Cloud companies that want to sell moderate-risk services to federal agencies now have a working example of what a full FedRAMP 20x approval looks like. On October 29, 2026, FedRAMP granted the first Class C certification that complies with its Consolidated Rules for 2026 (CR26), the program said in a November 2 blog post. FedScoop reported on November 3 that the recipient is Perplexity, and that the certification lets the General Services Administration and the Department of Agriculture use the Perplexity Enterprise and API Platform.
Class C is the 20x tier most closely aligned with FedRAMP's old "moderate" level, and FedScoop describes it as the most common type in the marketplace. That makes the first full Class C the template most providers will study. FedRAMP itself framed the award as a starting gun rather than a finish line. "Everything up until now has been development, piloting, training, preparing," the blog said.
Why the First CR26 Class C Matters More Than the Class A Awards
FedRAMP published CR26 in June 2026 and opened the 20x pipeline in August. The rules created an entry-level Class A certification for companies with a high-quality security program and an external SOC 2 Type II or GovRAMP assessment. FedRAMP granted the first Class A on August 25, 2026, and FedScoop counts seven Class A certifications today.
Class A is a fast lane, not the destination for most sellers. CR26 also set the official rules for Class B and Class C, which FedRAMP described as carrying "much stricter requirements than the pilot but significantly improved assurance expectations." Until October 29, no provider had cleared the full Class C bar. FedRAMP said the winning product addressed "all of the rules developed over the 19 months since the public launch of FedRAMP 20x."
The same product was already in use at agencies under a pilot Class C certification, according to the blog, which cited that usage as evidence of "the demand and value of FedRAMP 20x."
From Pilot Certifications to the Full CR26 Rules
FedRAMP announced the 20x initiative on March 24, 2025, eight months after the Office of Management and Budget issued Memorandum M-24-15 on July 25, 2024. Over the following 19 months, FedRAMP ran three pilot phases. Twenty-six companies received limited pilot certifications during that period, with an agreement to adopt the final rules once they were complete. FedRAMP called those final rules "much more complicated."
The first full Class C shows that a product with a pilot certification and existing agency users can reach the full certification. According to FedScoop, Perplexity's own announcement said the certification brings "live web search and source-cited answers within its certified environment" to GSA and USDA users.
Other pilot holders have not yet been reported as crossing over. FedScoop reports that OpenAI's ChatGPT and Filevine hold pilot Class C certifications along with about a dozen others. Twelve Class B certifications remain in the pilot phase, including Google Gemini for Government and Flock Safety. FedScoop notes there are no Class B or Class D (the old "high" level) 20x certifications yet under the full rules.
What Key Security Indicators Replace
The substantive change in 20x is how FedRAMP judges security. Instead of reading narrative descriptions of controls, assessors measure "outcome metrics supplied by the cloud service provider through Key Security Indicators," the blog said. FedRAMP gave a concrete example: the results of hundreds of static application security testing scans, with the resulting approvals or denials of code changes, tell assessors more than "a paragraph of narrative text that describes how they plan to incorporate such scans into their testing."
FedRAMP tied that approach to OMB's directive that commercial products should not need a separate government build. The blog quoted M-24-15 directly: "FedRAMP should not incentivize or require commercial cloud providers to create separate, dedicated offerings for Federal use, whether through its application of Federal security frameworks or other program operations."
For providers, the practical effect is that the evidence FedRAMP wants is the telemetry a mature engineering team already produces. The blog urged industry to keep "shifting compliance operations closer to engineering where appropriate."
Nearly 100 Products Are Already in the 20x Queue
FedScoop reports that nearly 100 products have begun the certification process, including some from Anthropic and Cisco. FedRAMP's own post put it as "nearly a hundred companies" that "have already stepped across that starting line."
The agency also acknowledged a data gap. Products with limited pilot certifications "have already seen wide-scale usage across government," the blog said, but FedRAMP "unfortunately lacks the necessary data at this time to properly demonstrate this in the FedRAMP Marketplace."
FedRAMP said 20x "will need to be expanded and improved continuously" and that agencies will need more guidance and support, especially from the FedRAMP Board. Its stated ambition is scale, as the blog put it: "Every FedRAMP Certification, every agency ATO, one at a time, FedRAMP will run with them until we are running with thousands."
What It Means for Contractors
Cloud and software-as-a-service vendors aiming at moderate-impact federal work now have a completed Class C to benchmark against. The first full award went to a product that already held a pilot certification and had agency users, which suggests that pilot holders with live federal customers are well placed to convert next. OpenAI, Filevine and the roughly dozen other pilot Class C holders face the same CR26 bar that the first full Class C cleared.
Companies still outside the program should plan their submissions around Key Security Indicators rather than narrative system security plans. That means instrumenting pipelines, scanning and change control so they produce machine-readable evidence of outcomes. Firms that already hold a SOC 2 Type II or GovRAMP assessment can use Class A as a faster entry point while they build toward Class C.
Integrators and resellers should note that agencies are already using 20x-certified products, according to FedRAMP. GSA and USDA can now use the Perplexity Enterprise and API Platform under the full certification. With no Class B or Class D under the full rules yet, those tiers remain open ground, and the first providers to clear them will likely set the reference point for everyone behind them.
.jpg){kind=link}