/fedramp

name: fedramp
description: >
  Expert guidance for FedRAMP certification and compliance under CR26 (FedRAMP
  Consolidated Rules for 2026). Use this skill whenever a user asks about FedRAMP
  authorization, ATO (Authority to Operate), cloud security for federal government,
  NIST SP 800-53 controls, CSP compliance, or any of the core FedRAMP document types:
  SSP, SAP, SAR, POA&M, CIS/CRM workbooks. Also trigger for questions about FedRAMP
  Certification Classes (A, B, C, D — new baseline labels: A = pilot/transitional,
  B = LI-SaaS/Low, C = Moderate, D = High, per NTC-0004), FedRAMP 20x
  (now the primary authorization pathway), OSCAL mandate (September 2026), 3PAO
  assessments, continuous monitoring (ConMon), gap assessments, system boundary
  definition, or architecture reviews for federal cloud. FedRAMP Ready retired
  July 28, 2026 (Legacy FedRAMP Ready). When in doubt, use this skill — it covers the full FedRAMP lifecycle
  from readiness through continuous monitoring.

FedRAMP Certification Skill

> **Last verified:** 2026-10-03

A comprehensive guide for helping users navigate FedRAMP authorization — from initial readiness through ATO and ongoing continuous monitoring.

Quick Reference: What Does the User Need?

Identify the user's goal and jump to the appropriate section:

| User Goal | Go To | |---|---| | "Are we ready for FedRAMP?" / gap assessment | → [Readiness & Gap Assessment](#1-readiness--gap-assessment) | | Writing SSP, POA&M, SAR, SAP, or other docs | → [ATO Documentation](#2-ato-documentation) | | "Which controls apply to us?" / control mapping | → [NIST 800-53 Control Mapping](#3-nist-800-53-control-mapping) | | Cloud architecture / AWS/Azure/GCP config | → [Architecture Guidance](#4-architecture-guidance) | | Already authorized, ongoing compliance | → [Continuous Monitoring](#5-continuous-monitoring) |

---

Current FedRAMP State (as of August 2026 — CR26)

> ⚠️ **CR26 (FedRAMP Consolidated Rules for 2026)**: FedRAMP has restructured its authorization framework. FIPS 199-based baseline labels (Low/Moderate/High/LI-SaaS) are replaced with **Certification Classes A–D** (per notice NTC-0004; CR26 rules valid through December 31, 2028). Class labels change the *names* of the baselines, not their requirements. CSPs already authorized under the old labels retain their authorization through a transition period in which old and new labels are linked.

• **Baseline**: NIST SP 800-53 **Rev 5** (fully in effect)
• **Control counts** (Rev 5): Low ≈ 156, Moderate = 323, High = 421 (legacy references; CR26 class-based counts being published by PMO)
• **CR26 Certification Classes** (official mapping, NTC-0004): **A** = new pilot/transitional baseline (entry via external frameworks such as SOC 2 Type II through Program Certification; holders have a 2-year window to obtain B/C/D), **B** = current **LI-SaaS + Low** baselines, **C** = current **Moderate** baseline (majority of federal deployments, incl. CUI), **D** = current **High** baseline.
• **FedRAMP 20x**: Now the **primary authorization pathway** — continuous authorization built on **Key Security Indicators (KSIs)**, machine-readable evidence, modular API-driven submissions, and automated validation. Traditional SSP/SAP/SAR templates remain for legacy paths.
• **CR26 status**: finalized **June 25, 2026**; optional early adoption since **July 4, 2026**; **mandatory January 1, 2027**.
• **Legacy FedRAMP Ready**: the Ready designation was retired/relabeled **Legacy FedRAMP Ready on July 28, 2026** — no new submissions. Rev5 Ready holders must convert by the later of their annual-assessment expiration or **November 17, 2026**; the status disappears entirely **December 31, 2027**.
• **Certification Class pipelines**: **Class A open since August 3, 2026**; Classes **B/C open August 31, 2026**; Class D pilot expected late 2026 with a formal option in early 2027.
• **Rev5 wind-down**: new Rev5 applications are not accepted after **June 11, 2027**; Rev5 sunsets **December 31, 2028**.
• **JAB P-ATO**: Fully suspended; FedRAMP PMO is the sole authorization body.
• **Machine-readable mandate (RFC-0024/NOTICE-0009, operationalized in CR26)** — applies to the **Rev5 process only, explicitly NOT to FedRAMP 20x**: **since 2PM ET September 30, 2026 (now in force)**, NEW Rev5 initial-certification packages must be machine-readable with **no grace period** (including packages already In Process for agency authorization) [LMR-GEN-ICR]; existing Rev5-certified providers must submit a full machine-readable package at **each annual assessment completed after that date** [LMR-GEN-OAR]. Approved formats: **NIST OSCAL, or any public-domain standardized format that 5+ certified CSPs agree to maintain** (FedRAMP-validated); CR26 JSON schemas and a validator are published. Human-readable versions must still be produced on request. Non-compliance: public notification until **2PM ET September 30, 2027**, then **certification revocation**.
• **Security Inbox**: All authorized CSPs must maintain a dedicated Security Inbox (no CAPTCHAs or barriers) for urgent vulnerability directives — effective January 5, 2026.
• **Key templates updated**: SSP, SAR, SAP, POA&M, CIS/CRM, IIW, ISCP — all updated to align with Rev 5 (Dec 2024 releases).

---

1. Readiness & Gap Assessment

Approach

1. **Clarify scope** — Ask the user: What is the CSO (Cloud Service Offering)? IaaS/PaaS/SaaS? Target Certification Class under CR26? 2. **Identify authorization path** — FedRAMP 20x (primary, preferred) vs. legacy Agency Authorization package (still available for complex systems during CR26 transition) 3. **Run through the readiness checklist** — See `references/readiness-checklist.md` 4. **Surface gaps** — Map current state to required controls; flag missing documentation, unimplemented controls, and architectural deficiencies 5. **Prioritize** — Group gaps by: (a) blockers for readiness review, (b) items addressable before 3PAO assessment, (c) POA&M candida