FedRAMP 20x Class A Is Open — Is Your Company Ready?
#fedramp#compliance#saas#readiness
By Philip Luca — Founder of GovExpress; prior domain experience at Bloomberg Government and GovWin IQ.
Note on terms: The Consolidated Rules retired “Authorized” as the status term: the status a cloud service holds is now FedRAMP Certified. Where this post says “authorization” generically, read “certification”.
On August 3, 2026 the FedRAMP 20x Class A pipeline opened — the first submission window of the modernized program. Class B and C pipelines followed on August 31. For a software company that has never sold to the federal government, this is the clearest on-ramp in years, and it is open now.
If you hold a SOC 2 report and have wondered whether the federal market is reachable, it is. But “reachable” is not the same as “ready.”
This piece is about readiness. For the mechanics of the pipeline itself — who qualifies, the seven required KSIs, the SOC 2 fast path, and the two-year clock — see our primary-source explainer, FedRAMP 20x Class A Pipeline: What Opens August 3 and Who Qualifies.
Ready is not a checkbox
Here is the trap most ISVs walk into: they treat compliance as a set of self-attested boxes. We have SOC 2. We say we encrypt at rest. We assert least-privilege access. Every one of those is a claim the vendor makes about itself.
Self-attested compliance is not verified compliance. A federal buyer — and the prime contractor evaluating you as a subcontractor — knows the difference, and the entire acquisition process is built to find it. The gap between “we attest” and “an independent party verified” is exactly where deals stall in due diligence.
FedRAMP 20x raises the bar in the other direction, too: the program is moving toward machine-readable, continuously-evidenced authorization rather than a once-a-year document review. Readiness is now something you demonstrate with evidence, not something you assert in a slide.
What “ready” actually looks like
Before you spend a quarter on an authorization effort, you should be able to answer three questions with evidence, not optimism:
- Where do you actually stand? Not a vibe — a score. GovExpress produces a 100-point Federal Readiness Score across the 12 categories a federal buyer weighs (registration and identity, compliance posture, market fit, competitive position, financial readiness, past performance and more), read as one of five tiers from Not Federal Ready to Federal Established. The methodology lists them all.
- What is verified vs. merely attested? The GovExpress compliance overlay distinguishes verified FedRAMP / CMMC / SOC 2 status from self-reported status on every vendor you search in the app, with the source and observation date behind each verified mark, and “Insufficient data” rather than a guess when a public source is down. You see your posture the way a contracting officer would.
- What are the next five moves? A readiness report is only useful if it ends in an action plan — the specific, sequenced steps that move your score before you submit, not a 40-page audit you file and forget.
The compliance calendar you can’t ignore
The FedRAMP window does not stand alone. Three adjacent facts are load-bearing and frequently reported wrong:
| Obligation | Status in 2026 |
|---|---|
| CMMC Phase I | In force. If you touch Department of War (DoW) work, the baseline obligations have not gone away. |
| CMMC Phase II | Suspended — not cancelled (memo 26-P-1023, announced July 13, 2026). Suspended means paused, not repealed. |
| DFARS 252.204-7012 | In force. The safeguarding and incident-reporting clause is still a contractual reality for Department of War (DoW) work. |
Getting this distinction right is itself a signal: it tells a federal buyer you understand the environment you’re asking to sell into.
Readiness comes before the submission
The pipeline is open, so the date that matters now is the day you submit — and readiness is not an overnight exercise. The companies that do well in FedRAMP 20x are not the ones that start their readiness work the day they file — they are the ones who walk in already knowing their score, already knowing what’s verified, and already holding a 90-day plan.
Find out where you stand before you submit, not after. You can see how the Federal Readiness Score is built, or start with the product.
Related reading
Frequently Asked Questions
Is self-attested compliance the same as verified compliance?
No. Self-attestation means the vendor formally attests to its own posture — someone put their name on it, but the examiner is still the vendor. Verified means an independent third party with no stake in the outcome examined the evidence and issued a result a federal evaluator can check. Federal acquisition is explicitly built to find the gap between the two.
When did the FedRAMP 20x Class B and Class C pipelines open?
August 31, 2026. The Class A submission pipeline opened first, on August 3, 2026.
Has CMMC Phase II been cancelled?
No — it is suspended, which is not the same thing. Memo 26-P-1023, announced July 13, 2026, suspended Phase II. Suspended means paused, not repealed, and planning as though Phase II is gone is a mistake. CMMC Phase I remains in force, as does DFARS 252.204-7012.
The CMMC brief
What the Phase 2 suspension changed and what it did not — the obligations that still bind, the assessment path a contract puts you on, the scoping decision that drives the cost, and the sequence that fits inside a pipeline. Sourced from the primary record.