Fedramp

FedRAMP Certification Skill

Last verified: 2026-10-03

A comprehensive guide for helping users navigate FedRAMP authorization — from initial readiness through ATO and ongoing continuous monitoring.

Quick Reference: What Does the User Need?

Identify the user's goal and jump to the appropriate section:

Current FedRAMP State (as of August 2026 — CR26)

⚠️ CR26 (FedRAMP Consolidated Rules for 2026): FedRAMP has restructured its authorization framework. FIPS 199-based baseline labels (Low/Moderate/High/LI-SaaS) are replaced with Certification Classes A–D (per notice NTC-0004; CR26 rules valid through December 31, 2028). Class labels change the names of the baselines, not their requirements. CSPs already authorized under the old labels retain their authorization through a transition period in which old and new labels are linked.

• Baseline: NIST SP 800-53 Rev 5 (fully in effect)
• Control counts (Rev 5): Low ≈ 156, Moderate = 323, High = 421 (legacy references; CR26 class-based counts being published by PMO)
• CR26 Certification Classes (official mapping, NTC-0004): A = new pilot/transitional baseline (entry via external frameworks such as SOC 2 Type II through Program Certification; holders have a 2-year window to obtain B/C/D), B = current LI-SaaS + Low baselines, C = current Moderate baseline (majority of federal deployments, incl. CUI), D = current High baseline.
• FedRAMP 20x: Now the primary authorization pathway — continuous authorization built on Key Security Indicators (KSIs), machine-readable evidence, modular API-driven submissions, and automated validation. Traditional SSP/SAP/SAR templates remain for legacy paths.
• CR26 status: finalized June 25, 2026; optional early adoption since July 4, 2026; mandatory January 1, 2027.
• Legacy FedRAMP Ready: the Ready designation was retired/relabeled Legacy FedRAMP Ready on July 28, 2026 — no new submissions. Rev5 Ready holders must convert by the later of their annual-assessment expiration or November 17, 2026; the status disappears entirely December 31, 2027.
• Certification Class pipelines: Class A open since August 3, 2026; Classes B/C open August 31, 2026; Class D pilot expected late 2026 with a formal option in early 2027.
• Rev5 wind-down: new Rev5 applications are not accepted after June 11, 2027; Rev5 sunsets December 31, 2028.
• JAB P-ATO: Fully suspended; FedRAMP PMO is the sole authorization body.
• Machine-readable mandate (RFC-0024/NOTICE-0009, operationalized in CR26) — applies to the Rev5 process only, explicitly NOT to FedRAMP 20x: since 2PM ET September 30, 2026 (now in force), NEW Rev5 initial-certification packages must be machine-readable with no grace period (including packages already In Process for agency authorization) [LMR-GEN-ICR]; existing Rev5-certified providers must submit a full machine-readable package at each annual assessment completed after that date [LMR-GEN-OAR]. Approved formats: NIST OSCAL, or any public-domain standardized format that 5+ certified CSPs agree to maintain (FedRAMP-validated); CR26 JSON schemas and a validator are published. Human-readable versions must still be produced on request. Non-compliance: public notification until 2PM ET September 30, 2027, then certification revocation.
• Security Inbox: All authorized CSPs must maintain a dedicated Security Inbox (no CAPTCHAs or barriers) for urgent vulnerability directives — effective January 5, 2026.
• Key templates updated: SSP, SAR, SAP, POA&M, CIS/CRM, IIW, ISCP — all updated to align with Rev 5 (Dec 2024 releases).

1. Readiness & Gap Assessment

Approach

1. Clarify scope — Ask the user: What is the CSO (Cloud Service Offering)? IaaS/PaaS/SaaS? Target Certification Class under CR26?
2. Identify authorization path — FedRAMP 20x (primary, preferred) vs. legacy Agency Authorization package (still available for complex systems during CR26 transition)
3. Run through the readiness checklist — See references/readiness-checklist.md
4. Surface gaps — Map current state to required controls; flag missing documentation, unimplemented controls, and architectural deficiencies
5. Prioritize — Group gaps by: (a) blockers for readiness review, (b) items addressable before 3PAO assessment, (c) POA&M candidates

FedRAMP Ready retired July 28, 2026 (now "Legacy FedRAMP Ready"). Advise CSPs by pipeline instead: Class A (open since August 3, 2026) for external-framework entry, Classes B/C from August 31, 2026 for full certification; legacy Rev5 Ready holders must convert by the later of annual-assessment expiration or November 17, 2026.

Key Readiness Questions to Ask the User

• Are you targeting FedRAMP 20x (preferred) or a legacy authorization package?
• What cloud platform (AWS GovCloud, Azure Government, GCP, on-prem hybrid)?
• Are you leveraging any existing FedRAMP-authorized IaaS/PaaS (e.g., AWS GovCloud FedRAMP High)?
• Do you have FIPS 140-2/3 validated encryption in place?
• Is your authorization boundary defined and documented?
• Do you have a vulnerability scanning program (OS, DB, web app, container)?
• Are security policies and procedures documented?
• Do you have an Incident Response Plan (IRP) and Contingency Plan (CP) that have been tested?
• Are your Rev5 authorization package artifacts machine-readable (OSCAL or an approved format)? Mandatory for new Rev5 packages from Sept 30, 2026; for existing providers at the next annual assessment after that date. (20x has its own machine-readable model.)

Output Format

• Produce a gap table: Control Family | Current State | Gap | Priority | Owner
• Summarize top 5–10 high-priority gaps as prose
• Note the target Certification Class and whether FedRAMP 20x is feasible

2. ATO Documentation

The core FedRAMP authorization package consists of:

Authorization Package
├── System Security Plan (SSP) + Appendices A–Q
├── Security Assessment Plan (SAP) + Appendices A–D  [3PAO-prepared]
├── Security Assessment Report (SAR) + Appendices A–F  [3PAO-prepared]
└── Plan of Action & Milestones (POA&M)  [SSP Appendix O]

Important: Word/Excel templates are being retired for Rev5 — new Rev5 packages must be machine-readable (OSCAL or approved format) from September 30, 2026; existing providers convert at their next annual assessment. Human-readable renditions on request. Templates: https://www.fedramp.gov/documents-templates/

Document Guidance

For detailed guidance on each document type, read the appropriate reference file:

• SSP → references/ssp-guide.md
• POA&M → references/poam-guide.md
• SAP / SAR → references/sap-sar-guide.md
• Supporting appendices → references/appendices-guide.md

General Writing Principles for All ATO Docs

1. Describe only what is implemented — Do not document planned or aspirational controls; these trigger findings and must go in POA&M instead
2. Be specific — Reference exact tools, filenames, section numbers, policy names; vague language causes findings
3. Mind the verbs — Each control requirement uses specific verbs (track, document, enforce, test). Address each verb explicitly
4. Shared responsibility — For any customer-configurable or shared control, create a clear "Customer Responsibility" section
5. Keep it consistent — Architecture diagrams, data flows, inventory, and control statements must all be internally consistent

3. NIST 800-53 Control Mapping

Control Families (Rev 5)