to hunt for files, FedRAMP will push back on your submission.

​
Scope and Marketplace listings

Rules pages: Minimum assessment scope, Marketplace listing, Certification data sharing.
emu-gov, 2026-08-17 (comment): Whether a service is in FedRAMP scope depends on how the agency uses it. The examples on the Scope of FedRAMP page aren’t an exclusion list. A key test is general education and training offered to the public. FedRAMP doesn’t issue blanket out-of-scope determinations.
emu-gov, 2026-09-09 (comment) and pete-gov, 2026-09-09 (comment): A feature that can’t be bought on its own can’t have its own listing. List it as a service under the parent offering, and include its components in the MAS-CSO-IIR scope. A standalone product with its own team, package and ConMon is a separate offering with its own listing.
pete-gov, 2026-10-05 (comment) and 2026-10-06 (comment): For software installed locally in an agency, the cloud service’s control over it is in scope. That includes command and control, telemetry and updates. The software itself, running in the agency environment, isn’t. You can include information about it under MAS-CSO-SUP.
pete-gov, 2026-09-02 (comment): No rule requires a full trust center for an Initial Implementation listing. The explicit rules govern, not the narrative. The rules that apply are:A public FedRAMP landing page with that information counts as a “basic FedRAMP-compatible Trust Center.”
pete-gov, 2026-10-16 (comment): An initial Marketplace listing under MKT-IIP-AGU is fine if you intend agencies to use the offering, even with no named agency customer. Scope the offering to the parts you expect to make available to agencies that are likely to handle or affect confidentiality, integrity or availability of federal customer data. For agency data in agency-managed storage, everything handling it, and everything likely to affect its confidentiality, integrity or availability, is in play. A storage service added later can join the existing certified scope as a significant change, or be a separate certified offering if it’s a different product. Staff said FedRAMP can’t give architecture advice.

​
Vulnerability evaluation and reporting

Rules page: Vulnerability evaluation and reporting.
pete-gov, 2026-10-13 (comment): PAIN N0 and accepted vulnerabilities aren’t linked. You may accept the risk of a vulnerability at any PAIN. Track a vulnerability until it’s remediated. A fully mitigated vulnerability is still present, so keep tracking it. See VER-TFR-MAV: you MUST categorize any vulnerability not fully mitigated or remediated within 192 days of evaluation as accepted.

​
Open questions

These were still unanswered in the thread as of 2026-10-14:
  • Whether a provider with an outdated cryptographic module can track it as an open vulnerability past the grace date, and whether that triggers a corrective action plan or revocation (question). For current crypto rules and the open RFC-0035, see Cryptographic module use.
  • Whether IVV-CSO-RAA lets a firm with a firewall between its advisory and assessment teams assess a provider it advised (question).

​
What it means for you

  • If your service isn’t cloud-native on a certified IaaS or PaaS, Class A is your 20x entry point today. Moving higher means Rev5 Class B or above until rules for self-hosted services exist.
  • For Class A, an independent assessment is optional. Check the Class A rules listed in FRC-CLA-MFR.
  • Write your secure configuration guide for agency customers configuring your service, not as an OS hardening benchmark.
  • Treat rule adoption as a significant change and notify customers.
  • In your SDR, use machine-readable answers with direct artifact links, not pointers to legacy documents.