FedRAMP 20x vs FedRAMP Rev 5: Which Certification Path Fits Your Cloud Service

Cloud providers entering the US federal market in late 2026 face a path decision that is mostly made for them by their architecture, their customers and the calendar, yet many still budget for the wrong one. FedRAMP now certifies services under two types: 20x, the new outcome-based route built on Key Security Indicators (KSIs) and Program Certification, and Rev5, the legacy NIST SP 800-53 control route that usually needs an agency sponsor and stops taking new applications on 11 June 2027. This guide is a decision page: who is eligible for which path, how KSIs differ from Rev5 controls as an assurance model, what evidence automation each demands, the dates that close doors, and how agencies treat each package. It is written for cloud provider leaders, compliance and engineering leads, and their advisers. It does not re-explain 20x mechanics: for every KSI theme and rule set see the FedRAMP 20x guide, and for the legal basis and programme overview see the FedRAMP Guide. Rule text was read from FedRAMP's official 2026 documentation repository and fedramp.gov on 14 November 2026; FedRAMP changes rules often, so confirm before committing budget.

Key takeaways

• Short answer: 20x for cloud-native services on certified infrastructure, Rev5 only where you must. FedRAMP says services built on FedRAMP Certified infrastructure or platforms "should choose FedRAMP 20x"; Rev5 is currently the only option for services that run their own infrastructure or need Class D.
• The path follows the type. 20x always runs on Program Certification (no sponsor). Rev5 runs on Agency Certification, which needs a completed agency ATO and a signed ATO letter, apart from two narrow temporary pipelines.
• The Rev5 door is closing. No new Rev5 applications after 11 June 2027, FedRAMP Ready stopped accepting submissions on 28 July 2026, and Rev5 itself is described as a type that "will be retired".
• Automation is the real cost line. 20x Class C requires at least two automated validation methods per KSI and Class D at least four, while Rev5 still requires every baseline control and parameter documented in the Security Decision Record (SDR).
• You cannot hedge with both programme certifications. Rule FRC-CSO-POP forbids seeking 20x and Rev5 Program Certification for the same offering, and FedRAMP strongly discourages holding a Rev5 Agency Certification alongside 20x.

The decision in one table

FedRAMP's own advice on paths is that "you don't really get to choose your Certification Path because it's the result of the choices you've already made". The table sets out the facts that drive the choice.

Eligibility: who can take each path

20x eligibility

• Architecture: FedRAMP positions 20x for services built on FedRAMP Certified infrastructure or platforms. Its published goals treat self-hosted and hybrid services as later work, so a provider running its own data centres should not assume a 20x route exists today.
• Class A entry: a provider must have completed, within the past 12 months, a certification or equivalent process from one of three alternative frameworks: FedRAMP Rev5 (including FedRAMP Ready) at any historical impact level, SOC 2 Type II, or GovRAMP at any impact level. See the How to Read a SOC 2 Report Guide and the StateRAMP / GovRAMP Guide.
• Classes B and C: a fresh independent assessment by a FedRAMP Recognized assessment service, completed within the previous three months, is mandatory; for Class A it is optional.
• KSIs even if you plan Rev5 later: a July 2026 clarification states that Class A providers must address the KSIs even if they intend to pursue a Rev5 Program Certification path in the future.

Rev5 eligibility

• Agency Certification: the provider must have completed the ATO process with its agency sponsor, ending with "a formal signed ATO letter" sent to FedRAMP over official government channels (rule FRC-APS-ATO). No sponsor, no path.
• Lost Sponsor and Ready Conversion pipelines: opened 10 August 2026 for Class B or C, closing on 11 June 2027. Eligibility requires one of these between January 2025 and March 2026: In Process on the Marketplace but lost sponsorship; a completed SAP and SAR under an informal agency agreement; a completed Readiness Assessment Report; or FedRAMP Ready status. FedRAMP must confirm eligibility before submission, and applicants agree to follow the updated Rev5 rules by 19 February 2027.
• Existing FedRAMP Ready holders: must convert to a FedRAMP Certification by the later of their annual assessment expiry or 17 November 2026; the legacy Ready status is removed entirely on 31 December 2027.
• Class D today: Rev5 Agency Certification is the only route until 20x Class D becomes a formal option, which FedRAMP anticipates for early 2027.

KSIs versus Rev5 controls: two assurance models

Both types end in the same artefact family (Certification Package Overview, Secure Configuration Guide, SDR) and both answer to SP 800-53. The difference is what the provider is asked to prove and how often.

A KSI is not a shortcut around controls. FedRAMP maps each KSI to SP 800-53 controls, so a provider that later needs Rev5 or an agency asks control-level questions can still answer them. What changes is the burden of proof: under 20x a narrative that an account review happens quarterly is weaker evidence than a dashboard showing the review ran, what it found and when it was closed. The identity theme shows this clearly: KSI-IAM-AAM (automating account management), KSI-IAM-APM (passwordless methods), KSI-IAM-ELP (least privilege), KSI-IAM-JIT, KSI-IAM-SNU (securing non-user authentication) and KSI-IAM-SUS (responding to suspicious activity) are outcomes an assessor can measure, where Rev5 asks for the equivalent AC-2, IA-2 and IA-5 implementations to be described and tested.

