FedRAMP 20x 3PAO | Class A, B & C Certification

The U.S. federal government, through the FedRAMP and the FedRAMP Program Management Office (PMO), developed the Federal Risk and Authorization Management Program (FedRAMP) in order to standardize and streamline the security assessment, authorization, and continuous monitoring of cloud service offerings used by federal agencies.

FedRAMP 20x is no longer a pilot concept. It is the live certification path for new Low and Moderate offerings.

Class A pipeline opened August 3, 2026 (replaces FedRAMP Ready).
Class B and Class C pipelines opened August 31, 2026 (updated Low / Li-SaaS and Moderate paths).
Lazarus Alliance is accepting native 20x Class B and Class C intake now.
The FedRAMP Consolidated Rules for 2026 become mandatory for all stakeholders on January 1, 2027.
FedRAMP will stop accepting new Rev5 certifications on June 11, 2027.
FedRAMP will not issue program certifications for both 20x and Rev5 on the same offering. Choose one path.

Lazarus Alliance is an A2LA-accredited FedRAMP Third-Party Assessment Organization (3PAO). We assess traditional Rev5 packages and 20x Class A, B, and C packages built around Key Security Indicators (KSIs), machine-readable OSCAL evidence, and continuous validation.

Current FedRAMP 20x Status — Updated September 2026

FedRAMP 20x is now operational for Class A, Class B and Class C Certifications. Class A applications opened August 3, 2026, followed by Class B and Class C on August 31. FedRAMP Ready is now legacy, while Rev5 remains available through limited transition paths. The Consolidated Rules for 2026 become mandatory January 1, 2027, and FedRAMP will stop accepting applications for new Rev5 Certifications on June 11, 2027.

Federal Risk and Authorization Management Program (FedRAMP)

FedRAMP is the U.S. government-wide program that standardizes security assessment, authorization, and continuous monitoring for cloud products and services used by federal agencies.

Established in 2011 and written into law by the FedRAMP Authorization Act, the program still exists to eliminate duplicative testing: authorize once, reuse many times. What changed in 2025–2026 is how that authorization is earned.

The traditional Rev5 path is a narrative, control-by-control assessment against NIST SP 800-53 Rev. 5 baselines (Low, Moderate, High). FedRAMP 20x is the modernization program built under OMB Memorandum M-24-15. It replaces long static packages with:

Certification classes instead of only Low / Moderate / High labels
Key Security Indicators (KSIs) instead of hundreds of narrative control statements
Machine-readable OSCAL packages instead of Word SSPs and PDF binders
Continuous, automated validation instead of periodic, document-centered validation
Program certification issued by FedRAMP and reusable by agency authorizing officials

Lazarus Alliance still supports Rev5 through the published wind-down. For any new Low or Moderate offering that belongs on the Marketplace, 20x is the path we recommend opening first.

What FedRAMP 20x Changes

FedRAMP 20x was announced by GSA in March 2025, proven in public pilots through early 2026, and opened for production Class A, B, and C certifications in August 2026.

The design goal is simple: make it possible to automate most of the application and validation of FedRAMP security requirements, reuse commercial security investments, and keep authorization data current without a yearly documentation rebuild.

20x does not remove independent assessment. A FedRAMP-recognized 3PAO still analyzes, validates, and attests to the quality of the provider’s materials so FedRAMP can determine whether the security posture is acceptable for reuse.

What it does remove is the assumption that security is proven by paragraphs. Under 20x, encryption, account management, logging, vulnerability response, and boundary enforcement are demonstrated as current system state — configuration, telemetry, and repeatable tests — not as a story written for last year’s audit.

