Skip to main content
Official source: FedRAMP Certification (FRC), FedRAMP Consolidated Rules release 2026.10.14.01. This page is a plain-English summary. The official rule text governs.

​
In short

This ruleset is the front door to FedRAMP. You pick a target Certification Profile, build a complete FedRAMP Certification Package, get listed in the Marketplace, and then apply yourself through the official form. You can’t use a third party to apply for you. Class A (20x only) lets you start from an existing SOC 2 Type II, GovRAMP or FedRAMP Rev5 assessment. Classes B, C and D need a fresh independent assessment. Rev5 adds a control baseline per class, and legacy FedRAMP Ready offerings MUST convert to a FedRAMP Certification.

​
Who it applies to

All rules here apply to cloud service providers. Each subset narrows the scope further:
The FRC-CSX subset header lists Classes B, C and D, but FRC-CSX-VVK and FRC-CSX-VVR also carry a Class A variant (MAY). Likewise, the FRC-CCL subset is scoped to Rev5 Agency Classes B to D, while the notes on FRC-CCL-UCC and FRC-CCL-DCC describe moves to and from Class A. The upstream changelog records this narrowing. Check the official page if your case depends on it.

​
Key dates

From the ruleset’s “Effective Date(s)” blocks: Other dates that matter for this ruleset:
  • 2026-11-17: the earliest deadline for FedRAMP Rev5 Ready offerings to convert to a FedRAMP Certification. The actual deadline is the later of this date and the expiration of your annual assessment (FRC-CSF-RDY).
  • 2027-06-11: FedRAMP stops accepting applications for new FedRAMP Rev5 Certifications (Important Deadlines).
  • 2027-12-31: legacy FedRAMP Ready status is removed entirely (FRC-CSF-RDY).
  • 2028-02-01: all grace periods for the Consolidated Rules for 2026 expire (Important Deadlines).
For what “obtain”, “maintain” and “grace period” mean, see Important Deadlines.

​
What you need to do

​
General provider responsibilities (FRC-CSO)

Applies to every provider obtaining or maintaining any FedRAMP Certification.
The upstream notes on FRC-CSO-JSN say the FedRAMP Schema Validator on fedramp.gov won’t work properly if CORS isn’t configured. If a web app can’t read your JSON without bypassing browser security defaults, “there has likely been a problem.”

​
FedRAMP Class A certification rules (FRC-CLA)

Applies only to 20x Program Certification at Class A.
You MUST address all of these and include artifacts or an information mapping for each in your package:
  • FedRAMP Certification: FRC-CSO-PKG, FRC-CSO-JSN, FRC-CSO-POP (this page)
  • Minimum Assessment Scope: MAS-CSO-IIR (summary)
  • Certification Data Sharing: CDS-CSO-PUB, CDS-CSO-UTC, CDS-UTC-AAD (summary)
  • Addressing FedRAMP Communication: AFC-CSO-INB, AFC-CSO-RCV, AFC-CSO-CRA (summary)
  • Incident Evaluation and Communication: IEC-CSO-EFR, IEC-CSO-FIR (summary)
  • Vulnerability Detection and Response: VDR-CSO-DET (summary)
  • Collaborative Continuous Monitoring: CCM-OCR-AVL, CCM-OCR-NRD (summary)
  • Independent Verification and Validation: IVV-CSX-AIA (summary)
  • Key Security Indicators: KSI-CMT-LMC, KSI-CNA-RNT, KSI-CED-RAT, KSI-IAM-AAM, KSI-IAM-APM, KSI-INR-RIR, KSI-SVC-SIN (summary)
The upstream notes add three points. Some of these rules have no counterpart in external frameworks, so you may need new processes. Write a summary detailed enough that reviewers don’t need to dig into your SOC 2 or other materials (“see SOC 2 report” isn’t helpful). You must cover the listed KSIs to get Class A even if you plan to move to a Rev5 Program Certification later.
You MAY address these, if applicable:
  • Collaborative Continuous Monitoring: CCM-QTR-MTG
  • Certification Data Sharing: CDS-CSO-PSM
  • Cryptographic Module Use: CMU-CSO-UVM
  • FedRAMP Certification: FRC-APP-FIA
  • Independent Verification and Validation: IVV-CSO-FIA
  • Security Decision Record: SDR-CSX-KMT
  • Vulnerability Evaluation and Reporting: VER-TFR-IRI, VER-TFR-MRH, VER-TFR-NRI

​
Applying for FedRAMP certification (FRC-APP)

Applies once you’ve met all other relevant rules and are ready to apply, for any class.

​
Applying with an agency sponsor (FRC-APS)

Applies to Rev5 Agency Certification, Classes B to D.

​
Changing certification class (FRC-CCL)

Applies to Rev5 Agency Certification, Classes B to D. The upstream notes list the upgrade paths (A to B, C or D; B to C or D; C to D) and downgrade paths (D to C, B or A; C to B or A; B to A). FedRAMP’s preferred upgrade approach is to improve within your current class until you meet the target class, then apply. The notes also warn that downgrading or canceling has “severe negative consequences” for you and your agency customers.

​
20x-specific provider responsibilities (FRC-CSX)

Applies to 20x Program Certification.

​
Rev5-specific provider responsibilities (FRC-CSF)

Applies to Rev5 Certification (Program and Agency), Classes B to D.
The upstream notes on FRC-CSF-RDY say the simplest conversion in most cases is to a FedRAMP 20x Class A Certification. Offerings that don’t convert, or don’t meet the criteria, are renamed Legacy FedRAMP Ready and otherwise retired from FedRAMP Ready.

