Skip to main content
Thread: #146 Rev5 questions and discussion on the Consolidated Rules for 2026 (or Legacy), opened by pete-gov on 2026-06-24 and still open. This digest covers staff posts through 2026-10-28. Last reviewed: 2026-10-29 against upstream release 2026.10.14.01. Staff answers are paraphrased. Follow each link for the exact wording. Staff statements don’t change the published rules. Where they conflict, the official rules govern.

​
Bottom line

FedRAMP staff treat the Consolidated Rules for 2026 (CR26) as mandatory for every Rev5 provider on the dates in the Rev5 deadlines table. If you miss a “maintaining” date, expect a corrective action plan and an In Remediation status. If you miss the grace date, expect revocation. Vulnerability detection and response (VDR) and vulnerability evaluation and reporting (VER) come first, on 2026-12-07. When you adopt them, POA&Ms give way to VER reports, and staff expect you to handle the switch as a significant change. FedRAMP stops accepting new Rev5 certifications, including uplifts, on 2027-06-11.
How staff are identified. The thread lists pete-gov (FedRAMP Director), nicole-gov, dan-fedramp, paulagosta, emu-gov and rhoesing as FedRAMP responders. The dataset also marks four posts by nathan-gov as official, only because the login ends in -gov. That account isn’t on the thread’s staff list, and all four posts are questions. This page shows them as questions, not FedRAMP positions.