FedRAMP Certification Classes A–D
Class	Legacy analog	What agencies can generally use it for	20x bar	Pipeline status
A	FedRAMP Ready	Entry listing; pilots, configuration, testing, and many non-sensitive use cases	Six federal mandates, then 12 months after a federal customer to begin moving to Class B or higher	Opened August 3, 2026
B	Low / Li-SaaS	Most Low objectives; some Moderate or High with agency compensating controls	51 KSIs	Opened August 31, 2026
C	Moderate	Most Low and Moderate objectives; some High with compensating controls	56 KSIs plus tighter continuous validation	Opened August 31, 2026
D	High	Most unclassified High-impact use cases	Later-phase High baseline	Pilot expected late 2026; formal option expected early 2027

Class A — Marketplace on-ramp

Class A is the new FedRAMP 20x Marketplace on-ramp following the transition of FedRAMP Ready to legacy status. It is built for cloud services with a mature commercial security program that need a federal listing without immediately carrying a full Low or Moderate operating burden.

Providers must address the Class A federal mandates, including FIPS-validated cryptography, multi-factor authentication aligned to NIST SP 800-63B, CAC/PIV support, DNSSEC, defined vulnerability-response timelines, and an authorization boundary and data-flow picture precise enough for independent verification. A complete Readiness Assessment Report or a strong SOC 2 Type II package can accelerate a Class A submission. It does not skip the KSI work required for Class B or C.

Once a federal customer is using the service, the provider has 12 months to begin the move to Class B or higher.

Class B — Updated Low / Li-SaaS

Class B consolidates the old Low and Li-SaaS tracks. It is the production 20x path for offerings whose residual risk is limited and whose agency use is typically bounded. Providers must meet 51 Key Security Indicators and maintain the ongoing reporting the class requires.

No dual Rev5 + 20x program certification is available on the same offering. If Class B is the right assurance level, build it as a native 20x package.

Class C — Updated Moderate

Class C is still the center of the federal cloud market. It is the production 20x path for enterprise services agencies will actually run. Providers must meet 56 Key Security Indicators, operate a tighter continuous-validation cadence (including three-day validation expectations at this class), and keep vulnerability, incident, and change data current in a form FedRAMP and agencies can consume.

If your buyers are asking for “FedRAMP Moderate,” Class C is the conversation you are in.

Class D — High, later phase

Class D is the High path. FedRAMP expects a late-2026 pilot and a formal option in early 2027. Until that pipeline opens, High-impact work remains on the established High / Rev5 and agency-authorization tracks. Lazarus Alliance continues to assess those packages and will take native Class D intake when the PMO opens it.

Which Path You Should Take: 20x vs. Rev5

Traditional Rev5 Assessment Timeline
Phase	Activities	Duration	Deliverables
Phase 0 – Pre-Engagement & Decision	Consultation, Moderate/High baseline, agency sponsor, authorization boundary, CSP responsibilities.	1–2 weeks	Engagement agreement, roadmap, boundary diagram, baseline confirmation.
Phase 1 – Scoping & Readiness	System inventory, inheritance, initial gap against NIST SP 800-53 Rev. 5, FedRAMP tailoring, documentation review.	2 weeks	Inventory, initial SSP outline, inheritance mapping, readiness gap report.
Phase 2 – Gap Assessment & Remediation	Full control gap analysis, policy/procedure development, POA&M, evidence strategy using Cybervisor™ automation.	3–4 weeks	Gap report, draft SSP, initial POA&M, evidence roadmap.
Phase 3 – Evidence Collection & Testing	Implementation verification, automated + manual testing, penetration testing support, evidence repository.	4–6 weeks	Evidence package, test results, updated POA&M, implementation statements.
Phase 4 – Reporting & Package	Final SSP, SAR, FedRAMP package assembly, agency or PMO submission support.	2–3 weeks	Complete Rev5 package (SSP, SAR, POA&M) and 3PAO artifacts.
Phase 5 – Authorization & ConMon	ATO coordination, ConMon setup, ongoing automation in Continuum GRC.	4 weeks initial, then ongoing	Marketplace support, ConMon plan, monthly dashboards.

