# Sequencer Knowledge Docs: FedRAMP 20x, CR26, and Community Discussions, Updated Nightly > Plain-English summaries of the FedRAMP Consolidated Rules for 2026 and what FedRAMP staff say about them, from Sequencer Assurance. - [Sequencer Knowledge Docs: FedRAMP 20x, CR26, and Community Discussions, Updated Nightly](https://sequencerassurance.com/docs/index.md): Plain-English summaries of the FedRAMP Consolidated Rules for 2026 and what FedRAMP staff say about them, written for cloud service providers. - [What changed](https://sequencerassurance.com/docs/changelog.md): Upstream FedRAMP rule releases and updates to this knowledge base, newest first. - [Rule summaries](https://sequencerassurance.com/docs/rules/index.md): How the FedRAMP Consolidated Rules for 2026 are organized, how to read them, and a provider's step-by-step path through every ruleset. - [Provider deliverables](https://sequencerassurance.com/docs/rules/provider-deliverables.md): Every FedRAMP rule that makes a provider produce a document, report, dataset, published data, form or notification, with its force and JSON schema. - [FRR and KSI](https://sequencerassurance.com/docs/rules/frr-and-ksi.md): How the FedRAMP process rules (FRR) and the Key Security Indicators (KSI) differ, how they connect, and where Rev5 control guidance fits. - [FedRAMP certification](https://sequencerassurance.com/docs/rules/fedramp-certification.md): How your cloud service offering obtains and keeps a FedRAMP Certification: the package, the application, Class A, class changes, and the 20x and Rev5 specifics. - [Certification package overview](https://sequencerassurance.com/docs/rules/certification-package-overview.md): Supply a short, consistent overview of your cloud service offering, in human-readable and JSON formats, as part of your FedRAMP Certification Package, and keep the package current. - [Security decision record](https://sequencerassurance.com/docs/rules/security-decision-record.md): Keep a verified and validated record, in human-readable and JSON formats, of how you meet each applicable FedRAMP rule, Key Security Indicator and Rev5 control. - [Minimum assessment scope](https://sequencerassurance.com/docs/rules/minimum-assessment-scope.md): Define your cloud service offering as every information resource likely to handle, or likely to affect the security of, federal customer data, and document its flows and third-party dependencies. - [Certification data sharing](https://sequencerassurance.com/docs/rules/certification-data-sharing.md): Publish key offering information publicly and share your FedRAMP Certification Data with agencies and FedRAMP through a FedRAMP-compatible trust center. - [Marketplace listing](https://sequencerassurance.com/docs/rules/marketplace-listing.md): What you must publish and submit to get your cloud service offering, assessment service or advisory service listed in the FedRAMP Marketplace. - [Vulnerability detection and response](https://sequencerassurance.com/docs/rules/vulnerability-detection-and-response.md): Find every kind of vulnerability in your cloud service offering through persistent, mostly automated detection, then mitigate or remediate it within class-based timeframes. - [Vulnerability evaluation and reporting](https://sequencerassurance.com/docs/rules/vulnerability-evaluation-and-reporting.md): Evaluate every detected vulnerability for exploitability, internet-reachability and Potential Agency Impact, then report vulnerability activity to all necessary parties on a fixed cadence. - [Significant change notification](https://sequencerassurance.com/docs/rules/significant-change-notification.md): Classify every significant change to your cloud service offering as routine recurring, adaptive or transformative, and notify agency customers on the timeline each type requires. - [Incident evaluation and communication](https://sequencerassurance.com/docs/rules/incident-evaluation-and-communication.md): Promptly decide whether an incident is FedRAMP reportable, then send initial, ongoing and final incident reports to FedRAMP and affected agencies within class-based timeframes. - [Collaborative continuous monitoring](https://sequencerassurance.com/docs/rules/collaborative-continuous-monitoring.md): Publish an Ongoing Certification Report every 3 months and, depending on your class, host a Quarterly Review so agencies can monitor your service without bespoke requests. - [Addressing FedRAMP communication](https://sequencerassurance.com/docs/rules/addressing-fedramp-communication.md): Maintain a FedRAMP Security Inbox that reliably receives FedRAMP email, and complete the required actions in Emergency and Emergency Test messages within the stated timeframe. - [Key Security Indicators](https://sequencerassurance.com/docs/rules/key-security-indicators.md): The 46 security capabilities a FedRAMP 20x cloud service offering demonstrates, grouped into 10 themes, and how they vary by class. - [Secure configuration guide](https://sequencerassurance.com/docs/rules/secure-configuration-guide.md): You must publish guidance that tells customers how to securely set up and run the top-level administrative accounts and security settings of your service. - [Cryptographic module use](https://sequencerassurance.com/docs/rules/cryptographic-module-use.md): You must document the cryptographic modules that protect federal customer data, and how strongly you are expected to use validated modules depends on your class. - [Independent verification and validation](https://sequencerassurance.com/docs/rules/independent-verification-and-validation.md): How often you must be independently assessed, what evidence you must supply to assessors, and what assessors must give you for your certification package. - [FedRAMP recognition](https://sequencerassurance.com/docs/rules/fedramp-recognition.md): The rules independent assessors must follow to become and stay FedRAMP Recognized, and what that means when you choose an assessor. - [Agency use](https://sequencerassurance.com/docs/rules/agency-use.md): The rules agencies must follow when they authorize and use FedRAMP Certified cloud services, and what those rules mean for you as a provider. - [Discussion digests](https://sequencerassurance.com/docs/discussions/index.md): Plain-English digests of FedRAMP community discussions, with FedRAMP staff positions called out separately from community comments. - [Rev5 questions on the Consolidated Rules for 2026](https://sequencerassurance.com/docs/discussions/rev5-cr26-questions.md): Digest of FedRAMP staff answers in the community thread for Rev5 questions on the Consolidated Rules for 2026 (discussion #146), grouped by ruleset. - [20x questions on the Consolidated Rules for 2026](https://sequencerassurance.com/docs/discussions/20x-cr26-questions.md): Digest of FedRAMP staff answers in the community thread for 20x questions on the Consolidated Rules for 2026 (discussion #147), grouped by topic and ruleset. - [Notable staff answers](https://sequencerassurance.com/docs/discussions/notable-staff-answers.md): FedRAMP staff answers from community threads active since 2026-06, other than the main Rev5 and 20x CR26 Q&A threads and the RFC threads. - [RFC history](https://sequencerassurance.com/docs/discussions/rfc-history.md): Every FedRAMP Request for Comment thread in the community discussions, with status, date and the current ruleset it relates to where that's clear. ## Optional - [Official FedRAMP rules](https://www.fedramp.gov/2026/) - [FedRAMP community discussions](https://github.com/FedRAMP/community/discussions) This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.