FedRAMP 20x: Classes A Through D, and What Replaced Low, Moderate, and High

By Josh Hammer, CEO, H&V Complynt

When clients come to me about cloud compliance, the first question they ask is “which framework applies?” That is the wrong first question. It jumps straight to the paperwork and skips the question that determines whether the paperwork even matters: what data does this workload handle, and where does it actually live?

FedRAMP is part of the answer, but the framework question cannot be answered until the data-flow question is. So if you are still asking, “Which FedRAMP level do we need?” you may be starting from the wrong model.

FedRAMP 20x did not simply adjust the old Low, Moderate, and High baselines. It replaced that structure with a new program organized around certification classes, rulesets, and certification options. The distinction matters: providers must build and maintain evidence against the rules that apply to their offering, while contractors must understand how their cloud providers’ authorization paths and transition plans affect their own contracts.

The practical question is now: Which class and ruleset apply to this cloud service, and what evidence must it continuously produce?

That shift rewards providers who invest early in machine-readable evidence and continuous validation. Waiting for every detail of 20x to “settle” is not a neutral choice. The rules are already published, the transition milestones are set, and the work of building reliable evidence takes time.

Tier 1: Understand the change before choosing a path

What FedRAMP does, and who it affects

The Federal Risk and Authorization Management Program (FedRAMP) provides a standardized approach for assessing and authorizing cloud services used by federal agencies. It establishes a way to review a cloud service’s security posture and make assessment information available for agency use.

FedRAMP certification applies to cloud service offerings, not automatically to every organization that uses them. Still, federal contractors that consume cloud services need to pay attention. A provider’s authorization, service boundary, and transition plan can affect whether that service remains suitable for a contract or agency mission.

That is why this change matters even if you are not seeking FedRAMP certification yourself. Your cloud provider’s path through 20x and any changes to its authorization status may affect your ability to meet contractual and agency requirements.

Why 20x replaced the old tier structure

For years, providers and customers often framed the question as “Low, Moderate, or High?” FedRAMP 20x replaces that legacy baseline structure with Classes A through D and rulesets that describe the requirements for an offering.

This is a program structure change, not a renaming exercise. The Consolidated Rules for 2026 (CR26) bring the rules into a consolidated framework for 20x and specify how providers demonstrate and maintain security. FedRAMP says CR26 becomes mandatory for all stakeholders on January 1, 2027.

In other words, do not treat old “levels” as labels you can simply translate one-to-one. The new framework changes how certification is organized, how evidence is represented, and how security is validated over time.

Class, ruleset, and certification option: three different ideas

A class describes a certification path within the 20x structure. A ruleset contains requirements that apply to an offering, potentially based on the class and service characteristics. A certification option refers to the available path under which a cloud service can pursue certification.

These terms work together, but they are not interchangeable. A provider should identify the relevant offering and its characteristics, determine the certification option, then use the applicable class and ruleset to plan evidence and operations. FedRAMP’s Consolidated Rules for 2026 are the primary reference for that analysis.

For agencies and contractors buying cloud services, the same logic changes procurement questions. “Is it FedRAMP Moderate?” may not be enough to understand the provider’s current path. Ask which 20x class or legacy status applies, which ruleset governs, and how the provider plans to sustain the required evidence.

Tier 2: What the 20x framework changes in practice

Classes A through D: a progression, not a simple conversion chart

FedRAMP’s new classes create a progressive certification structure. Public descriptions support only a broad comparison with the familiar impact categories, so avoid treating the classes as exact equivalents:

• Class A is the lightest path in the new progression.
• Class B broadly corresponds to services in the lower-impact range.
• Class C broadly corresponds to moderate-impact services and is designed for more substantial assurance requirements.
• Class D is the highest-impact path, with development and rollout planned as part of FY27 work.

Those descriptions help orient planning, but they are not a substitute for checking the actual rules for your service. FedRAMP’s FY27 goals include bringing all certification options under the 20x umbrella, including Class D and rulesets for self-hosted and hybrid-hosted services. The program also aims to keep initial assessment decisions within 30 days of application. These are program objectives, not a guarantee of a specific provider’s outcome. FedRAMP described the goals in its FY26-to-FY27 update.

Here is the belief I correct most often: contractors treat any FedRAMP-authorized service as acceptable for any workload. The authorization attaches to the provider’s service as assessed, within a defined boundary, at a specific class or baseline. It does not attach to your configuration, your data type, or your workload. A service authorized at one class may be entirely wrong for data at a higher impact level, and “it is FedRAMP authorized” is not an answer to the question “is it authorized for what we are putting in it?”

Structured evidence replaces a narrative-first package

A central 20x shift is from assembling a primarily narrative security package to producing structured, machine-readable artifacts, including JSON versions of the Certification Package Overview and Security Decision Record.