What Lazarus Alliance Delivers

Lazarus Alliance coordinates directly with your organization to select the class, shape the boundary, build an assessable 20x or Rev5 package, and perform the independent 3PAO assessment. Our Cybervisor™ assessors work in Continuum GRC / A.ITAM — a FedRAMP-authorized GRC platform — so scoping, evidence, scoring, and reporting stay in one system instead of a folder of spreadsheets.

20x services now open

Class decision and path selection. 20x versus the limited Rev5 window. Class A versus B versus C, based on data types, federal customer intent, inheritance, and the actual residual risk — not a marketing label.
Boundary and inheritance design. Cloud service offering (CSO) scoping, customer-responsibility matrix, and inheritance from FedRAMP-authorized IaaS, PaaS, and managed services.
KSI and control mapping. The 51 or 56 indicators tied to implemented NIST SP 800-53 outcomes. Existing SOC 2, ISO 27001, CMMC, and Rev5 work is reused where it is real. Recycled narratives are not.
OSCAL package build. SSP, assessment results, and POA&M in machine-readable form from the first working draft. The package is the system of record, not a conversion project at the end.
Evidence and ConMon architecture. Automated collection, Class C validation cadence, vulnerability SLAs, FIPS-validated cryptography, MFA, operational logging, and a trust-center pattern agencies can actually consume.
Independent 3PAO assessment. Testing, live demonstrations, validation of automated evidence, Security Assessment Report, submission support, Marketplace listing support, and continuous monitoring after authorization.
Rev5 completion and transition. If you are already in a Rev5 package that still has a viable calendar, we finish it and map the CR26 / 20x conversion so you are not rebuilt from zero in 2027.

Related authorization work we keep in the same program

DoD SRG IL4 / IL5 / IL6 overlays where the federal buyer is a defense mission, not a civilian Moderate workload.
StateRAMP, TX-RAMP, GovRAMP, IRS 1075, CMMC, SOC 2, NIST 800-53 / FISMA reuse from the same control library and evidence store.
Continuous monitoring operations after listing — monthly and event-driven reporting, vulnerability tracking, significant-change handling, and dashboard access for your team.

Lazarus Alliance, an accredited FedRAMP Third-Party Assessment Organization (3PAO), is historically about 46% faster than traditional 3PAO firms, meaning that your authorizations can be achieved in 5–9 months. — Michael Peters, CEO & Founder

That speed claim was earned on disciplined Rev5 work. It applies to 20x only when the offering is automation-first and the evidence is coming from running systems. 20x is not a shortcut around engineering. It is a faster assessment of work you already operate.

Native 20x Intake Process

Native intake means the engagement starts in 20x shape. We do not write a Rev5 binder and “convert it later.”

Phase 0 — Decision and engagement (1–2 weeks)

Risk-free consultation. Confirm Class A, B, or C. Confirm 20x versus any remaining Rev5 exception. Define the authorization boundary, inheritance, federal customer hypothesis, and CSP versus customer responsibilities. Signed engagement, project roadmap, and baseline/class confirmation.

Phase 1 — Scoping and readiness (2 weeks)

System inventory, data types, KSI applicability, control inheritance, and a first-pass gap against the target class. Continuum GRC is stood up as the working system. Output: inventory, inheritance map, initial OSCAL outline, and a readiness gap report.

Phase 2 — Gap closure and evidence architecture (3–4 weeks)

KSI-by-KSI gap analysis, policy-as-code and operational fixes, POA&M only where the class still allows it, and an evidence strategy that pulls from production telemetry instead of screenshots. Cybervisor™ automation is used to keep collection repeatable. Output: prioritized remediation plan, draft machine-readable SSP, initial POA&M, and evidence roadmap.

Phase 3 — Implementation verification and testing (4–6 weeks)

Independent verification of implemented KSIs, automated plus manual testing, penetration testing support where the class and boundary require it, live demonstrations, and an evidence repository that a FedRAMP reviewer can traverse. Output: test results, findings, updated POA&M, and assessable implementation statements.