​
Deadlines, grace periods and enforcement

pete-gov, 2026-06-25 (comment): Each ruleset has its own timeline at the top of the ruleset. The VDR and VER rulesets carry the NTC-0014 dates: 2026-12-07 to obtain or maintain certification, and a grace period ending 2027-03-07. This matches current upstream (VDR, VER).
emu-gov, 2026-07-09 (comment): The “obtaining” dates apply to new submissions and class changes, such as an uplift. Anything submitted on or after 2027-01-01 must conform to the new rules or risk denial.
emu-gov, 2026-07-10 (comment): Addressing FedRAMP communication (AFC) and the secure configuration guide (SCG) are already required. Their grace period ended 2026-07-01. Optional early adoption of CR26 started 2026-07-04. Packages submitted before 2027-01-01 may mix legacy Rev5 and CR26. The provider, assessor and agency agree on the mix, keeping the obtaining dates in mind.
emu-gov, 2026-07-16 (comment): The rules have fixed dates. FedRAMP will try to be reasonable about real extenuating circumstances, but don’t count on leniency if you haven’t started on VDR and VER.
emu-gov, 2026-07-30 (comment): If a Rev5 Class C provider doesn’t implement CR26, the consequence is a corrective action plan, then revocation of FedRAMP Certification, on the dates in the important deadlines.
paulagosta, 2026-10-19 (comment): FedRAMP has revoked a few certifications or authorizations for failures to adhere to FSI quarterly testing. Staff pointed to Notice 16 and its initial warning, and said several of those providers are no longer on the Marketplace.
pete-gov, 2026-10-15 (comment): Ready Conversion providers must fully implement all CR26 rules required for a new Rev5 Certification, with a built-in grace period of about six weeks in place of 2027-01-01. All other grace periods apply only to providers that already hold a FedRAMP Certification. FedRAMP Ready isn’t one.
pete-gov, 2026-10-28 (comment): Asked whether a Ready Conversion assessor may use a penetration test from a third party that isn’t a FedRAMP-recognized assessor, staff said CR26 doesn’t require a penetration test from a FedRAMP-recognized independent assessor. You can include another assessor’s results in your Vulnerability Detection and Response activity reports. If you submit under the legacy rules and convert to CR26 by February, staff said they will accept a POA&M or finding for lacking a recognized penetration test. You would document what you did instead and why you see no significant resulting risk, and the finding goes away after you switch. The answer doesn’t speak directly to whether the assessor may review and incorporate the results, and the rules don’t address the legacy-rules arrangement.
pete-gov, 2026-10-20 (comment): FedRAMP will learn whether you’ve implemented CR26 by looking at the materials you produce under collaborative continuous monitoring and other rulesets. Staff said it will be obvious fairly quickly if providers aren’t supplying them. All the significant change rules apply, and many significant changes don’t need independent assessment.
pete-gov, 2026-10-21 (comment): For an active Rev5 provider, 2027-08-01 is when a service goes into remediation and needs corrective action under the trust center (CDS) rules, though staff strongly discourage waiting. The ruleset’s own grace date is 2028-02-01. See Certification data sharing.
pete-gov, 2026-10-22 (comment): FedRAMP will confirm VDR implementation by asking you and reviewing your required VDR and VER activity reports. It won’t evaluate progress along the way. Full implementation is expected by 2026-12-07, and if you miss it you supply a corrective action plan to finish by 2027-03-07. Staff warned that the grace period covers FedRAMP Certification only, and that agencies must report on BOD 26-04 compliance by 2026-12-07.
pete-gov, 2026-10-26 (comment), asked whether “full implementation” of VDR means meeting every SHOULD: Full implementation means all applicable rules are addressed. Addressing a rule means you show you read and understood it and implemented what it takes to follow it and explain how, or you document a decision not to follow it and your reasoning (see Implementing the rules). This is for FedRAMP Certification only, and agency contracts or customers may expect more. For the December 2026 activity report, he said you submit it with that month’s continuous monitoring, the same way as other ConMon information. For response times to FedRAMP requests he pointed to the Addressing FedRAMP communication rules, whose grace period has ended.
pete-gov, 2026-10-26 (comment, follow-up) and 2026-10-27 (comment), on when an annual assessment must use CR26 materials:
  • Each ruleset has its own maintaining and grace dates, summarized on the Rev5 deadlines page. Some are mandatory regardless of assessment timing. The CCM rules for the OCR are mandatory for everyone on 2027-04-02.
  • For an assessment starting on 2027-07-31, staff said the grace period has ended for AFC, SCG, MKT, VDR, VER, CMU, IEC and SCN. It runs through the independent assessment for FRC, IVV, MAS and CPO. You can still wait on CCM, CDS and SDR.
  • By the end of 2027 everything is switched over for everyone, except CDS.
  • Staff strongly encourage adopting all CR26 rules before your next independent assessment.
  • There is no cut-over date for legacy packages. Staff expect mixed packages and said that is intended. You can add supplemental documents or Verification: statements to the SSP, with no template. See It’s not a trap.
  • The 2026-10-26 comment first gave a wrong CPO date, and staff corrected it. On 2026-10-27 staff said the dates in each ruleset are accurate and the rules are the source of truth. The Rev5 CPO grace period is 2027-07-01, as noted above.
paulagosta, 2026-08-06 (comment): The VDR and VER dates follow the 180-day timeline in CISA BOD 26-04. If you miss a maintaining date, expect a corrective action plan with a fix date no later than the grace date, and a “deficient” flag on the Marketplace. After the grace period, expect removal. “First FedRAMP independent assessment” means initial and annual assessments, not significant change assessments. The grace date depends on when the assessment starts, not when it’s due. For example, if your annual assessments start in November, rules with an “assessment started after 2027-01-01” grace date apply at your November 2027 assessment.
paulagosta, 2026-08-19 (comment): FedRAMP will check status mostly through the quarterly FedRAMP Security Inbox (FSI) tests. On the Rev5 side, only the CDS ruleset requires you to tell FedRAMP when you transition. For the five rulesets whose grace period is tied to the assessment start date, FedRAMP will ask for your planned timeline around the maintaining date.
The same comment said the Rev5 CPO maintaining date was 2027-01-01. The current Rev5 deadlines list a maintaining date of 2027-07-01 for CPO, with the grace period ending “On the first FedRAMP independent assessment started after 2027-07-01.” See the next notes.
paulagosta, 2026-08-26 (comment) and 2026-08-27 (comment): For the five rulesets tied to your annual assessment, your grace period runs to your next assessment. Your plan and timeline should fit within 12 months of your last assessment, and you should be able to show them at the maintaining date, most likely through the next FSI test. For those five rulesets, you won’t get a corrective action plan just for timing. You may move your annual assessment cadence earlier, but not later, and you must keep the earlier cadence in later years.
pete-gov, 2026-08-27 (comment): The 20x and Rev5 CPO dates are meant to differ. The Rev5 CPO grace period should end at the first FedRAMP independent assessment after 2027-07-01, not 2027-01-01.
Since applied upstream. Release 2026.09.13.02 moved the Rev5 CPO grace date to 2027-07-01 (upstream changelog). The current Certification package overview Rev5 block shows maintaining 2027-07-01 and grace “On the first FedRAMP independent assessment started after 2027-07-01.”
pete-gov, 2026-09-11 (comment): The December 7 deadline follows CISA BOD 26-04. What FedRAMP does afterward depends on how CISA responds across government. After 2026-12-07, FedRAMP will request a corrective action plan showing how you’ll meet VDR and VER. Providers that don’t meet the rules move to In Remediation, and FedRAMP tells their agencies. After 2027-03-07, FedRAMP will revoke certification for providers that still don’t meet VDR and VER. In a follow-up on 2026-09-13, he noted that FedRAMP used In Remediation after NOTICE-0016.
pete-gov, 2026-10-05 (comment), answering a question about readiness for 2026-12-07:
  • All applicable VDR and VER rules must be addressed by that date.
  • The reports required under the VER Reporting subset are enough evidence until you update your SDR.
  • Updating the SSP, ConMon procedures or SDR by December 7 isn’t required, but staff recommend it.
  • You adopt and operate VDR and VER by December 7. Independent verification and validation comes later, in your normal assessment cycle.
  • A SHOULD rule counts as met if you address it, explain your decision and identify the risk to agency customers. See force of the rule.
paulagosta, 2026-09-22 (comment, clarification): For initial certifications, the legacy initial package checklist now asks which CR26 rulesets you conform to, with evidence locations. For providers with an active certification, FedRAMP checks CR26 status through the quarterly FSI tests instead.
pete-gov, 2026-09-22 (comment): For an annual assessment that runs from October to December 2026, the provider and assessor should implement as much as they can within scope, so they don’t have to repeat it soon after. Every CR26 rule is open to early adoption, and every Rev5 ruleset has a grace period. For rulesets tied to the start of the next assessment, such as SDR, you can adopt now or wait until your next assessment starts.
pete-gov, 2026-10-13 (comment): If you start a legacy Rev5 annual assessment in November 2026 and submit it in March 2027, FedRAMP will accept it to maintain certification, as long as you also meet each ruleset’s maintaining dates. Staff discourage delaying adoption.