That shift changes the work for both the provider and the reviewer. Providers need to organize evidence so it is structured, current, and connected to the relevant security indicators. Reviewers can work with consistent information rather than relying solely on large narrative documents assembled for a single assessment.

The benefit is not that documentation disappears. It is that evidence can become more reusable and easier to validate. But machine-readable evidence is only useful if it is accurate, well-scoped, and connected to how the service actually operates. A JSON file cannot turn an incomplete inventory or an ineffective control into good evidence.

Key Security Indicators make validation continuous

20x is built around Key Security Indicators (KSIs) and continuous validation. Instead of treating compliance as a package prepared at one point in time, providers are expected to demonstrate that key security conditions remain true.

For Class C, the rules require at least two automated validation methods per KSI and six months of historical metric data. Those requirements make operational readiness important. A provider cannot create six months of trustworthy history at the moment it decides to apply; it needs a working process that captures and preserves validation results over time.

Think of the difference as a snapshot versus a time series. A snapshot says, “This setting appeared correct when someone checked.” A sustained record helps show whether it stayed correct, how it was validated, and when the evidence was captured. That distinction is useful not only for FedRAMP, but also for continuous risk management approaches such as NIST Cybersecurity Framework 2.0.

Safe harbor is conditional, not blanket immunity

CR26 introduces explicit safe-harbor criteria that can protect providers from certain liability when they meet defined conditions. That is a meaningful feature of the rules, but it should not be read as blanket immunity, a guarantee against all legal claims, or a substitute for meeting applicable obligations.

Providers should review the actual criteria in CR26 and document how they meet them. If a safe-harbor provision applies, the protection depends on satisfying the conditions it defines. It does not certify an organization, eliminate contractual duties, or remove the need to assess and manage security risk.

Vulnerability response moves beyond monthly scanning

A monthly vulnerability scan can be useful, but it does not satisfy the new VDR and VER requirements by itself.

FedRAMP’s Vulnerability Detection and Response (VDR) and Vulnerability Evaluation and Reporting (VER) rules take effect December 7, 2026, aligning the program with CISA Binding Operational Directive 26-04. The directive prioritizes vulnerability response using risk factors that include public exposure, Known Exploited Vulnerability status, exploit automation, and technical impact.

That is a move away from treating severity scores as the sole prioritization signal. In FedRAMP’s approach, providers need to evaluate whether a vulnerability is reachable over the internet and likely exploitable, among other relevant factors. The rules also require providers to assume exploits are automatable unless they have evidence showing otherwise.

FedRAMP’s Public Notice NTC-0014 explains the alignment and states that legacy monthly scanning alone is insufficient. Providers on a corrective action plan have a grace period through March 7, 2027; after that date, certification can be revoked if the rules are not being followed. The dates are operational planning milestones: teams need time to build exposure-aware triage, response workflows, and evidence, not just schedule another scan.

Transition dates are planning markers

Three dates belong on every provider’s transition plan:

• December 7, 2026: VDR and VER rules take effect.
• January 1, 2027: CR26 becomes mandatory for all FedRAMP stakeholders.
• March 7, 2027: The VDR/VER corrective-action grace period ends.
• June 11, 2027: FedRAMP stops processing new legacy Rev5 certification applications.

FedRAMP reported 92 new certifications in FY26, bringing the total to 538 certified cloud service offerings. It also reported 71 Initial Implementation listings and 760 agency ATOs/ATUs. The program operated with a budget of roughly $10 million. These figures, from FedRAMP’s FY26 update, help explain why 20x emphasizes automation, reusable evidence, and scalable review.

FedRAMP has also been conducting outreach to clarify how the new rules differ from legacy guidance. Nextgov/FCW reported on GSA’s effort to help agencies and private companies understand the overhaul. FedRAMP targeted October 16, 2026 for input on self-hosted cloud considerations; providers should consult the program’s current rules and community materials for the latest status.

What cloud-service customers should ask providers

If your organization buys rather than provides cloud services, use the transition as a reason to refresh due diligence. In my experience, this is where the conversation goes sideways more often than anywhere else: the boundary mismatch. A client gets well into a project before discovering that the provider’s assessed boundary does not match the workload they are deploying into it. The authorization is real. It simply does not cover the thing they are building, or not in the configuration they are building it. By the time that surfaces, the architecture is set and the rework is expensive. Discover the mismatch during selection, not during implementation.

Ask your provider:

1. Which certification class, ruleset, or legacy status applies to the specific service we use?
2. What is your transition plan for the relevant 20x rules and milestones?
3. How are vulnerabilities assessed for internet reachability and exploitability, beyond monthly scanning?
4. What evidence can you provide about continuous validation, changes, and corrective actions?
5. How will you notify customers if the service’s certification status, boundary, or use conditions change?

