Rev5 questions and discussion on the Consolidated Rules for 2026 (or Legacy) #146
Replies: 15 comments 36 replies
|
Can you confirm whether the March 7, 2027 grace period defined in NTC-0014 remains accurate and unchanged? Specifically, is this grace period still authoritative, or has it been superseded or modified by the CR26 Consolidated Rules timeline, including the January 1, 2027 mandatory adoption date? As per NTC-0014: "FedRAMP will provide a grace period through March 7, 2027 where cloud service offerings may maintain their FedRAMP Certification under a corrective action plan (which will include notice to all agencies). After this date, FedRAMP Certification will be revoked for all cloud service offerings not following these rules." |
We're having some sort of problem with the way our website hosting provider is rendering out pages that is causing some links not to work properly when you click on them within fedramp.gov - they all work when you hit reload or click on them from elsewhere or even open them in a new tab. For example if you click on the link that you pasted here, it works. 🤷 I'm going to keep trying to track this down tonight. |
|
@judgecspab-max - several links seem to land on error pages, but you can usually resolve by refreshing the URL. Not sure why they won't land properly. For example, using Edge, this link: 
takes me here: 
but then I do a refresh on that and it takes me to the page. |
|
I think I've tracked this down to an issue with sveltekit capturing the link to route it within an SPA refresh instead of treating it like a static route. Not sure why this behavior didn't appear until yesterday in production since we've been using this methodology for the I've pushed a fix that detects the static routes and forces a full browser reload for those routes to bypass the capture and it appears to work - I can no longer replicate the 404 popping up when clicking a link to Please let me know if you have any further issues and I'll check back in later tonight! |
|
Yes! The links I recall having issues seem to work now, for me. Thanks for all the work and related updates you've been doing to get CR26 published! |
|
All good now! |
|
After review of the Rev 5 SCN process ahead of the July 4 optional adoption date, we noticed the published schema (fedramp-significant-change-notification-schema-2026-06-24.json) does not match the SCN-CSO-INF required fields SCN-CSO-INF, which mandates 10 fields in every notification. The schema marks only 3 as required (certificationPackageOverviewUri, changeType, changeDescription) and does not include:
|
|
For CR26 we wanted to make the schemas absolutely minimal to allow providers initial flexibility while we were doing some weird new stuff. The schemas thus reflect a sort of skeleton to build around rather than an attempt at a complete constraining way of approaching data sharing. It was a deliberate choice to avoid any situations where people might interpret the schema as a ghost rule - follow the actual written rules, not templates or schemas. We'll likely add a FAQ to help.fedramp.gov about this. And CR27 may explore stricter structures once everyone spends more time approaching this problem in different ways. |
|
Thanks Pete--I appreciate the approach your describe, however, the schema marks 3 fields as "required" with one, certificationPackageOverviewUri not even being in SCN-CSO-INF. Can we change "required" to "recommended"? |
|
The Certification Package Overview is a separate schema that contains metadata about the CSO including your FedRAMP ID, Provider Name, Service Name, etc. We decided to include the CPO uri in all of the schemas rather than asking providers to duplicate this information across every submission. |
|
If going for a new Rev5 certification prior to Jan 1, 2027, are CSPs required to follow the new CR26 Rev5 baseline/control guidance, or can they still use the old Legacy Rev5 parameters, SSP templates, SAP/SAR templates, etc? Similarly for assessors, for new Rev5 certification assessments prior to Jan 1, are they required to assess against the new CR26 Rev5 baseline/control guidance, or should/can they continue to follow the Legacy Rev5 rules/templates? Or is this choice up to the CSP/agency? I think I can intuit the answer from the Important Dates/Deadlines, without an explicit statement about which elements of Legacy Rev5 are still officially allowed (though maybe I am just not finding that statement) - which is that this is ultimately up to what the agency customer wants/agrees to with the CSP. Ie, the assessor can assess against the set of rules they are directed to assess by the CSP/agency, whether Legacy Rev5 or CR26 Rev5, up until a given CR26 rule or the full CR26 ruleset is explicitly stated to be mandatory for Rev5. This is especially relevant to CSPs who were already well along the path toward Rev5 and did not want to wait for the finalized CR26 rules to be available. For example, if they are about to be assessed now or in the next few months, and had worked over X time period to set up their system/documentation/etc using Legacy Rev5 rules, templates, etc. Corollary - what needs to be done by Jan 1, 2027 - is it enough to have completed the Legacy Rev5 assessment with the assessor, or does the agency/FedRAMP need to also approve the Legacy Rev5 certification prior to Jan 1? |
