Data, Not Documents: The FedRAMP Revolution and a New Model of Trust

PALO ALTO, CA – June 30, 2026 – For years, the path for technology companies to serve the U.S. federal government was paved with paper. Mountains of it. Thousand-page security plans, manual evidence collection, and point-in-time audits created a system that was slow, expensive, and often a step behind reality. Today, that system is being fundamentally dismantled. The government's new FedRAMP 20x standard isn't an update; it's a revolution that replaces static documentation with dynamic, machine-readable data as the currency of trust.

At the forefront of this shift is Anecdotes, a governance, risk, and compliance (GRC) platform that just announced it has achieved FedRAMP 20x Moderate (Class C) Certification. As a participant in the program's pilot, the company offers a unique look into this new world—one where security is a live, verifiable fact, not a carefully constructed narrative. This isn't just a story about one company's compliance milestone; it's about a profound innovation in how our public institutions can build a more secure, agile, and trustworthy digital foundation.

The End of an Era: From Paper Mountains to Real-Time Proof

For over a decade, the Federal Risk and Authorization Management Program (FedRAMP) was the gatekeeper for cloud services in government. While its goal of standardizing security was noble, the process, known as Rev5, became a notorious bottleneck. Authorization could take 12 to 18 months, requiring a federal agency sponsor and a colossal investment in creating and maintaining System Security Plans (SSPs) that documented adherence to hundreds of security controls. The final product was a snapshot, a moment in time that began aging the second it was printed.

FedRAMP 20x, officially codified in the recently released Consolidated Rules for 2026 (CR26), throws that model out the window. The core change is a philosophical one: trust must be earned continuously, not just demonstrated annually. Instead of static documents, the new standard demands live, machine-readable evidence pulled directly from a company's systems.

This is accomplished through several key changes:

• Key Security Indicators (KSIs): The hundreds of granular controls from the Rev5 era are being replaced by a smaller, more focused set of KSIs—around 61 for the Moderate level. These are not procedural checkboxes but measurable, automatable security outcomes. The question is no longer "Did you write a policy for this?" but "Can your system prove, right now, that it is doing this?"
• Machine-Readable Evidence: Authorization packages must now be submitted in a standardized, machine-readable format like the Open Security Controls Assessment Language (OSCAL). This allows for automated review and continuous monitoring, turning compliance from a human-led reading exercise into a data-driven validation process.
• No Agency Sponsor Required: In a move that dramatically lowers the barrier to entry for innovative companies, the FedRAMP Program Management Office (PMO) can now issue a "20x Program Certification" directly. This allows cloud providers to get certified and listed on the FedRAMP Marketplace without first securing a costly and time-consuming agency sponsorship.

This isn't just about efficiency. It's about effectiveness. Past government reports have highlighted inconsistencies in how agencies implemented the old standards, creating potential security risks. By mandating continuous, automated validation, FedRAMP 20x aims to provide a much more reliable and transparent view of a system's security posture at all times.

Building for a New Reality: The Architecture of Continuous Trust

The transition to 20x is not a simple lift, as it requires a fundamental re-engineering of how companies approach compliance. For many, it will mean a significant investment in automation and infrastructure. For Anecdotes, however, the new standard was an affirmation of its founding principles. The company announced it achieved its certification using its own native platform, without bolting on third-party tools.

"For years, audits have assessed a carefully curated version of reality," said Jake Bernardes, CISO at Anecdotes. "FedRAMP 20x changes that. The goal is no longer a convincing evidence package. It is continuous, transparent trust built on data that reflects the real state of your security posture."

This statement gets to the heart of the innovation. The company's platform was designed as an "agentic GRC" system, using intelligent software agents to continuously pull data from source systems—like cloud environments, code repositories, and security tools. This creates an audit-grade data infrastructure where compliance isn't a separate activity but an intrinsic property of the system. Controls are monitored live, and evidence is already structured in the machine-readable format 20x requires.

This native alignment is a critical differentiator. While many legacy GRC vendors are now racing to adapt their tools for OSCAL export and automated evidence collection, platforms built from the ground up for this data-driven model have a distinct advantage. They are not merely translating old processes for a new format; their architecture embodies the new philosophy of continuous validation. This is the institutional innovation that truly matters: building systems where transparency and integrity are inherent features, not afterthoughts.

A Blueprint for the Future: Navigating the Path to 20x

Anecdotes is one of nearly 30 services to achieve 20x certification so far, signaling a clear direction for the federal market. Their journey through the pilot program serves as a crucial case study for the thousands of other cloud service providers (CSPs) that need to navigate this transition. The Rev5 standard will sunset in mid-2027, making the shift to 20x an inevitability for anyone wishing to do business with the federal government.

"FedRAMP 20x is the most significant change to federal cloud certification in years, and most organizations do not yet know what it means for their existing programs," warned Yair Kuznitsov, CEO and Co-Founder of Anecdotes. "We went through it ourselves. We know it is not a simple lift. For organizations migrating from Rev5 or pursuing 20x for the first time, the path requires adapted methodology and the right technology."

For federal agencies, this shift promises faster access to a wider array of secure and innovative technologies. The ability to make risk-based decisions on real-time data rather than stale reports empowers them to modernize more quickly and serve the public more effectively. For CSPs, the message is clear: the era of compliance-as-documentation is over. The future belongs to those who can build and operate systems that emit continuous, verifiable proof of their security.

Beyond the Beltway: How Federal Innovation is Redefining Risk

While born from the needs of the U.S. government, the principles behind FedRAMP 20x are poised to ripple across the entire technology landscape. This push for data-driven, continuous compliance is a leading indicator of where the broader GRC industry is headed. The concept of a Continuous Authority to Operate (cATO), once a theoretical ideal, is now being put into practice on a massive scale.

This model demands a new level of integration between security, operations, and development. It champions an "always-on" approach to risk management, where vulnerabilities are identified and remediated in near real-time, not just discovered during a semi-annual audit. By mandating machine-readable standards like OSCAL, the government is creating a common language for security that will foster greater automation and interoperability across both public and private sectors.

What we are witnessing is a powerful example of institutional innovation driving market-wide change. By redefining its own standards for trust, the federal government is setting a new benchmark for what it means to be a secure and reliable digital service. It's a move away from performative compliance and toward a future where our digital infrastructure is built on a foundation of verifiable, continuous, and transparent trust.