Certification package overview

Official source: Certification Package Overview (CPO), FedRAMP Consolidated Rules release 2026.10.14.01. This page is a plain-English summary. The official rule text governs.

In short

The Certification Package Overview (CPO) is a concise summary of your cloud service offering that sits inside your FedRAMP Certification Package. For Rev5, it replaces the historically required System Security Plan, not including its appendices. You must supply it in both human-readable and JSON formats, and it pulls together information required by several other rulesets. You must also keep the whole Certification Package up to date on a cadence that depends on your type and class, from every week (20x Class D) to every year (Rev5 Class B and C).

Who it applies to

Subset	Type	Path	Class	Audience
General Provider Responsibilities	20x, Rev5	Program, Agency	B, C, D	Providers
20x-Specific Provider Responsibilities	20x	Program	A, B, C, D	Providers
Rev5-Specific Provider Responsibilities	Rev5	Program, Agency	B, C, D	Providers

The General subset lists Classes B, C and D, but CPO-CSO-OSA includes a Class A variant (MAY). The rule notes on CPO-CSO-OVR also say that if a referenced rule doesn’t apply to your class or type, that information isn’t required.

Key dates

	20x	Rev5
Status	Required (Consolidated Rules for 2026)	Required (Consolidated Rules for 2026)
Optional adoption allowed	2026-07-04	2026-07-04
Obtaining initial certification	2026-07-04	2027-01-01
Maintaining ongoing certification	2027-01-01	2027-07-01
Grace period ends	First FedRAMP independent assessment started after 2027-01-01	First FedRAMP independent assessment started after 2027-07-01

What you need to do

General provider responsibilities (20x and Rev5)

Rule	Force	What it means for you
`CPO-CSO-OVR`	MUST	Include a Certification Package Overview in your Certification Package, in human-readable and JSON formats, with at least the information required by the rules listed below.
`CPO-CSO-MTD`	MUST	Include basic metadata: the name, title and contact information of the official responsible and accountable for the package, the version, the date and time of last update, and the source of the update.
`CPO-CSO-OSA`	Varies by class (MAY for A, MUST for B, C, D)	Include the overall summary of your FedRAMP independent assessment that your assessor supplies under `IVV-IAS-OSA`. See differences by class.

CPO-CSO-OVR requires the overview to include at least the information required by these rules:

Ruleset	Rule	Information
Certification Package Overview	`CPO-CSO-MTD`	Certification Package Overview Metadata
Certification Data Sharing	`CDS-CSO-PUB`	Public Information
Certification Data Sharing	`CDS-CSO-SVC`	Public Service List
Certification Data Sharing	`CDS-CSO-IRP`	Include Relevant Policies
Minimum Assessment Scope	`MAS-CSO-IIR`	Identify Information Resources
Minimum Assessment Scope	`MAS-CSO-FLO`	Information Flows and Security Categories
Minimum Assessment Scope	`MAS-CSO-TPR`	Third-Party Information Resources
Using Cryptographic Modules	`CMU-CSO-CMD`	Cryptographic Module Documentation
Independent Verification and Validation	`IVV-CSO-ICP`	Inclusion in Certification Package

The JSON format follows the FedRAMP Certification Package Overview schema.

20x-specific provider responsibilities

Rule	Force	What it means for you
`CPO-CSX-CPM`	Varies by class (SHOULD for A, MUST for B, C, D)	Persistently maintain your Certification Package so it is up to date and complete, at least every 3 months (A), month (B), 2 weeks (C) or week (D).

The rule notes say FedRAMP expects 20x providers to maintain the package using automation as changes occur, so it is never out of date. The rule doesn’t require or expect persistent human review of all materials at this cadence.

Rev5-specific provider responsibilities

Rule	Force	What it means for you
`CPO-CSF-CPM`	MUST (B, C, D)	Persistently maintain your Certification Package so it is up to date and complete, at least every year (B and C) or every six months (D).

