Skip to main content
This page tracks two things: changes FedRAMP makes to the Consolidated Rules for 2026, and changes to this site. Each upstream entry summarizes FedRAMP’s own changelog and links the official rules and our summaries. The official changelog governs if anything here differs. Each entry starts with its date. For an upstream release, that’s the date FedRAMP published it.
​
Site changes
Date: 2026-11-01
  • Site: the knowledge base is now Sequencer Knowledge Docs, published by Sequencer Assurance at sequencerassurance.com/docs, with a new design. No rule summaries or digests changed.
  • Review: nightly updates that pass automated checks are now published without a person reviewing them first. Anything else still waits for review. See How this site stays current.
​
Discussions 2026-10-30
Date: 2026-10-30
  • Rules: no upstream rule text changed since release 2026.10.14.01. No rule summaries were edited.
  • Discussions: RFC-0035 has a new community comment, which raises gaps about justifying non-CMVP-validated modules, a baseline for them, downgrade prevention and key management. It isn’t a FedRAMP staff position, and there are still no staff answers in the thread. RFC-0035 remains a proposal. The published CMU-CSO-UVM text governs. See RFC history.
​
Discussions 2026-10-27 to 2026-10-28
Date: 2026-10-29
  • Rules: no upstream rule text changed since release 2026.10.14.01. Staff notes were added to Incident evaluation and communication, VER and FedRAMP certification.
  • Discussions: new staff positions in #146 on the incident report notification oversight (IEC-CSO-IIR, IEC-CSO-OIR and IEC-CSO-FIR; FedRAMP plans to make notifying all necessary parties optional, and the published rule still governs until it changes), the VER-EVA-EFA evaluation factors and penetration tests for Ready Conversion. See the Rev5 digest.
  • RFCs: RFC-0033 gained two late third-party comments that FedRAMP relayed. They are community input, not staff positions. See RFC history.
​
Discussions 2026-10-27
Date: 2026-10-28
  • Rules: no upstream rule text changed since release 2026.10.14.01. A staff note on N5 was added to VER, which summarizes VER-EVA-EPA.
  • Discussions: new staff positions in #146 on PAIN ratings (follow the final rules, not RFC-0031, and a non-mission-critical service isn’t automatically N5) and on mixed legacy and CR26 packages during the transition. See the Rev5 digest.
​
Discussion #146 update
Date: 2026-10-27
  • Rules: no upstream rule text changed since release 2026.10.14.01. Staff notes were added to VER and Certification package overview.
  • Discussions: new pete-gov positions in #146 on what “full implementation” means for SHOULD rules, the December 2026 activity report, false-positive reporting, and mixed legacy and CR26 packages in 2027. See the Rev5 digest.
​
Discussion #186 staff answer
Date: 2026-10-26
  • Rules: no upstream rule text changed since release 2026.10.14.01.
  • Discussions: pete-gov answered #186 on 2026-10-25: the FedRAMP Marketplace is the only official source of FedRAMP status, and FedRAMP can’t stop other claims unless they say “FedRAMP Certified” or “FedRAMP Authorized.” Added to Notable staff answers.
​
Discussions 2026-10-24 to 2026-10-25
Date: 2026-10-25
  • Rules: no upstream rule text changed since release 2026.10.14.01. No rule pages changed.
  • Discussions: RFC-0035 gained two community comments. It still has no staff comments, so RFC history only notes the comment status. A new thread, #186, asks whether a “FedRAMP Compliant” logo is allowed for providers not on the Marketplace. It has no staff answer, so no page was added.
​
Discussions 2026-10-15 to 2026-10-22, and staff flags corrected
Date: 2026-10-24
  • Rules: no upstream rule text changed since release 2026.10.14.01. Staff notes were added to VDR, VER, Minimum assessment scope, FedRAMP certification, Certification data sharing and Incident evaluation and communication.