​
Scope of CR26 for Rev5, packages and certification paths

pete-gov, 2026-10-27 (comment): FedRAMP expects packages that mix legacy Rev5 and CR26 approaches during the transition. Staff said it’s temporary, and that FedRAMP chose incremental adoption over a fixed cut-over date years away, accepting the churn. Staff said providers and assessors can’t simply put everything off. A community member’s recap (starting in 2027, create CR26 packages and substitute interim items for rulesets not yet due) is community context, not a FedRAMP position, and no staff reply confirmed it. The published dates in the Rev5 deadlines govern.
emu-gov, 2026-08-20 (comment): A Rev5 certification needs only the rules with Rev5 applicability. All 15 rulesets apply to both Rev5 and 20x. The big difference is controls (Rev5) versus Key Security Indicators (20x). Each subset’s applicability (type, path, class, audience) tells you which rules are in scope, and some rules also vary by class.
paulagosta, 2026-08-24 (comment): For Lost Sponsor and Ready Conversion providers, assessment results now go in the certification package overview (CPO) and security decision record (SDR). IVV-IAS-SUM says no separate SAP or SAR is required.
paulagosta, 2026-08-24 (comment): FedRAMP won’t accept a Rev5 uplift or net-new certification after 2027-06-11, whenever you entered the agency pipeline. pete-gov said the same on 2026-07-31 (comment): you must have applied by 2027-06-11, and anything still In Process after that date can’t finish. See also the timeline.
paulagosta, 2026-08-06 (comment): This answered a question about a Rev5 Class D service that isn’t cloud-native and has no 20x path yet. Rev5 certifications remain as long as you meet your FedRAMP obligations and transition to the CR26 rulesets. Other services can still leverage the offering. Your listing stays active unless you stop meeting your obligations, ask to leave, or FedRAMP retires Rev5. An RFC on 20x Class D was pending at the time. It was later published as RFC-0033 (see RFC history).
pete-gov, 2026-10-07 (comment): FedRAMP has no DISA reciprocity path. DISA or your agency ATO holder can sponsor a Rev5 agency certification, or you can build a 20x package and apply for program certification.
pete-gov, 2026-10-08 (comment): All Li-SaaS authorizations are grandfathered into Rev5 Class B for now. The plan is for them to move to 20x Class B or full Rev5 Class B, and an RFC is expected. Until then, continue with legacy Li-SaaS. Migration timelines will give at least a year of runway. CR26 lets new certifications reuse recent assessment results and focus on what changed.

