FedRAMP 20x Requirements: KSIs, Classes and Key Dates

For years startups couldn't realistically sell to the U.S. federal government.

The demand was there. But you needed FedRAMP certification, which meant $500k-$1m in costs, 12-18 months of work and a sponsoring agency to open the door. That’s why, in 15 years, only around 400 companies became FedRAMP certified.

FedRAMP 20x is changing things. It replaces static documentation with automated, machine-readable continuous monitoring, speeds up the compliance process, and removes the need for an agency sponsor.

With FedRAMP 20x Phase 3 now live and the Class B and Class C pipelines open, the federal market is finally accessible to modern cloud-native companies.

In this guide, I'll break down the FedRAMP 20x requirements, explain how Key Security Indicators work, and outline exactly how to prepare your security posture to position your organization to take advantage of this opportunity. 

What Are the Core FedRAMP 20x Requirements?

The FedRAMP requirements aren’t being loosened with FedRAMP 20x. If you’re aiming for Class B (formerly Low) or Class C (formerly Moderate) certification, you’ll still need to align with the same NIST 800-53 controls. However, the way you’ll prove compliance is changing. 

Rather than long, narrative documents explaining how you meet each control (the current Rev5 approach), FedRAMP 20x switches to proving compliance via Key Security Indicators using machine-readable formats and heavily automated validation. So instead of writing statements about how you meet each control, you codify those policies directly into your technical implementation.

Automated Validation Thresholds

At the core of FedRAMP 20x is the concept that cloud service providers (CSPs) will consistently and automatically validate their security posture using machine-readable evidence and Key Security Indicators (KSIs). 

Under FedRAMP’s Consolidated Rules for 2026 (CR26), Class B has 41 mandatory KSIs and Class C has 46. Automated validation should be in place at Class B and must be in place at Class C. Class C also requires historical metrics from persistent validation covering at least the past six months. For initial certification, you don't need six months of data before applying. You need the validation mechanisms running and a commitment to meet the six-month requirement as that history builds.

To meet these requirements, CSPs must constantly pass data to prove KSIs are met. For example, rather than writing a narrative stating that you enforce multi-factor authentication (MFA), your architecture must output machine-readable logs demonstrating that MFA is active for 100% of privileged users. 

If a control fails, your system must flag it immediately.

Machine-Readable Submission Formats

Your validation evidence must be embedded or linked directly from both human-readable and machine-readable submission formats. And made available unredacted for FedRAMP review.

Critically, the data in these two formats must perfectly reconcile. 

If your human-readable policy dictates a 90-day password rotation, but your machine-readable outputs a 120-day enforcement, your package will be rejected. 

You must provide a machine-readable schema that FedRAMP and your assessor can use to validate and interpret your automated outputs. 

This ensures that agency risk executives can review the human-readable summaries while technical subject matter experts can programmatically verify the underlying machine data.

Comprehensive Information Resource Tracking (FRR-MAS-01)

FRR-MAS-01 (Comprehensive Information Resource Tracking) requires that a cloud service provider identify and maintain a complete set of information resources that are likely to handle federal customer data or impact its confidentiality, integrity, or availability.

FedRAMP’s guidance expects this set to be generated and updated in an automated, authoritative way so that providers can demonstrate ongoing awareness of all relevant resources at the time of assessment.

The inventory should consider all logical and physical resources in scope — including systems, software, platforms, people with access to critical data, and other components that could affect security posture — rather than being a simple static list or annual diagram. 

How Does FedRAMP 20x Certification Replace Legacy Authorizations?

FedRAMP 20x is replacing the traditional Rev5 process. The Class B and Class C pipelines opened on August 31, 2026, June 11, 2027 is the last day to apply for a new Rev5 certification, and existing Rev5 certifications must align with CR26 from January 1, 2027. 

Here’s how 20x is changing FedRAMP’s approach to certification and CSPs:

No Agency Sponsor Required

Under the legacy Rev5 system, you had to find a federal agency willing to sponsor your certification. FedRAMP 20x eliminates this barrier. 

With no requirement for an agency sponsor, FedRAMP 20x opens the federal marketplace to innovative companies that previously weren’t able to access government contracts (or didn’t have the time and budget to commit to FedRAMP certification). 

Speed to Certification

Traditional authorizations often required 12-18 months of preparation and investment. In contrast, pilot participants in the 20x Low program have received certification in less than two months from their start date. Class C asks more of you up front, with at least two automated validation methods per KSI. You don't need to wait out six months of metrics before applying, though. If your mechanisms are in place, you can pursue initial certification and build the six months of validation history from there. 

