FedRAMP 20x: what changes for cloud providers, and what stays hard
FedRAMP is replacing document-heavy authorization with machine-readable evidence and Key Security Indicators, and has said the legacy Rev5 process is expected to wind down. The paperwork gets lighter. The engineering does not.
- Published
- October 8, 2026
- Reading time
- 10 minutes
- Written by
- MarkTillson Cloud Assurance Practice
For more than a decade, a FedRAMP authorization meant a system security plan that could run to hundreds of pages, a long assessment by a third-party assessment organization (3PAO), and an authorization process measured in many months. FedRAMP 20x, launched in March 2025, is the program’s attempt to change that model: fewer narrative documents, more machine-readable evidence, and security demonstrated through measurable indicators that can be checked continuously.
By late 2026 the direction is clear, even if some details are still settling. This article explains what has changed, what it means for cloud service providers deciding when and how to pursue authorization, and why the hardest parts of FedRAMP remain: engineering, operations and evidence.
FedRAMP has published its changes incrementally through requests for comment, notices and pilot phases, and several of its dates are stated as targets. Everything here is drawn from FedRAMP’s own statements. Check fedramp.gov for the latest position before you lock a plan.
What FedRAMP 20x is
At its core, 20x replaces control-by-control narrative with Key Security Indicators (KSIs): statements of security outcomes (covering identity and access management, configuration, monitoring and recovery, among others) that a provider demonstrates with evidence, much of it generated automatically from its systems. FedRAMP’s request for comment on the first set of KSIs specified that packages submitted for assessment must be machine-readable and able to be regenerated on demand.
The program has proceeded in phases. A first phase piloted the approach at the Low impact level in 2025. A second phase, run from November 2025 to the end of March 2026 according to FedRAMP, tested the indicators at the Moderate level for effectiveness and burden, and the first pilot authorizations from that cohort were granted in March 2026. FedRAMP has also organized its offerings into classes: Class B corresponds to Low, Class C to Moderate and Class D to High.
What happens to Rev5
The traditional process, based on the NIST SP 800-53 Revision 5 baselines, has not disappeared. FedRAMP has stated that the current Rev5 authorization process is expected to cease operations at the end of fiscal year 2027, and that standards developed for 20x that are applicable to Rev5 are being retrofitted to it through what it calls Balance Improvement Releases. It has also set target dates in 2027 for Rev5 submissions to provide machine-readable authorization data.
For providers, that creates a planning question with no single right answer. Those mid-way through a Rev5 effort, particularly at High, may reasonably continue. Those starting now at Low or Moderate should assess whether the 20x route fits their architecture and evidence maturity.
| Traditional Rev5 model | 20x model | |
|---|---|---|
| Primary artifact | Narrative system security plan, control by control | Machine-readable package demonstrating Key Security Indicators |
| Evidence | Largely documents and screenshots, assessed periodically | Largely generated from systems, regenerable on demand |
| Monitoring | Monthly continuous-monitoring deliverables and annual assessment | Oriented towards near-real-time demonstration of posture |
| Main burden | Documentation and coordination | Engineering automation and data quality |
What genuinely gets easier
- Less prose. Writing and maintaining hundreds of pages of control narrative was a major cost of the old model. Moving to structured, outcome-based evidence removes much of it.
- Faster feedback. Evidence that is generated by systems can be checked repeatedly, so drift is visible earlier, to the provider and potentially to agencies.
- Reuse. Machine-readable evidence produced for FedRAMP can often support other frameworks and customer assurance requests, if it is designed with that in mind.
What stays hard
Your architecture still has to meet the bar
Indicators measure outcomes. A provider with shared tenancy where isolation is weak, long-lived credentials, inconsistent encryption or incomplete logging will fail the indicators just as it would have failed the controls. 20x changes how security is demonstrated, not how secure the system needs to be.
Automation is real engineering
Producing trustworthy, regenerable evidence requires pipelines that collect configuration state, identity data, vulnerability findings and logs from every component in the authorization boundary, transform them into the required format and preserve their integrity. That is a software project with its own testing, change control and failure modes.
The boundary is still the boundary
Defining what is inside the authorization boundary, including the third-party services and external systems the offering depends on, remains one of the most consequential and most debated decisions. Automation does not make a poorly drawn boundary correct.
Independent assessment still matters
Assessment by an accredited 3PAO remains central to FedRAMP’s model of trust. In a world of machine-readable evidence, the assessor’s questions shift towards whether the evidence pipeline is complete and reliable and whether the indicators truly reflect the system. Providers should expect scrutiny of their automation as well as its outputs.
Operations never stop
Vulnerability remediation timelines, incident response and significant-change management continue after authorization. A posture that is visible continuously is also a posture that must be maintained continuously.
A readiness plan that works under either model
- Decide the impact level and route with your agency sponsors and target customers, informed by FedRAMP’s current guidance.
- Draw the authorization boundary and inventory every component and external service within it.
- Close architectural gaps first: identity, encryption, logging, vulnerability management, configuration baselines and supply-chain controls.
- Build the evidence pipeline as a product, with owners, tests and change control.
- Run a readiness assessment against the current indicators or baseline before formal 3PAO assessment begins.
- Operationalize continuous monitoring before authorization, not after.
MarkTillson is your readiness and cloud security engineering partner. FedRAMP requires the firm that designs your controls to be separate from the firm that assesses them, so we build the system, the evidence pipeline and the package, and work alongside the independent 3PAO you select. We will plan whichever route gets you authorized fastest.
Key takeaways
- 20x replaces narrative with machine-readable evidence and Key Security Indicators.
- FedRAMP expects the Rev5 process to wind down by the end of FY2027, with 20x improvements retrofitted meanwhile.
- Documentation burden falls; engineering burden rises.
- Architecture, boundary and operations remain the hard parts.
- Check fedramp.gov before fixing dates in a plan; the program is still evolving.
Sources
- FedRAMP, FedRAMP 20x program pages and phase recaps, fedramp.gov.
- FedRAMP, RFC-0006, 20x Phase One Key Security Indicators.
- FedRAMP, RFC-0024, Rev5 Machine-Readable Packages, and subsequent notice on initial outcomes.
- FedRAMP, “FedRAMP built a modern foundation in FY25 to deliver massive improvements in FY26”, 30 September 2025.
- NIST SP 800-53 Rev. 5, Security and Privacy Controls for Information Systems and Organizations.
MarkTillson builds packages for the questions an assessor will actually ask. Our FedRAMP practice puts that knowledge to work on your package, whichever route you choose. Talk to us before you commit to a date.
