Question 1

What are the FedRAMP 20x Certification Classes?

Accepted Answer

FedRAMP 20x uses Certification Classes instead of impact levels. Class A is the new entry-level tier for cloud services with mature security and compliance programs; it replaced FedRAMP Ready, and its pipeline opened August 3, 2026. Class B is an updated version of the former FedRAMP Low and Class C replaces FedRAMP Moderate; their 20x pipelines opened August 31, 2026. Class D (the High equivalent) is not yet available under 20x: FedRAMP says it will be developed in 20x Phase 4, with a pilot expected in late 2026 and a formal option in early 2027. FedRAMP will stop accepting applications for new Rev5 Certifications on June 11, 2027.

Question 2

Can a SOC 2 Type II report help with FedRAMP?

Accepted Answer

Yes, as an entry path. FedRAMP says providers with a complete FedRAMP Readiness Assessment Report or a SOC 2 Type II can apply for a 20x Class A Certification. Once a federal customer uses the service, the provider has 12 months to begin moving to Class B or higher, which needs a full FedRAMP assessment. SOC 2 does not replace a Class B, C or D assessment.

Question 3

What happened to FedRAMP Ready?

Accepted Answer

FedRAMP Ready became a legacy status on July 28, 2026; FedRAMP accepts no new FedRAMP Ready submissions after that date and points providers to 20x Class A instead. Existing listings show as Legacy FedRAMP Ready on the Marketplace, and completed Readiness Assessment Reports can still be submitted for Class A.

Question 4

What is CR26?

Accepted Answer

CR26 is the FedRAMP Consolidated Rules for 2026, published in June 2026. It introduced Class A and set the official rules for CR26-compliant Class B and Class C. Optional early adoption began July 4, 2026, and FedRAMP says the rules take mandatory effect for all stakeholders on January 1, 2027 (some areas have their own effective dates).

Question 5

Who performs FedRAMP assessments: a 3PAO or a FedRAMP Recognized assessor?

Accepted Answer

Both terms describe the same role. Historically FedRAMP called independent assessors Third Party Assessment Organizations (3PAOs), and many firms still use that name. Under CR26, FedRAMP refers to independent assessors that hold FedRAMP Recognition (FedRAMP Recognized assessors); they must obtain and maintain accreditation through A2LA's Cybersecurity Inspection Body Program.

Question 6

Has anyone been certified under FedRAMP 20x yet?

Accepted Answer

Yes. FedRAMP granted the first 20x Class A Certification on August 25, 2026, and the first CR26-compliant 20x Class C Certification on October 29, 2026; FedRAMP did not name either product. Separately, Perplexity announced on October 28, 2026 that Perplexity Enterprise had achieved FedRAMP Class C (Moderate) certification, assessed by 360 Advanced. FedRAMP also reports that 26 companies received limited pilot certifications during the 20x pilots.

Question 7

How much does FedRAMP cost and how long does it take?

Accepted Answer

FedRAMP does not publish cost or timeline figures, and we have not found a reliable public benchmark for 20x engagements. Cost depends on the Certification Class, the assessor's fee, internal engineering time and continuous monitoring. Get written quotes from FedRAMP Recognized assessors.

FedRAMP

Key controls