Official source: Independent Verification and Validation (
IVV), FedRAMP Consolidated Rules release 2026.10.14.01. This page is a plain-English summary. The official rule text governs.In short
Class B, C and D providers MUST complete a FedRAMP independent assessment of all applicable FedRAMP rules at least once a year with a FedRAMP Recognized independent assessment service (or, very rarely, FedRAMP itself). Class A providers MAY. You must give assessors evidence that your security measures are implemented (verification) and effective (validation), and you must put the assessment results in your certification package without changing their meaning. Each year, 20x providers must cover all Key Security Indicators, and Rev5 providers must cover a fixed list of controls for their class. Some rules in this ruleset bind assessors rather than you. They are included because they define what your assessor must do and what you will receive.Who it applies to
The subset applicability lists Class B, C and D, but
IVV-CSO-FIA and IVV-CSX-AIA also publish Class A variants. FRC-CLA-MFR lists IVV-CSX-AIA as a mandatory rule for Class A.Key dates
What you need to do
Key terms: verification, validation and certification package.General provider responsibilities
Notes from the official text:
IVV-CSO-FIA: the first assessment is typically called an “initial assessment” and later ones “annual assessments.” Assessment by FedRAMP directly is limited to services FedRAMP explicitly prioritizes and is described as “extremely” rare. FedRAMP Recognized independent assessment services are listed on the FedRAMP Marketplace.IVV-CSO-SEIandIVV-CSO-SEEgive a firewall example: verify the firewall rules are in place and supply that evidence (preferably by showing how configurations deploy from a source of truth), then validate that traffic is actually blocked (for example, with metrics on blocked versus allowed traffic).IVV-CSO-ICP: “inappropriate modification” means changing the underlying intent of the assessor’s content. You may change presentation and formatting.IVV-CSO-USR: many services with effective automation don’t need sampling and can verify and validate most measures automatically.
General independent assessor responsibilities
These rules bind your assessor. They tell you what to expect and what you will receive.20x-specific provider responsibilities
Rev5-specific provider responsibilities
For the full control list per class, see
IVV-CSF-AIA in the official text.
Why this matters to you as a CSP
The assessor rules (IVV-IAS) don’t bind you directly, but they shape your assessment and your package:
- Your assessor must check your measures at a technical level, not just documents or screenshots (
IVV-IAS-VIM,IVV-IAS-VEF). The official notes mention reviewing underlying code as appropriate. Your own evidence and explanations underIVV-CSO-SEI,IVV-CSO-SEEandIVV-CSO-STEfeed that review. - Two assessor deliverables become part of your package: the per-Practice summary goes in your Security Decision Record (
IVV-IAS-SUM), and the overall summary goes in your Certification Package Overview (IVV-IAS-OSA). - Your assessor must confirm you included their results without inappropriate modification (
IVV-IAS-VIP). This mirrors your own obligation underIVV-CSO-ICP. - Advice from your assessor is allowed on both sides (
IVV-CSO-RAA,IVV-IAS-SHA), but not if it is likely to compromise the assessment’s objectivity and integrity.
Differences by class
What FedRAMP staff have said
You own the SDR content; your assessor supplies and checks its part. On
2026-09-08, pete-gov said the provider is responsible for all content in the Security Decision Record. The assessor supplies information for inclusion (IVV-IAS-SUM) and verifies it was included (IVV-IAS-VIP), and you must include it without inappropriate modification (IVV-CSO-ICP). He added that you are expected to verify and validate things yourself, and the assessor then independently verifies and validates them. Discussion #169 commentIVV-IAS-SUM versus IVV-IAS-OSA. On 2026-10-13, pete-gov said IVV-IAS-SUM is a summary of verification and validation for each FedRAMP Practice, and IVV-IAS-OSA is an overall summary of the whole assessment. Discussion #146 comment. In a follow-up the same day, he said IVV-IAS-SUM is the instruction to the assessor to supply what you need for items 4 and 5 of SDR-CSO-FRR (independent verification and independent validation). Discussion #146 commentClass A without an independent assessment. On
2026-09-09, emu-gov confirmed that you can be listed on the FedRAMP Marketplace with a Class A Certification without an independent assessment service performing independent verification and validation. Discussion #147 commentThe grace period follows your assessment start date. On
2026-08-06, paulagosta said “first FedRAMP independent assessment” means initial Rev5 and annual assessments, not significant change support. The grace date is tied to when the assessment starts, not when it is due. Discussion #146 comment. On 2026-09-22, pete-gov added that someone completing an annual assessment in December 2026 can early adopt everything or defer much of it until their next assessment starts. Discussion #146 commentLegacy Rev5 assessments started in 2026. On
2026-10-13, pete-gov confirmed that a legacy Rev5 annual assessment started in November 2026 and submitted in March 2027 can be accepted to maintain certification, as long as you meet the ruleset maintain dates. FedRAMP discourages putting off adoption for many months. Discussion #146 commentReusing recent assessments. On
2026-10-08, pete-gov said the 2026 rules allow reuse of assessment results as long as there aren’t major changes and a “fresh” assessment confirms this. Assessments for a new certification are meant to focus on deltas from previous assessments. Discussion #146 commentRelated
- Security decision record
- Certification package overview
- Key Security Indicators
- FedRAMP recognition: how assessors become and stay FedRAMP Recognized.
- Rev5 questions on the 2026 rules and 20x questions on the 2026 rules