What is FedRAMP 20x?
FedRAMP 20x is the next evolution of the Federal Risk and Authorization Management Program. It replaces the legacy FedRAMP v5 control framework with a modernized, automation-ready model built around Key Security Indicators (KSIs)—standardized, measurable security outcomes.
FedRAMP 20x introduces new Low and Moderate baselines that streamline evidence requirements, increase automation potential, and provide clearer alignment with NIST 800-53 Rev 5. The goal: reduce manual documentation and accelerate authorization for cloud service providers working with U.S. federal agencies.
Who does FedRAMP 20x apply to?
FedRAMP 20x applies to any Cloud Service Provider (CSP) or vendor that stores, processes, or transmits U.S. government data and seeks to sell to—or remain authorized with—federal agencies.
It’s especially relevant for:
Existing FedRAMP v5 CSPs preparing to migrate to 20x.
Vendors approved for the 20x pilot through the FedRAMP PMO.
Organizations planning to pursue FedRAMP authorization in 2026 and beyond.
Even vendors that aren’t yet authorized can begin preparing now. Implementing FedRAMP 20x controls early ensures a smoother transition once public submissions open.
What is the timeline for FedRAMP 20x compliance?
Phase | Description | Timing |
Phase 1 – FedRAMP 20x Low Pilot | Completed pilot with 12+ organizations validating the new Low baseline. | ✅ Complete (Summer 2025) |
Phase 2 – FedRAMP 20x Moderate Pilot and Launch | Vanta launches in-platform FedRAMP 20x Moderate support as the PMO begins the Moderate pilot. | ~Oct 25 - ~ Jan 26 |
Phase 3 – Readiness Window | Non-pilot orgs can prepare and implement 20x controls in advance of public release. | Dec 2025 – Feb 2026 |
Phase 4 – Public Release | PMO expected to open submissions for Low and Moderate baselines. | Feb – May 2026 (Q1 – Q2 2026) |
Phase 5 – High Baseline (TBD) | Expansion to High impact systems following Moderate public release. | Late 2026 (TBD) |
Does this require a formal audit or certification?
Yes—FedRAMP 20x still requires an official authorization process coordinated by the FedRAMP Program Management Office (PMO).
Just like prior versions, Cloud Service Providers must:
Work with a Third-Party Assessment Organization (3PAO) to perform a security assessment.
Submit their authorization package for PMO review.
Maintain continuous monitoring once authorized.
While the FedRAMP 20x framework introduces new automation capabilities and streamlined evidence models, the core authorization steps remain unchanged. Only PMO-approved organizations can submit during the pilot phase; public submissions open in 2026.