|
Thanks @emu-gov - I think that somewhat answers the corollary question (ie, the need to actually officially submit to FedRAMP prior to Jan 1 to be safe), but what about for submissions prior to Jan 1 related to the assessment process and artifacts. Could you please confirm and/or comment on what I was intuiting for those in the first two paragraphs? |
|
Addressing FedRAMP Communication (AFC) and Secure Configuration Guide (SCG) are required now. The grace period ended July 1st 2026, but as those requirements were communicated at the beginning of the year, that should not come as a surprise, though some might have only been tracking for existing certifications and not new submissions. Optional early adoption of CR26 started July 4th. We anticipate receiving packages of many shapes and sizes between now and January 1st. Some will be legacy Rev5 (+ AFC & SCG), others might be 100% CR26, others might be legacy Rev5 + AFC, SCG, VER & VDR, and still others might be some bespoke combination. Package composition would be a conversation between provider, assessor and agency, but keep the obtain dates top of mind! Remember that agencies have adoption timelines for BOD 26-04, so early adoption of VDR/VER could really benefit them, too. We recognize some folks are in-flight and have made investments in legacy processes and materials. We can't give business advice or give specific council on how each provider should approach. That is why we built CR26 in the open, provided the flexibility of early adoption, and gave about 6 months of lead time for new submissions. |
|
Great - thank you Emu! |
|
@emu-gov Just to make sure we're crystal clear on this: If a CSP has been preparing for months for a traditional (legacy) Rev 5 assessment and has their assessment in Nov or Dec 2026, if they submit the package to FedRAMP January 2, it must be prepared according to the CR26 rules (e.g., include a CPO and SDR instead of an SSP, include VDR/VER reports instead of a POA&M, include machine-readable output, etc.)? It would be rejected if it didn't follow the CR26 rules? |
|
I am completely biased, but I tend to think we are pretty reasonable people — as an example, the lost sponsor / ready conversion pathways were created because some providers got stuck in extenuating circumstances. The rules have specific dates so we can get this party started. If you are late to that party, the door might be locked. Lots can happen between now and January. We could be overwhelmed with reviews, a shutdown could halt existing agency reviews, your dog could eat your SSP appendices, etc. Stuff happens in this biz and we will do our best to respond as reasonable humans, but if it is Nov and you haven't even looked at VDR / VER, your head is not in the game. |
|
For a Rev5 Class C (Moderate) CSO with multiple agency ATOs, what are the consequences if they do not implement any CR26 Rev5 rules? At which date would they be exposed to those consequences? |
|
Corrective action, then revocation of FedRAMP Certification. https://www.fedramp.gov/2026/providers/updating/deadlines/#important-deadlines |
|
For the CDS-TRC-USH Rev. 5 requirement stating that “Trust Centers MUST share FedRAMP certification data with all necessary parties without interruption,” we are considering leveraging our Trust Center as the primary mechanism for providing stakeholders, including agency customers, with access to certification information. Under this model, we, as the Cloud Service Provider (CSP), would retain responsibility for provisioning and deprovisioning access to the Trust Center. Our interpretation is that the existence of a dedicated Trust Center, combined with an established operational process and support team responsible for managing access, satisfies the intent of providing certification data to authorized stakeholders without interruption. Given that we maintain a dedicated process and team to provision access, support affected customers, and provide alternative access mechanisms when necessary to the same Trust Center, our position is that these customer-imposed network restrictions should not constitute noncompliance with the “without interruption” requirement. We believe we are taking reasonable and proactive measures to ensure continuous availability of certification information to authorized parties despite circumstances that are outside our direct control. Do you have any concerns or objections to this interpretation and approach? |
|