Phase 4 — Package and submission (2–3 weeks)

Final OSCAL package, Security Assessment Report, 3PAO attestation, and submission support to FedRAMP for program certification. Output: complete Class A, B, or C Certification package and Marketplace submission support.

Phase 5 — Authorization and continuous monitoring (4 weeks to stand up, then ongoing)

Program certification coordination, agency reuse support, ConMon plan, automated reporting cadence, and ongoing maintenance in Continuum GRC. Class C stays on the tighter validation clock. Output: Marketplace listing support, approved ConMon operating model, and monthly dashboards.

Why this finishes faster than a document project: A2LA-accredited assessors (ISO/IEC 17020 #3822.01), Cybervisor™ automation, Continuum GRC, and Proactive Cyber Security® methodology reduce typical FedRAMP assessment timelines by 40–50% when the CSP is prepared and the package is automation-first.

Fastest realistic calendars (prepared CSPs)

Class A — weeks to a small number of months, depending on mandate readiness and existing SOC 2 / RAR quality
Class B (updated Low) — commonly faster than legacy Low when KSIs are already instrumented
Class C (updated Moderate) — still a serious engineering program; mature CSPs with aggressive 3PAO support are targeting the same compressed 5–9 month band we publish for disciplined Moderate work
Legacy Rev5 Moderate / High — remains a 9–12 month (or longer) document-and-test cycle if you stay on that path

Unprepared offerings do not get those calendars. 20x punishes missing telemetry faster than Rev5 punished missing paragraphs.

Traditional Rev5 Assessment Timeline
Phase	Activities	Duration	Deliverables
Phase 0 – Pre-Engagement & Decision	Consultation, Moderate/High baseline, agency sponsor or JAB path, authorization boundary, CSP responsibilities.	1–2 weeks	Engagement agreement, roadmap, boundary diagram, baseline confirmation.
Phase 1 – Scoping & Readiness	System inventory, inheritance, initial gap against NIST SP 800-53 Rev. 5, FedRAMP tailoring, documentation review.	2 weeks	Inventory, initial SSP outline, inheritance mapping, readiness gap report.
Phase 2 – Gap Assessment & Remediation	Full control gap analysis, policy/procedure development, POA&M, evidence strategy using Cybervisor™ automation.	3–4 weeks	Gap report, draft SSP, initial POA&M, evidence roadmap.
Phase 3 – Evidence Collection & Testing	Implementation verification, automated + manual testing, penetration testing support, evidence repository.	4–6 weeks	Evidence package, test results, updated POA&M, implementation statements.
Phase 4 – Reporting & Package	Final SSP, SAR, FedRAMP package assembly, agency or PMO submission support.	2–3 weeks	Complete Rev5 package (SSP, SAR, POA&M) and 3PAO artifacts.
Phase 5 – Authorization & ConMon	ATO coordination, ConMon setup, ongoing automation in Continuum GRC.	4 weeks initial, then ongoing	Marketplace support, ConMon plan, monthly dashboards.

Treat Rev5 as a closing window, not a preferred future state. If you start a new Moderate program after August 2026 without a documented exception, you are choosing the slower path on purpose.

Current Marketplace designations you will still see

FedRAMP Authorized (Agency ATO or 20x Program Certification): Reusable by other agencies with their own authorizing-official review.
FedRAMP Ready / Legacy Ready: Being replaced by Class A. Ready listings are on a published wind-down.
FedRAMP In Process: Actively working with a 3PAO and sponsor or PMO toward authorization.
20x Class A / B / C Certification: The new production labels for entry, Low, and Moderate assurance.

