Compliance

FedRAMP 20x is easier than you think

  • FedRAMP 20x certified in as little as 30 days1
  • Mycroft’s GRC engineer guides you through the process
  • Much less expensive and time consuming than the old Rev5 process
Book a demo
Watch the webinar
Trusted by
  • Wisedocs
  • Casco
  • Sixtyfour

What changes after one call

FedRAMP 20x is open now, needs no agency sponsor, and replaces the multi-year, multi-million dollar Rev5 process, which closes on June 11, 2027. Mycroft makes it straightforward.
Your deal moves before you are certified
Agencies know certification takes time. A Marketplace listing, a proven partner and firm dates keep the deal moving while you finish. The same certification opens doors with defense primes and other companies that only buy from certified vendors.
A plan with dates, not a maze
20x replaces 300+ control narratives with 46 measurable indicators. If you already hold SOC 2, Class A builds on it. We tell you which class you need, what it asks of you personally, and when each step lands, before you sign anything.
An expert in your corner, not a dashboard
We write the records, talk to the assessor and run the program with you. Mycroft is itself FedRAMP 20x Certified, so we went through this process on our own platform.

The full certification package you need

Every deliverable FedRAMP 20x asks for, prepared by Mycroft and kept current after you are certified.

  • Security Decision Record (SDR)
  • Vulnerability Evaluation & Reporting (VER)
  • Vulnerability Detection & Response (VDR)
  • Automatic evidence collection and validation
  • Ongoing Certification Report (OCR)
  • FedRAMP-compliant Trust Center
Features

What the work looks like with Mycroft

One team and one platform from SOC 2 to Class A to Class D. You never bring in a second vendor, and you never explain your business twice.

Your engineers fix what matters, not everything, every week

20x asks for fast remediation, and without severity triage that means your engineers patch every finding on a weekly treadmill. Mycroft rates each finding against FedRAMP’s own deadlines, tracks it from detection to the monthly report, and detects when the fix has landed, so your team works the short list, not the whole scanner output.

Agencies can see you are serious before the checkmark

FedRAMP requires your certification data to live in a trust center that agencies and their systems can read. Mycroft publishes your package and reports there and keeps them current, so a procurement officer can check your status without emailing you, and your sales team has something to point at today.

Nobody on your team writes a 300-page security plan

For Class B, C and D, the Security Decision Record replaces the System Security Plan. Mycroft builds it from your live controls and evidence, in the human-readable and JSON formats FedRAMP expects, and keeps it current as your decisions change. You review it. You do not author it.

Evidence builds itself from day one

Class C wants at least two automated checks behind every indicator, with six months of history once you are operating. Mycroft collects that evidence continuously from your cloud, code and identity systems, so nobody spends the week before an assessment pulling screenshots.

Nothing in scope slips through

The fastest way to fail a check is an asset nobody knew was in scope. Mycroft keeps your inventory current automatically, so every check covers all of it and you are never surprised by the assessor.

Your vendors stop being your blind spot

FedRAMP expects you to know every third-party service inside your boundary and to keep watching its risk. Track those vendors, their assessments and their access to federal data in one place, with SBOM tracking for the components inside your own software, so a supplier’s problem never becomes your finding.

Mycroft keeps you certified, quarter after quarter

Certification is the start, not the finish. 20x asks for a report every quarter and vulnerability activity every month. We keep all of it on schedule so it never lands on your desk at 11pm.
Quarterly report, assembled for you
The Ongoing Certification Report your agencies expect every three months, built from live data
Monthly vulnerability reporting
Detection, evaluation and reporting on FedRAMP’s clock, without a spreadsheet
Quarterly reviews, planned with you
We prepare the agenda and the numbers before you sit down with an agency
Annual assessment, no scramble
Evidence is already collected, so the yearly assessment is a review, not a rebuild
SOC 2 and FedRAMP, done once
Controls are cross-mapped, so the work you did for SOC 2 counts here too
Records kept current
Your Security Decision Record and machine-readable documents update as your system changes
Identity monitoring
Missing MFA and leftover accounts caught before an assessor finds them
Agency API access
Agency systems read your certification data directly from your trust center
Audit trail on every download
Every grant, NDA and download on the Trust Center is logged for you
Training that runs itself
FedRAMP-specific security training with on-hire and annual refreshers tracked for you
Client Testimonial
“
We would not be at this milestone without Mycroft. Huge shout out to Mike, Jon, Jan, and the entire Mycroft team for helping us get here and for staying with us for the much harder work ahead. Today, Casco is FedRAMP listed and we are heads-down focused on FedRAMP 20x Class C.”
Rene Brandel
Founder & CEO of Casco
Client Testimonial
“
Having Mycroft as our security partner has positioned us to be more competitive in the market. With their help, Wisedocs has been able to create a best-in-class security posture that customers can feel confident about.”
Jenna Earnshaw
COO of Wisedocs

Unlock other frameworks

Already have SOC 2? You are closer than you think. The same team and platform run your SOC 2, ISO 27001, ISO 42001 and FedRAMP programs, cross-mapped so nothing is done twice.
CMMC →
ISO 27001 →
SOC 2 →
ISO 42001 →

