Security Control Assessment
FedRAMP announces first full CR26-compliant 20x Class C certification
FedRAMP’s November 2 announcement reports the first full CR26-compliant 20x Class C certification, granted October 29. The milestone concerns cloud-security assessment, not an agency ATO or a contract award.
- CDG website publication
- Official source publication
- Source checked
- Official source review
- Source reviewed Nov 3, 2026
CDG news update
FedRAMP announced on November 2, 2026 that it granted the first full CR26-compliant FedRAMP 20x Class C certification on October 29. The announcement distinguishes this certification from the earlier limited pilot certifications.
FedRAMP says the 20x assessment measures security capabilities using outcome metrics supplied through Key Security Indicators. That makes the evidence behind a cloud offering’s security claims relevant to security-control-assessment work.
The program’s Marketplace guide says certification provides security materials for agencies’ own authorization decisions. FedRAMP does not grant agency Authorizations to Operate (ATOs). Teams should verify current certification status and review the offering’s scope and security information.
Contracting takeaway: for federal cloud pursuits, separate the product’s certification evidence from the customer agency’s authorization and acquisition requirements. Map proposed assessment and RMF support to the agency’s actual needs. This announcement is a program milestone, not a solicitation, contract award or invitation to subcontract.