A FedRAMP project can begin with the wrong question: “Which route is cheaper?” Before comparing proposals, establish what your agency customer needs, what your service already has, and which route is actually available. The result should be a short decision record that sales, engineering and compliance can all use.
Open the FedRAMP 20x vs Rev5 working record to document this decision with evidence and an accountable owner.
This article focuses on route selection and transition planning. For the separate question of assessment fees, internal labor and ongoing expenses, use our FedRAMP cost planning guide.
Table of Contents
In this guide
FedRAMP 20x vs Rev5: Separate Four Decisions
On small screens, swipe within a table to read the remaining columns.
| Decision | Question to resolve |
|---|---|
| Certification type | Is this a 20x project or a Rev5 project? |
| Certification class | Which assurance commitment fits the intended agency use? |
| Certification path | Does the project proceed through Program or Agency Certification? |
| Applicable dates | Are you obtaining a new certification or maintaining an active one? |
Do not use these terms interchangeably in a request for proposals. A vendor offering a “FedRAMP package” should be able to identify all four. If two proposals assume different types or boundaries, their headline prices are not directly comparable.
FedRAMP 20x vs Rev5: Start With Your Situation
The official certification path guidance distinguishes Program Certification, provided directly by FedRAMP, from Agency Certification, which uses an agency authorization and sponsorship relationship. Your existing circumstances constrain the path.
| Your situation | Starting position | Next check |
|---|---|---|
| Pursuing 20x | Program Certification | Confirm the applicable class and package requirements. |
| Rev5 project with an agency sponsor | Agency Certification is generally the relevant route. | Reconcile the current engagement with the agency and transition rules. |
| Lost Sponsor or Ready Conversion candidate | A limited Rev5 Program route may apply. | Ask FedRAMP to confirm eligibility before submission. |
| Already certified | Begin with maintenance obligations. | Map the applicable ruleset dates before proposing a new project. |
The limited Rev5 routes are not a general sponsor-free alternative for every applicant. FedRAMP describes historical qualifying circumstances and requires eligibility confirmation. Keep the supporting records and use the official process rather than assuming that an old assessment automatically qualifies.
Choose the Class Against a Real Agency Use Case
FedRAMP’s class selection guidance describes progressive investment. It generally points established commercial providers entering the federal market toward Class A, while providers with existing agency needs should select a starting class that meets those requirements and their business circumstances.
Do not translate Low, Moderate and High into a rigid one-to-one class equivalence. The official guidance explains that alignment depends on the agency use case. Obtain the customer’s requirement and record how the proposed service supports it.
Editorial recommendation: Write the intended use in plain language before collecting vendor quotes. Include the buyer, service, deployment boundary, expected information and unresolved questions. A class label without this context leaves room for expensive misunderstandings.
Have SOC 2 Type II? Check What It Can Support
The official Class A external-framework FAQ lists eligible assessments completed within the preceding twelve months, including SOC 2 Type II, GovRAMP and specified Rev5 materials. A SOC 2 Type I report is not the Type II report named in that list.
For a SOC 2 Type II submission, the FAQ calls for the complete report, applicable bridge or gap letters, verified audit-engagement documentation, the expected next-report schedule and supplemental evidence where applicable. Having a report is an input to the process, not automatic FedRAMP certification.
Check the Package, Not Just the Report Cover
The Class A package FAQ identifies additional materials, including the Certification Package Overview, Security Decision Record and applicable sample schemas. It also distinguishes required, recommended and optional elements. Use that current list as the package inventory rather than treating this article as a submission specification.
Before commissioning more work, assign someone to review the service scope and dates of each existing artifact. Mark missing items explicitly. “Available somewhere in the audit folder” is not a useful status when a reviewer needs a particular document.
FedRAMP 20x vs Rev5 Deadlines for 2026–2027
The official timeline records the following milestones. These are program dates, not promises that your application will be completed by a particular day.
| Date | Milestone |
|---|---|
| July 28, 2026 | FedRAMP stopped accepting new FedRAMP Ready submissions. |
| August 3, 2026 | The 20x Class A application pipeline opened. |
| August 31, 2026 | The 20x Class B and C pipelines opened. |
| January 1, 2027 | Broad mandatory adoption milestone, subject to specific applicability and effective dates. |
| June 11, 2027 | FedRAMP will stop accepting new Rev5 certification applications. |
January 1 Is Not a Universal Certification Expiry Date
The more detailed provider deadline guidance distinguishes new applications from active certifications. New 20x applications have had to follow applicable Consolidated Rules since July 4, 2026. New Rev5 applications must do so from January 1, 2027; active 20x offerings must follow applicable rules by that date or face corrective action.