​
Vulnerability detection and response (VDR)

Rules page: Vulnerability detection and response.
pete-gov, 2026-09-13 (comment): VDR-TFR-NMV means you verify and validate documentation, personnel and budgets every 3 months. Verify means collect evidence that they’re followed. Validate means check that the evidence shows they’re followed correctly. That’s separate from the review and update cadence for policies under the Rev5 “-1” controls. Tracking last-verified dates in your minimum assessment scope inventory makes sense, and you summarize this work in your VDR activity reports.
dan-fedramp, 2026-08-14 (comment): VDR-CSO-SIR lets you monitor a sample of identical resources, such as containers from the same image, instead of every instance. Sampling is always optional. VDR-TFR-PSD sets the detection cadence, which you can meet by scanning everything or by scanning samples.
pete-gov, 2026-09-08 (comment): Under VDR-TFR-PVR, a successful mitigation leads to a new evaluation, and the clock resets from that evaluation. Example: if you evaluate a vulnerability on 9/2 and lower its PAIN on 9/18, the new deadline is 9/18 plus the timeframe for the new rating. The goal is to mitigate first. The timeframes are worst cases.
pete-gov, 2026-10-08 (comment): FedRAMP doesn’t prescribe how to apply VDR-CSO-DET to software composition analysis, code scans or SBOMs. You choose the approach, then document and share it. Staff strongly recommend grouping at scale to reduce noise.
pete-gov, 2026-10-13 (comment), on existing vulnerabilities at transition: VDR deadlines run from evaluation, not detection. You must report the gap between detection and evaluation and start evaluating promptly. A longer gap during the transition is fair. Start evaluating your backlog now, prioritize what’s serious, then report.
pete-gov, 2026-10-14 (comment): This answered a question from nathan-gov about long-standing POA&M milestones agreed with agencies. Most can move over and be tracked as accepted vulnerabilities. No FedRAMP rule requires agency concurrence to accept vulnerabilities after initial certification, but your contracts might.
pete-gov, 2026-10-20 (comment) and 2026-10-22 (follow-up): Detection time is when the detection system found the vulnerability, not when a later system processed it. The VDR-TFR-PVR timelines run from evaluation. Whether IaC-managed resources are unlikely to drift is for your engineering team to decide. If a vendor fix isn’t available, mitigate instead of only accepting the vulnerability, and explain the risk and impact to customers if you don’t. A fully mitigated KEV still needs remediation, and the staff comment gave 14 days. VDR-TFR-KEV is a SHOULD that follows the CISA catalog due dates and doesn’t state 14 days, so the published rule governs. In the follow-up, staff said the SHOULD can rest on valid technical reasons you can’t compensate for, but agencies may not accept them.

​
Incident communications

Rules page: Incident evaluation and communication.
pete-gov, 2026-10-21 (comment): Confirmed the three routes for incident reports: email fedramp_security@fedramp.gov, follow each agency’s own procedure, and post to the trust center or USDA Connect for all necessary parties. Many agencies write notification expectations into the procurement agreement, usually as an email address.
pete-gov, 2026-10-28 (comment): A community member pointed out that the IEC-CSO-IIR, IEC-CSO-OIR and IEC-CSO-FIR rule statements say to notify “FedRAMP and directly impacted federal customer agencies,” while the notification requirement also lists “all necessary parties” through the trust center. Staff called that an oversight, because these rules don’t require notifying all necessary parties. They opened FedRAMP/Rules#47 and said they will make that notification optional. Posting incident information in the trust center remains helpful but is up to you. Staff also said an incident notification must not enable a threat actor, so sanitize it as appropriate. In most cases posting incident reports publicly should be fine. In rare cases where even the existence of an incident could create a threat, share it carefully with affected parties only. This is a stated plan, and the upstream text hasn’t changed yet, so the published rule governs until FedRAMP updates it. It refines the 2026-10-21 note above.