Evidence automation: what each path demands

FedRAMP's 2026 rules require automation on both types, but the floor is very different. Under Rev5 FedRAMP no longer provides Word templates and expects "semi-structured text data that is compatible with basic JSON schemas", which it calls "a significant shift for many compliance organizations". Under 20x the automation is in the security validation itself.

The practical reading: a Class C provider on 20x needs two independent automated checks per KSI running continuously and a three-day cycle on machine resource status. That is an engineering platform, usually built on pipelines the service already runs. A Rev5 Class C provider needs monthly cycles but far more documented control content. For the evidence engineering side see the Audit Evidence and Continuous Controls Monitoring Guide.

Timelines and dates that close doors

Ruleset deadlines also differ by type. Most 20x rulesets apply to ongoing certification from 1 January 2027, while several Rev5 rulesets phase in later: Collaborative Continuous Monitoring on 2 April 2027, the Certification Package Overview on 1 July 2027, and the SDR and Certification Data Sharing on 1 August 2027. On 2 November 2026 FedRAMP announced the first full 20x Class C certification, so the Moderate-like 20x route is no longer theoretical.

A planning trap: a Rev5 agency route needs the ATO letter to reach FedRAMP before 11 June 2027 for the application to be accepted. Agency ATO cycles depend on the sponsor's own authorising official, so a provider without a sponsor today should treat Rev5 as unavailable for planning purposes.

Agency acceptance: how each package is used

• Both are reusable evidence: FedRAMP's agency guidance says the goal for both types is "reuse with judgment": rely on the package for the common provider assessment work, then focus agency effort on whether the service, used this way, is acceptable for the mission. Agencies may ask for more information where there is a demonstrable need, and are told not to turn reuse into a new provider assessment.
• Rev5 packages look familiar: they are based on the traditional control framework and assessment materials, which suits agency GRC tools built around control catalogues.
• 20x packages are living data: FedRAMP describes them as certification data "that a cloud service provider maintains over time", shared through a trust centre, documentation portal, files or APIs, rather than a static folder reviewed once.
• Class versus impact level: FedRAMP says there is "not a direct correlation" between class and FIPS 199 impact level. An agency that has written "FedRAMP Moderate" into a contract may need to be walked through how a Class C certification answers that requirement. See the NIST SP 800-53 Privacy Controls and FIPS 199/200 Categorisation Guide.
• Agency still decides: certification does not replace the agency's own authorisation to operate or use. For the agency side of that relationship see FedRAMP vs FISMA.

Option profiles: assurance model, failure modes and controls

Choosing 20x

• Assurance model: FedRAMP trusts measured outcomes, persistently validated, on the same commercial service customers already use. The risk FedRAMP is managing is drift between what the provider claims and what the platform does, which is why validation frequency rises with class.
• Architecture in words: the offering sits on certified IaaS or PaaS; a Minimum Assessment Scope covers every resource likely to handle federal customer data; telemetry from identity, configuration, vulnerability and change pipelines feeds automated KSI checks; results publish to a trust centre in FedRAMP JSON.
• Failure modes: treating KSIs as a questionnaire; automated checks that test the presence of a tool rather than the outcome; a Minimum Assessment Scope that omits a third-party component or support tooling; assuming Class A will satisfy an agency that needs Moderate-like assurance.
• Controls to prioritise: identity lifecycle and just-in-time access for user and non-user accounts, automated secret rotation, central tamper-resistant logging and version-controlled redeployment, because these are the hardest to retrofit as measurable signals. See the FedRAMP 20x guide for the full KSI list.

Choosing Rev5

• Assurance model: a sponsoring agency has accepted the risk through its own ATO, and FedRAMP certifies a control implementation against a known baseline. The managed risk is incomplete control coverage, so depth of documentation and testing matters.
• Architecture in words: usually a government-only environment, owned and operated by the provider, with its own boundary, control parameters, plan of action and milestones, and a monthly continuous monitoring rhythm.
• Failure modes: starting without a committed sponsor; budgeting for Word-era documentation when the rules now require JSON; missing the 1 January 2027 rule changes that apply to Rev5 too; assuming a Rev5 certification can sit beside a 20x Program Certification.
• Controls to prioritise: parameter assignment across the baseline (FedRAMP requires all organisation-defined parameters documented in the SDR), vulnerability detection and response timeframes, and continuous monitoring reporting, because these are where Rev5 packages most often stall.

