The FedRAMP 20x Pipelines Are Open: Where the 2026 Rules Stand Today
When FedRAMP published its Consolidated Rules for 2026 earlier this summer, most of the important dates were still ahead of us. That has changed. As of today, the transition is no longer theoretical: the FedRAMP Ready path has closed, the FedRAMP 20x Class A pipeline is live, and the temporary Rev5 Program Certification pipelines are accepting a limited set of providers. The 20x Class B and C pipeline opens at the end of this month.
If you are a cloud service provider, agency, or assessor, the practical question is no longer “what is coming” but “which pipeline applies to us, and are we ready to enter it.” Here is where things stand and what to do about it.
What has actually opened
The milestones below have already taken effect. These are the shifts that change what you can do right now:
July 6, 2026: FedRAMP Marketplace listings opened for providers in the Initial Implementation phase.
July 28, 2026: FedRAMP Ready went legacy. No new FedRAMP Ready submissions are accepted. Providers who would previously have pursued Ready should now target FedRAMP 20x Class A Certification instead.
August 3, 2026: The FedRAMP 20x Class A pipeline opened. FedRAMP is now accepting Class A applications.
August 10, 2026: Two temporary Rev5 Program Certification pipelines opened for Class B and Class C, the Ready Conversion and Lost Sponsor pipelines, allowing a limited set of providers to pursue a Rev5 Program Certification without an agency sponsor. These temporary pipelines are time-limited: the CR26 grace period for the Ready Conversion and Lost Sponsor path ends February 19, 2027, so providers who qualify should confirm eligibility and move early.
August 31, 2026: The FedRAMP 20x Class B and C pipeline opens. This is the next date on the calendar, so it is worth confirming your target class before it does.
The two dates that anchor everything else remain firm: the Consolidated Rules become mandatory for all stakeholders on January 1, 2027, and FedRAMP stops accepting new Rev5 Certifications on June 11, 2027.
FedRAMP timeline → fedramp.gov/2026/timeline
1. Class A is a reciprocity path, not just a 20x path
One of the clearer refinements since the rules first published is how Class A works, and it is more than a technicality. Class A is designed largely as a reciprocity path. Rather than rebuilding a full package from scratch, a provider can use evidence of an equivalent process completed within the last 12 months, specifically SOC 2 Type II, GovRAMP, or FedRAMP Rev5 Ready, as the basis for a Class A Certification, submitted directly to FedRAMP through Program Certification without an agency sponsor. Alongside that reciprocity, Class A carries a defined set of mandatory FedRAMP rules (see FRC-CLA-MFR in the ruleset reference) that every applicant must meet, and it runs on the 20x path rather than Rev5. It is also worth understanding how the ruleset is organized: FedRAMP rules are tiered as mandatory, recommended, and optional by class. For planning purposes, the mandatory rules are the ones that gate your certification, while the recommended and optional rules are where scoping judgment comes in. Because those tiers are detailed and still being refined, the ruleset reference is the authoritative place to confirm exactly which rules apply to your specific system. If Class A is your target, start by confirming which equivalent process you can bring for reciprocity and reviewing the mandatory Class A rules before you scope.
2. 20x favors continuous evaluation over point-in-time documentation
The central direction of the rules has not changed, and now that the pipelines are open it is the operating model rather than a preview. FedRAMP 20x leans on continuous evaluation and measurable security outcomes rather than heavy point-in-time documentation packages. For organizations building toward federal work, engineering your environment for continuous validation is the most future-aligned route, and it is now the route that is actually open for business.
3. Two certification paths: Agency and Program
FedRAMP has formalized two paths, and the Program path is now more than a concept. The Agency path is the familiar route, where a package is submitted to a sponsoring agency for review. The Program path is where FedRAMP itself performs the independent assessment through Program Certification, for both 20x and Rev5. With the temporary Ready Conversion and Lost Sponsor pipelines now open for Class B and C, providers who have lost a sponsor or were mid-Ready have a defined route forward that does not depend on first securing an agency sponsor.
Choosing a certification path → fedramp.gov/2026/providers/start/path
4. The FedRAMP Rules are part of the assessment itself
This remains one of the most consequential structural changes. FedRAMP assessments, both 20x and Rev5, incorporate the FedRAMP Rules published in the ruleset reference. Each rule carries metadata on the certification type it applies to, the path, the applicable classes, and the intended audience. That structure makes scoping an assessment far more precise, and it means reading the ruleset is now part of preparing for one.
Ruleset reference → fedramp.gov/2026/reference
5. Classes, not impact levels
The High, Moderate, and Low baselines are replaced by a class-based model, Classes A through D, that organizes certifications and applicable rules by assurance level. With the 20x Class A pipeline open and Class B and C opening August 31, identifying your target class is now an immediate planning step rather than a future one. The ruleset reference is organized around these classes for both 20x and Rev5.
Looking ahead, Class D is the one tier without an open pipeline yet. Specific dates are not confirmed, but 20x Class D pilots have been anticipated for government fiscal year Q1. There is little official documentation so far, so treat this as a forward-looking signal rather than a firm date, and watch the FedRAMP timeline for confirmation.
6. The rules are still being refined, so version awareness matters
FedRAMP is maintaining a public changelog and has continued to issue clarifications since the initial release, including adjustments to how Class A requirements and control guidance are expressed. None of these have reversed the direction of the program, but they do mean that specific rule references can shift. Before scoping an engagement, confirm you are working from the current ruleset version rather than an earlier copy.
Changelog → fedramp.gov/2026/changelog
What to do next
The throughline is the same as it was in June, but the clock has moved from planning to action. Concrete next steps:
Confirm your target path and class. With Class A open and Class B and C opening August 31, this is the first decision, not a later one.
Check the pipeline that fits your situation. If you lost a sponsor or were mid-Ready, review the temporary Ready Conversion and Lost Sponsor pipelines while they are available.
Study the ruleset reference before scoping. Because the rules are now part of the assessment, reading them is part of getting ready for one. Verify you are on the current version.
Mark the two firm dates. Mandatory adoption on January 1, 2027, and the end of new Rev5 Certifications on June 11, 2027, bound every plan.
Fortreum is an accredited FedRAMP 3PAO, and we are tracking the Consolidated Rules closely as they are refined. Readiness preparation and the formal independent assessment are handled as separate engagements, with separate teams and timelines, to preserve assessor independence.
If you have questions about which pipeline fits your organization or what these changes mean for your timeline, our team is happy to talk it through.
