FedRAMP 20x: How Many Products Have Been Certified Through It

38 of the 557 certified products on the FedRAMP Marketplace came through 20x, as of 12 November 2026. Class A holds 11 of them, Class B 12 and Class C 15, and no product holds Class D through 20x because FedRAMP has not opened it. A further 98 20x products are listed in Initial Implementation with no class yet. The other 519 certified products went through Rev5, the older route. The impact levels and classes guide covers the class labels and the full Marketplace count.

The share is rising. Of the 47 certifications dated since the 2026 rules took effect on July 4, 12 were 20x and 35 were Rev5.

How many products have certified through 20x

The Marketplace labels each product with a certification type. 20x Pilot marks the products certified in FedRAMP’s 2025 and 2026 pilots, and 20x marks those certified under the final 2026 rules. Together they make up 136 of the 792 listings: 38 certified and 98 not yet.

Certification type	Class A	Class B	Class C	Class D	Certified
20x Pilot	0	12	14	0	26
20x	11	0	1	0	12
Rev5	0	53	367	99	519
All certified	11	65	382	99	557

Every one of the 38 went through the FedRAMP program route. Of the 519 Rev5 products, 461 went through an agency, 52 through the Joint Authorization Board and 6 through the program route. FedRAMP says 20x certifications are processed directly by FedRAMP and need no agency contract or sponsor.

The pilot produced Class B and Class C certifications only, and the 2026 rules produced eleven Class A certifications in about ten weeks. The first Class A certification is dated 25 August 2026.

20x against Rev5 month by month

Rev5 certifications have run at 4 to 10 a month through 2026. 20x certifications ran at 1 to 4 a month, had none in July and have returned at 2 to 4 a month since August.

Month in 2026	Rev5	20x (pilot and final)
January	7	2
February	8	2
March	8	3
April	8	4
May	7	4
June	8	1
July	4	0
August	7	2
September	10	2
October	10	4
November, to the 12th	4	4
Total	81	28

Since 1 August, 12 of the 43 certifications were 20x, which is 28%.

Who holds each class

Class A went to 11 products, among them Bland AI, Files.com, ElevenLabs, Harness, JupiterOne and Cursor. Class B and Class C came from the pilots. Phase 1 was open to the public, and Phase 2 was limited to providers that passed Phase 1, to AI-prioritized offerings and to critical-need services such as trust centers and GRC tools. Ten of the 38 certified products carry the Artificial Intelligence category on the Marketplace, against 10 of the 519 Rev5 products.

GRC tools are overrepresented too. FedRAMP’s own Phase 1 lesson says program authorization without an agency sponsor opened the door to GRC tools, the largest submission category. In the data, 33 of the 136 20x listings carry the Governance, Risk, and Compliance category, 24%, against 66 of all 792 listings, 8%.

Three of the compliance platforms rated on this site hold 20x certifications. Vanta holds two: Class B for its Trust Management Platform, certified 25 July 2025, and Class C for Vanta Government Cloud, certified 24 April 2026. Drata holds Class B, certified 5 December 2025. Secureframe holds Class C, certified 7 August 2025. Paramify, which the Marketplace files under Governance, Risk, and Compliance, holds Class C. Sprinto, Scrut, Thoropass and OneTrust have no Marketplace listing.

The SOC 2 compliance software ranking scores the six platforms that run SOC 2 programs, and the CMMC software ranking covers the Vanta Government Cloud certification.

Independent assessors tested most of the 38. A-LIGN and Schellman account for 5 each, and Coalfire and Fortreum for 3 each. A-LIGN and Schellman are also on the SOC 2 audit firm list. 7 of the 11 Class A listings name no independent assessor, which matches the Class A rule below that an independent assessment is optional.

What Class A asks for

FedRAMP built Class A for existing commercial products that already hold a SOC 2 Type II report. Within the past 12 months the provider must have completed one of three alternatives: FedRAMP Rev5 at any historical impact level, a SOC 2 Type II examination or GovRAMP at any impact level. It supplies the full report, or the equivalent materials, with its application. A SOC 2 report is one of the three accepted ways in.

The provider then addresses seven Key Security Indicators: logging changes, restricting network traffic, reviewing all training, automating account management, adopting passwordless methods, reviewing incident response procedures and securing information. A fresh independent assessment from a FedRAMP Recognized service is optional at Class A, and the rules say a provider may supply one that is under three months old.

FedRAMP says each class brings more assurance and more commitment to agency customers. It advises most providers to start at Class A and warns against going straight to Class C or Class D without an agency contract that requires it.

What is still in the queue

98 products sit in Initial Implementation under 20x, all on the program route and none yet assigned a class. FedRAMP’s Phase 4, a pilot of 20x Class D, is estimated for the first half of fiscal 2027, and FedRAMP expects Class D to become a formal option in early 2027. It says a provider entering the federal market from zero will often reach 20x Class C and then Class D faster than it would reach Rev5 Class D.

Rev5 closes to new certifications on June 11, 2027. Until then it remains the only route for services that run their own infrastructure and for Class D, and it needs a signed agency ATO letter. The FedRAMP hub lists the rated platforms that cover the program. 33 of the 132 trust centers in the trust center study name some level of FedRAMP certification, and a Class A listing is one more line on that page.