​
Vulnerability evaluation and reporting (VER)

Rules page: Vulnerability evaluation and reporting.
pete-gov, 2026-10-28 (comment): Asked whether using only exploitability, reachability and PAIN would fall short of VER, staff said the VER-EVA-EFA factors help you do the evaluations the other rules require. It isn’t either-or, and you can’t accurately judge likely exploitability under VER-EVA-ELX without considering the relevant factors. Staff said PAIN isn’t a ninth factor: reachability and exploitability are inputs, while “internet reachable,” “likely exploitable” and PAIN are outcomes. Staff also pointed to the “It’s Not a Trap” section of the rules overview. For SHOULD rules, do what your engineers support, be ready to explain why it’s technically right, and FedRAMP isn’t going to nitpick. The published VER-EVA-EFA is a SHOULD.
pete-gov, 2026-09-10 (comment) and 2026-09-11 (comment): Under VER-EVA-EPA, PAIN is the cumulative effect on the federal government. A disruptive effect on more than one agency is N4. Derive it from your inventory with a rules engine where you can. If you have only one agency customer, N5 can’t apply. With no agency customers there’s no PAIN, but staff expect serious providers to simulate it. Rating everything as if it affects multiple agencies is acceptable and conservative.
pete-gov, 2026-09-28 (comment): A vulnerability doesn’t simply inherit its component’s PAIN. Start from the worst case, then lower the rating for the vulnerability’s actual technical impact. Staff “STRONGLY” encourage rating below the component’s ceiling when the effect is narrower. Don’t lower PAIN for reachability or exploitability. Those are separate evaluations under VER-EVA-ELX and VER-EVA-EIR.
pete-gov, 2026-10-02 (comment): Once VER-EVA-EFP finds a false positive, the other evaluations are done: exploitability, reachability and PAIN are all null. You can report them as not applicable. One option is to report false positives as accepted vulnerabilities in a “false positive” group under VER-EVA-GRV. He said he’d clarify VER-EVA-EPA to allow PAIN 0 or N/A.
pete-gov, 2026-10-26 (comment), on reporting false positives under VER-EVA-EFP: FedRAMP has no specific guidance, because several approaches fit. False positives are in VER-RPT-PER and the vulnerability details report by default. In VER-RPT-VDT you can mark fields not applicable and flag the false positive in the supplementary information item. VER-EVA-GRV lets you keep one “false positives” group. N0 is a reasonable but not mandatory outcome, and you should still flag the finding as a false positive. The comment wrote VDR-RPT-VDT once. The published rule ID is VER-RPT-VDT.
pete-gov, 2026-10-15 (comment): The CVSS user interaction metric doesn’t by itself show that a vulnerability isn’t automatable under VER-EVA-AIA, but you can use it as evidence. A flaw that needs a specific action on one terminal you’ve walled off is probably not automatable. A flaw that only needs someone to open an email attachment still is, because “someone is gonna open that email.” In general, high user interaction requirements are likely to reduce automatability.
nicole-gov and pete-gov, 2026-10-27 (nicole-gov, pete-gov), answering a community question on how to set PAIN ratings:
  • Follow finalized rules, not what an RFC proposed. The community member noted that RFC-0031 defined N-ratings by adverse effect on agency operations, while the final rules use customer-effect definitions.
  • You don’t need to know how agencies use your service in detail, only that agencies use it. You must give customer agencies timely information about vulnerabilities that may affect them. Agencies then decide which compensating controls to implement.
  • A vulnerability that could cause a complete outage across multiple agencies doesn’t automatically get N5. VER-EVA-EPA defines N5 as a debilitating customer effect on more than one agency. That means interrupting use for most users, or compromising most federal customer data. If the service isn’t doing mission-critical work, so it isn’t likely to affect most users or most data, staff said you would not evaluate it as N5. Staff gave a narrow customer effect on one or more agencies, rated N2, as the more likely result.
  • The definition says an unknown customer effect should be treated as debilitating until proven otherwise.
Since applied upstream. On 2026-10-05, VER-EVA-EPA added N0 (“Exploitation is extremely unlikely to have any adverse effects on agencies”). See the rule.
paulagosta, 2026-08-24 (comment): Once you transition to VDR and VER, POA&M requirements go away. They’re replaced by the vulnerability details report (VER-RPT-VDT) and a human-readable monthly report (VER-TFR-MHR). Agency meetings become quarterly under CCM-QTR-MTG.
paulagosta and pete-gov, 2026-09-11 (Paul, Pete, Pete follow-up), on agencies that still ask for a legacy POA&M or SSP:
  • Agencies may add needs beyond FedRAMP through their contracts.
  • Treat these requests as customer experience. A legacy-format POA&M export is a trivial request that doesn’t affect your certification.
  • The CPO and SDR carry most of what an SSP held.
  • Agencies build their own POA&Ms from provider information. They shouldn’t copy yours.
paulagosta, 2026-10-02 (comment, follow-up): This answered nathan-gov’s question about providers that haven’t moved to a CDS trust center. Keep using your current ConMon sharing method, which for most Class B and C providers is USDA Connect. Posting the VER-TFR-MRH JSON there on the required cadence is acceptable for now. The long-term goal is programmatic access. FedRAMP won’t create new Connect folders. Document where the files go in your SCN or SCR for the VDR and VER transition, or in your monthly ConMon brief.

