FedRAMP 20x is the federal cloud-security certification path that certifies SaaS products through automated, continuously validated Key Security Indicators instead of narrative control documents. Since the Consolidated Rules for 2026 (CR26) launched on June 24-25, 2026, FedRAMP 20x is a widely available certification path, not a pilot.
That shift turns FedRAMP from a vague "someday" requirement into a dated go-to-market decision for GovTech founders, CEOs, and VPs of Sales running public sector software companies under $5M ARR. Two new Requests for Comment (RFCs), RFC-0035 and RFC-0036, are open right now, and the evidence rules inside them show where federal security expectations are heading.
This guide explains the split between pilot status and full certification, compares Classes A through D, lays out real cost ranges, and gives GovTech SaaS leaders a decision framework for deciding whether FedRAMP 20x belongs in the 2027 plan.
What Changed in FedRAMP 20x: Pilot Phases Versus Full Certification
FedRAMP ran 20x as a series of limited pilots before it opened the path to everyone. Phase One ran from April through September 2025 at Low impact and produced 26 complete submissions. Phase Two ran from November 18, 2025 into March 2026 at Moderate, and the first Moderate authorizations followed on March 6, 2026.
CR26 ended the pilot era. The Class A pipeline opened August 3, 2026, and the Class B and Class C pipelines opened August 31, 2026. Every 20x class uses Program Certification, which needs no agency sponsor.
Why Pilot Status and Full Certification Are Not the Same Thing
Pilot participation proved a vendor could work with FedRAMP's early rules. Full certification proves a vendor meets CR26 as written. The difference shows up in four places:
- Phase Two pilot participants get no exemption. To join the Class D pilot, they need a full CR26-compliant 20x Class C Certification by December 1, 2026.
- FedRAMP Ready stopped accepting new submissions on July 28, 2026, and FedRAMP now directs those providers to 20x Class A.
- CR26 becomes mandatory for all stakeholders on January 1, 2027, including existing Rev5 certifications.
- FedRAMP stops accepting new Rev5 applications on June 11, 2027.
As of August 11, 2026, FedRAMP listed 529 certified services, and 28 of them came through 20x. The path is open, and the early adopters are already on the Marketplace.
FedRAMP 20x Certification Classes A Through D for GovTech SaaS
CR26 replaced impact-level branding with Certification Classes A, B, C, and D. FedRAMP tells agencies that a class describes the level of assurance a provider delivers, not the sensitivity of the data. The agency customer, not the vendor, determines the impact level of its own system.
The table below maps each class to the work it demands and to the GovTech products that most often fit. The GovTech fit column is energizeGTM's reading of the rules, not FedRAMP guidance.
| Class | Roughly aligns with | Assessment basis | Typical federal data | GovTech fit |
|---|---|---|---|---|
| Class A | Pilot and negligible-risk use | 7 Key Security Indicators; independent assessment optional | Configuration, testing, and evaluation use | Early-stage vendor with no federal customer yet |
| Class B | Low, including LI-SaaS | All 46 Key Security Indicators; one automated validation method per indicator | Public-facing content; no PII beyond username, password, and email | Public transparency software and open-data tools |
| Class C | Moderate | All 46 Key Security Indicators; two automated validation methods; six months of validation history | Most controlled unclassified information: PII, procurement, financial, and operational records | Municipal finance software, government accounting software, grant management software, contract management software for government |
| Class D | High | Four automated validation methods; 18 months of validation history | Law enforcement, emergency services, financial, and health systems | Public safety software, EMS management software, fire department software (pilot only until 2027) |
Source for the class details: a Compyl summary of FedRAMP's CR26 pages.
Moderate remains the center of the market. FedRAMP guidance says Moderate accounts for nearly 80% of cloud service offerings, so Class C is the class most GovTech vendors with real federal revenue will eventually face.
