FedRAMP stops new Rev5 applications on June 11, 2027: planning the move to 20x

On October 8, 2026, the FedRAMP program marked the start of federal fiscal year 2027 with a review of FY26 and its goals for the year ahead. The headline for cloud providers is a firm end date for the legacy process. FedRAMP will stop accepting applications for new Rev5 certifications on June 11, 2027, and it advises providers without significant Rev5 progress and a guaranteed agency sponsor to move to FedRAMP 20x immediately. Separately, the Consolidated Rules for 2026 move from optional to mandatory adoption on January 1, 2027.

FedRAMP is the federal program that sets security requirements for cloud services used by federal agencies. Rev5 is the long-standing process built on NIST SP 800-53 Revision 5 controls and document packages. FedRAMP 20x is its replacement. It relies on Key Security Indicators, which FedRAMP says can show security posture in near real time, and on automated, machine-readable evidence in place of static yearly assessments.

The dates that matter

July 28, 2026: FedRAMP Ready became legacy, and new Ready submissions are no longer accepted.
August 3, 2026: applications opened for 20x Class A certification.
August 31, 2026: applications opened for 20x Class B and Class C certification.
January 1, 2027: the Consolidated Rules for 2026 take mandatory effect. Providers must follow them to maintain certification.
June 11, 2027: FedRAMP stops accepting applications for new Rev5 certifications.
End of FY27: FedRAMP expects to publish clear transition paths and timelines for all cloud services to move to 20x.

How the 20x classes line up

Class A is for services with mature security and compliance programs that want to enter the federal market. FedRAMP says a Class A certification can skip the independent assessor, but one is needed to move up to a permanent certification class.
Class B corresponds to the Low impact level, for small-scale or light-use services that an entire agency is unlikely to rely on for important work.
Class C corresponds to Moderate, for common enterprise services likely to be used across an entire agency or to deliver important government services.
Class D corresponds to High and is not yet available. FedRAMP estimates a Class D pilot in the first half of FY27 and lists bringing all certification options, including rulesets for self-hosted and hybrid-hosted services, under 20x as an FY27 goal.

FedRAMP reports that it issued 92 new certifications in FY26, 66 under Rev5 and 26 under 20x. Among its FY27 goals, it says it will continue issuing initial assessment decisions within 30 days of application.

What cloud providers should do now

If you are not well into a Rev5 effort with a committed sponsor, follow FedRAMP's advice and plan for 20x instead.
Treat this as engineering work, not paperwork. FedRAMP no longer provides traditional document templates for Rev5. It expects semi-structured data that fits FedRAMP's JSON schemas, and it warns that its assurance rulesets will require new engineering and product work.
Prepare for January 1. Review the Consolidated Rules and the changelog against your current certification, and assign an owner for each ruleset that applies to you.
Automate evidence collection from your cloud and CI/CD platforms where you can. The 20x approach expects status and outcomes to be enforced and validated automatically whenever possible.

What agencies should check

Agencies must ensure that any in-scope cloud service they use has a FedRAMP certification, and they must follow FedRAMP rules for assessment and use of a cloud service.
Review contracts. Agencies must avoid terms that prevent a provider from meeting ongoing FedRAMP rules. Terms that stop a provider from sharing its Ongoing Authorization Reports with other agencies are unacceptable. FedRAMP says such an agreement would force it to revoke the certification.
Keep the agency System Security Plan focused on what the agency is responsible for, and record each selected control as agency-implemented or inherited.
Ask providers on your current contracts which 20x class they are targeting and when, so a planned transition does not surprise your own authorization schedule.

This article is general information, not legal or procurement advice. FedRAMP says its future dates are estimates that may shift, so confirm current requirements with FedRAMP and your agency before you plan around them.