The 2026 Consolidated Rules, Requirement by Requirement
On June 24, 2026 FedRAMP replaced its rolling beta documents with one declarative ruleset. For a cloud service provider that means 161 rules across 15 rulesets, 46 Key Security Indicators, and four Certification Classes — all mandatory from January 1, 2027. Below is exactly which of those requirements this Trust Center implements — as of the CR26 completeness program, every provider-side ruleset outright.
What the 2026 Consolidated Rules ask of a cloud service provider
- 15Rulesets binding providers
- 161Provider rules
- 46Key Security Indicators
- A–DCertification Classes
Derived from the FedRAMP machine-readable ruleset, version 2026.07.14.01.
CR26 Made a Trust Center Mandatory
This is the part most providers miss. Under Certification Data Sharing, providers must use a FedRAMP-compatible trust center to store and share their certification data, and the rules define in six specific requirements what "compatible" means. It is no longer a nice-to-have alongside your package — it is part of the package.
Compatible on All Six Rules
Uninterrupted availability, documented programmatic access to every artifact, an inventory and history of agency access, access logging retained for at least six months, human and machine-readable formats, and self-service provisioning. All six, today.
Mandatory January 1, 2027
CR26 is optional to adopt now and required of every stakeholder — including existing Rev 5 certifications — from January 1, 2027. Class B and Class C pipelines are already open.
Machine-Readable or It Doesn't Count
CR26 requires JSON valid against official FedRAMP schemas for the certification package, decision record, monitoring reports, change notifications, and vulnerability reporting. Documents alone no longer satisfy the rules.
Coverage, Ruleset by Ruleset
Every one of the 15 CR26 rulesets that places obligations on a cloud service provider — all 15 covered. Where a step is FedRAMP-run (Marketplace listing decisions), we cover every provider-side rule and track the FedRAMP-run step to completion. When a roadmap item exists, its rows are marked with an asterisk and the item is spelled out on the row and again below — the roadmap is empty today.
An .xlsx workbook with this coverage checklist, the machine-readable artifact endpoints, and the open roadmap items — ready to drop into an RFP response.
| Status | Ruleset | Provider rules | What CR26 requires | How we implement it |
|---|---|---|---|---|
| Covered | AFCAddressing FedRAMP Communication | 8 | Maintain a monitored security inbox for FedRAMP correspondence and act on what arrives. | Security inbox with FedRAMP criticality designators, class-scaled reaction deadlines enforced by an hourly clock, acknowledge/complete lifecycle, verified-sender trust with untrusted-sender warnings, Emergency routing to a designated senior security official, and an automatic notify-FedRAMP obligation when the inbox address of record changes. |
| Covered | CCMCollaborative Continuous Monitoring | 17 | Publish Ongoing Certification Reports and hold quarterly reviews with the agencies using your service. | Ongoing Certification Reports pre-filled from live posture in JSON and human-readable form — with period-gap detection against the previous report, a publish-armed 3-month deadline clock, and an explicit sensitive-information review gate. Quarterly reviews come with a subscribable calendar feed, an agency Q&A loop, save-time enforcement of the 3–10-business-day scheduling window, and a registration approval queue that auto-approves federal addresses and holds third parties for a relevance decision. |
| Covered | CDSCertification Data Sharing | 20 | Use a FedRAMP-compatible trust center to share certification data, log who accessed it, and keep it continuously available. | This is the ruleset that regulates trust centers — we meet all 21 CDS rules (the 20 that bind providers, plus the Rev 5 migration rule) and prove it continuously: a live conformance scorecard, served at /api/v1/fedramp/20x/cds-conformance/ and surfaced beside every rule on the FRR compliance page, re-derives 12 of the 21 from observable platform state on demand; 2 more are satisfied by construction and reported as static, the rest are self-attested beside published evidence, and every live automated check has a CI guard test that fails the build the moment it regresses. Uninterrupted sharing, programmatic access, an agency access inventory with history, hard-floored access-log retention, agency self-service provisioning, denial notices on a five-business-day clock, and immutable historical snapshots. |
| Covered | CMUCryptographic Module Use | 3 | Document the cryptographic modules in use and their validation status. | Cryptographic module inventory per service with CMVP validation status, published in the public posture manifest — each module carries a server-derived validation requirement scaled to your Certification Class, unvalidated modules demand a documented risk decision (justification, approver, date) before the inventory publishes clean, and the agency-tenant crypto-defaults attestation is published verbatim. |
| Covered | CPOCertification Package Overview | 3 | Maintain a Certification Package Overview in human-readable form and as JSON valid against the official schema. | Schema-validated Certification Package Overview generated from your live data, in JSON and human-readable form, republished automatically when the underlying facts change — with a daily freshness reconcile as backstop. The package names an accountable official, carries version/last-updated/source metadata and the assessor’s overall summary, and bundles the assessment scope, crypto inventory, and independent-assessment results as one navigable document. |
| Covered | FRCFedRAMP Certification | 21 | Meet the class-scaled certification bar — including minimum automated validation methods per Key Security Indicator and months of retained validation history. | Certification Classes A through D modeled end to end — including Class A alternative-framework reciprocity: SOC 2 Type II / FedRAMP Ready / GovRAMP intake with a twelve-month currency check, per-framework assessment-material checklists, and the mandatory/recommended/optional Class A rule-set rollups derived from the ruleset itself. Package lifecycle with readiness scoring across every required artifact, and an automation gate that counts distinct automated validation methods per indicator against your class. All 46 Key Security Indicators carry automated validation coverage out of the box — the AWS, GCP, and Azure validation packs plus native platform checks (incident response, exercises, budget, training, change management, vulnerability disclosure, residual risk) union to full coverage, with the live number computed on the Automation page. Application gates enforce the 7-day package-freshness window at submit, block dual Rev5+20x enrollment unless an audited program transition is recorded, and track marketplace listing state; deadline clocks cover the 9-month stale-assessment boundary, 120-day downgrade notice, and the FedRAMP Ready conversion date. |
