Questions Regarding FedRAMP 20x Phase 3 Transition and Authorization Pathways

[philipdank]

I have a few questions regarding FedRAMP 20x Phase 3 and the available authorization pathways:

If a system is currently listed as FedRAMP Ready (RAR), are there any additional requirements or steps needed to transition to a formal FedRAMP 20x Class C designation?
For a system that has already achieved FedRAMP Ready status, should the organization continue pursuing the traditional FedRAMP Rev. 5 authorization process with an agency sponsor, or would it be more appropriate to prepare for and pursue the FedRAMP 20x assessment pathway?
If both pathways remain viable options, what factors should be considered when determining whether to continue with the traditional authorization route versus transitioning to the FedRAMP 20x framework?

[pete-gov]

If a system is currently listed as FedRAMP Ready (RAR), are there any additional requirements or steps needed to transition to a formal FedRAMP 20x Class C designation?

Yes - we've outlined the expectations in the Certification Path section of the Public Preview of the Consolidated Rules for 2026. Some of this content is incomplete but will be finalized when these rules become official.

In short, folks will need to commit to implementing all of the required changes to the Rev5 process by February 2027 to receive a FedRAMP Rev5 Class C Program Certification based on FedRAMP Ready.

For a system that has already achieved FedRAMP Ready status, should the organization continue pursuing the traditional FedRAMP Rev. 5 authorization process with an agency sponsor, or would it be more appropriate to prepare for and pursue the FedRAMP 20x assessment pathway?

Cloud service providers need to make this decision on their own based on the information available to the public; FedRAMP can't make recommendations or provide business advice.

If both pathways remain viable options, what factors should be considered when determining whether to continue with the traditional authorization route versus transitioning to the FedRAMP 20x framework?

The most important factor to consider from FedRAMP's perspective is that Rev5 is considered a legacy process that is actively being replaced by 20x.

[philipdank]

Thank you for the detailed response and clarification. I appreciate you taking the time to provide additional context around the Certification Path section and the transition from the FedRAMP Rev. 5 process to FedRAMP 20x.