FedRAMP is the US federal program for authorizing cloud services. A CTO's decisions are which route to take, which impact class fits the product, and how to build continuous evidence instead of a one-time audit pack. Be careful with wording: "in process" and "authorized" are different statuses on the FedRAMP Marketplace.
What is FedRAMP 20x?
FedRAMP describes 20x as a new approach to cloud security assessment and authorization that moves beyond traditional compliance. Providers set their own security goals, continuously measure how well their decisions work, and give agencies assurance through progressively increasing commitments. The FedRAMP site says the rules for 20x certification are finalized for Class A, Class B and Class C, while Class D will be developed in Phase 4. It also says 20x is currently in Phase 3, and that future dates are estimates, not commitments. The FedRAMP homepage lists a Class D cloud-hosted pilot requirements RFC published on 15 October 2026.
What are the classes?
According to FedRAMP, Class A is for services with mature security and compliance programs entering the federal marketplace, requiring a small amount of information up front and a small subset of initial continuous monitoring and reporting. Class B is for common small-scale or light-use services where an entire agency is unlikely to depend on the service for important work. Class C is for common enterprise services likely to be used across an agency or to deliver important government services.
The impact of a compromise on the agency drives the class, not the size of your company. A constructed example: a collaboration tool that stores only public-facing marketing drafts is a very different case from a service that processes case files for a whole agency. Picking too low a class wastes a cycle; picking too high burns months.
What does continuous evidence mean for engineering?
FedRAMP's stated principles stress transparency, accountability, accuracy and automatic validation: status and outcomes should be automatically enforced and validated where possible, with continuous evidence valued over a policy that says something should happen. Practically, this favors teams that can produce live data: asset inventory, vulnerability status, configuration state, patch timelines, access logs.
Key Security Indicators are the unit FedRAMP used in its pilot phase for validating security decisions by automation, so read the current indicator list before you design reporting.
What should you not claim?
Never describe a service as FedRAMP authorized, certified or "compliant" unless the Marketplace lists it with that status. Architecture work toward a target is not a status. Sales material that blurs this is a common and avoidable mistake. The Marketplace is the source of truth.
How should a CTO think about the build cost?
The expense is less the assessment than the operating model. FedRAMP's principles favor continuous, automated evidence, which means someone must own the pipeline that produces it and the response when it shows a problem. Budget for that ongoing work, not only a one-time project. Also budget for a separate or well-bounded environment, since the authorization boundary covers every component that handles federal data.
Consider whether your first target should be a lower class that proves the process and opens agency conversations. The program says Classes A to C are available now, so a staged approach is possible. Confirm with the program office and an assessor which class an agency sponsor would accept for your use case.
How to check or apply this
- Identify the agency use case and data types, and estimate the impact if the service were compromised.
- Read the current 20x class descriptions and choose the likely class with your assessor.
- Find or secure agency interest early; discuss sponsorship requirements with the program.
- Draw the authorization boundary: services, regions, subprocessors.
- Build automated reporting for inventory, vulnerabilities, configuration and access.
- Review your cryptographic module use against current program updates.
- Align public wording with Marketplace status and have counsel review it.
Safeguard's dependency inventory, vulnerability data and compliance automation can feed continuous evidence. We make no FedRAMP authorization claim.
Quick check
Is FedRAMP 20x finished?
No. FedRAMP says it is in Phase 3, with Classes A to C available and Class D planned for Phase 4. Dates are estimates.
Can we say we are FedRAMP ready?
Only if you can define precisely what you mean and it matches a status the program recognizes. Use plain, accurate wording.
Sources
Last reviewed: 18 October 2026.