Decision guidance

1. Do you run your own infrastructure? If yes, Rev5 Agency Certification is the current route, and only with a sponsor. Track FedRAMP's self-hosted and hybrid work before investing.
2. Do you need Class D now? If yes and you have a sponsor, Rev5. If you can wait, FedRAMP's own view is that a new entrant can obtain 20x Class C and then upgrade to 20x Class D "faster than obtaining a FedRAMP Rev5 Class D Certification".
3. Do you have a signed or near-signed agency ATO? If yes, Rev5 Agency Certification is viable before 11 June 2027; weigh it against the retirement signal.
4. Did you lose a sponsor or hold Ready between January 2025 and March 2026? Check the temporary Rev5 Program pipelines, but compare the cost of refreshing legacy materials with starting 20x Class A or B.
5. None of the above? 20x, starting at Class A unless an agency contract requires more. FedRAMP warns against going straight to Class C or D without that contract.

Small providers: 20x removes the sponsor dependency and most narrative writing, but the automation floor at Class B and C needs engineers who own the pipelines. Large providers: those with an existing Rev5 government region often keep it and wait for FedRAMP's published transition paths, while launching new commercial-first products on 20x. Avoid two FedRAMP types for one offering.

Worked scenarios

• SaaS analytics on a certified hyperscaler, SOC 2 Type II last spring, no federal customers: 20x Class A, because the SOC 2 Type II report is within 12 months and no contract demands more. Build automated KSI validation from day one so Class B is an upgrade, not a rebuild (upgrading is a new certification application under the rules).
• Identity platform with its own data centres and an agency pilot under way: Rev5 Agency Certification at Class C, provided the sponsor's ATO letter can reach FedRAMP before 11 June 2027. Plan the JSON SDR now and design new capabilities against KSIs so a future transition is cheaper.
• Provider that reached FedRAMP Ready in 2025 then lost its sponsor: eligible for the Ready Conversion pipeline to Rev5 Class B or C, but it must follow the updated Rev5 rules by 19 February 2027. If the service runs on certified infrastructure, compare that with 20x Class B, which avoids a type FedRAMP is retiring.

Where identity fits

Identity is where the two models feel most different day to day. 20x asks for measurable phishing-resistant or passwordless sign-in, just-in-time authorisation for user and non-user accounts, and secured non-user authentication; Rev5 asks for the AC-2, IA-2 and IA-5 implementations to be documented and tested. Service accounts, workload identities and API keys inside the Minimum Assessment Scope are in scope either way, so inventory them before choosing a path. See the FedRAMP 20x guide for the IAM indicators.

Detection and measurement

• Path readiness score: percentage of KSIs (20x) or baseline controls (Rev5) with evidence that is current and machine-readable.
• Automated method coverage: KSIs with the required number of automated validation methods for the target class (1, 2 or 4).
• Validation freshness: age of the oldest machine resource status check against the 7-day or 3-day 20x cycle, or the monthly Rev5 cycle.
• Package freshness at submission: days since provider verification (must be 7 or fewer) and months since independent assessment (3 or fewer for Classes B to D).
• Agency follow-up requests: number of additional information requests per agency review, a direct signal of how reusable the package is.

Common failure patterns

• Choosing Rev5 for familiarity: teams pick the control route because their consultants know it, then find no sponsor and a closing application window.
• Hedging with both types: preparing 20x and Rev5 Program submissions for one offering, which FRC-CSO-POP prohibits.
• Treating Class A as the finish line: agencies with Moderate-like data will need Class C, and upgrading is a fresh application with new evidence.
• Stale assessments: an independent assessment older than three months fails the freshness rule; older than nine months cannot be freshened by a change review.
• Letting an assessor apply: FRC-APP-NTP forbids third parties, including assessment services, applying on the provider's behalf.

Framework mapping

Practitioner checklist

• Confirm whether the offering runs entirely on FedRAMP Certified infrastructure or platforms.
• Record any agency sponsor commitment in writing and the expected ATO letter date against 11 June 2027.
• Check Class A eligibility: SOC 2 Type II, GovRAMP or FedRAMP assessment within the past 12 months.
• Pick the lowest class an agency contract actually requires; do not start at Class C or D without one.
• Map current telemetry to KSIs and count automated validation methods per KSI against the class floor.
• Move all package content to FedRAMP JSON schemas regardless of path.
• Schedule the independent assessment so the package is submitted within three months of completion.
• Commit to one FedRAMP type per offering and document the reason.

Standards and references

• FedRAMP: Choosing a Certification Type
• FedRAMP: Choosing a Certification Path
• FedRAMP: Choosing a Certification Class
• FedRAMP: Important Dates for the Consolidated Rules for 2026
• FedRAMP: 20x FedRAMP Certification Rules
• FedRAMP: Rev5 FedRAMP Certification Rules
• FedRAMP: Using FedRAMP 20x Certification Packages
• FedRAMP: fedramp.gov

Related NHI Mgmt Group resources: FedRAMP 20x · FedRAMP Guide · StateRAMP / GovRAMP Guide · FedRAMP vs FISMA · CUI Guide. This guide summarises FedRAMP's published rules and is not legal advice.