The Road to FedRAMP 20x

GRC Data & AI Summit 2026

Case study · Matt Hungate, Managing Principal, Schellman · Jake Bernardes, CISO, Anecdotes · Michael Kipnis, Information Security Manager, Anecdotes 

FedRAMP under Rev5 meant enormous documentation, a sponsor, and a timeline that could stretch to 24 months. Anecdotes went from never having touched federal compliance to 20x Moderate authorization in roughly six months, through the phase two pilot. Michael Kipnis ran it, even though he doesn’t even come from GRC. He came at it as an engineer, which turns out to be the point: Pete Waterman has said repeatedly that compliance is an engineering problem. Matt Hungate gives the assessor's side, where the investment shifts from producing documentation to building automation and pipelines. It is not less work. It is work you get something out of. All three get into what changes for teams still on Rev5, with FedRAMP set to stop accepting new Rev5 authorizations on June 11, 2027.

‍

What you'll take away

• What 20x changes on the assessor side, and where the investment moves once documentation stops being the deliverable
• How a team with no federal compliance background reached 20x Moderate in roughly six months
• What treating compliance as an engineering problem looks like in practice, and why it compressed the timeline
• Why the 20x process feels closer to iterative software development than to a traditional audit
• The June 11, 2027 Rev5 cutoff, and what to do now if you are not already sponsored

‍