Request evidence appropriate to your contract and the service, such as the provider’s current Marketplace status, relevant authorization or certification documentation, transition communications, and information about the service boundary and shared responsibilities. CISA BOD 26-04 directly binds federal agencies in its stated scope; contractor obligations depend on applicable contract terms and agency requirements. Do not assume that the directive automatically imposes identical duties on every contractor.

For background on evidence reuse across obligations, see why one control environment can support both SOC 2 and CMMC evidence. For identity and access risks, read what NIST IR 8587 changes about tokens and keys.

Tier 3: Put the operating process before the tool

The strongest position for providers is not to wait and see how 20x settles. Start building machine-readable evidence and continuous validation now. Those capabilities require consistent data, defined ownership, and operational discipline; they cannot be bolted on overnight. The same principle applies to buyers: verify your provider’s path and understand how it connects to your own obligations.

If I could leave contractors with one thing about choosing a cloud provider for government work, it is this: the provider’s transition calendar is your project risk, not the provider’s problem. When Rev5 applications stop being processed on June 11, 2027, and when CR26 becomes mandatory on January 1, 2027, those dates land on your contract timeline regardless of whose paperwork they appear in. A provider that has not started its transition is a schedule risk you are carrying. Ask about the transition plan before you sign, not after the milestone arrives.

At H&V Complynt, we see tools as an operating layer, not as the compliance process itself. Complynt supports automated control mapping, evidence collection with capture and verification dates, continuous monitoring, pre-built content packs, and policy-as-code. It provides cross-framework visibility across 150+ frameworks, including CMMC, NIST SP 800-171, NIST SP 800-53, RMF, SOC 2, HIPAA, and ISO 27001.

Complynt runs on FedRAMP High- and DoD IL5-authorized infrastructure on Palantir’s federal cloud. That hosting authorization applies to the hosting environment; it does not authorize or certify your organization, system, product, or deployment. H&V does not issue certifications and cannot guarantee an assessment outcome.

The right sequence remains: audit first, build the plan, then select tools. Begin with your offering or service boundary, identify the applicable rules, assess your evidence and operational gaps, and assign owners. Then choose tools that help collect, verify, and maintain the information you need.

For more on why technology cannot replace governance and accountability, read Compliance Tools Are Not a Compliance Program. Explore H&V Complynt’s compliance automation services or begin with a free readiness check.

What to do this week

• Identify whether your organization provides or consumes FedRAMP cloud services, or both.
• For each service, record the current certification status, service boundary, and applicable class or legacy path, and compare that boundary against the workload you actually deploy.
• Ask the provider to confirm in writing that the boundary covers your data type, impact level, and configuration.
• Ask providers for their VDR/VER readiness approach and how they assess exposure and exploitability.
• If you are a provider, inventory evidence sources and define who owns each KSI and validation method.
• Map the transition milestones to your internal planning calendar, and treat the provider’s transition plan as a dependency of your project schedule.
• Audit your current process and gaps before selecting or expanding compliance tools.

Frequently asked questions

1. Did FedRAMP rename Low, Moderate, and High?

No. FedRAMP 20x replaces the legacy Low/Moderate/High baseline structure with Classes A through D, along with rulesets and certification options. The classes have broad associations with impact ranges, but they should not be treated as direct, one-to-one renames.

2. Which FedRAMP class does my organization need?

Start with the workload, not the framework: what data does it handle, at what impact level, and where does it live? Then determine whether the provider’s authorization and boundary actually cover that configuration. If you provide a cloud service, determine the relevant certification option and ruleset based on the specific offering. If you buy cloud services, ask the provider which class or legacy status applies to the service you use, what its boundary includes, and how its transition plan affects your contract.

3. Does a FedRAMP authorization cover every use of a service?

No. The authorization attaches to the provider’s service within a defined boundary at a specific class or baseline. It does not automatically cover your configuration, your data type, or your workload. Verify that the boundary matches what you are deploying before you build on it.

4. Does monthly vulnerability scanning satisfy VDR and VER?

No. FedRAMP states that the legacy monthly scanning cycle is insufficient. The new rules require an exposure- and threat-based approach that considers factors such as internet reachability and exploitability.

5. What does the CR26 safe harbor mean?

CR26 includes defined safe-harbor criteria that can protect providers from certain liability when the specified conditions are met. It is not blanket immunity and does not remove contractual responsibilities or the need to manage security risk.

6. Does Complynt make my organization FedRAMP certified?

No. Complynt supports compliance operations, such as evidence collection, control mapping, and monitoring. The FedRAMP High and DoD IL5 authorizations apply to the hosting environment only; they do not authorize or certify a customer organization, system, product, or deployment.

Read next in this series

Compliance Tools Are Not a Compliance Program. Why a sound audit and plan must come before selecting automation.

By Josh Hammer, CEO, H&V Complynt