GSA Has Advanced FedRAMP Cloud Security Rollout

The General Services Administration has moved into the third phase of its five-part program to streamline cloud authorizations.

Updated on Oct. 8, 2026 in Cybersecurity

Isometric editorial illustration of tiered geometric blocks and pillars, representing an organized federal cloud security framework. — The General Services Administration has reached the third phase of its program to modernize and streamline federal cloud security authorization standards. AI Illustration. Upload story photo >

Live Poll

Do you trust federal cloud security standards to effectively support business and innovation?

The General Services Administration (GSA) has reached the third phase of its 20x rollout program to update federal cloud security standards. The agency is currently working to reduce bureaucratic red tape and increase automation for government cloud service providers.

Why it matters

Many agencies and private companies have relied on outdated, legacy rules that created significant confusion. By formalizing these new requirements, the GSA aims to accelerate cloud service authorizations across the federal government.

The GSA is currently executing phase three of the five-phase 20x program, which supports Class A, B, and C certification types. The agency has formalized these requirements through testing with cloud service providers during the first two phases.

The players

General Services Administration

This independent agency of the United States government manages and supports the basic functioning of federal agencies.

FedRAMP

The Federal Risk and Authorization Management Program provides a standardized approach to security assessment, authorization, and continuous monitoring for cloud products.

The details

To communicate these updates, the GSA is utilizing GitHub discussion boards, a dedicated YouTube channel, and an expanded help desk. These tools are designed to clear up industry confusion and guide stakeholders through the shift away from legacy Rev5 offerings.

October 8, 2026: The FedRAMP Security Director discussed the new 20x rules at a public forum.

The Tech Race

This transition marks a departure from the legacy FedRAMP Rev5 certification standards by replacing them with the automated 20x framework. This modernization is part of a broader federal push to move away from rigid, manual compliance toward agile, cloud-native security protocols.

Private sector cloud providers can expect a more automated authorization process that reduces the time spent on manual compliance documentation. For federal IT departments, the move aims to clarify rules and allow for faster adoption of modern, secure cloud technologies.

The takeaway

The GSA's push toward automation reflects the ongoing necessity of modernizing government IT infrastructure to meet contemporary security threats. Stakeholders should prioritize transitioning their workflows to the 20x framework to ensure long-term compliance with federal cloud standards.

What happens next

Phase four of the 20x rollout will introduce pilot programs for Class D certifications, while phase five will formally discontinue new certifications for legacy Rev5 offerings.