The short answer: 360 Advanced, a cybersecurity and compliance assessment firm based in St. Petersburg, Florida, served as the independent assessor for the first cloud service offering to earn a fully CR26-compliant FedRAMP 20x Class C certification. That offering is the Perplexity Enterprise and API Platform. FedRAMP confirmed the certification on October 28, 2026, and 360 Advanced announced its role on November 2, 2026.
Compyl is proud to partner with 360 Advanced, and this milestone matters well beyond federal cloud. It shows where security assessment is heading: away from narrative documents and toward continuous, evidence-based validation.
What is FedRAMP 20x Class C?
FedRAMP 20x is the federal government’s modernized approach to authorizing cloud services. Under the 2026 Consolidated Rules (CR26), FedRAMP replaced the old Low, Moderate and High impact levels with certification classes. Class C covers what used to be FedRAMP Moderate: systems that handle Controlled Unclassified Information, where a breach could cause serious harm.
The bigger change is how providers prove security. On the 20x path, they validate Key Security Indicators (KSIs) with machine-readable evidence that their systems actually produce, instead of relying mainly on a narrative System Security Plan. See the FedRAMP 20x certification rules for details.
What did 360 Advanced do as the independent assessor?
Under CR26, an independent assessor verifies three things: that security measures are implemented as documented, that they produce their intended outcomes, and that they hold up under technical-level review. For the Perplexity engagement, 360 Advanced:
- assessed the Key Security Indicators in the minimum assessment scope
- evaluated the automated validation methods supporting each indicator
- reviewed the machine-readable evidence behind them
360 Advanced will keep supporting Perplexity’s certification, including the required annual assessment. Dan Collins, CEO and Founder of 360 Advanced, described the firm’s approach as “led by people, powered by AI, for the future of cybersecurity compliance.”
Does a FedRAMP 20x Class C certification expire?
No, there is no fixed expiration date. The certification stays in effect as long as the cloud service keeps meeting ongoing requirements, including an independent assessment at least once a year.
Why does this matter for GRC teams outside federal cloud?
FedRAMP 20x previews where assurance in general is heading. Three shifts stand out:
- Evidence over narrative. Assessors want proof that systems generate, not prose that describes them.
- Continuous, not point-in-time. Without a fixed expiration date, staying compliant is an ongoing operating rhythm rather than a once-a-year scramble.
- Automation that holds up to review. Automated validation is now inside the assessment scope, so the way evidence gets collected has to be defensible too.
For governance, risk and compliance teams, the takeaway is the same whether you pursue FedRAMP or not. Your controls, evidence, risks and audit work need to live in one connected system, kept current, and ready for an assessor to inspect.
How Compyl and 360 Advanced work together
360 Advanced brings independent assessment and certification expertise across frameworks, including FedRAMP assessment services. Compyl is the GRC platform where teams run governance, risk, compliance and audit work day to day. Together, we help organizations prepare for an assessment, get through it, and stay ready afterward.
“Congratulations to the 360 Advanced team on leading the first FedRAMP 20x Class C assessment. It’s a clear signal that assurance is moving toward continuous, evidence-based validation, and we’re proud to partner with them.” — Dan Tangney, Head of Marketing & Partnerships, Compyl
Frequently asked questions
Who was the independent assessor for the first FedRAMP 20x Class C certification?
360 Advanced served as the independent assessor for the first fully CR26-compliant FedRAMP 20x Class C certification, earned by the Perplexity Enterprise and API Platform.
When was the first FedRAMP 20x Class C certification confirmed?
FedRAMP confirmed the certification on October 28, 2026. 360 Advanced announced its role as independent assessor on November 2, 2026.
Is FedRAMP Class C the same as FedRAMP Moderate?
Class C covers the same risk tier as the former Moderate impact level. The difference is how it is validated: under FedRAMP 20x, providers demonstrate Key Security Indicators with machine-readable evidence.
What is CR26?
CR26 is FedRAMP’s Consolidated Rules for 2026. It sets the current requirements for certification classes and independent assessments.
Does a FedRAMP 20x Class C certification expire?
No. There is no fixed expiration date. The certification stays in effect as long as the cloud service keeps meeting ongoing requirements, including an independent assessment at least once a year.
