At a glance
- FedRAMP says the Consolidated Rules for 2026 support finalized Class A, Class B, and Class C certification paths; Class D remains future work.
- Class A is an entry path for services with mature security and compliance programs, while Classes B and C address progressively broader and more important agency use cases.
- Certification supports an agency risk decision; it is not a universal verdict that a service fits every mission or data context.
- Revision 5 remains during the transition, but the Consolidated Rules for 2026 set a June 11, 2027 cutoff for new Rev. 5 applications.
What changed
On June 25, 2026, FedRAMP announced the Consolidated Rules for 2026. The program's current 20x page states that the Class A, Class B, and Class C certification rules are finalized and available, while Class D remains a future phase.
The class model creates clearer entry and growth paths without erasing risk context. FedRAMP describes Class A for mature providers entering the federal marketplace, Class B for common small-scale or light-use services, and Class C for common enterprise services or important government functions.
What remains buyer-specific
A certification package gives agencies a stronger basis for their own security decisions; it does not declare that one service is appropriate for every mission, data type, or operational dependency. Providers still need to explain scope, security goals, measures, validation, and known limitations clearly.
Revision 5 is also not disappearing immediately. Existing providers and eligible in-flight paths have a transition period, while Class D remains a future high-impact path. Federal teams need a roadmap tied to the certification path and buyer context they actually intend to pursue.
Why this favors evidence infrastructure
FedRAMP 20x emphasizes transparency, accountability, accuracy, automatic validation, continuous measurement, assessor engagement, and reusable certification information. A static packet assembled near the review date is a weak foundation for those expectations.
Providers need a living record that shows what changed, where proof came from, which security decision it supports, how validation ran, who reviewed it, and which released package contains it. Human-readable explanation and machine-readable evidence should represent the same system state.
ControlFrame point of view
The federal market is not merely asking for a faster report. It is moving toward an operating model built around security decisions, repeatable validation, source-bound artifacts, reviewer authority, and package reuse.
ControlFrame's FedRAMP 20x module is tracked as Planned. The accurate claim today is that the platform's evidence-custody model aligns with this direction—not that ControlFrame is FedRAMP certified or already produces an accepted 20x certification package.
Put it into practice
- Read the Consolidated Rules for 2026 against the class and agency use cases you intend to pursue.
- Map evidence to source systems, security decisions, validation methods, owners, and freshness—not just control labels.
- Separate reusable evidence from claims that still require assessor or agency confirmation.
- Track the transition from your current assurance posture to the certification class and package your buyer needs.
For the executive team
FedRAMP 20x is here, and Classes A, B, and C are finalized.
The durable advantage is continuously refreshed, source-bound evidence; repeatable validation; clear security decisions; assessor-ready review; and a package an agency can reuse with confidence.
Certification class still has to fit the agency mission and data context. Evidence infrastructure makes that decision faster without turning it into compliance theater.
Primary sources
- FedRAMP 20x — Available Now · FedRAMP
- FedRAMP Launches the Consolidated Rules for 2026 · FedRAMP
- FedRAMP Consolidated Rules for 2026 · FedRAMP