For an existing offering, inspect each ruleset’s obtain, maintain and grace-period dates. The same guidance gives February 1, 2028 as the end of all Consolidated Rules for 2026 grace periods. That outer limit does not override an earlier applicable deadline. Likewise, the June 2027 end of new Rev5 applications does not say every existing Rev5 certification expires that day.
Maintain a date register with a rule link, applicability decision, evidence owner and completion target. If a supplier gives you a single migration date, ask which ruleset and provider status it refers to.
FedRAMP 20x vs Rev5: Your Seven-Field Decision Record
The following worksheet is an editorial planning aid, not an official FedRAMP form. Copy it into your project notes and fill the evidence column before approving a statement of work.
| Decision field | Evidence to attach | Suggested owner |
|---|---|---|
| Agency use and required assurance | Buyer correspondence and unresolved acceptance questions | Account lead and compliance |
| Exact service boundary | Architecture, dependencies and deployment description | Engineering |
| Type, class and path | Applicable official guidance and documented rationale | Compliance |
| Current project or certification status | Existing engagement and status records | Program owner |
| Reusable assessment materials | Complete artifacts, dates and scope differences | Assurance lead |
| Applicable transition dates | Ruleset register and individual milestones | Program owner |
| Purchased work | Deliverables, exclusions and acceptance criteria | Procurement and technical owner |
A useful decision record can include an unresolved answer. Name the question, the person who can resolve it and the next evidence needed. Do not silently turn a sales assumption into an engineering requirement.
1. Agency use: write down the acceptance question
Ask the account owner to distinguish an exploratory conversation from a documented customer requirement. Keep the buyer’s wording and date alongside the internal interpretation. If the requirement merely says “FedRAMP,” list what is still unknown: the service, proposed use, assurance expectation and decision maker. Treat this as a request for clarification rather than permission to select the most convenient route. A forecasted deal and an accepted requirement are different planning inputs.
2. Service boundary: describe what the proposal covers
Use one named offering and a dated architecture description. Record relevant deployments, dependencies, integrations and operational responsibilities. Ask engineering to flag unresolved boundary questions before procurement requests a fixed price. A quote for one deployment should not silently become the budget for several products or regions. When the architecture changes, update the decision record and ask which assessment assumptions need to change with it.
3. Type, class and path: document the reasoning
Write one sentence for each choice, together with the official page and the question it answers. Avoid a single spreadsheet cell that mixes all three labels. If two advisers propose different approaches, compare their assumed customer requirement and existing project status before comparing their fees. An unexplained disagreement is a useful review item. Resolve it through the appropriate program or agency owner rather than averaging incompatible recommendations.
4. Current status: preserve the starting evidence
Identify which service and project each status record belongs to, and when it was last checked. Keep relevant correspondence and engagement records in a controlled location. Label uncertain or historical information clearly. A sales presentation, an earlier assessment and a currently accepted program status should not be filed under one undifferentiated “complete” heading. Ask the program owner to resolve a mismatch before someone commits to a transition schedule.
5. Reusable evidence: compare scope and dates
Build an artifact inventory that identifies the document, service scope, relevant period, owner and access location. Record differences between the assessed service and the offering now proposed. Do not mark a control as verified merely because a document has a familiar title. A reviewer should be able to find the relevant evidence and understand what it supports. Keep confidential assessment materials in appropriate access-controlled channels rather than public project notes.
6. Transition dates: assign a rule and an owner
For each milestone, record the linked rule, the applicability question, the responsible person and the evidence expected at completion. Add a review date for unresolved interpretations. This produces a more useful schedule than a generic “migrate by January” task. Keep program deadlines separate from the team’s internal targets, supplier lead times and customer commitments. An internal target is a management decision; it is not a replacement for an applicable external deadline.
7. Purchased work: define the handoff
Ask what the provider will deliver, what your staff must supply, who reviews the result and how scope changes are handled. Separate advice, implementation, evidence preparation and independent assessment in the proposal. Identify retesting and recurring work explicitly. A deliverable named “readiness complete” should have an agreed acceptance description. This is a procurement recommendation, not a claim that a particular wording guarantees certification or removes your operational responsibilities.
FedRAMP 20x vs Rev5: Two Planning Examples
Illustrative example A: A SaaS company has commercial assurance materials and an interested federal buyer, but no precise customer requirement. Its first action is to clarify the intended use and accepted assurance, then check the relevant entry requirements. Asking three vendors for an identical “full certification” quote would conceal the unresolved decision instead of answering it. This is a hypothetical planning example, not a report of a completed application.
Illustrative example B: An established project has assessment records and an agency relationship, but the team is considering a different type. It first inventories current commitments, reusable work and applicable transition dates. The next conversation asks what would actually change, who must confirm it and what new work is required. Neither sunk cost nor a supplier’s promise is sufficient to decide the route. Document the tradeoff and obtain the necessary confirmation.
