FedRAMP 20x and the New Certification Classes: What's Changing and How to Take Advantage

FedRAMP Changed Its Vocabulary — and Its Operating Model

With the Consolidated Rules for 2026, "authorization" becomes "certification," Low/Moderate/High become Classes A through D, and static documents give way to continuous, machine-readable validation. Most of it is terminology — but the parts that aren't will reshape how you sell to government.

If you've kept even half an eye on FedRAMP this year, you've seen the language shift. As of early May, official FedRAMP materials stopped saying "authorization" and started saying "certification," and the familiar Low/Moderate/High labels began giving way to lettered classes. This isn't cosmetic drift — it's the visible edge of FedRAMP 20x, the biggest redesign of federal cloud authorization since the program launched in 2011, now consolidated into a single 2026 rulebook.

The good news for anyone already authorized: most of this is terminology and process modernization, not a new wall of controls. The part that genuinely changes the game is how compliance gets demonstrated — continuously and in machine-readable form — and what that means for how fast a service can reach the market. Here's the map.

Authorization → Certification, and Why It Matters

For years, "FedRAMP authorization" and "authorization to operate" got used interchangeably, and the overlap caused real confusion. The two are not the same. FedRAMP attests that a cloud service completed its security assessment; an agency grants the authorization to operate (ATO) that actually puts the service into use. Renaming the FedRAMP side to "certification" makes that line explicit: FedRAMP certifies, agencies authorize. If you hold a FedRAMP authorization today, it carries over — no re-assessment required to adopt the new label.

Low / Moderate / High → Classes A, B, C, D

The legacy FIPS 199 impact levels are being retired in favor of four lettered Certification Classes. The driver is clarity: "Moderate" and "High" collided constantly with DoD Impact Levels, which use similar words for an entirely different framework. The baselines map closely to what you already know — with one wrinkle worth noting.

From Documents to Continuous Validation

This is the substantive shift behind the rename. The legacy model rested on point-in-time documentation and an annual audit cycle — hundreds of pages of narrative reviewed once a year. FedRAMP 20x replaces that with Key Security Indicators and machine-readable evidence that validate a running system on an ongoing basis. The intent is to assess security continuously rather than re-litigate a binder every twelve months.

The Timeline That Actually Matters

What This Means If You Build on GovDataHosting

Here's the part that should lower your blood pressure. The direction FedRAMP is moving — continuous monitoring, live validation, machine-readable evidence — is the way our platform already operates. GovDataHosting holds a FedRAMP High authorization, which maps to the new Class D, and our 24/7 SOC runs the kind of persistent monitoring that 20x is making the standard rather than the exception.

For software providers selling to government, that translates into a shorter, surer path. You build in a Class C or Class D environment, inherit the controls the platform already carries, and focus your effort on your application — exactly as before, but now aligned with where the program is headed. Your existing authorization carries over, and the continuous-monitoring muscle you'd otherwise have to build is already running underneath you.

What You Should Do Now

Three moves put you ahead of the change. First, learn the new vocabulary and find your class — most providers land at Class C, while High-impact and the most sensitive workloads sit at Class D. Second, choose your path deliberately: Rev5 and 20x are not interchangeable, and the document-based Rev5 route has a firm 2027 sunset. Third, build for machine-readable, continuous evidence now rather than retrofitting it later — and inherit everything you can from infrastructure that already does it.

The renaming will generate plenty of noise over the next two years. The signal underneath it is simple: FedRAMP is rewarding continuous, automated, reusable assurance — and that's the foundation we've built for federal agencies and the providers who serve them for 25+ years.