​
Differences by class

Three rules vary by class. Each class has its own statement upstream. FRC-CSF-BSL also differs by class, but only in which controls you must include (Classes B, C and D). There is no Rev5 Class A baseline.

​
What FedRAMP staff have said

Staff answers explain how FedRAMP applies the rules. They don’t change the published text, which governs.
Class A doesn’t need an independent assessment. You can get listed with a Class A Certification without an independent assessor performing verification and validation. Two Class A certified providers had none (emu-gov, 2026-09-09, discussion #147). FedRAMP added that the MAY in these rules is deliberate and “not a trap.” Having an assessor double-check first might make things smoother, but it’s “absolutely 100% not expected” (pete-gov, 2026-09-09, discussion #147). Related rules: FRC-CLA-IVV, FRC-APP-FIA.
Self-hosted and hybrid offerings can get Class A. Class A is open to offerings with hybrid or on-premises infrastructure. To go higher you’d move to Rev5 Class B, C or D until a higher 20x pathway exists (emu-gov, 2026-07-09, discussion #147). A provider running its own infrastructure can’t advance to 20x Class B or above until self-hosted rules are in place, but could move to Rev5 Class B or above (pete-gov, 2026-10-13, discussion #147).
Moving from Class A to Class B or C. You can apply for any Class B or C path you qualify for whenever you’re ready after Class A, or skip Class A entirely. As of 2026-08-07, staff said 20x Class B and C would open on 2026-08-31, Rev5 Class B and C were open but needed a sponsor, and Rev5 Program Class B and C (from 2026-08-10) needed you to qualify through Lost Sponsor or Ready Conversion (nicole-gov, discussion #147; see also this comment). A Class C review after Class A is still your “initial certification.” FedRAMP’s Class A report includes feedback for moving up to Class B or C (emu-gov, 2026-09-02, discussion #147). That answer was given about FRC-CSX-MOT, which was removed on 2026-10-08.
Pick one Program Certification type. You can’t have a 20x Certification and a Rev5 Program Certification. A conversion from FedRAMP Ready to a Rev5 Class B or above Program Certification still needs everything a full Rev5 certification needs, including a full assessment, and you can’t convert until you meet all of the requirements (pete-gov, 2026-07-24, discussion #147). A Rev5 Program Certification without a sponsor also requires agreeing to follow all CR26 Rev5 rules by 2027-02-19 (pete-gov, 2026-07-24, discussion #147). Related rule: FRC-CSO-POP.
FedRAMP Ready goes away. FRC-CSF-RDY is the only rule that applies to FedRAMP Ready offerings. There’s no mapping or replacement, and you need to switch to a FedRAMP Certification (pete-gov, 2026-07-17, discussion #152). Ready status expires 365 days after it’s granted by default. If you apply for the limited Ready (RAR) conversion, FedRAMP decides with you whether to move you to Initial Implementation after kick-off or keep you in Ready until day 366 (paulagosta, 2026-08-12, discussion #159).
Public JSON must be web-readable. In a case where a Trust Center served a CPO JSON file as application/octet-stream, FedRAMP said it would update the rules so public JSON can be consumed directly by web applications, including FedRAMP’s own (pete-gov, 2026-09-17, discussion #175). Strict web interoperability applies to required public JSON and to Marketplace listing data, and an RFC would follow for JSON behind a Trust Center login (pete-gov, 2026-09-17, discussion #175). The rule change landed in FRC-CSO-JSN on 2026-10-05.
You decide what counts as a distinct automated method. For FRC-CSX-VVK, how you separate automated methods is up to you. FedRAMP will include its own report on how assuring and diverse your methods are during certification (pete-gov, 2026-09-18, discussion #176).
Class A with a SOC 2 Type II. On 2026-10-21, answering a question about FRC-CLA-ASF, pete-gov said you don’t need a federal-specific SOC 2 boundary. It should cover the information resources you list under MAS-CSO-IIR. A first SOC 2 Type II with a 3-month observation period “should be acceptable,” and staff asked that you note it. The rules don’t state a minimum observation period. Discussion #184 comment
Ready Conversion has a short grace period only. On 2026-10-15, pete-gov said providers in the Ready Conversion program must fully implement all CR26 rules required for a new Rev5 Certification, with a built-in grace period of about six weeks instead of the 2027-01-01 date. The other grace periods apply only to providers that already hold a FedRAMP Certification, and FedRAMP Ready isn’t one. See FRC-CSF-RDY for the published dates. Discussion #146 comment
Penetration tests in Ready Conversion. On 2026-10-28, pete-gov said CR26 doesn’t require a penetration test from a FedRAMP-recognized independent assessor, and results from another assessor can go in your Vulnerability Detection and Response activity reports. If you submit under the legacy rules and convert to CR26 by February, staff said they will accept a POA&M or finding for lacking a recognized penetration test. You would document what you did instead and why you see no significant resulting risk, and the finding goes away after you convert. The rules don’t address the legacy-rules arrangement. Discussion #146 comment
Rev5 application cutoff. FedRAMP won’t grant Rev5 Certification to any provider after 2027-06-11. In-process agency certifications must be complete, and you must have applied, by that date (pete-gov, 2026-07-31, discussion #146).
Reusing recent assessments. CR26 rules allow reuse of assessment results if there are no major changes and a “fresh” assessment confirms this. Assessments for a new certification are meant to focus on the deltas. Existing LI-SaaS authorizations are grandfathered into Rev5 Class B for now, and an RFC on LI-SaaS migration is planned (pete-gov, 2026-10-08, discussion #146). Related rules: FRC-APP-FIA, FRC-APP-USA.