FedRAMP 20x Knowledge Authority

What changed from Rev5

FedRAMP 20x keeps the underlying security expectations but changes how a cloud service demonstrates them:

• The Security Decision Record (SDR) is the core package artifact under 20x, in place of the traditional System Security Plan (SSP).
• Key Security Indicators (KSIs) — 10 families and 46 indicators under CR26 — express measurable security capabilities that are validated by automated methods.
• Authorization status is expressed through Certification and Classes A-D.
• Monitoring is collaborative and continuous, rather than only a monthly document delivery.

Certification classes at a glance

FedRAMP uses Certification and Classes A-D for package baselines. During the transition through December 31, 2026, Class B (Low), Class C (Moderate) and Class D (High) pair the new class with the earlier impact label; Class A is a pilot. Certification does not replace an agency's own authorization to operate (ATO). Class A and Class D specifics continue to evolve — confirm the current class definitions on FedRAMP.gov before relying on them.

How certification works

The path runs from determining applicability and the right class, to implementing requirements and KSIs, establishing the SDR and persistent validation, gathering evidence, an independent assessment by a FedRAMP Recognized Independent Assessor (the role formerly called a 3PAO) where required, resolving findings, and the certification decision. Each stage is covered in the Get Certified guides.

Explore the knowledge hub