Sign in

FedRAMP

Federal Risk and Authorization Management Program — General Services Administration (GSA) / FedRAMP PMO

Also known as: Federal Risk and Authorization Management Program, FedRAMP 20x, FedRAMP Rev5, CR26

Official site Official change log Subscribe to FedRAMP (RSS)

Current version
CR26
Published 24 June 2026. source
Status
In force
Next deadline
in 53 days
CR26 becomes mandatory: new Rev5 applications and all active 20x certifications must follow it source
Who must comply
Cloud service providers whose products or services (IaaS, PaaS, SaaS) create, collect, process, store or maintain federal information on behalf of a US federal agency. Agencies must obtain and maintain a FedRAMP authorization for such services. source
How it is assessed
Assessments are performed by a FedRAMP-recognized independent assessment service, first for the initial certification and then annually. source
Written by
FedRAMP sits within the General Services Administration under the FedRAMP Authorization Act (December 23, 2022). OMB Memorandum M-24-15 (July 25, 2024) sets its scope, authorization paths and agency obligations, replacing the 2011 OMB memo that created the original program. source
Enforced by
When the grace period ends, FedRAMP revokes the FedRAMP Certification of a provider that fails to follow the rules. source
Last change

US federal program standardizing security authorization for cloud services used by federal agencies. Its rules set what a cloud provider must document, assess and continuously report to obtain and keep FedRAMP certification.

Recent changes

  1. Low
    FedRAMP publishes RFC-0036 FedRAMP 20x Class D Cloud-Hosted Pilot Requirements

    FedRAMP has published RFC-0036 defining pilot requirements for Class D cloud-hosted systems under the FedRAMP 20x framework. This establishes new baseline requirements for cloud service providers …

    New document

  2. Low
    FedRAMP publishes RFC-0035 on cryptographic module use updates

    FedRAMP has published RFC-0035 addressing updates to cryptographic module use requirements. This guidance clarifies expectations for cloud service providers implementing cryptographic controls in FedRAMP authorizations. Organizations …

    New document

  3. Info
    FedRAMP opens 2 new Requests for Comment

    FedRAMP has opened 2 new Requests for Comment. This allows stakeholders to provide feedback on proposed changes or initiatives. Organizations should review these requests if they …

    Draft consultation

  4. Info
    FedRAMP opens 2 new Requests for Comment

    FedRAMP has opened 2 new Requests for Comment. This provides an opportunity for stakeholders to review and provide feedback on proposed changes or policies. Participants should …

    Draft consultation

That is the last 90 days. Sign in to read further back.

Key dates

Add these dates to your calendar
  1. in 53 days CR26 becomes mandatory: new Rev5 applications and all active 20x certifications must follow it
  2. in 53 days Rev5 providers must follow the Significant Change Notification rules
  3. in 102 days CR26 grace period ends for Rev5 Lost Sponsor and Ready Conversion program certifications
  4. in 144 days Rev5 providers must follow Collaborative Continuous Monitoring (3-monthly reports)
  5. in 204 days Grace period ends for Rev5 Significant Change Notification rules
  6. in 214 days FedRAMP stops accepting applications for new Rev5 certifications
  7. in 234 days Rev5 certified services must supply a Certification Package Overview in human-readable and JSON formats (grace until their next assessment)
  8. in 326 days Grace period ends for Rev5 Collaborative Continuous Monitoring rules
  9. in 409 days FedRAMP Authorization Act sunset as enacted: 44 U.S.C. 3607-3616 are struck 5 years after enactment (Pub. L. 117-263, sec. 5921(d))
  10. in 449 days All CR26 grace periods expire; non-compliant services lose FedRAMP Certification
  11. in 783 days All FedRAMP Practices in the Consolidated Rules for 2026 expire no later than this date
  12. in 783 days Existing Rev5 certifications remain active until at least this date, unless FedRAMP is otherwise directed
  13. FedRAMP 20x Class B and Class C application pipelines open
  14. Temporary Rev5 Program Certification pipelines open for Class B and Class C
  15. FedRAMP 20x Class A application pipeline opens
  16. FedRAMP Ready becomes legacy; no new Ready submissions accepted
Show 2 earlier dates
  1. FedRAMP Marketplace listings open for providers in the Initial Implementation phase
  2. Consolidated Rules for 2026 take effect; new FedRAMP 20x applications must follow them

Version history

  1. RFC-0036 20x Class D cloud-hosted pilot requirements Draft

    Published RFC-0036 with proposed requirements for the FedRAMP 20x Class D cloud-hosted pilot source

  2. CR26 Major versionCurrent

    FedRAMP Consolidated Rules for 2026 released on a new centralized rules website, with JSON schemas for machine-readable packages; Rev5 and 20x pilot documentation moved to /legacy source

  3. FedRAMP Certification and Classes A-D Amendment

    All designations changed from "FedRAMP Authorization" to "FedRAMP Certification", and all impact-level designations to certification classes A, B, C and D source

  4. NTC-0009 initial outcome of RFC-0024 Draft

    Rev5 machine-readable package requirements will be generally aligned with those proposed in RFC-0024, but requirements and timelines are updated for gradual adoption over a longer period; comprehensive machine-readable data only for Class D. source

    More
    • Final requirements are in CR26
  5. RFC-0024 Rev5 machine-readable packages Draft

    Published RFC-0024 FedRAMP Rev5 Machine-Readable Packages for public comment source