New FedRAMP RFCs: What RFC-0033 Through RFC-0036 Signal for SaaS Vendors
FedRAMP opened four related RFCs between September and October 2026. All four center on the Phase 4 pilot for 20x Class D, the highest assurance tier. FedRAMP labels every date after the comment periods as a target, so treat the schedule as subject to change.
| RFC | Topic | Status |
|---|---|---|
| RFC-0033 | 20x Phase 4 development tracks for Class D | Opened September 9, 2026; comment period closed October 9, 2026 |
| RFC-0034 | Technical Advisory Group changes so agency security staff can work on Phase 4 packages | Opened September 9, 2026 |
| RFC-0035 | Cryptographic module use rules updates | Comments due November 17, 2026 |
| RFC-0036 | Class D cloud-hosted pilot requirements | Opened October 15, 2026; comments due November 19, 2026 |
What RFC-0036 Proposes for 20x Class D
The full text of RFC-0036 on fedramp.gov adds 2 definitions, updates to 6 rulesets, and 10 new Key Security Indicators. The headline proposals include:
- A cap of 10 pilot participants, with eligibility tied to holding a CR26-compliant Class C Certification before December 1, 2026.
- Six months of Class C certification without corrective action before Class D, with exemptions for urgent critical needs. The pilot itself requires a full non-pilot Class C but waives the six months.
- Foreign ownership, control, or influence (FOCI) indicators. FedRAMP will confirm that a provider tracks FOCI but will not rule on whether the FOCI is acceptable, because each agency makes that call.
- A requirement to document the post-quantum cryptography status of key establishment and digital signatures.
- Delivery of all machine-readable certification package data through a web API.
- Hosting on a Class C or Class D certified infrastructure or platform service.
What the RFCs Mean for GovTech Companies Under $5M ARR
Few sub-$5M ARR vendors will pursue Class D in 2027. The RFCs still matter because they show the direction of travel: API-delivered evidence, persistent validation, and supply-chain transparency. Vendors that build those habits at Class A or B will carry less rework into Class C.
FedRAMP Cost for SaaS Companies: Real Ranges for Government Compliance Software
FedRAMP publishes no official price list. A GAO review found that estimated costs of pursuing authorization ranged from tens of thousands to millions of dollars, and that data on actual costs stayed limited. Read the GAO report on FedRAMP before trusting any single number.
The ranges below come from compliance vendors that sell FedRAMP services, and they describe traditional Rev5 work. Treat them as ceilings for planning, not quotes.
| Cost item (Moderate unless noted) | Published range | Source type |
|---|---|---|
| Average total authorization cost | $250,000 to $750,000 | Secureframe |
| Year one authorization spend | $350,000 to $800,000 | Convox |
| Year zero all-in vendor invoices | $430,000 to $1,700,000+ | Knox Systems |
| Initial third-party assessment (3PAO) | $125,000 to $300,000 | Knox Systems |
| Gap assessment | $50,000 to $150,000 | cipherssecurity.com |
| Ongoing annual cost after authorization | $200,000 to $400,000 | Convox |
| Third-party assessment at Low impact | $100,000 to $250,000 | Secureframe, citing Schellman |
Run the math against your own revenue. A $250,000 to $750,000 first-year spend equals 12.5% to 37.5% of a $2M ARR company's annual revenue. That is a product-roadmap-sized bet, and it needs a federal pipeline behind it.
Secureframe expects the real savings from 20x Moderate to emerge only as the paths see widespread use, so no published figure yet proves a 20x discount. Budget as if the savings are zero until a certified vendor shows invoices.
How to Decide: Applying the Anti-ICP Framework to FedRAMP 20x
The Anti-ICP Framework is energizeGTM's method for naming the buyers a GovTech vendor deliberately will not chase. Apply it to FedRAMP: a federal buyer that demands Class C certification before you have the budget or the contract value to justify it belongs in your Anti-ICP until that changes.
FedRAMP's own advice, as summarized by Compyl, is to start at the lowest class that meets agency requirements and to avoid jumping to Class C or D without an existing contract that demands it. Use that rule to sort your options:
- Start at Class A when no federal customer has asked in writing for certification and you want a Marketplace presence at low cost.
- Move to Class B when your product handles only public-facing content and a federal or prime-contractor buyer asks for a Low-equivalent assurance.
- Commit to Class C when a named agency or prime contractor requires it and the contract value covers the first-year spend plus the ongoing annual cost.
- Skip Class D unless a federal buyer for your public safety software requires it and you can fund an 18-month validation history.
Three Anti-ICP Screening Questions for FedRAMP
- Has a named federal buyer or prime contractor asked for FedRAMP in writing, or only mentioned it in a conversation?
- Does the contract value cover year-one certification spend and the ongoing annual cost?
- Can your engineering team stand up automated, continuous evidence collection without pausing the product roadmap?
