Preparing for FedRAMP 20x Phase 2: Steps Cloud Service Providers Should Take Now

FedRAMP 20x is progressing quickly, with phase 2 just around the corner. Designed to modernize and streamline the authorization process, FedRAMP 20x is reshaping how cloud service providers (CSPs) achieve and maintain authorization to operate (ATO) in the federal marketplace. 

With key milestones on the horizon, providers should prepare now to ensure smooth and successful compliance. In this article, we’ll cover what’s coming in FedRAMP 20x Phase 2 (20xP2), including key dates and strategic steps you can take today. 

What is FedRAMP 20x Phase 2 and Why Does It Matter? 

FedRAMP 20x Phase 2 is the second stage of the program’s modernization effort to streamline the federal cloud authorization process. Phase 2 introduces the highly anticipated Moderate baseline as part of the 20x program and establishes the official requirements, documentation, and testing criteria that CSPs must meet to move forward under the new framework. 

20xP2 matters for several reasons, bringing the following: 

• Clarity and Consistency: Until now, CSPs have been working off draft guidance and pilot feedback. Phase 2 finalizes the rules of the road, giving providers a clear target for compliance. 
• Opportunity for Early Movers: Only eligible CSPs will be able to submit during the Phase 2 window (Oct–Dec 2025). Those who act quickly could gain authorization sooner and establish a competitive advantage in the federal market. 
• Preparation for Phase 3: Even for organizations not eligible in Phase 2, the finalized requirements serve as a blueprint. Starting alignment now positions CSPs to hit the ground running when Phase 3 opens in 2026. 
• Strategic Market Impact: FedRAMP authorizations remain a prerequisite for doing business with federal agencies. Successfully navigating Phase 2 not only accelerates compliance but also strengthens trust with federal customers. 

FedRAMP 20x Phase 2 Timeline 

With FedRAMP 20x moving into its next stages, timing is everything. The program’s rollout includes several important milestones over the next year, and each one carries different implications for CSPs. Whether you’re preparing to submit during the limited Phase 2 window or lining up for Phase 3 in 2026, understanding these tentative deadlines will help you plan strategically and avoid last-minute scrambles. 

Please note that each of the dates below are subject to change in light of the current government shutdown: 

• October 16–23, 2025: Finalization of Phase 2 Requirements
  • The official Phase 2 requirements will be locked in. CSPs will finally gain clarity on the updated documentation, security testing, and process criteria they must meet. 

• October 24–December 16, 2025: Phase 2 Submission Window 
  • Eligible CSPs will have just eight weeks to submit under Phase 2. This short window is a critical chance to move forward ahead of the broader market, but only organizations that meet eligibility criteria will be able to participate. 

• Q2 2026: Phase 3 Opens for Public Submissions
  • Phase 3 will fully open the door for Low and Moderate impact systems, enabling a much larger pool of CSPs to enter the program. For providers not in Phase 2, this is the next major opportunity. 

What CSPs Should Be Doing Now to Prepare for FedRAMP 20x 

With the clock ticking, CSPs can’t afford to wait until deadlines arrive. Proactive preparation now can make the difference between a smooth submission and a costly delay.  

Preparation steps you can take today include: 

1. Review and Align Controls: Map your current security program against draft or provisional FedRAMP 20x requirements. 
2. Engage Stakeholders: Ensure executive sponsors, compliance, and technical teams are aware of upcoming windows. 
3. Conduct Gap Assessments: Identify where your existing security capabilities might fall short. 
4. Develop Automation Strategy: Begin defining and implementing the processes and technology necessary to meet 20x’s rigorous automation requirements. 
5. Leverage Available Guidance: Use resources from FedRAMP, industry groups, or your 3PAO to avoid rework. 

Strategic Considerations for FedRAMP 20x Compliance 

For eligible CSPs, Phase 2 offers a valuable advantage. Submitting during this limited window can accelerate your path to market and signal proactive compliance to federal customers before the field becomes more crowded. 

Even if you don’t qualify for Phase 2, aligning with the finalized requirements now ensures you’ll be ready to act decisively when Phase 3 begins. Early preparation not only minimizes delays but also positions your organization to stand out in a larger, more competitive pool of providers. 

How Schellman Can Help with FedRAMP 20x Compliance 

Schellman has supported numerous CSPs through the FedRAMP 20x journey, and we’re closely monitoring the evolution of the program. Our experienced team of experts can help you: 

• Conduct readiness and gap assessments 
• Develop a roadmap tailored to your eligibility and target phase 
• Streamline compliance while reducing delays 

FedRAMP 20x represents a significant shift, as well as a major opportunity. With Phase 2 finalization and submission windows fast approaching, CSPs who prepare now will be better positioned for success. 

Don’t wait until 2026. Start aligning today to maximize your FedRAMP 20x readiness. Contact us to learn how we can help you stay ahead of the curve. 

And in the meantime, discover additional FedRAMP insights in these helpful resources:  

• FedRAMP 20x: Key Changes and Impacts to Cloud Service Providers 
• FedRAMP 20x Pilot: Reimagining the Low Baseline 
• The New Frontier of 2025 Compliance: Mastering GovRAMP, IN-RAMP, and the Mystery of FedRAMP 20x