{"type":"rich","version":"1.0","provider_name":"Transistor","provider_url":"https://transistor.fm","author_name":"The 38North Security Podcast","title":"FedRAMP 20x Is Here: The Six Changes That Matter Most","html":"","width":"100%","height":180,"duration":7,"description":"With FedRAMP's Consolidated Rules for 2026 being final, FedRAMP 20x is officially here. \nThat changes how cloud service providers enter FedRAMP, define scope, prove security, maintain certification, and work with federal agencies.\nIn this episode, Ingrid Velasquez-Woodley speaks with Sam Leestma, Vice President of Solutions Engineering, and Spence Witten, Principal Consultant at 38North Security, about the six parts of CR26 most likely to affect cloud providers and agencies.\nTopics include:\n* How the new certification classes differ from the Rev. 5 impact levels\n* Whether Minimum Assessment Scope will actually reduce cost and complexity\n* Why Key Security Indicators may provide better assurance than point-in-time evidence\n* Whether the Security Decision Record could become the next oversized compliance document\n* What VDR and VER require before the December 7, 2026 deadline\n* Why existing Rev. 5 providers may struggle with vulnerability automation\n* How ongoing certification differs from continuous validation\n* Whether annual assessments should become less burdensome\n* Why CR26 limits agencies from creating their own parallel FedRAMP requirements\n* What the major CR26 transition dates mean for providers\n* What CSPs considering 20x—and those already holding Rev. 5 certifications—should do now\nThe discussion also covers where FedRAMP got the model right, where the final rules still create uncertainty, and how implementation by agencies, assessors, and providers will determine whether CR26 actually reduces duplication and improves security visibility.\nImportant dates discussed:\nJune 24, 2026 — CR26 becomes final\nJuly 4, 2026 — Optional early adoption begins\nJuly 28, 2026 — FedRAMP Ready becomes a legacy designation\nAugust 3, 2026 — Class A applications open\nAugust 10, 2026 — Limited Rev. 5 Class B and C transition pathways open\nAugust 31, 2026 — 20x Class B and C applications open\nDecember 7, 2026 — VDR and VER become mandatory\nJanuary 1, 2027 — Broader mandatory...","thumbnail_url":"https://img.transistorcdn.com/F1tJUOFCpWg5jT1oJwuKVVZpnVivYRjIx629PibCQ5g/rs:fill:0:0:1/w:400/h:400/q:60/mb:500000/aHR0cHM6Ly9pbWct/dXBsb2FkLXByb2R1/Y3Rpb24udHJhbnNp/c3Rvci5mbS9zaG93/LzQ5MjM0LzE3MDY2/MzQ4NDEtYXJ0d29y/ay5qcGc.webp","thumbnail_width":300,"thumbnail_height":300}