FedRAMP Requirements Explained: What You Actually Have to Do

FedRAMP's requirements changed on July 4, 2026, when the Consolidated Rules for 2026 (CR26) took effect for every cloud service offering seeking or holding a FedRAMP Certification. Three things now set what you have to do: the certification profile you target, the requirements that profile carries, and the Ongoing Certification work you sustain after FedRAMP certifies the service. An agency sponsor still gates most Rev 5 certifications, and it plays no part in 20x, where FedRAMP issues every certification directly.

We updated this guide on September 23, 2026 for CR26. Rule IDs below come from FedRAMP's machine-readable rules dataset, version 2026.09.13.02. For the full 20x process, from the first decision to the first Ongoing Certification Report, see our FedRAMP 20x compliance guide.

Start with the certification profile

A certification profile is three choices: type, path, and class. FRC-CSO-FCP requires you to name the profile you are targeting and follow every FedRAMP rule that comes with it, so the profile sets the scope of the whole program.

The type is Rev 5 or 20x. FedRAMP calls 20x the modern type, intended for cloud-native services built on FedRAMP Certified infrastructure or platforms, and calls Rev 5 a legacy type that is still the only option for services that run their own infrastructure or need a Class D certification. FedRAMP stops accepting new Rev 5 applications on June 11, 2027, and existing Rev 5 certifications remain active until at least December 31, 2028.

The class replaces the Low, Moderate, and High impact levels. FedRAMP says the classes loosely align with the NIST SP 800-53B baselines and that there is no direct correlation between a class and an impact level, because providers tailor controls and agencies place services inside their own systems in different ways. The agency still categorizes its own system.

FedRAMP's advice on choosing is direct: start with Class A in most cases, avoid going straight to Class C or Class D unless an existing agency contract requires that commitment, and never plan to go straight to Class D.

The sponsor gate under the new rules

For Rev 5, the sponsor still decides whether you get certified. Agency Certification is generally required for Class B and C and always required for Class D, and FRC-APS-ATO requires a completed Authorization to Operate with your agency sponsor, ending in a signed ATO letter the agency sends to FedRAMP through official channels. Two limited pipelines, for providers that lost a sponsor, completed a readiness assessment, or reached FedRAMP Ready between January 2025 and March 2026, opened on August 10, 2026 for a Rev 5 Class B or C Program Certification without a sponsor. They close on June 11, 2027.

For 20x, there is no sponsor. Every 20x certification is a Program Certification issued directly by FedRAMP, and each agency still issues its own Authorization to Operate before it uses the service. The gating question moves from finding an agency to proving that your measurements and reporting work. You cannot hold Rev 5 and 20x Program Certifications for the same offering (FRC-CSO-POP), so pick the type before you invest in either.

What you build: controls or KSIs, plus the provider rules

On Rev 5, the requirements are NIST SP 800-53 Rev. 5 controls. The CR26 baselines list 155 controls for Class B, 322 for Class C, and 409 for Class D (FRC-CSF-BSL), each documented in a Security Decision Record. FedRAMP removed most of its own parameter values from the baselines, so you assign every organization-defined parameter yourself and document the assignment in that record (FRC-CSF-ACP). FIPS 140 validated encryption is now expected only where data is sensitive, with your use of it documented, and the package moves from Word and Excel templates to simplified JSON documents or, in some cases, optional OSCAL.

On 20x, the requirements are Key Security Indicators proven with automated, machine-readable evidence. Class A requires 7 of the 46 indicators, Class B requires 41 and makes the other 5 optional, and Class C requires all 46.

Both types share the rest of the structure. A Certification Package Overview in human-readable and JSON form, together with the Security Decision Record, takes the place of the System Security Plan (CPO-CSO-OVR). The Minimum Assessment Scope replaces the legacy authorization boundary and covers every information resource likely to handle federal customer data or affect its confidentiality, integrity, or availability (MAS-CSO-IIR). You must be listed in the FedRAMP Marketplace before you apply (FRC-APP-MLF). Class B, C, and D need an independent assessment by a FedRAMP Recognized assessor completed within the three months before you apply (FRC-APP-FIA). You submit the application yourself, because FedRAMP no longer accepts applications from assessors or other third parties (FRC-APP-AFC, FRC-APP-NTP).

The ongoing obligations people underestimate

CR26 renamed continuous monitoring to Ongoing Certification because the requirements are far broader than vulnerability scans, and failing them costs you the certification. Rev 5 and 20x share most of the rules and differ on cadence. The Vulnerability Detection and Response (VDR) and Vulnerability Evaluation and Reporting (VER) rulesets become required for every Class B, C, and D provider on December 7, 2026.

Penetration testing now sits inside vulnerability detection. FedRAMP's control guidance for CA-8 says penetration testing is part of vulnerability detection and subject to the VDR rules. The Rev 5 baselines still include CA-8 at every class, and CA-8(1) and CA-8(2), independent penetration testing and red team exercises, at Class C and D. Developer testing under SA-11, including static code analysis under SA-11(1), is in the Class C and D baselines as well. We cover the red team exercise itself in the FedRAMP red team requirement.

Incident response testing (IR-3) stays in the Class C and D baselines, and FedRAMP's guidance now points it to the Incident Evaluation and Communication rules instead of a FedRAMP-set frequency, so you define how often you test and document it. Significant changes run on a notification framework instead of advance approval: each change is sorted into routine recurring, adaptive, or transformative (SCN-CSO-EVA), and a transformative change needs notices 30 and 10 business days before it and 5 after.

Deadlines if you hold Rev 5 today

The rules under an existing Rev 5 certification change on a fixed schedule, and FedRAMP treats grace periods as hard deadlines. These are the dates that matter most. The full calendar is in our FedRAMP 20x guide.

Realistic expectations

FedRAMP's review is no longer the slow part. Its internal goal is an initial decision within 30 days of receiving any certification application, the clock stops whenever FedRAMP is waiting on you, and the first two 20x Class A Certifications moved from In Process to Certified in 19 and 17 days in August 2026. Preparation sets the calendar. Workstreet estimates Class A readiness at 90 to 120 days from a SOC 2 baseline and puts a legacy Rev 5 effort at 12 to 18 months. On Rev 5, the sponsor's procurement calendar sits on top of that, so start the sponsor conversation before the compliance spend.

Where BD Emerson fits

BD Emerson advises cloud service providers on FedRAMP, and we are not a FedRAMP Recognized assessor. Our FedRAMP compliance consulting team handles Rev 5 readiness and the CR26 package and Ongoing Certification changes, and our FedRAMP 20x readiness team designs KSI measures with your engineers and reviews the validations behind them. We perform the offensive testing work through FedRAMP penetration testing and CA-8(2) red team exercises. If NIST SP 800-171 or CMMC also apply to you, NIST compliance consulting shares much of the same control work.