The Federal Risk and Authorization Management Program issued its first full 20x Class C certification on October 29 to an unnamed cloud product. This certification meets all requirements in the Consolidated Rules for 2026, marking a shift from narrative documentation to outcome-based security assessments. The program aims to align with Office of Management and Budget goals for shared infrastructure by allowing providers to measure commercial environments against common security outcomes. Agencies like the Department of Veterans Affairs are beginning to reference these indicators in procurement processes. FedRAMP plans to expand the 20x model to more industries and providers, with the legacy Rev5 agency path set to phase out in June 2027.
Read the full story at executivegov.com.
Photo: LoboStudioHamburg / Pixabay