In general the trust center requirements are designed to allow a cloud service provider to be thoughtful and intentional about sharing information with customers while focusing on the best customer experience to help them retain and satisfy their customers. That's why they're relatively minimal. If agencies are routinely telling FedRAMP that they don't have the access they need to a cloud service provider's trust center, then we'd be likely to conclude that the rules aren't being met. And sometimes agencies reach out to us to complain about how shoddy someone's trust center is, and in those situations we're likely to consider other actions in the long run (such as public marketplace listings that identify the minimal compliance and access problems so agencies are aware in advance). FR doesn't make recommendations but focusing on a high quality customer experience over a minimally-compliant one is the preferred approach. And an opinionated comment: Agencies should unblock the domains of trust centers for services they use as part of their ATO, it's bonkers that this is a thing. Sometimes though trust centers require weird proprietary integrations that aren't feasible though, and that can create problems that aren't as simple as unblocking a website (for example, I've seen trust centers that we at GSA are unable to access because they expect an account with an identity provider that is not authorized for use at GSA, that's an incredibly poor customer experience). |
|
I know the answer to this question will be "we're reasonable people", but confusion is still rampant. For the deadline where "FedRAMP will stop accepting any new FedRAMP Rev5 Certifications on June 11, 2027," does this mean a CSP cannot apply for a new Rev5 Marketplace Listing after June 10, 2027? Or FedRAMP will not accept Rev5 packages for CSPs who are already in process? Thanks. |
The current line is clear: FedRAMP will no longer accept applications for new FedRAMP Rev5 Certifications. FedRAMP Rev5 Certification will not be granted to any cloud service provider after June 11, 2027. All in process agency certifications must be completed and the cloud service provider must have applied for their FedRAMP Certification by June 11, 2027. Any cloud service provider that is still In Process will no longer be able to complete that process because they will not be able to apply for FedRAMP Rev5 Certification. This is the direction we are operating under today, and have made clear to the public and to every federal agency nearly a year in advance. The reality on June 11, 2027 may change based on the situation a year from now, but anyone making an assumption that it will change is taking quite a risk. |
|
VDR-TFR-NMV states "Providers MUST verify and validate the status of non-machine-based information resources at least once every 3 months" and once you break down the definitions, I'm interpreting the requirement as: "CSPs must verify and validate documentation, personnel, and budgets every 3 months"
Is this an accurate interpretation of the requirements involved? And while the -1 controls in each control family in Rev5 would revert back to the ODPs, wouldn't this effectively create a new and different requirement for the policies and procedures (as well as various other documents)? Instead of reviewing them every 1/3 years, now they'd need to be verified and validated every 3 months. And then finally, if all of the above is true, would it make sense to notate this on the "Rev5 Control Guidance" page, given there's no direct mention that a VDR rule is impacting documentation? |
|
Hello, any follow up on the above question? |
|
We have a Class D CSO with an existing Rev5 Agency ATO that does not meet the Cloud Native Architecture (KSI-CNA) requirement. Since no current 20x pathway exists for a non-cloud-native CSO of this Certification Class, we request clarification on the following: Pathway & Timeline
ATO Continuity
Marketplace Listing
Tracking & Escalation
|
|
George, 20x Class D Pathways and Rules are not out yet. As discussed yesterday, we have a pending RFC expected to be published this month or early next month that will deal with Class D 20x pilots and submissions. Class D Pilot is expected to commence ~Oct-Mar. This will drive alot of your answers, but I will answer the ones we do know. Does the existing Rev5 ATO remain valid on current terms until sunset, regardless of 20x pathway status? Can the CSO still be leveraged by other CSOs? Does the listing stay active while the CSO is blocked from 20x? What would trigger a change, what notice would we receive, and when would we receive it? There are plenty of ways to receive information. Is this pathway gap already logged (RFC, NTC, tracking number)? Can PMO provide a point of contact for follow-up? Paul |
|
