Moving to FedRAMP 20x: Which Rev5 Certifications Can Coexist?

Before planning to keep a Rev5 certification while pursuing 20x, identify the existing certification’s path. “We already have Rev5” is incomplete information for this decision. The current concurrency rule treats Rev5 Program Certification differently from Rev5 Agency Certification for the same cloud service offering.

FRC-CSO-POP prohibits seeking both Rev5 Program Certification and 20x Program Certification for that offering. Its note does not prevent seeking and maintaining Rev5 Agency Certification alongside 20x Program Certification, but strongly discourages that combination because of complexity and confusion.

Separate type, path and class

FedRAMP’s definitions give these terms different jobs:

• Type: the form of assurance, either Rev5 or 20x.
• Path: the source of certification, from an agency-sponsored authorization or directly from FedRAMP. The legacy Agency path is available only for Rev5 and still involves FedRAMP review and approval.
• Class: the category of assurance the offering supplies to federal customers.

Current path guidance routes 20x to Program Certification, without an agency sponsor. Rev5 Program availability is limited to specific circumstances; a provider’s existing Rev5 label does not establish that it uses that path. Read the actual certification record before applying POP.

Apply the rule to the same offering

Preserve the note alongside the prohibition. A shorthand statement that all Rev5 and 20x coexistence is prohibited loses its distinction. Describing the second row as an endorsed migration strategy loses the warning in the other direction.

The relevant object is the cloud service offering: FedRAMP defines it as a specific packaged cloud product or service supplied to customers and subject to certification. Use that offering’s identity and scope in the decision record, rather than relying on a company-wide certification label.

Make the operational decision reviewable

The following is editorial planning advice, not a FedRAMP application or transfer procedure. Before committing to concurrent work, put the facts and unresolved decisions in one short record:

1. Offering and present status: identify the offering, current type, path and class, with the supporting certification reference.
2. Target state: name the intended 20x Program certification and class, clearly separating a plan from an achieved status.
3. Reason for coexistence: explain the customer or operational need and why the added complexity is being considered.
4. Ownership: identify who maintains each package, tracks applicable obligations and resolves inconsistent descriptions.
5. Customer communication: agree on accurate language for what the offering currently holds and what it is pursuing.

For example, a Rev5 Agency-certified offering considering 20x Program Certification can record that POP does not prevent coexistence, then assess the work and confusion risks. That observation does not certify the offering for 20x or settle the agency’s future use of it.

Treat readiness, assessment work and agency authorization as separate decisions. POP’s note provides no automatic transfer process, assessment waiver or promise that agency ATOs remain unchanged. The agency-use guidance keeps acceptance of risk for the agency’s specific use with its authorizing official.

Use the FRC dates for the 20x plan

The 20x FRC ruleset lists July 4, 2026 for optional adoption and obtaining initial certification, and January 1, 2027 for maintaining ongoing certification. Its grace period ends on the first FedRAMP independent assessment started after January 1, 2027.

These are the applicable 20x ruleset dates, not a newly announced October concurrency change or a universal transition deadline. POP’s current source records its June 24, 2026 launch.

Common planning questions

Can the same offering pursue both Program certification types?

No. POP says providers MUST NOT seek both Rev5 Program Certification and 20x Program Certification for the same offering.

Is Rev5 Agency plus 20x Program recommended?

The note does not prevent seeking and maintaining that combination, but strongly discourages it because of complexity and confusion. It does not establish that the offering satisfies every condition for either certification.

For related planning, see certification classes explained and agency onboarding and package handoff.