Why Cloud Providers Finish Faster with Lazarus Alliance

A2LA-accredited 3PAO under ISO/IEC 17020, certification number 3822.01 .
Native 20x intake, not a Rev5 retrofit. Class selection, KSIs, OSCAL, and ConMon architecture are the engagement, not an afterthought.
Continuum GRC / A.ITAM and AITAMBot. Scoping, evidence, scoring, and reporting live in a FedRAMP-authorized GRC platform. The same library supports FedRAMP, GovRAMP, NIST, CMMC, and SOC 2 reuse.
Cybervisor™ assessors who have delivered thousands of assessments and know the difference between a control that exists in a policy and a control that exists in production.
Fixed-scope commercial discipline. Clear boundary, clear class, clear deliverables. Scope creep is how FedRAMP programs die.
Proactive Cyber Security®. Authorization is not a PDF event. It is an operating model you can keep after the Marketplace listing posts.

Lazarus Alliance provides FedRAMP, FISMA, and NIST audit, advisory, and assessment services for public, private, community, and hybrid cloud offerings — SaaS, PaaS, and IaaS.

At Lazarus Alliance, proactive isn’t just our trademark—it’s our promise to protect your future before threats even emerge. — Michael Peters, CEO & Founder

Frequently Asked Questions

What is FedRAMP?

FedRAMP (Federal Risk and Authorization Management Program) is a U.S. government program that standardizes security assessment, authorization, and continuous monitoring for cloud products and services. It enables cloud service providers (CSPs) to demonstrate compliance with FISMA and NIST requirements, allowing federal agencies to use cloud platforms confidently. There are two authorization paths: Agency and FedRAMP Marketplace.

What is FedRAMP 20x?

FedRAMP 20x is the program’s cloud-native modernization path. Instead of authorizing a service only against a long narrative NIST SP 800-53 baseline, 20x certifies offerings by class (A, B, C, and later D) against Key Security Indicators, machine-readable evidence, and ongoing validation. Class A, B, and C rules are finalized. The pipelines are open.

20x does not remove independent assessment.

FedRAMP's current Certification Package rules explicitly require the overall independent-assessment summary for Classes B, C and D.

How is 20x different from Rev5?

Rev5 asks you to describe every applicable 800-53 control and prove it in an annual-style package. 20x asks you to operate a defined set of measurable indicators and keep the proof current. You still need a 3PAO. You still need a real boundary, FIPS-validated crypto where required, identity discipline, logging, and vulnerability response. You do not need a thousand-page novel about those things.

Who is eligible for FedRAMP Certification?

Cloud service providers seeking FedRAMP Certification must select the appropriate certification class and path, meet the applicable FedRAMP requirements, establish the required certification package and evidence, and complete the applicable verification, validation, and independent assessment activities. Rev5 offerings continue to use NIST SP 800-53-based SSP and control-assessment requirements during the transition period.

What services does Lazarus Alliance provide for FedRAMP?

Lazarus Alliance offers a full suite of FedRAMP support, including:

Native 20x Class A, B, and C intake and independent 3PAO assessment
Rev5 readiness, gap analysis, advisory, and 3PAO assessment during the transition window
Business justification and class-selection reviews (cost, timeline, inheritance, buyer fit)
Boundary, KSI, and NIST SP 800-53 mapping
OSCAL package development and evidence architecture
Cybervisor™ assessments for Low, Moderate, High, and 20x classes
Continuous monitoring design and operation in Continuum GRC
Related overlays: DoD SRG, StateRAMP, CMMC, SOC 2, IRS 1075, FISMA / NIST

What are the benefits of working with Lazarus Alliance for FedRAMP?

Key benefits include a 46% reduction in traditional assessment time through critical path methodology and advanced audit software, significant cost savings by avoiding scope creep and annual hikes, proactive threat prevention to maintain compliance, and expanded access to government markets with minimized risks. As an A2LA ISO/IEC 17020 accredited organization, they provide experienced Cybervisors™ for reliable, conflict-free partnerships.

How long does the FedRAMP authorization process take?