Compliance frameworks such as FedRAMP, StateRAMP, and CJIS work as eligibility gates, not checkboxes. A "no" to any screening question above means the gate is a future project, not a current deal requirement. Hold the line and keep selling where the gate is already open. The GovTech Founders GTM Playbook walks through how to sequence markets so compliance spend follows revenue.
Turn Security Evidence Into Sales Assets With the WIIFM Framework
The WIIFM Framework (What's In It For Me) requires a separate value proposition for each stakeholder in a government deal. Security certification gives each stakeholder a different reason to care, and the sales team needs a different sentence for each.
- Agency security reviewer: a certified package that FedRAMP guidance says agencies must presume adequate at or below its impact level, which shortens the review.
- Program owner or department head: a clearer path to purchase, because a Marketplace listing can shorten the security review.
- Procurement officer: a listed, verifiable designation that answers the cloud security question in the solicitation.
GAO's June 2026 report on federal cloud procurement found that 15 of 24 surveyed agencies named difficulty obtaining FedRAMP-authorized cloud solutions as a common obstacle. Buyers want certified options and often struggle to find them.
Put that evidence to work in the sales process:
- Add a one-page security summary to every federal proposal, listing class, scope, and status.
- Pre-answer the security questions that recur in solicitations before the buyer asks.
- Train account executives to state the exact class and status, never "FedRAMP in progress" without a pipeline date.
- Listen to how practitioners handle these conversations on the Built for Government podcast.
FedRAMP 20x Timeline GovTech Founders Should Track
| Date | What happens |
|---|---|
| November 13, 2026 | Class C applicants who intend to join the Class D pilot should notify the FedRAMP Director |
| November 17, 2026 | RFC-0035 comments due |
| November 19, 2026 | RFC-0036 comments due |
| December 1, 2026 | Deadline to hold a CR26-compliant Class C Certification for Class D pilot eligibility |
| January 1, 2027 | CR26 becomes mandatory for all stakeholders |
| June 11, 2027 | FedRAMP stops accepting new Rev5 applications |
Check the official FedRAMP 2026 important dates page before you plan around any of these. FedRAMP calls several of them targets.
FedRAMP 20x FAQ for GovTech SaaS Founders
What is the difference between a FedRAMP 20x pilot and a full 20x certification?
A pilot tested FedRAMP's early 20x rules with a small group of invited providers. A full 20x certification means a provider met the Consolidated Rules for 2026 through Program Certification. Pilot participation does not count as a full certification, so Phase Two participants still need a CR26-compliant Class C Certification to join the Class D pilot.
Does a GovTech SaaS company under $5M ARR need FedRAMP?
A GovTech SaaS company needs FedRAMP when it sells cloud services that create, collect, process, store, or maintain federal information on behalf of a federal agency. A company that sells only to state and local governments faces a different scope question. Founders should confirm scope with each buyer in writing before spending money.
How much does FedRAMP certification cost for a SaaS startup?
Vendor-published estimates for a Moderate authorization run from about $250,000 to $750,000 on average, with some estimates reaching $1.7M or more in year zero. Ongoing annual costs are estimated at $200,000 to $400,000. FedRAMP publishes no official cost table, so treat every figure as a planning range.
Do I still need an agency sponsor for FedRAMP 20x?
No. All FedRAMP 20x classes use Program Certification, which operates without agency sponsorship. Rev5 certifications generally still require a sponsor, and FedRAMP stops accepting new Rev5 applications on June 11, 2027.
Conclusion: Treat FedRAMP 20x as a Sequenced Go-to-Market Bet
FedRAMP 20x moved from pilot to standard path in 2026, and the new RFCs show FedRAMP raising the evidence bar at the top. For a GovTech SaaS company under $5M ARR, the winning move is sequencing: pick the lowest class a real buyer requires, tie the spend to contract value, and build automated evidence habits early.
Founders who decide on purpose, with a named buyer and a funded plan, will outsell those who chase a certification because it sounds impressive.
Next Steps for GovTech Founders
- Try the GovTech GTM Scorecard to see where compliance sits in your go-to-market readiness.
- Download the WIIFM Framework to build a separate security message for each government stakeholder.
- Learn more about the energizeGTM process.
- Visit the energizeGTM Library for articles, downloads, podcasts, playbooks, and frameworks.
- Contact us to learn more.
Pair this guide with the GovTech founders sales guide for the buyer-side view of procurement.