Frequently asked questions

The questions people ask us on the first call
No. Most of the people who call us have not heard of it either. FedRAMP 20x is the modernized path to FedRAMP Certification, announced by the GSA in March 2025 and now part of the FedRAMP Consolidated Rules for 2026. Instead of writing narratives for hundreds of NIST SP 800-53 controls, you demonstrate 46 Key Security Indicators (KSIs) with machine-readable evidence, validated by automation wherever possible. Being early to it is an advantage, not a gap.
Less than you are bracing for, and we tell you the real number on the first call rather than a comfortable one. Our team runs the program: we map the indicators to what you already do, collect the evidence automatically, write the records and talk to the assessor. Your time goes into decisions only you can make, such as what is in scope and which fixes to prioritize, not into documentation.
Often, yes. Agencies know certification takes months. What they look for is whether you are listed on the FedRAMP Marketplace, who you are partnered with, and whether you have committed to dates. Being able to show an active program with a named team behind it is frequently enough to keep the deal moving while you finish.
No. FedRAMP 20x dropped the sponsor requirement. You can get certified and listed on the FedRAMP Marketplace before any agency has signed with you, which is how you start without a federal customer in hand.
No. Defense primes, FedRAMP-certified companies and contractors working toward CMMC are required to buy from certified vendors, so FedRAMP opens commercial doors as well as federal ones. One certification, two markets.
No. Rev5 meant a System Security Plan covering 300+ controls, an annual assessment and monthly continuous monitoring deliverables, and it typically took a year or more.
20x replaces that with 46 KSIs grouped into ten themes, evidence collected continuously by automation, a human-readable Ongoing Certification Report every three months and, for Class B and C, a yearly independent assessment. The pilot cohorts moved through review in weeks rather than months. Both paths end in the same status, FedRAMP Certified, and Rev5 stops accepting new applications on June 11, 2027.
Not if findings are triaged. 20x expects fast remediation, and the teams that struggle are the ones fixing every scanner result every week. Mycroft rates each finding by how much it could affect agencies, tracks it against FedRAMP’s deadlines, detects when the fix has landed and publishes the result to your trust center. Your engineers work a short, ranked list, and the assessor sees the proof without asking.
For Class A, less than you might expect. A SOC 2 Type II from the past 12 months is the foundation. On top of it you address seven Key Security Indicators and a small set of FedRAMP rules, including incident reporting and a quarterly report. Class B and C ask for more: all 46 KSIs and an independent assessment, and for Class C at least two automated validation methods per KSI. With Mycroft, the path from SOC 2 to Class A to Class D runs on the same platform with the same team, and the controls are cross-mapped so the SOC 2 work counts.
The work continues, which is where most of the effort in 20x sits and where people without a partner start to feel alone. You supply an Ongoing Certification Report every three months, report vulnerability activity every month, notify agencies of significant changes and keep the machine-readable certification data in your trust center current. Class C providers must also host a quarterly review with agencies (Class B providers should), and Class B and C repeat the independent assessment every year. Mycroft keeps each of these on schedule, so none of it becomes your late night.
The 2026 rules replace Low, Moderate and High with four classes, and which one you need depends on the data your federal customer will put in your service. We work that out with you on the first call.
Class A is the entry point, built on a SOC 2 Type II, GovRAMP or Legacy FedRAMP Ready assessment from the past 12 months plus seven mandatory KSIs and a small set of FedRAMP rules, including incident reporting and a quarterly report
Class B corresponds to the former Low baseline
Class C corresponds to the former Moderate baseline and requires at least two automated validation methods per KSI
Class D corresponds to the former High baseline. FedRAMP is piloting 20x Class D in late 2026 and plans to offer it formally in early 2027. Mycroft supports Class D on 20x today
Yes for Class B and C (the 2026 rules now say “FedRAMP Recognized assessor” rather than 3PAO). You must submit an independent assessment completed within three months of applying, and repeat it at least once a year covering all KSIs. For Class A, an extra FedRAMP assessment is optional, but you must keep up the assessment your underlying SOC 2 or GovRAMP framework requires. Assessors under 20x spend their time validating automated evidence rather than reading documents, and we handle that conversation with them for you.
FedRAMP 20x replaces the System Security Plan with a set of records you keep current. Mycroft prepares each of these and keeps them up to date; you review and approve. For Class B, C and D:
Security Decision Record (SDR): how you follow each applicable FedRAMP rule, with verification, validation and independent assessment results, in human-readable and JSON formats
Ongoing Certification Report (OCR): a summary for agencies every three months covering changes, accepted vulnerabilities, incidents and the agencies using your service
Vulnerability reports: activity under the Vulnerability Detection and Response (VDR) and Vulnerability Evaluation and Reporting (VER) rules, reported at least monthly
Certification package: an overview of your service, your SDR and a real or sample OCR, submitted when you apply, with machine-readable data in JSON that matches FedRAMP’s schemas
Class A needs less: it builds on your SOC 2 Type II or GovRAMP assessment, plus the certification package and a quarterly report.
The Consolidated Rules for 2026 launched in June 2026, with optional adoption from July 4, 2026
The Class A pipeline opened August 3, 2026 and the Class B and C pipelines opened August 31, 2026
The 2026 rules become mandatory for everyone on January 1, 2027
FedRAMP stops accepting new Rev5 applications on June 11, 2027
All grace periods end on February 1, 2028, and offerings not fully following the 2026 rules lose their certification

We turn the compliance nightmare into a dream

Talk to us

1The 30-day timeline applies to FedRAMP 20x Class A, measured from kickoff to a submitted certification package. It assumes a SOC 2 Type II or GovRAMP report from the past 12 months, a service running on a major cloud platform, and your systems connected to Mycroft in the first week. Class B, C and D require an independent assessment and a period of collected evidence, so they take longer.