Continuous Compliance vs. Point-in-Time

Legacy FedRAMP relied on static System Security Plans. These would often be hundreds of pages long and describe exactly how your controls were designed and work at its time of writing. 

FedRAMP 20x replaces this with a continuous compliance approach. You're no longer writing narratives about your security, you are designing systems that automatically demonstrate secure configurations and practices in near real-time.

Lee Neeper, Director of Quality Management at A-LIGN, frames the change this way: "Under legacy Rev 5, compliance was a static, written narrative. Under 20x, compliance is driven by KSIs expressed through continuous scripts, APIs, and machine-readable data. This means CSPs suddenly realize their compliance infrastructure needs its own SDLC."

That difference shows up most clearly in how teams behave before an assessment. "In traditional audits, CSPs used 'audit prep weeks' to clean up access lists, trigger overdue scans, or manually pull clean screenshots prior to an audit," Neeper says. "20x relies on persistent, dynamic evidence."

When Will FedRAMP 20x Roll Out? 

FedRAMP 20x is being rolled out in phases:

• Phase 1 (Completed Sept 2025): The 20x Low Pilot proved the core concept, accepting 26 submissions and granting an initial 12 pilot certifications.
• Phase 2 (Completed March 31, 2026): The 20x Moderate Pilot was limited to 13 participants working towards Moderate (now Class C) certification through 20x. 
• Phase 3 (Live now): CR26 formalized the Class B and Class C requirements. The Class A pipeline opened on August 3, 2026, and the Class B and Class C pipelines opened on August 31, 2026. 
• Phase 4 (FY27 Q1 to Q2): FedRAMP is piloting a 20x path for Class D (High). Until it opens, Class D runs through Rev5.
• Phase 5 (FY27 Q3 to Q4): FedRAMP aims to stop accepting new Rev5-based authorizations after June 11, 2027.

How to Prepare Your Organization for the FedRAMP 20x 

Under FedRAMP 20x, the role of the third-party assessor (3PAO) shifts from primarily reviewing written narratives and static evidence to independently verifying the accuracy, reliability, and effectiveness of code as compliance.

Rather than performing traditional control-by-control narrative audits, assessors evaluate whether a CSP’s machine-readable evidence, Key Security Indicators (KSIs), and automated validations accurately represent the system’s real security posture.

If you’ve already completed SOC 2 or ISO 27001, the pathway to FedRAMP 20x is much clearer than you may expect.

In traditional FedRAMP, your audit hinged on a System Security Plan (SSP) that describes every aspect of your system and how you’re meeting each required control. An SSP would often run hundreds of pages and take months to prepare. 

FedRAMP 20x replaces long, narrative SSPs with KSIs (Key Security Indicators) and Machine-Readable Data.

Take a requirement like encryption. Under FedRAMP 20x you’d supply an encryption key, ID, or other structured data as a KSI rather than writing a description of how you handle the encryption.

If you’re already using modern cloud tools like AWS and Datadog, these platforms can generate the continuous, machine-readable evidence that FedRAMP 20x requires. 

This shift effectively means you’re coding compliance requirements directly into your infrastructure so they can be monitored automatically — which reverses traditional compliance timelines. So instead of spending time gathering evidence after you’ve implemented controls, you’re designing systems to continuously monitor controls as you implement them. This has the additional benefit of being better security.

The mistake Neeper sees most often is one of category: "FedRAMP 20x doesn't lower the security bar—it changes the delivery mechanism. Companies expect a paperwork reduction project and suddenly realize they have entered a software engineering transformation."

Choosing the Right Partner

When it comes to preparing for FedRAMP 20x, my advice is to always work with a partner — ideally one that understands both traditional FedRAMP (and the NIST 800-53 controls) as well as modern, cloud-based infrastructure.

Because the 20x certification timeline is compressed (again, assessors we’ve spoken to completed 20x Low assessments in two to three weeks), it’s important to work with a compliance partner that can move quickly, gets your tech stack, and understands compliance as code.

The Window of Opportunity

The FedRAMP 20x Class B and Class C pipelines opened to the broader public on August 31, 2026.

This creates a significant opportunity for organizations looking to expand into the public sector. We're already working with FedRAMP assessors to get companies scheduled for FedRAMP 20x assessments before the end of 2026.

Now is the time to start preparing your tech stack and implementing KSIs, especially if you’re aiming for Class C, where persistent validation has to be running and building a six-month history.

Are you ready to unlock the federal market? Connect with our team to learn more about how Workstreet can help your business work towards FedRAMP 20x today.