Key Takeaways:
- FedRAMP Ready and the Readiness Assessment Report retired on July 28, 2026. FedRAMP 20x Class A Certification is now the standard starting point for first-time federal vendors.
- Class A Certification assumes an existing SOC 2 Type 2 examination and mature security program, and an independent annual assessment is optional rather than required at this class.
- FedRAMP replaced “3PAO” with “Assessor” and the System Security Plan with the Security Decision Record, so older collateral using the previous terms is out of date.
- The Consolidated Rules for 2026 become mandatory January 1, 2027, and new Rev5 certifications stop being accepted June 11, 2027.
FedRAMP has officially retired the Readiness Assessment Report process. Cloud service providers now start their federal journey with FedRAMP 20x Class A Certification, a path built specifically for commercial software companies rather than large systems integrators. For a mid-market SaaS company weighing FedRAMP consulting services, understanding what changed matters before comparing providers. Here are seven facts to know:
- FedRAMP Ready Is Retired
FedRAMP stopped accepting FedRAMP Ready submissions on July 28, 2026. Providers pursuing federal authorization for the first time now start with FedRAMP 20x Class A Certification instead, which opened for applications on August 3, 2026. Any FedRAMP consulting services provider still pitching a Readiness Assessment Report as the entry point is working from outdated guidance.
- Class A Is Built for Companies with an Existing SOC 2 Type 2 Examination
FedRAMP designed Class A Certification for existing commercial products that already carry a SOC 2 Type 2 examination and a mature security program. The certification path assumes you’ve already invested in independent security assurance and builds on it, rather than asking you to start from zero.
- Certification Classes are Designated A Through D, but Higher Isn’t Automatically Better
FedRAMP now organizes assurance into four Certification Classes, A through D, with assurance increasing at each step. FedRAMP’s own guidance recommends starting at Class A unless a specific agency contract already requires more. Skipping ahead to Class C or D without an active agency relationship generally isn’t a good use of a growth-stage SaaS company’s budget.
- An Independent Annual Assessment Is Optional at Class A
Class A providers may complete a persistent independent verification and validation assessment through a FedRAMP-recognized assessment service, but it isn’t required the way it is for Class B, C, and D. Instead, a Class A provider works within the rules of its underlying alternative security framework, meaning the SOC 2 Type 2 examination carries weight in the certification itself. However, providers must stay current with their underlying framework’s own cycle (i.e., in this case, the existing SOC 2 Type 2 renewal) to fully satisfy the ongoing independent verification requirement.
- FedRAMP Stopped Using the Term “3PAO”
FedRAMP now calls independent assessors simply “Assessors,” moving away from the historical “Third-Party Assessment Organization (3PAO)” label. The change addresses market confusion around firms that provide both advisory and assessment services to different clients, who were all being called 3PAOs, blurring where one role ended, and the other began.
- The System Security Plan Has a New Name and a New Shape
FedRAMP 20x replaces the traditional System Security Plan with the Security Decision Record, a persistently maintained account of the security decisions a provider makes over the life of a cloud offering. It documents implementation rationale, resulting risk, assessment findings, and supporting evidence, and is designed to be measured against outcomes rather than static documentation.
- Mandatory Adoption Lands January 1, 2027
The Consolidated Rules for 2026 become mandatory for all stakeholders on January 1, 2027, and FedRAMP stops accepting new Rev5 certifications entirely on June 11, 2027. A mid-market SaaS company currently weighing its options should plan around the Class A path rather than treating the old process as a fallback.
WHAT THIS MEANS FOR YOUR PROVIDER SHORTLIST
A software company evaluating FedRAMP consulting services should ask directly whether a prospective advisor understands the 2026 rules, not the retired Readiness Assessment process. Review FedRAMP’s own Choosing a Certification Class guidance for the full decision framework.
