IVV-CSX-AIAMUST
Prove every Key Security Indicator
20x Class B, C and D providers must include all KSIs in a FedRAMP independent assessment at least once per year. Class A must meet its alternative security framework instead.
- Home
- FedRAMP 20x
Run FedRAMP 20x as a continuous operation
FedRAMP 20x replaces long narrative packages with declarative rules, Key Security Indicators and recurring reports. NISTcompliance.ai turns those rules into daily work: validate KSIs with automated methods, run Vulnerability Detection and Response (VDR) and Vulnerability Evaluation and Reporting (VER) on your Class timeframes, share certification data through a trust center, and keep every package machine-readable.
Runs inside Quzara Cybertorch: FedRAMP Certified, Rev5 Class D (High)SOC 2 Type 2
What 20x asks of you
Four obligations that never stop
Under the Consolidated Rules for 2026, certification is maintained continuously, not renewed by paperwork.
NTC-0014MUST
Run VDR and VER
Required for every offering obtaining or maintaining FedRAMP Certification from Dec 7, 2026. The grace period ends Mar 7, 2027.
CCM-OCR-AVLMUST
Report every 3 months
Every 20x provider, Class A included, supplies an Ongoing Certification Report to all necessary parties every 3 months. Class C and D must also host a Quarterly Review.
CDS-CSO-UTCMUST
Share through a trust center
Providers must use a FedRAMP-compatible trust center to store and share FedRAMP Certification Data. Trust centers must offer documented programmatic access (CDS-TRC-PAC).
Sources: IVV rules, NTC-0014, CCM rules, CDS rules. FedRAMP Consolidated Rules for 2026, checked Oct 23, 2026. Not a substitute for the official rules.
20x or Rev5
Why most new offerings should choose 20x
FedRAMP describes 20x as the modern Certification Type and Rev5 as the legacy one.
Processed directly by FedRAMP
20x Certifications do not need an agency sponsor. FedRAMP recommends 20x for cloud offerings built on FedRAMP Certified infrastructure or platforms.
Legacy, and on a retirement path
Rev5 typically needs an agency sponsor. FedRAMP expects to retire Rev5 as a new Certification Type in mid-2027. It is the only option today for offerings that run their own infrastructure or need Class D.
Plan the move →20x Class D is coming
FedRAMP anticipates piloting 20x Class D in late 2026, with a formal option expected in early 2027.
See the Classes →The 2026 rules apply to everyone
FedRAMP states that providers that do not adjust to the updated rules will lose their FedRAMP Certification, whichever type they hold.
Sources: Certification Types, Updating to 2026 rules. FedRAMP Consolidated Rules for 2026, checked Oct 23, 2026. Not a substitute for the official rules.
The platform
One system for every 20x workflow
KSI validation
Map all ten KSI themes to automated methods and see which indicators meet your Class threshold.
KSI validation →VDR and VER
PAIN-rated triage, Class timeframes, KEV due dates and a monthly VER report your team signs off.
VDR and VER →Trust Center
Certification data, Ongoing Certification Reports and VER history for the agencies that use you.
Trust Center →Machine-readable packages
JSON and OSCAL output kept consistent with the human-readable versions by automation.
Packages →Assessor workspace
Evidence of implementation and effectiveness, ready for your annual independent assessment.
Assessor workspace →Managed remediation
Quzara engineers who work the vulnerability queue with you when the clock is short.
Managed remediation →Certification Classes
What each Class is for
Summarized from FedRAMP's Certification Class guidance.
Commercial products
For existing commercial products with a recent independent assessment (FedRAMP Rev5, SOC 2 Type II or GovRAMP, within the past 12 months) and a mature security program. Adequate for most non-sensitive use cases. FedRAMP calls it the simplest way to get certified to obtain a customer.
Most Low objectives
Adequate for most Low security objectives and some Moderate or High ones.
Low and Moderate
Adequate for most Low and Moderate security objectives and some High ones. Intended for providers with an active customer base and an existing federal compliance program.
Most use cases
Adequate for most use cases regardless of security objective, excluding classified systems. Rev5 today; 20x Class D is expected to pilot in late 2026.
Sources: Certification Classes, Certification Types. FedRAMP Consolidated Rules for 2026, checked Oct 23, 2026. Not a substitute for the official rules.