Did I hear correctly on this afternoon's CWG call, that if a Rev5 CSP doesn't adopt VDR and VER by 12/7/26 they will be considered non-compliant and labeled as such on the Marketplace? So, even though there is a grace until 3/7/27 we are non-compliant on 12/8/26 if we haven't adopted all of VDR and VER? I also heard that we could let FedRAMP PMO know where we are in implementation and supply a CAP to get there by 3/7/27. Does that mean if we provide implementation status and CAP to get there by 3/7/27 that we wouldn't be labeled as non-compliant on Marketplace? Also, wondering if a Significant Change Assessment is considered an independent assessment for Grace Ends. We are a Rev 5 CSP who has their annual assessment in November 2026 who will receive SAR after 1/1/2027. Do we have a grace period until our next assessment in November 2027, or do we have to adopt the 1/1/2027 rulesets with our first Significant Change Assessment in 2027? Or must we adopt 1/1/2027 rulesets with our November 2026 annual assessment? |
|
The VDR/VER requirement dates are tied to CISA BOD 26-04. It was released on 10 June 2027 and latest implementation requirements were 180 days, which come out to about 7 Dec 2026 so we adjusted our dates for VDR/VER to align. In general, if you don't meet in your case maintain dates, you should expect a CAP. The CAP should have a fix NLT than date tied to the grace period and listed as deficient in the MP. Once the grace period passes, you should expect to be pulled from marketplace and FedRAMP completely. First Independent Assessment was meant to cover Initial Rev 5 Assessments and Annual Assessments, not SC support. Please also note, that the the grace date is tied to you assessment START date, not the DUE date. There are only a handful of CR26 rules tied to your Independant Assessment start date. This was done because transitioning to these outside of the AA window doesn't make sense for the most part. So if your AA's have started every Nov, the rules explicitly tied to "On the first FedRAMP independent assessment started after 2027-01-01" would be tied to your Nov 2027 Assessment. |
|
@paulagosta Thank you for clarifying that the grace date is tied to the assessment START date and applies to annual assessments only. Very helpful. Follow-up to confirm our understanding: We are an existing Rev5 Class C and Class D CSP. Our next annual assessment starts in October 2026 (before Jan 1, 2027) and will complete approximately September 2027. Based on your clarification, we understand that: Our October 2026 assessment (started before Jan 1, 2027) follows the legacy methodology Additionally: at that first assessment under the new IVV rules (~October 2027), is the expected scope the full Rev5 baseline (all 322 Class C / 409 Class D controls) or the annual mandatory controls (80/101 per IVV-CSF-AIA) with the new methodology (IVV-CSO-SEI, IVV-CSO-SEE, IVV-IAS-VIM/VEF) applied? |
|
For VDR-CSO-SIR, the following is written: "Providers MAY sample effectively identical information resources...". This points to sampling being a optional rule, but not strictly necessary. However, a later VDR rule, VDR-TFR-PSD, states the following: "Providers with Class C Certifications SHOULD persistently perform vulnerability detection on representative samples of similar machine-based information resources, at least once every 3 days." Understanding that technically SHOULD rules have some wiggle room, does the combination of these two rules read as:
|
|
VDR-CSO-SIR is simply saying that if you have identical resources, e.g. multiple containers spawned from the same image, it is OK to address any other monitoring requirements by selecting a sample of the identical instances rather than repeating the monitoring on every instance. VDR-TFR-PSD specifically requires vulnerability detection every 3 days. This detection cna be achieved by scanning all system components or by scanning samples of identical components. Sampling is always optional. |
|
Thanks for the response Dan. That makes sense with VDR-CSO-SIR, but the way you worded your response on language of VDR-TFR-PSD makes it sound like the rule states detection must be done every 3 days, sampling or not. But that's not the language used in the rule. The rule explicitly states "on representative samples". If it's intended to cover all detection, sampling-based or not, I suggest an update to the rule language is needed. |
|
I have similar questions as @zeesharfcspab stated in a comment above. For CSPs who completed their legacy Rev5 annual assessment before CR26 Rev5 was published, and whose next annual assessment does not begin again until H1 of 2027. This creates a window where several rulesets reach their maintain date without an intervening FedRAMP independent assessment. I am trying to confirm how conformance is demonstrated in the interim to avoid the stated CAP that will be given to CSPs if the maintain date is not met (stated in the CR26 Rev5 community update 8/5). My questions are as follows:
|
For rules that have a grace period tied to your AA date (there are 5), we will still do a status check through FSI around the maintain dates, but will request you planned timeline if you haven't transitioned due to your AA cycle date.