Prepared CSPs on a disciplined 3PAO program have historically finished 40–50% faster than traditional 3PAO calendars, with authorizations in the 5–9 month band when the system is ready. Class A can be materially shorter. Class C is not a two-week badge. Uninstrumented environments take longer under 20x, not shorter, because missing telemetry is obvious.

How much does FedRAMP authorization cost?

Costs depend on the CSP's maturity, cloud type, and authorization path, but Lazarus Alliance drives down expenses through advanced audit software, experienced partnerships, and proactive approaches that prevent costly compliance threats. Their Business Justification Review evaluates total program costs, including assessments and monitoring, to inform decisions. Contact them at +1 (888) 896-7580 for a tailored estimate.

How can I get started with FedRAMP through Lazarus Alliance?

Start with a FedRAMP Readiness Assessment or Business Justification Review to gauge fit and roadmap. Reach out via phone (+1 (888) 896-7580) or their contact form for a consultation. They'll guide you through SSP preparation, gap analysis, 3PAO audits, and continuous monitoring to achieve ATO efficiently.

Do I still need an agency sponsor?

For many 20x Class A and Class B efforts, program certification does not wait on a sponsor the way classic agency ATO did. Agencies still decide whether their use of the service is acceptable. Class C enterprise use and any High / Class D work should be planned with real agency demand in mind. We will tell you if your class choice is running ahead of the buyers.

What are Key Security Indicators?

KSIs are the measurable, testable security outcomes FedRAMP 20x uses instead of a pure narrative control catalog. Class B requires 51. Class C requires 56. Each indicator must be addressed. Automated validation is expected for a large share of them. Evidence must be available in human-readable and machine-readable form.

Credentials You Can Count On

American Association for Laboratory Accreditation (A2LA) ISO/IEC 17020 accredited certification number 3822.01

Talk with one of our experts

Our Lazarus Alliance Cybervisor™ teams have experience performing thousands of assessments for organisations providing services to clients around the world.

We're here to answer any questions you may have.

Benefits of FedRAMP Certification

Access to the U.S. federal cloud market. Once authorized or 20x-certified, civilian agencies can reuse the determination. Defense buyers still layer DoD SRG requirements where the mission requires it.
Do-once, use-many-times reuse. Agencies issue their own ATO from the existing package instead of running a full independent assessment. That is what shortens federal sales cycles from 18–36 months to a single-digit-month review in the best cases.
Public Marketplace listing. Federal buyers and integrators still start at fedramp.gov. Class A, B, and C certifications are the labels they will learn in FY2026–FY2027.
Competitive differentiation. Most commercial SaaS never finishes this work. Authorization remains a sales asset, not a brochure claim.
SLED and regulated-commercial pull-through. GovRAMP, TX-RAMP, healthcare, financial services, and critical-infrastructure buyers continue to treat FedRAMP as strong evidence of security discipline.
Valuation and diligence. GovTech investors and acquirers treat a current FedRAMP authorization or 20x certification as a diligence checkbox and a valuation driver.
Better engineering. KSIs and 800-53 both force account management, logging, encryption, vulnerability response, and boundary control that benefit every customer, not only federal ones.
Improves overall security and engineering discipline: The rigorous NIST 800-53-based controls, continuous monitoring, and independent 3PAO assessment force mature security practices that benefit all customers, not just federal ones.
Downstream framework reuse. A clean FedRAMP Moderate / Class C package still accelerates (GovRAMP, TX-RAMP, IRS 1075, CMMC IL4/IL5, HIPAA with a FedRAMP-aligned BAA, etc.).
Sticky federal revenue. Multi-year agency adoption and expansion follow authorization more reliably than they follow a slide deck.
A current operating model, not a binder. 20x makes that last point enforceable. Continuous validation is the product.

FedRAMP 20x & 3PAO Certification Services | Class A, B & C | Lazarus Alliance. Call +1 (888) 896-7580 today.