FedRAMP announces first full CR26-compliant 20x Class C certification
FedRAMP’s November 2 announcement reports the first full CR26-compliant 20x Class C certification, granted October 29. The milestone concerns cloud-security assessment, not an agency ATO or a contract award.
Source: Cyber Defense Group. Original reporting and dates are preserved.
NERSC server racks, October 14, 2011. Archival illustrative infrastructure, not the certified cloud service or a FedRAMP facility. No endorsement implied.
Derrick Coetzee / Wikimedia Commons · CC0 1.0 Universal Public Domain Dedication · LicenseThe photograph above has its own source and credit. Image references in the original reporting below may describe a different image on the source publication.
Cyber Defense Group update
FedRAMP announced on November 2, 2026 that it granted the first full CR26-compliant FedRAMP 20x Class C certification on October 29. The announcement distinguishes this certification from the earlier limited pilot certifications.
FedRAMP says the 20x assessment measures security capabilities using outcome metrics supplied through Key Security Indicators. That makes the evidence behind a cloud offering’s security claims relevant to security-control-assessment work.
The program’s Marketplace guide says certification provides security materials for agencies’ own authorization decisions. FedRAMP does not grant agency Authorizations to Operate (ATOs). Teams should verify current certification status and review the offering’s scope and security information.
Contracting takeaway: for federal cloud pursuits, separate the product’s certification evidence from the customer agency’s authorization and acquisition requirements. Map proposed assessment and RMF support to the agency’s actual needs. This announcement is a program milestone, not a solicitation, contract award or invitation to subcontract.
Sources and references
Source publication notes
FedRAMP certification is distinct from an agency Authorization to Operate; FedRAMP does not grant ATOs.
The announcement does not name the cloud offering. No provider, contract value or government endorsement is inferred.
Archival NERSC photograph from October 14, 2011 is illustrative infrastructure, not the certified service or a FedRAMP facility.
Educational information, not legal advice. Current official program guidance and the instructions for your application control. Registration, certification, or consulting does not guarantee an award.