Show 4 older versions
  1. FedRAMP 20x Major version

    GSA announced a new direction for FedRAMP, including 20x Phase One goals source

  2. OMB M-24-15 Major version

    Rescinded the 2011 OMB FedRAMP memo and replaced the program's vision, scope and governance, introducing agency and program authorization paths source

  3. Rev. 5 baselines Major version

    Baselines updated from NIST SP 800-53 Rev. 4 to Rev. 5 and SP 800-53B, with a CSP transition plan source

  4. FedRAMP Authorization Act Major version

    Congress established FedRAMP in law (Section 5921 of Public Law 117-263, the FY2023 NDAA), amending Chapter 36 of Title 44 US Code source

Who it applies to

Applies to commercial cloud services (IaaS, PaaS, SaaS) that handle federal information on behalf of an agency.

Private companies
FedRAMP does not regulate private companies: its rules bind a provider only once it seeks to obtain or keep a FedRAMP Certification. source
Marketplace
To be certified and listed on the FedRAMP Marketplace, a service must have direct or indirect government-wide use. source
Out of scope
Some services fall outside the scope, such as a system used only for a single agency's own operations and not offered as a shared service, social media platforms and search engines. source
Classes and types
Requirements scale by certification class (A to D) and type: 20x for cloud-native services, Rev5 for the legacy process built on NIST SP 800-53 Rev. 5 controls. source source source

How compliance is assessed

Assessments are performed by a FedRAMP-recognized independent assessment service, first for the initial certification and then annually.

Program Certification
Program Certification comes directly from FedRAMP without an agency sponsor and is required for 20x. source
Agency Certification
Agency Certification requires an agency to authorize the service first and then sponsor it, and is used for Rev5. source
Legacy name
The assessment service is called a 3PAO in legacy Rev5 documents. source source
Ongoing Certification
CR26 replaces "continuous monitoring" with "Ongoing Certification": Ongoing Certification Reports every 3 months, quarterly reviews (mandatory for Classes C and D), and advance notice of significant changes. source source
Significant changes
Transformative changes require notice at least 30 business days before work starts. source

Enforcement and penalties

When the grace period ends, FedRAMP revokes the FedRAMP Certification of a provider that fails to follow the rules.

Fines
FedRAMP itself imposes no fines. source
Corrective action
If a provider fails to follow the rules, FedRAMP requests corrective action during the grace period. source
Revocation
When the grace period ends, FedRAMP revokes the FedRAMP Certification with public notice. source
Market access
Agencies may only use FedRAMP Certified services for in-scope use, so losing certification closes that market. source
Regaining certification
FedRAMP states it will take no other punitive action, and a provider can regain certification by showing it follows the rules. source
False claims
Submitting false or fraudulent claims to the government is a crime and is referred to the Department of Justice. source
Agencies
Agencies that bypass FedRAMP face audits by OMB, Inspectors General and GAO. source

Documents

  1. Standard FedRAMP Consolidated Rules for 2026 (CR26)
  2. Standard FedRAMP Rules (machine-readable source of truth for CR26)
  3. Guidance CR26 Important Dates
  4. Law text OMB Memorandum M-24-15, Modernizing the Federal Risk and Authorization Management Program
  5. Guidance FedRAMP Requests for Comment (RFCs)
Show 3 more documents
  1. Guidance FedRAMP Public Notices
  2. Template Legacy Documentation Reference (Rev5 baselines and templates)
  3. Guidance Rev5 Continuous Monitoring Playbook v1.0 (2025-11-17, pre-CR26)

Frequently asked questions

What is FedRAMP Class A?

Class A is one of four FedRAMP Certification Classes (A, B, C, D). It is available only as a FedRAMP 20x Program Certification; Rev5 Class A is unavailable. A provider may obtain a 20x Class A Certification and later change it to Rev5 Class B, C or D via Agency Certification. source

What is a FedRAMP significant change?

FedRAMP uses the NIST SP 800-37 Rev. 2 definition: "a change that is likely to substantively affect the security or privacy posture of a system." CR26 sorts significant changes into three types: routine recurring, adaptive and transformative. source

How much notice does FedRAMP require for a significant change?

For a transformative change, providers must notify agencies of initial plans at least 30 business days before work starts and of final plans at least 10 business days before. Adaptive changes are notified within 10 business days after finishing. A change of certification class needs a new assessment. source

What is FedRAMP 20x?

FedRAMP 20x is FedRAMP's newer certification approach. Providers set their own security goals, continuously measure their effectiveness and validate them automatically through Key Security Indicators, instead of passing a point-in-time audit. The Phase 1 pilot ran from April through September 2025. Full rules are final for Classes A, B and C; Class D will be developed in Phase 4, estimated for FY27 Q1-Q2. source

What is FedRAMP CR26?

CR26 is the FedRAMP Consolidated Rules for 2026: one set of rules for both 20x and Rev5, in effect from July 4, 2026, with enforcement from January 1, 2027. Its practices expire no later than December 31, 2028. source

Is a FedRAMP authorization now called a FedRAMP certification?

Yes. FedRAMP adopted the single label "FedRAMP Certification" (Certified), following the FedRAMP Authorization Act's definition of an authorization as a certification. An agency's own authority to operate is a separate decision by that agency. source

Verified against official sources on 17 October 2026. We monitor the official sources for this framework. Watching since 10 September 2026. Subscribe to FedRAMP (RSS)