|
|
Hi @paulagosta,
|
|
Hello! Question: for an existing Rev 5 adoption of CR 26, I understand that the only rules we are required to implement are those classified as "Rev 5" and "All," and that any that are labeled 20x would be filtered out. Can I get a confirmation on this please? We want to make sure we scope correctly. |
|
You are correct, only rules with applicability for Rev5 would have to be met in a Rev5 Certification. ALL 15 Rulesets (AFC, CDS, VDR, etc.) are applicable to both Rev5 & 20x. The big difference is Controls (Rev5) vs KSIs (20x). The Subsets within each Ruleset identify the applicability (Type, Path, Class, Audience). So rules nested under a Subset with REV5 applicability would be in scope. Some rules have differences based on Class at the rule level as well. |
|
This is incredibly helpful, thanks!! I was overscoping this till Secure IT shared this with me yesterday. Appreciate the confirmation! 🙏🏻 |
|
Hello, for a Lost Sponsor/Readiness Conversion Rev 5 path, what deliverables are expected at our next annual assessment? I understand that SAP/SAR/RET are legacy now, so it would be great to get clarity on scoping the audit with our independent assessor. Thank you! (and happy Friday!!) |
|
Your Certification Package Overview and Security Decision Record will contain your assessment results now. |
|
@paulagosta, thank you!! Additionally, what is the expectation for Rev 5 POA&M reporting? It seems to me that with VER-RPT-NID, we should not be publishing a traditional monthly POA&M, but only including information per VDR/VER specifications. Can you please confirm? |
|
Elaine, Yes. When you transition to VDR/VER, POA&M requirements go away. You will transition to FedRAMP Vulnerability Detail Report (VER-RPT-VDT) and a human readable Monthly Activity Report (VER-TFR-MHR). Your tempo for agency meetings also changes to a quarterly requirement in accordance with Collaborative Continuous Monitoring (CCM-QTR-MTG). |
|
Great!! Thank you! |
|
@paulagosta, I am advising my leadership team to push VDR/VER to GovRAMP in place of the traditional conmon. We can still pay their $1000 / month fee, but I cannot fathom running both processes. I know you can't offer business advice here, but have you heard other providers' stance on this? Do you know if others intend to use VDR/VER in place of monthly POA&M and conmon processes outside of FedRAMP? |
|
Hello, for CSPs with an existing Rev5 Class C certification looking to uplift their offering to Rev5 Class D via agency sponsor, will this have to be completed/submitted by the June 2027 Rev5 cutoff for new Rev5 submissions? Thanks! |
|
Pete, 100% Yes. We will not accept a Rev 5 uplift or net-new Certification after June 11, 2027. It doesnt matter what date they entered the agency pipeline. |
|
Thanks, Paul! |
Uh oh!
There was an error while loading. Please reload this page.
This thread is for any and all Q&A or general discussion related to FedRAMP Rev5 in general that does not need to have its own thread.
FedRAMP released the Consolidated Rules for 2026 on June 24, 2026 with a considerable set of changes for FedRAMP Rev5 that will apply to all cloud service providers.
These changes include:
Some of these changes take effect for all cloud service providers on certain dates no matter what, others take effect at the next annual assessment. In general, these are sweeping changes that will require all cloud service providers to begin planning now to continue to meet FedRAMP Rev5 requirements.
Historical materials are available at https://fedramp.gov/legacy.
You may see some of the following folks from FedRAMP responding in this thread:
pete-gov- Pete, FedRAMP Directornicole-gov- Nicole, Security Directordan-fedramp- Dan, Lead Cloud Security Engineerpaulagosta- Paul, Lead Cloud Security Engineer (Bastion)emu-gov- Emu, Lead Cloud Security Engineer (Vanguard)rhoesing- Ryan, Chief of Staff & Policy Branch ChiefAll reactions