​
Significant changes when adopting VDR and VER

Rules page: Significant change notification.
paulagosta, 2026-08-26 (comment):
  • Moving to VDR and VER will likely affect controls such as CA-1, CA-5 and CA-7. Treat it as a significant change, whether you follow the SCR or SCN process.
  • Most of these changes are expected to be adaptive, but it depends on your changes. See the “Tips on adaptive changes” in SCN-ADP-NTF.
  • Evidence of compliance will show in your repository and ConMon outputs.
  • Paul would recommend going straight to delisting, with no corrective action plan, for anyone who knowingly misrepresents their status.
nicole-gov, 2026-10-05 (comment): Implementing VDR and VER is likely a significant change to how you handle and report vulnerabilities. It should trigger the significant change ruleset so customers learn about the changes, impacts and timelines.

​
Security decision record and independent verification and validation

Rules pages: Security decision record, Independent verification and validation.
dan-fedramp, 2026-09-01 (comment): You may organize SDR responses however communicates best, including combining fields. Don’t use SDR-CSO-FRR and SDR-CSF-CTF to re-list every response. Your answers to those rules should describe the process that keeps the SDR compliant. For example, implementation could be your GRC tool generating the SDR, verification a completeness script, and validation that script’s output.
pete-gov, 2026-10-13 (comment, follow-up): Follow the rules, not the schema notes. SDR-CSO-FRR and SDR-CSF-CTF require both an explanation of how you verify and validate and the results of doing it.
paulagosta, 2026-08-27 (comment) and 2026-08-26 (comment): For Rev5 controls assessed under legacy methods in the past 3 years, use item 8 of SDR-CSF-CTF (responses or clarifications to independent comments) to separate earlier results and give the assessment date. Pull from earlier SSPs and SRTMs. You may keep existing control parameter values. Changes should go through significant change.
paulagosta, 2026-08-26 (comment): Under the CR26 IVV ruleset, test methods aren’t prescribed. Assessors choose them using SP 800-53A as a guide, and may still use the old SRTM test types. Under legacy templates, keep the SRTM methods and document any deviation in SAP section 5.1.
pete-gov, 2026-10-13 (comment, follow-up): IVV-IAS-SUM is the assessor’s summary for each FedRAMP Practice. It tells the assessor to supply items 4 and 5 (independent verification and validation) of SDR-CSO-FRR. IVV-IAS-OSA is the summary of the whole assessment.
pete-gov, 2026-10-15 (comment): How the assessor reports on IVV-IAS-VIP and gets access to the final package is for the provider and assessor to settle in their contract. The provider is responsible for meeting the rules.
pete-gov, 2026-09-23 (comment): FedRAMP uses verification and validation in the ISO sense. Verification confirms something is actually there. Validation confirms it’s suitable for its intended use and works. Pete said test of design and test of effectiveness don’t map one-to-one and mostly fall under validation. He called this an informal reading.

