# GSA Advances FedRAMP 20x Cloud Certification

GSA is in the third phase of the five-phase FedRAMP 20x rollout, formalizing revised certification requirements and clarifying how they differ from legacy guidance. The overhaul moves federal cloud authorization toward automated validation and continuously maintained security evidence, with a Security Decision Record replacing the traditional System Security Plan. GSA is developing Class A, B, and C certification requirements, while Class D pilots are planned. FedRAMP plans to stop accepting new Rev. 5 certification applications on **June 11, 2027**; these signals describe a compliance-policy transition, not a contract award or solicitation.

- Cloud service providers pursuing federal business should assess service-specific certification coverage and their ability to automate security evidence and support continuous validation.
- Providers using or pursuing Rev. 5 should account for the June 11, 2027 cutoff for new applications in their authorization and product-transition plans; the deadline does not itself indicate that existing Rev. 5 authorizations end on that date.
- Procurement teams evaluating cloud services should review how suppliers’ FedRAMP 20x certification classes and evidence practices align with agency security and acquisition needs, and use official FedRAMP updates to clarify evolving requirements.

**Jurisdictions:** federal
**Industries:** Information Technology
**Topics:** Cloud Services, Regulatory Compliance
**Published:** October 12, 2026

### Government Entities
- General Services Administration (GSA)
- Federal Risk and Authorization Management Program (FedRAMP)
- National Institute of Standards and Technology (NIST)

### Vendors
- Cloudflare ()

### Key Quotes
> We were able to develop [20x processes] in real time, make adjustments to the rules that weren't clear, and so a lot of the very beginning was managing a lot of frustration about too much information happening all at one time
> — Nicole Thompson, FedRAMP Security Director

> While 20x is designed to reduce the administrative burden associated with traditional assessments, it shifts more of the work toward engineering, automation and continuous validation. The work doesn’t disappear; it changes.
> — Matt Hungate, Principal at Schellman

> In reality, if we could make a world where the FedRAMP stuff could be applied across the board, it would raise the floor for everything
> — Anish Patel, Head of Federal at Cloudflare

### Sources
- [GSA seeks to boost understanding of FedRAMP 20x overhaul - Nextgov/FCW](https://www.nextgov.com/digital-government/2026/10/gsa-seeks-boost-understanding-fedramp-20x-overhaul/416508) - Nextgov/FCW
- [What Is FedRAMP? The enterprise guide to federal cloud compliance - Spiceworks](https://www.spiceworks.com/it-networking/what-is-fedramp-the-enterprise-guide-to-federal-cloud-compliance) - Spiceworks