The rule notes describe the Rev5 timeframe as the worst-case maximum. They say Rev5 providers should maintain their packages far more often, and at least after every transformative significant change. See Significant change notification.

Differences by class

Rule	Class A	Class B	Class C	Class D
`CPO-CSO-OSA` overall summary of assessment	MAY include	MUST include	MUST include	MUST include
`CPO-CSX-CPM` 20x package maintenance	SHOULD, every 3 months	MUST, every month	MUST, every 2 weeks	MUST, every week
`CPO-CSF-CPM` Rev5 package maintenance	Not listed (the rule changelog says all Class A certifications are 20x)	MUST, every year	MUST, every year	MUST, every six months

What FedRAMP staff have said

Rev5 grace period date. On 2026-08-27, pete-gov confirmed that the CPO dates are meant to differ for 20x and Rev5, and that the Rev5 grace period ends on the first FedRAMP independent assessment after 2027-07-01, not 2027-01-01. The current release already shows 2027-07-01. Discussion #146 comment

Partial packages during the transition. On 2026-10-26 and 2026-10-27, pete-gov said each ruleset has its own maintaining and grace dates, listed on the Rev5 deadlines page. He said FedRAMP expects mixed (“frankenstein”) packages of legacy and CR26 material and set no single cut-over date. You may add supplemental material next to a legacy package, such as separate documents or Verification: statements in SSP control text, and no template is required. He said everything except CDS will be switched over for everyone by the end of 2027. He also said the dates in each ruleset are accurate and the rules are the source of truth. Discussion #146 comment (2026-10-26), Discussion #146 comment (2026-10-27)

CPO replaces most of the SSP. On 2026-08-24, asked which deliverables to expect now that the SAP, SAR and RET are legacy (for a Rev5 lost sponsor or readiness conversion), paulagosta said your Certification Package Overview and Security Decision Record will contain your assessment results. On 2026-09-11, paulagosta added that the CPO and SDR need machine-readable and human-readable versions, and that most components of an SSP now reside in the CPO and SDR. Discussion #146 comment (2026-08-24), Discussion #146 comment (2026-09-11)

The CPO URI in other schemas. On 2026-06-30, dan-fedramp explained that the CPO is a separate schema with metadata about the offering, such as FedRAMP ID, provider name and service name. FedRAMP includes the CPO URI in all of its other schemas so you don’t have to duplicate this information in every submission. Discussion #146 comment

Public CPO JSON must be web-consumable. On 2026-09-17, after a Marketplace update with public CPO JSON was rejected because of its content type, pete-gov said FedRAMP would strictly require web interoperability (a CORS allow and an appropriate content type) for JSON data that must be public, such as CDS-CSO-PUB and CDS-CSO-SVC. An RFC would follow for JSON data behind a trust center login. The rules were later updated in FRC-CSO-JSN (2026-10-05). Discussion #175 comment

FedRAMP certification: FRC-CSO-PKG requires the package to include CPO information.
Security decision record
Certification data sharing
Minimum assessment scope
Independent verification and validation
Rev5 questions on the Consolidated Rules for 2026
Provider deliverables

Start here

Rule summaries

Discussion digests

In short

Who it applies to

Key dates

What you need to do

General provider responsibilities (20x and Rev5)

20x-specific provider responsibilities

Rev5-specific provider responsibilities

Differences by class

What FedRAMP staff have said

​In short

​Who it applies to

​Key dates

​What you need to do

​General provider responsibilities (20x and Rev5)

​20x-specific provider responsibilities

​Rev5-specific provider responsibilities

​Differences by class

​What FedRAMP staff have said

​Related

In short

Who it applies to

Key dates

What you need to do

General provider responsibilities (20x and Rev5)

20x-specific provider responsibilities

Rev5-specific provider responsibilities

Differences by class

What FedRAMP staff have said

Related