​
Certification data sharing and trust centers

Rules page: Certification data sharing.
pete-gov, 2026-07-31 (comment): The trust center rules, including CDS-TRC-USH, are deliberately minimal. If agencies routinely tell FedRAMP they can’t get the access they need, FedRAMP is likely to conclude the rules aren’t met. Staff prefer a high-quality customer experience over minimal compliance.
pete-gov, 2026-10-07 (comment): CDS-CSO-PUB makes providers own their public information. FedRAMP imports it into the Marketplace, and agencies can pull it straight from you.
pete-gov, 2026-10-21 (comment): A third-party trust center vendor doesn’t need a FedRAMP certification, at Class D or any class. The Minimum Assessment Scope doesn’t require FedRAMP Certified third-party resources, but you must address their potential impact on federal customer data. If you manage package information responsibly, the trust center could sit outside the scope entirely.

​
JSON schemas

pete-gov, 2026-06-27 (comment) and 2026-10-02 (comment): CR26 schemas are deliberately minimal. Whether the schema marks a field optional or required says nothing about whether the rules require that information. Follow the written rules, not templates or schemas. For example, the SCN schema doesn’t list every item in SCN-CSO-INF, but the rule still applies.
dan-fedramp, 2026-06-30 (comment) and pete-gov, 2026-09-16 (comment): Each schema includes the CPO URI so you don’t repeat offering metadata. If your CPO isn’t ready when other reporting rules take effect, you have flexibility. Pete suggested pointing the URI at a page showing implementation status.

​
Other staff posts

  • pete-gov, 2026-06-25 (comment, fix): A fedramp.gov bug briefly returned 404 errors on CR26 links. Staff fixed it the same day.
  • paulagosta, 2026-08-25 (comment) and 2026-08-26 (comment): an event pointer and a hand-off to dan-fedramp. Neither is a rule position.

​
Open questions

These were still unanswered in the thread as of 2026-10-14:
  • Whether the rule text for VDR-TFR-PSD should change so it doesn’t say “representative samples” when sampling is optional (community follow-up). The current rule text is unchanged.
  • Whether the Rev5 control guidance should note that VDR-TFR-NMV applies to documentation controls (community follow-up).
  • At the first assessment under the new IVV rules, which controls are in scope: the full baseline or the annual subset (question).
  • Whether all providers will have to adopt 20x by 2028 (question).
  • Whether an existing DISA assessment can cut the effort for a Rev5 agency certification, and whether Initial Implementation listing is available meanwhile (question).
  • Whether the initial package checklist should use the assessment start date for MAS, CPO and SDR, and whether VER reports alone can close a low POA&M item (question).

​
What it means for you

  • Plan to meet every applicable VDR and VER rule by 2026-12-07. Staff say the VER Reporting outputs are your evidence until you update your SDR.
  • Handle the VDR and VER transition through your significant change process (SCN or legacy SCR). Record where your new reports live.
  • Check your own dates against the Rev5 deadlines. For FRC, IVV, MAS, CPO and SDR, the grace period ends at the first independent assessment started after the listed date.
  • If you plan a Rev5 uplift or new Rev5 certification, it must reach FedRAMP before 2027-06-11.
  • For SDR-CSO-FRR and SDR-CSF-CTF, give both your method and its results, and follow the rule text rather than the schema.
  • “Full implementation” means addressing every applicable rule, including SHOULD rules, by implementing it or documenting your decision and reasoning. Submit the December 2026 activity report with that month’s ConMon.
  • Expect mixed legacy and CR26 packages in 2027. Check each ruleset’s own dates and add supplemental material for the rulesets you have adopted.