FedRAMP Consolidated Ruleset for 2026 (CR26) is released

Original title: FedRAMP Consolidated Ruleset for 2026 (CR26) is now released

FedRAMP has released the Consolidated Ruleset for 2026 (CR26), establishing the updated framework for federal cloud security authorization. This update provides cloud service providers with revised security controls, compliance standards, and requirements for obtaining and maintaining FedRAMP authorization to serve U.S. federal agencies.

What changed

• FedRAMP Consolidated Ruleset for 2026 (CR26) is now available, superseding previous versions and establishing the current baseline security controls and compliance framework for federal cloud services

Who is affected

Cloud service providers seeking FedRAMP authorization, federal agencies procuring cloud services, and organizations providing cloud infrastructure or services to U.S. federal government