Before Buying Readiness or Assessment Services
Send each provider the same decision record. Ask them to identify the assumed type, class, boundary, existing evidence, exclusions and handoff responsibilities. Request a written explanation of what changes if your agency requirement or project scope changes.
Keep the supplier’s deliverables distinct from your own operating responsibilities. FedRAMP’s provider responsibility guidance places responsibility for accurate materials, ongoing activities and adoption of rule changes on the provider. Paying a consultant does not transfer that accountability. An agency can also impose additional requirements for its particular use.
For budgeting, link the agreed scope to our FedRAMP assessment and operating-cost worksheet. For a proposed testing engagement, review the pentest statement-of-work checklist only for the relevant testing scope; it is not a substitute for FedRAMP certification requirements.
FedRAMP 20x vs Rev5 Planning FAQ
Who should own the decision record?
Choose one accountable program owner and ask the relevant specialists to review their fields. Sales can supply the customer context, engineering the boundary, assurance the evidence inventory, and procurement the proposed deliverables. This is a suggested division of work, not a program requirement. Record the reviewers and review date so a later reader can distinguish a checked decision from a working assumption. Ownership should include a way to escalate unresolved questions, rather than merely maintaining the document.
How should we compare conflicting provider proposals?
Put the proposals beside the same project brief and compare their assumptions one field at a time. Ask each provider to explain any different boundary, reuse assumption, deliverable or customer dependency. Do not treat a larger document count as proof of greater assurance, or a lower price as proof of efficiency. First identify whether the providers are offering equivalent work. Keep the resulting clarification with the proposal so the agreed scope remains visible after the sales conversation.
What belongs in the first internal handoff?
For a FedRAMP 20x vs Rev5 discussion, hand over the dated decision record, the architecture reference, an artifact index and a list of open questions. Include where restricted materials can be accessed through the approved channel. Describe which assumptions remain provisional and who can resolve them. The goal is to let the next owner continue the decision without reconstructing every conversation. This suggested handoff supports planning; it is not an official submission package or a substitute for one.
Can a readiness checklist guarantee approval?
No conclusion about approval follows simply from completing this editorial worksheet. Treat it as an index of decisions and supporting information, then check the actual requirements for the service and applicable process. Avoid labelling an unresolved item complete merely because a supplier has accepted the task. A useful status distinguishes a proposed action, an implemented change and reviewed evidence. Ask what the evidence establishes and what remains untested before using it to support a stronger claim.
When should the team review the plan again?
As an internal management practice, revisit the record when a material assumption changes: the customer requirement, service architecture, agency relationship, available assessment material or supplier scope. Also review the official sources before an application or contractual commitment. Keep a short change note identifying the new information and the decisions affected. A review does not need to restart the entire project, but it should reveal when a previous conclusion no longer fits the current situation. Do not overwrite that history silently.
Your Next Action: Resolve the First Missing Decision
Use this FedRAMP 20x vs Rev5 worksheet before opening another pricing tab. If the agency requirement is unclear, clarify it. If the boundary is unsettled, review the architecture. If an exception is essential, obtain eligibility confirmation. Once those questions are documented, ask for a proposal tied to that specific project.
Recheck the linked official pages before submitting an application or committing to a transition schedule. This article is a dated planning guide, not an assurance that a particular offering will qualify, finish on time or satisfy every agency requirement.
FedRAMP 20x vs Rev5: path decision handoff
Use this when: you are a SaaS team deciding which current application path fits a defined agency use case. Copy the table into your working notes and replace the prompts with a dated response. Keep unresolved items visible rather than filling them with a default assumption.
| Decision field | What to record | Your evidence / owner / next check |
|---|---|---|
| Agency use case | Name the intended agency use and the person who confirmed it. | To complete |
| Class and path | Record the proposed class, eligible path and unresolved exception. | To complete |
| Evidence reuse | Identify each existing report, its scope and the rule supporting reuse. | To complete |
| Purchased work | Separate preparation, independent assessment and continuing operations. | To complete |
How to use the result: Resolve the first unsupported path assumption before commissioning work. Mark each row confirmed, provisional or unresolved, and link the source that supports the status. Keep a reviewer and review date beside decisions that affect spending, deployment or external claims.
This is an editorial working aid. Complete it with your own scope, source documents and responsible reviewers; the completed table alone does not establish compliance or acceptance.
Worksheet change record — October 20, 2026
Added this fedramp path decision handoff with four article-specific working fields, evidence ownership and a next action. The article’s existing source notes retain their own review dates. This addition does not represent a new verification of every statement or a newly executed lab test.