  • Discussions: new staff positions in #146 and #147, covering VDR timing and KEVs, user interaction as VER-EVA-AIA evidence, Ready Conversion grace, incident report routes, trust center vendors and how FedRAMP will check VDR by 2026-12-07. See the Rev5 digest and 20x digest. New threads in Notable staff answers: #182 (no rule requires 90 days of ConMon data), #183 (metadata and MAS-CSO-MDI), #184 (Class A SOC 2 Type II boundary) and #181 (RFC side thread).
  • RFCs: RFC-0035 has community comments but no staff answers, and the new RFC-0036 (20x Class D pilot) is open until 2026-11-19. Both are proposals, not rules. See RFC history.
  • Staff flags: the sync re-flagged posts by emu-gov, a FedRAMP staff login that hid its org membership, as official. This affects 33 threads. Pages already treated emu-gov as staff, so most needed no change. Notable staff answers now covers four 2026 threads that were missing: #167 (Class B and C submission rejection reasons), #161 (no NDAs for Trust Center access), #155 (Class A submission steps) and #141 (event announcement).
​
Site correction
Date: 2026-10-23
  • Discussions: in Rev5 CR26 questions, the IVV-IAS-VIP staff position now links pete-gov’s 2026-10-15 repost. The 2026-10-14 comment it linked before was removed from GitHub. The guidance didn’t change.
​
Upstream 2026.10.14.01 and site launch
Date: 2026-10-14
  • Rules: no rule text changed. FedRAMP improved search on its site: machine-generated rulesets are now excluded from search except the Ruleset Reference, and per-rule changelogs are hidden from search results.
  • Control mappings: the per-rule changelogs in this release record control-mapping updates dated 2026-10-13 on 35 FRR rules and 40 Key Security Indicators. FedRAMP’s release notes don’t mention them. See FRR and KSI and the official Key Security Indicators page.
  • Site: launched this knowledge base, checked against upstream release 2026.10.14.01. It published the Rule summaries, including a provider’s step-by-step path through every ruleset, Provider deliverables, FRR and KSI and a summary page for each ruleset, and the discussion digests, which separate FedRAMP staff positions from community comments.
​
Upstream 2026.10.08.01
Date: 2026-10-08
  • Rules: FedRAMP described this release as typos and convenience only, but it includes two rule changes for 20x providers:
    • Removed FRC-CSX-MOT (Metrics Over Time for Key Security Indicators) as duplicative of SDR-CSX-KMT. See FedRAMP certification.
    • Changed SDR-CSX-KMT (Key Security Indicator Metrics) from MUST to SHOULD for Class B, and clarified that Class C daily metric data includes the status of persistent validation. The forces are now A: MAY, B: SHOULD, C: MUST, D: MUST. See Security decision record.
  • Content: added the FedRAMP Trigrams page, which explains the three-letter codes used in rule IDs.
  • Content: fixed “understand” to “understood” in the SHOULD NOT explanation on the Rules page and in the definition, after a community report in FedRAMP/2026 discussion #124.
​
Upstream 2026.10.05.01
Date: 2026-10-05
  • Rules: clarifications to seven rules. FedRAMP now tracks rule improvements as issues in the FedRAMP Rules repository.
  • Discussions: the FRC-CSO-JSN change follows FedRAMP staff comments by pete-gov on 2026-09-17 in discussion #175, which said FedRAMP planned to make clear that JSON must be directly consumable by web applications.
  • Content: adopted new social cards on the official site.
​
Upstream 2026.09.22.01
Date: 2026-09-22
  • Rules: no rule text changed.
  • Content: the Rev5 Deadlines and 20x Deadlines pages now explain how to apply each date. The labels on every ruleset changed: “Obtain” is now “Obtaining Initial Certification”, “Maintain” is now “Maintaining Ongoing Certification”, and “Grace Ends” is now “Grace Period Ends”. See Key dates.
​
Upstream 2026.09.13.02
Date: 2026-09-13