How Long Does FedRAMP 20x Take? The Timeline From Preparation to Authorization
Get the real timeline from prep to authorization based on where your company is starting from.
If somebody came to us a year ago exploring FedRAMP authorization, we'd say it’d take 12 to 18 months and somewhere between half a million dollars to over a million all-in. Plus, you’d need an agency sponsor to open the door for you.
With FedRAMP 20x, we're having totally different conversations. Cloud service providers that participated in the Phase 1 pilot completed low authorizations in as little as two to three weeks. Conceptually that's kind of crazy. But the audit speed isn't really the part you should be planning around, it's the prep work to get you audit-read that determines your actual timeline.
How Long Does FedRAMP 20x Take?
The short answer: Potentially weeks for the audit and months for the Prep
We've heard from assessors who were part of the FedRAMP 20x Phase 1 pilot who completed FedRAMP low assessments in two to three weeks and expect moderate to land in a similar range.
That said, the pilot has been small with 12 FedRAMP Low authorizations during Phase 1 and 13 participants selected for the Phase 2 (Moderate) pilot. So it’s worth flagging that those timelines might not hold as the program scales up. However, FedRAMP itself says pilot participants received authorization in less than two months from their start date and I'd expect most assessments to settle somewhere in the 1-2 months range once things open for Low and Moderate authorizations during Phase 3.
Total timeline, prep included, looks more like three to six months depending on where a company is starting from. That's still a fraction of the old 12-18 month path though.
What Changed and Why the Audit Is So Fast?
Traditional FedRAMP required organizations to build System Security Plans which are long narrative documents where you'd write explaining how you meet each NIST 800-53 control. An assessor would need to read through it all and verify your controls before confirming you met the requirements for FedRAMP authorization.
FedRAMP 20x replaces those narratives with Key Security Indicators (KSIs). KSIs are a layer on top of the same NIST 800-53 controls used in traditional FedRAMP. However, each KSI maps back to multiple controls. A KSI says something like "you shall implement multi-factor authentication" or "you must encrypt data at rest." Then companies determine how they meet that KSI and develop specific validations from their log management, their event management system, their authentication tools — pulling that data in a machine-readable format like OSCAL.
With the traditional approach, you'd write a statement about how you meet a control, put it in an SSP. With 20x, you codify each control into your technical implementation and the machine-readable files your systems kick out are validating that continuously. So the assessor isn't reading a static document during the authorization process, they're confirming automated evidence is accurate and generally complete. That's the main reason the audit takes weeks instead of months (or years).
Your Timeline Depends on Where You're Starting
The companies we're talking to and working with that are looking toward 20x in the second half of 2026 are almost all companies coming to the federal government from the commercial side. They've done SOC 2 or ISO 27001 and are now looking at the public sector as an expansion segment. A lot of them are companies I never would have imagined going down the FedRAMP route before 20x, which is incredibly exciting as one of the core goals of 20x is to get more innovative companies into the FedRAMP Marketplace.
Here’s how long 20x may take depending on your starting point:
With SOC 2 or ISO 27001 Already in Place
Our estimate: 3-4 months
Most of these companies are tech startups using cloud tools and cloud services from AWS, Datadog, and other modern security providers. They have the technology and the tooling in place. It's really a matter of aligning that and maybe expanding upon it to come in line with the 20x KSIs.
The overlap between SOC 2 and FedRAMP 20x is real, but the level of technical implementation 20x requires is a higher bar. You're having to make similar security commitments, but the evidence standard is different. You can't just describe your controls, your systems need to continuously prove them.
Some Security Program, No Certification
Our estimate: 4-6 months
Foundations need to come first. Cloud infrastructure needs to be properly configured, logging producing usable output, policies codified — all before you start thinking about KSI validations.
How 20x Changes Your Approach to Compliance
The path to FedRAMP 20x is totally different from the traditional FedRAMP route, and the biggest difference is where your time goes.
Traditionally, companies would spend a lot of time post-implementation at the audit doing manual screenshot collection, compiling evidence, walking assessors through documentation. The audit was where the pain lived. With 20x, you're spending much more time upfront designing continuous monitoring, building validations, and hard-coding your compliance commitments into how your infrastructure is deployed and configured. The system is set up to automatically collect evidence, and that's why the audit is so much faster and more affordable.
What's interesting to me is how going through 20x changes the way companies think about their other compliance programs too. With SOC 2, we're sometimes thinking about it as "how do we generate the evidence we need for those controls?" With 20x, the conversation shifts to "how do we actually mature your security so you can continuously prove it?" That investment carries over to every framework you touch afterward. I think we're going to see 20x change how companies approach even commercial certifications they've been doing for years.
Where FedRAMP 20x Stands Today
FedRAMP set what most people thought were pretty aggressive rollout timelines for 20x, and so far they've hit every milestone, which is kind of incredible. Here’s where we’re at:
- Phase 1 (Low pilot): Ran from April to September 2025 and focused on 20x as a way to validate FedRAMP Low authorizations.
- Phase 2 (Moderate pilot): Running now through the end of March 2026, with 13 selected cloud services participating and working towards FedRAMP Moderate authorization through 20x.
- Phase 3 (Broad opening): The target is for Low and Moderate authorizations to open up for wide adoption in Q3 2026.
- Phase 4 (High pilot): FY27 Q1-Q2.
- Phase 5 (End of Rev5 new authorizations): FY27 Q3-Q4.
Talking to assessors and folks in the federal space, everyone has confidence they'll hit the Q3 date and companies we work at Workstreet are already preparing to submit the second half of this year.
It’s Time to Start Building Towards FedRAMP 20x
There’s a good chance we see a real first mover advantage in the FedRAMP Marketplace as government and SLED (State, Local, and Education) organizations are keen to open up to modern technology.
If you have SOC 2 or ISO 27001, start with a gap analysis mapping your current security posture against the published KSIs to see where you may already meet controls and where you’ll need to do some work. Next, you need to evaluate how to take your existing security controls and map them to 20x with machine-readable evidence.
If you’re used to commercial compliance, that may sound like a lot of work (and truthfully, it is). That’s why I’d also recommend working with a compliance partner that has both cloud-native security and public sector/FedRAMP experience. Our public sector practice is built around helping modern cloud service providers open up to the government through FedRAMP.
Final Thoughts
The U.S. Army just signed a $5.6 billion, 10-year contract with Salesforce. The public sector buys the same kinds of tools as any other large organization. Every startup focused on growth should at least evaluate whether the federal market is a viable segment. With 20x removing the biggest barriers, the math is different now.
The FedRAMP 20x assessment can take weeks rather than months (though exact timelines will keep evolving as the program scales past the pilot). The real timeline question is what happens before your assessment starts. With SOC 2 or ISO already done, and modern cloud infrastructure in place, you may be closer than you think.
What excites me most is that this process actually changes how you build compliance programs. Instead of periodic evidence collection for point-in-time audits, you're building continuous security monitoring that runs all the time.
If you're exploring FedRAMP 20x and want to understand what it would look like for your company specifically, talk to our team. We'll walk you through where you stand and what it would take to get authorized.
