FedRAMP 20x, CR26, Classes A–D: get the plain-English guide.

Download for free

Free guide · Second Front Special Edition

GET FLUENT in FedRAMP 20x, FAST.

Get your free copy

We use your details to send the book and occasional related updates from Second Front. Unsubscribe any time.

Trusted by teams shipping to government

Cohere
Ultra
Onebrief
VIA
DailyPay
Epoch
Armada

// What's changing in FedRAMP 20x

New rules.
New vocabulary.
All piling up.

CR26 and 20x brought a new rulebook, Certification Classes, a path that can skip the agency sponsor, and a long list of new terms.
This is what catching up on all of it at once feels like.

New terms0
Retired terms0
Guides that sort it out1

In effect · Live now

July 4, 2026

CR26 in effect.

Mandatory

January 1, 2027

CR26 becomes mandatory.

Window closes

June 11, 2027

No new Rev5 applications accepted.

Make sense of the pile.

Download for free

// A CHAPTER FOR EVERYONE

The new FedRAMP, made simple

leadership and product

Pick the right class and path

Learn how FedRAMP's Certification Classes and paths work, and how to match them to  your target agencies so you invest at the right level.

federal sales

Skip the sponsor search

See how the new Program Certification path works for Classes A–C, and when an agency sponsor still makes sense.

engineering & security

Understand the new evidence model

Get up to speed on the Security Decision Record, Key Security Indicators, and machine-readable evidence, and learn how automation keeps your Certification current long after day one.

everyone

Ten ways to win at FedRAMP

Practical advice on classifying your data, drawing your boundary, inheriting controls, and preparing for assessment, with a few movie lines along the way.

// From the guide

If Goldilocks were on your development team, she’d tell you to draw those boundaries ‘just right.’

Too big and you create extra work by drawing unnecessary components into scope.

Too small and you may leave out components that really do affect security.

Chapter 2

Evolving the FedRAMP System

// The faster path: inheritance

Inherit the hard parts

FedRAMP lets cloud providers inherit security controls from a certified underlying platform. Second Front and its Game Warden platform handle much of the foundational work, so your team can focus on your application.

Three paths to FedRAMP. One platform to get there.

01 · As little as 90 days

2F Boundary

Deploy under Second Front's existing FedRAMP Certification in as little as 90 days. No agency sponsor required.

02 · Your listing

Own

Build and maintain your own FedRAMP listing with Second Front's platform and team behind you.

03 · On your terms

Equivalency

Validate FedRAMP security equivalency without a full Certification, on your terms.

// FAQ

FedRAMP 20x FAQ

FedRAMP 20x is FedRAMP's newer approach to Certification. It focuses on security outcomes, machine-readable evidence, and automated, ongoing validation rather than static documents. It's open now for Classes A–C, and Class D is expected next.

Spotted in: Chapters 2 & 4

It's the same milestone under a new name. CR26 changed “authorization” to “Certification,” while agencies still issue their own Authorizations to Operate (ATOs).

Spotted in: Chapter 2

CR26, the Consolidated Rules for 2026, is FedRAMP's single rulebook. It replaces years of scattered guidance and introduces the new Certification terminology and Classes A–D. It becomes mandatory on January 1, 2027.

Spotted in: Chapter 2

Yes. Under FedRAMP 20x, the Program Certification path lets Classes A-C get certified without an agency sponsor. Class D still requires one.

Another option is to deploy under the existing FedRAMP Certification held by Second Front and its Game Warden platform, which requires no agency sponsor for any Class and can take as little as 90 days.

Spotted in: Chapters 2 & 5

FedRAMP will stop accepting new Rev5 applications on June 11, 2027, and services that already hold a Rev5 Certification can expect a transition path to 20x.

Spotted in: Chapter 4

Ready to speak FedRAMP 20x?

Download for free

Wiley

Published by Wiley as part of the For Dummies series, this special edition turns FedRAMP's 2026 changes into a quick, practical read.

Second Front

Brought to you by Second Front. Built by national security veterans, Second Front helps software companies cut deployment to  government markets from years to weeks.

© 2026 Second Front Systems · For Dummies and the Wiley logo are trademarks of John Wiley & Sons, Inc.

secondfront.com