Side by side
What changes from Class to Class
Swipe to see every column
| Requirement | Class A | Class B | Class C | Class D |
|---|---|---|---|---|
| Automated methods per KSI | Optional (may) | At least 1 (should) | At least 2 (must) | At least 4 (must) |
| Annual independent assessment | May (must still meet its alternative framework) | Must | Must | Must |
| Ongoing Certification Report every 3 months | Must | Must | Must | Must |
| Synchronous Quarterly Review | May | Should | Must | Must |
| Evaluate vulnerabilities after detection (should) | 14 days | 7 days | 5 days | 2 days |
| Drift detection (should) | Every 3 months | Monthly | Every 14 days | Every 7 days |
| VER JSON history update | Monthly (may) | Monthly (should) | Every 14 days (should) | Every 7 days (should) |
| Monthly human-readable VER report | Not on Class A lists | Must | Must | Must |
Sources: Certification rules, IVV rules, CCM rules, VDR rules, VER rules. FedRAMP Consolidated Rules for 2026, checked Oct 23, 2026. Not a substitute for the official rules.
Watch for
Two rules that shape the choice
AGU-USE-CLASHOULD NOT
Class A is a starting point
Agencies should not authorize a Class A offering for more than 12 months unless it is actively seeking Class B, C or D.
CLASS GUIDANCEGUIDANCE
Do not skip straight to C or D
FedRAMP advises that providers generally should not go straight to Class C or D unless an existing agency contract requires that level of commitment.
Sources: Agency Use rules, Certification Classes. FedRAMP Consolidated Rules for 2026, checked Oct 23, 2026. Not a substitute for the official rules.
Deadlines
The dates that matter
From the FedRAMP 20x deadline schedule and notice NTC-0014. Rev5 follows a separate, later schedule.
Swipe to see every column
| Rules | Initial certification | Ongoing certification | Grace period ends |
|---|---|---|---|
| VDR and VER | Dec 7, 2026 | Dec 7, 2026 | Mar 7, 2027, then certification is revoked |
| CCM, CDS, CMU, CPO, FRC, IEC, IVV, MAS, SCN and SDR | Jul 4, 2026 | Jan 1, 2027 | First FedRAMP independent assessment started after Jan 1, 2027 |
Sources: 20x deadlines, NTC-0014. FedRAMP Consolidated Rules for 2026, checked Oct 23, 2026. Not a substitute for the official rules.
Go deeper
FedRAMP 20x guides
The FedRAMP 20x Hub
The 2026 rules, Certification Types and what each provider must do.
Read the guide →FedRAMP Certification Classes A Through D
How to choose a Class and what each one requires.
Read the guide →FedRAMP 20x Roadmap
Phases, dates and what is due next.
Read the guide →Questions
Common questions
Do VDR and VER apply to Rev5 offerings?
Yes. FedRAMP notice NTC-0014 makes VDR and VER required for all cloud service offerings obtaining or maintaining FedRAMP Certification from Dec 7, 2026, with a grace period that ends Mar 7, 2027.
Does FedRAMP 20x need an agency sponsor?
No. FedRAMP states that 20x Certifications are processed directly by FedRAMP and do not need an agency sponsor. Rev5 typically requires a sponsor or contract in advance.
When do existing 20x providers have to follow the 2026 rules?
Most 2026 rulesets apply to ongoing 20x certification from Jan 1, 2027, with a grace period that ends at the first FedRAMP independent assessment started after that date. VDR and VER follow the Dec 7, 2026 and Mar 7, 2027 dates. Rev5 providers follow a separate, later schedule for several rulesets, such as CDS on Aug 1, 2027.
Which Class should a new SaaS product start with?
FedRAMP designed Class A for existing commercial products that already hold a recent FedRAMP Rev5, SOC 2 Type II or GovRAMP assessment and run a mature security program. Plan the move to Class B or higher: agencies should not authorize Class A offerings for more than 12 months unless the provider is pursuing a higher Class.
Can I get 20x Class D today?
Not yet as a formal option. FedRAMP anticipates piloting 20x Class D in late 2026 and expects it to become a formal option in early 2027. Rev5 is the path to Class D today.
Book a demo
See your 20x path in 30 minutes
Your Class, your KSI gaps, your VDR clock and what agencies will see in your trust center.