GovRAMP proposes a 20x delta assessment, comments due 4 December

GovRAMP proposes a 20x delta assessment, comments due 4 December

2 November 2026: GovRAMP, the non-profit that verifies cloud security for US state and local governments, wants cloud providers that hold FedRAMP 20x certification to reach its own verified statuses through a shorter "delta" assessment instead of a second full one. Request for Comments GR-2601 opened on 2 November and closes on 4 December at 5 p.m. Eastern.

Not yet independently verified. GovRAMP's analysis workbook was not opened, so the per-control detail behind its coverage figures is not checked by us. This is a proposal: GovRAMP has given no date for a decision. We will update this when it can be confirmed, and remove this note.

Comment is open to members and non-members alike: government agencies, cloud service providers, third-party assessment organisations (3PAOs) and consultants. GovRAMP prefers its online form and also takes email at rfc@govramp.org with the subject "RFC for 20x Delta Assessment".

How far FedRAMP 20x already goes

GovRAMP's staff mapped the FedRAMP 20x Key Security Indicators (KSIs), published in FedRAMP's 2026 Consolidated Rules, against NIST SP 800-53 Revision 5 and its own baselines at the Moderate impact level, the level most of its programme uses. They found that 20x has the potential to meet:

• 88.3% of GovRAMP Core control coverage;
• 78.8% of GovRAMP Ready control coverage;
• 62.4% of GovRAMP Authorized control coverage.

A mapped KSI is not proof, the RFC says. A KSI may relate to a NIST control without the provider's evidence satisfying that control, which is why the proposal rewrites each mapped KSI using NIST SP 800-53A assessment objectives, with more defined guidance the higher the status a provider seeks.

The controls 20x leaves out

Some controls do not map to any KSI at all: 7 for GovRAMP Core, 17 for Ready and 120 for Authorized. GovRAMP proposes to score them with the protection values from the GSA FedRAMP office's threat-based controls study and keep only those at or above its cut score of 41.772. On that rule, 4 of the 7 Core gaps and 24 of the 120 Authorized gaps would be assessed; related controls would be grouped into new GovRAMP KSIs.

The proposal covers only the annual assessment. It leaves continuous monitoring alone, because in August GovRAMP's board already accepted FedRAMP's Vulnerability Disclosure Reporting and Vulnerability Exploitation Reporting requirements as meeting its own monitoring rules for Authorized products.

Points GovRAMP wants answered

Besides the overall balance between assurance and effort, the RFC asks for views on three specific requirements: System Security Plan documentation, annual penetration testing, and supplemental evidence for malicious-code protection. Responses are reported in aggregate by stakeholder group, without naming respondents.

If the approach is affirmed, GovRAMP's staff will extend the analysis to every verified status and impact level. For a SaaS vendor selling to both federal and state buyers, the outcome sets how much of its 20x assessment it can reuse for state and local customers.

Sources

• GovRAMP: GovRAMP Opens Public Comment Period on Proposed 20x Delta Assessment, 2 November 2026
• GovRAMP: Request for Comments (RFC) GR-2601, Proposed 20x Delta Assessment (PDF), 2 November 2026