The Doors Open Today: 20x Marketplace Listings, and Three Weeks to Say Goodbye to FedRAMP Ready
Back in May, when GSA confirmed 20x as the permanent authorization model, the calendar was still a promise: rules finalized "by end of June," pipelines opening "in the second half." In June we watched the program retire "Authorized" for "Certified" and sort the baselines into Certification Classes. Both posts ended with some version of "the dates will tell us if they mean it."
The dates arrived. On June 25, FedRAMP launched the Consolidated Rules for 2026 — finalized, not drafted — and published a transition ladder with specific rungs. The first one is today: July 6 is the day Marketplace listings open for cloud service providers entering the 20x initial implementation stage. As of this morning, 20x isn't a pilot you apply to or a policy you read about. It's a door you can walk through.
The ladder, in one place
Worth having the whole thing on one page, because the rungs are close together:
- June 25, 2026 — Consolidated Rules for 2026 launched. This is the rulebook everything below runs on.
- July 6, 2026 — Marketplace listings open for the initial implementation stage. CSPs can put themselves on the board today.
- July 28, 2026 — FedRAMP Ready transitions to Legacy. No new Ready submissions after this date.
- August 3, 2026 — the Class A certification pipeline opens.
- August 10, 2026 — temporary Rev5 Program Certification pipelines open, the bridge for systems mid-flight.
- August 31, 2026 — Class B and Class C pipelines open.
- January 1, 2027 — the new rules become mandatory for all stakeholders, including every existing Rev5 certification.
- June 11, 2027 — FedRAMP stops accepting new Rev5 applications entirely.
Two things about the shape of that list. First, it's front-loaded: everything that opens, opens in the next eight weeks. Second, it's symmetric — every door that opens has a corresponding door that closes, and the closings are the part we'd put on the calendar first.
July 28 is the date hiding in the middle
The rung that deserves more attention than it's getting: FedRAMP Ready goes Legacy in three weeks.
For a decade, Ready was the on-ramp — the designation that said a 3PAO has looked at this system and it's plausibly authorizable, the thing sales teams pointed at while the full authorization ground forward. Whole go-to-market plans are built around achieving Ready in a given quarter.
If that's your plan for Q3, you now have until July 28 to submit — and a decision to make about whether submitting is even the right move, given that the thing you'd earn is a Legacy label on arrival. For most teams mid-preparation, we suspect the honest answer is to stop polishing the Ready package and redirect that energy at the 20x initial implementation stage, which as of today has a live Marketplace listing attached to it. The signaling value that Ready used to provide — we're real, we're in the pipeline, agencies can start conversations — is exactly what the initial implementation listing now exists to provide, inside the model that has a future.
That's a genuinely better trade, but only if you catch it now. The worst outcome is spending July finishing a Ready submission that arrives as a museum piece.
What "initial implementation stage" actually asks
The listing that opens today isn't a certification — it's a declared position. Entering the initial implementation stage means you're publicly on the board as working toward a 20x certification under the Consolidated Rules, visible to agencies browsing the Marketplace. FedRAMP's guidance to CSPs entering it is blunt in its simplicity: start reviewing the Consolidated Rules now, and build a submission strong enough to support agency reuse.
We made the argument in our 20x prep-reality post that the honest unit of 20x preparation isn't document assembly, it's making your environment machine-assessable — Key Security Indicators you can produce as data, continuously, rather than narratives you write annually. The stage structure reinforces that reading. The gap between "listed in initial implementation" and "certified in a Class A/B/C pipeline" is exactly the gap between saying your controls hold and being able to show it on demand. The teams that treat today's listing as a marketing checkbox will rediscover that gap in August; the teams that treat it as the start of an evidence-automation build will close it.
Note the sequencing, too: Class A opens August 3, Classes B and C on August 31. If you're targeting the higher-rigor class, your pipeline opens first. The program is explicitly not making the serious cases wait behind the simple ones.
If you're already Rev5
The existing fleet doesn't get to watch from the stands. Two of the rungs are yours:
- August 10 opens temporary Rev5 Program Certification pipelines — the mechanism for systems currently mid-authorization to land somewhere stable while the ground moves.
- January 1, 2027 is when the Consolidated Rules become mandatory for everyone — including systems that already hold a Rev5 certification. FedRAMP's own recommendation is to adopt immediately rather than ride the deadline.
That January date is closer than it looks. Between now and then sits exactly one more quarter-plus-change, and the rules you'd be adopting include the vulnerability-response model we wrote about in the BOD 26-04 post — with its own December 7 effective date for the VDR rules and a March 2027 revocation grace period behind it. If your ConMon, your evidence pipeline, and your vulnerability triage are still shaped like 2024, the migration is not a Q4 side project. It's the Q3 project.
What we keep coming back to
We've been saying for a while that 20x rewards the teams who treat compliance as an engineering discipline — evidence as a byproduct of operations, controls that report their own state. What changed today is small but real: that stopped being a thesis about the future and became a listing you can hold. The program published its dates and, so far, is hitting them. The respectful response is to believe the calendar.
It's also, candidly, the bet behind the Novaprospect audit suite — tooling built for the world where the assessment artifact is a query result, not a Word document. Between today's Marketplace opening and the Class pipelines in August, the next eight weeks are the window where that world stops being optional.