Free preliminary self-assessment
How Ready Is Your Organization for FedRAMP 20x?
Use this free preliminary scorecard to identify potential gaps in governance, architecture, evidence, security operations, and continuous readiness.
- 36 questionsabout 5–10 minutes
- 12 categoriesgovernance to third parties
- No registrationYour answers stay in this browser. Nothing is sent to a server, and no registration is required.
This scorecard is an informational self-assessment. It does not constitute FedRAMP authorization, certification, an official assessment, or a determination of compliance.
Important: Do not enter CUI, classified information, passwords, secrets, or sensitive production information.
What FedRAMP 20x readiness means
FedRAMP 20x is a FedRAMP initiative to modernize federal cloud authorization. Public descriptions of the effort emphasize automation, continuous validation, and security information that can be shared in machine-readable form.
Readiness, as used in this scorecard, is a practical question: how consistently could your organization define the service, know what it consists of, make and document security decisions, and demonstrate current, verifiable evidence over time?
The twelve categories reflect general themes of cloud security programs and the practices that tend to determine how much preparation work remains. They are not a transcription of official requirements.
FedRAMP 20x requirements, pilots and terminology are evolving. Always confirm current details against official FedRAMP guidance (fedramp.gov) and with qualified advisors.
Who should use this scorecard
- Cloud Service Providers (CSPs) that are considering FedRAMP 20x and want a first view of potential gaps.
- Security, GRC and engineering leaders who need a structured way to start an internal conversation.
- Teams that already hold other attestations (for example SOC 2 or ISO 27001) and want to see where demonstrability may differ. Holding another framework does not automatically satisfy FedRAMP requirements.
- Consultants and advisors running a quick preliminary conversation with a client.
How scoring works
Your score is a maturity indicator generated from your responses. It is not a FedRAMP compliance percentage.
- Each of the 36 questions is answered on a 0–5 maturity scale: 5 means fully implemented and demonstrable; 0 means unknown or cannot demonstrate. Every level has a specific description for that question.
- Within a category, answers are combined using question weights, so more foundational questions count more. Each category score is normalized to 0–100.
- Category scores are combined using category weights, which are normalized so that they total 100%. Categories such as System Scope & Architecture and Evidence & Validation carry more weight because many other activities depend on them.
- "Not applicable" answers are left out of the calculation rather than counted as full marks, are listed as "Review Required", and reduce coverage. Unanswered questions are also left out and the result is marked provisional.
- Selected questions also ask "Could you demonstrate this today?" That produces a separate Evidence Demonstrability percentage and also raises the priority of gaps you could not demonstrate.
- Gaps are prioritized using score, question weight, severity, whether the answer was "Unknown", and whether evidence could be demonstrated. Every finding lists the answers that triggered it.
Overall results are described as Early Stage (0–39), Developing (40–59), Moderately Prepared (60–74), Strong Foundation (75–89) or High Maturity (90–100).
- 0–39Early Stage. Your responses indicate that many foundational practices are not yet in place or could not be demonstrated.
- 40–59Developing. Your responses indicate some foundations, with significant gaps or uncertainty remaining across several areas.
- 60–74Moderately Prepared. Your responses indicate many practices in place, with notable gaps in consistency or demonstrability.
- 75–89Strong Foundation. Your responses indicate solid and largely demonstrable practices, with limited remaining gaps.
- 90–100High Maturity. Your responses indicate consistently implemented and demonstrable practices across the topics in this scorecard.
Category weights
Weights are relative and are normalized when the overall score is calculated, so the shares below always total 100%.
| Category | Relative weight | Share of overall score |
|---|---|---|
| A. Governance & Accountability | 8 | 7.4% |
| B. System Scope & Architecture | 12 | 11.1% |
| C. Information Resources | 10 | 9.3% |
| D. Security Decisions & Documentation | 8 | 7.4% |
| E. Identity & Access | 8 | 7.4% |
| F. Configuration & Vulnerability Management | 10 | 9.3% |
| G. Logging, Monitoring & Detection | 10 | 9.3% |
| H. Incident Response | 8 | 7.4% |
| I. Evidence & Validation | 12 | 11.1% |
| J. Continuous Monitoring & Operational Readiness | 7 | 6.5% |
| K. Automation & Machine-Readable Data | 5 | 4.6% |
| L. Third-Party Dependencies | 10 | 9.3% |
What the score does not mean
- It is not a FedRAMP compliance percentage, authorization, certification, or determination of eligibility.
- It is not an official FedRAMP, agency or third-party assessment.
- It does not verify any answer. It reflects only what you entered.
- It does not map to specific official requirements, and a high score does not predict the outcome of any formal process.
- Items marked "Review Required" need professional interpretation before any conclusion is drawn.
Frequently asked questions
What is FedRAMP 20x?
FedRAMP 20x is a FedRAMP initiative aimed at modernizing how cloud services are authorized for federal use, with greater emphasis on automation, continuous validation and machine-readable security information. FedRAMP 20x requirements, pilots and terminology are evolving. Always confirm current details against official FedRAMP guidance (fedramp.gov) and with qualified advisors.
What does this score mean?
The score is a maturity indicator generated from your own responses. It summarizes how mature you believe your practices are across twelve areas, and where the largest gaps appear to be. It is not a FedRAMP compliance percentage, and it is not mapped to any official requirement list.
Does a high score mean we are FedRAMP compliant?
No. A high score means your self-reported practices appear mature across the topics in this scorecard. It does not indicate compliance, eligibility, readiness for authorization, or any outcome of an official process.
Can this replace a formal assessment?
No. This is a preliminary, informational self-assessment based on your own answers. It cannot replace guidance from FedRAMP, an independent assessor, or qualified advisors. Items marked "Review Required" specifically need professional interpretation.
What should we do if our score is low?
A low score is a starting point rather than a verdict. Review the priority gaps and the 30/60/90-day roadmap, resolve any "Unknown" answers first (not knowing is itself a finding), and consider an expert review to validate your scope and priorities.
Who should complete the assessment?
Ideally someone with a broad view of the service, such as a security lead, GRC lead or engineering lead, who can consult colleagues. Answer based on what you could demonstrate today, not on what is planned or intended.