| Covered | IECIncident Evaluation and Communication | 7 | Evaluate incidents, rate their severity, and communicate initial, ongoing, and final reports to every affected party. | Initial, ongoing, and final incident reports with severity rating and class-scaled reporting deadlines enforced by reminders and escalations, one-click reviewed delivery to stakeholders with per-recipient tracking, an agency-readable report feed, adversary technique mapping, indicators of compromise, and a reviewer-gated engine that publishes disclosures to your public trust center. |
| Covered | IVVIndependent Verification and Validation | 8 | Have a FedRAMP-recognized independent assessment service verify and validate your Key Security Indicators annually. | A full assessor workbench on both sides: evidence supply with chain of custody, a cross-provider review queue, cryptographically signed attestations, revocation, findings threads, and release-over-release diffs. Assessment cycles give every determination a per-period history — annual coverage (all KSIs for 20x, the class-scaled Rev5 control sets), the 3-year all-controls rollup, and carried-forward findings are computed and clocked as obligations; sampling is documented into the signed attestation, and the workspace flags an SDR changed since signature. |
| Covered | MASMinimum Assessment Scope | 5 | Define the information resources in scope, how information flows between them, and which third parties you depend on. | Scope admin workspace across all seven resource types with field-level completeness validation (every in-scope resource needs an information flow and security category), third-party mitigation and compensating-control documentation, supplemental separation, an advisory KSI-coverage check, and an agency-gated machine-readable scope document published at a real URL and carried in the manifest. |
| Covered | MKTMarketplace Listing | 5 | Obtain and maintain a FedRAMP Marketplace listing, and — while in the Initial Implementation Phase — document continuous progress publicly. | Listing decisions are FedRAMP-run; every provider-side rule is covered: the listing-request form tracked to completeness with an explicit recorded submission, documented goals and milestones with quarterly progress updates published on an anonymous public feed and clocked by the obligation engine, the two-year assessment deadline armed from the recorded initial listing date, and the direct/indirect agency use-case declaration published in the Certification Package Overview. |
| Covered | SCGSecure Configuration Guide | 9 | Publish secure configuration guidance for customers, keep it versioned, and make it machine-readable. | A guide builder with sections and settings, a publish pipeline that freezes, renders, signs, and catalogs each release, full version history, and a signed machine-readable render alongside the human-readable pages. |
| Covered | SCNSignificant Change Notification | 16 | Notify agencies of adaptive, routine recurring, and transformative changes inside the required timing windows, and keep the history. | All three CR26 change categories with their timing windows enforced — every deadline, including the Transformative per-phase track, is a tracked obligation with reminders and permanent late-send flags — plus an approval workflow, immutable audit records served to agencies in JSON and Markdown, schema-shaped JSON, and automatic publication to your public trust center. |
| Covered | SDRSecurity Decision Record | 2 | Maintain a Security Decision Record giving, per rule, the explanation, verification, validation, and independent assessment. | Schema-validated Security Decision Record assembled from your indicator narratives, requirement posture, and assessor attestations — served to agencies through gated access, in JSON and human-readable form. |
| Covered | VDRVulnerability Detection and Response | 18 | Detect vulnerabilities on the required cadence and remediate within class-scaled timeframes driven by severity, reachability, and exploitability. | Findings carry the full CR26 evaluation model — Potential Agency Impact rating, internet reachability, likely exploitability, editable in-app with an audited justification — against the remediation matrix for your Certification Class (all four class tables, straight from the ruleset), with class-scaled detection cadences across all three scopes, live CISA KEV due dates capping every deadline, and scanner failures surfaced instead of ignored. |
| Covered | VERVulnerability Evaluation and Reporting | 19 | Report vulnerability activity monthly in human-readable form, maintain a machine-readable historical feed, and track accepted vulnerabilities. | Vulnerability Detail Reports as schema-validated JSON plus a monthly human-readable rollup with activity overviews, PAIN reduction history and projected next steps on every finding, accepted-vulnerability tracking with rationale, an all-time machine-readable historical activity feed (VER-TFR-MRH), and a standing monthly reporting obligation with reminders. |
CR26 contains 17 rulesets in total. The other two — AGU (Agency Use of FedRAMP Certified Cloud Services) and REC (FedRAMP Recognition of Independent Assessment Services) — bind federal agencies and independent assessment services respectively, and place no obligations on a cloud service provider.
Every Claim Above Is Something You Can Fetch
CR26 asks for programmatic access to all certification data. Your Trust Center serves it as signed, schema-validated endpoints — the same ones an agency or assessor will call.
- Posture manifest
/api/v1/fedramp/20x/manifest.jsonPublic summary, JSON and YAML - Full posture manifest
/api/v1/fedramp/20x/manifest.full.jsonAgency-gated, access logged - Certification Package Overview
/api/v1/fedramp/20x/cpo.jsonSchema validated - Security Decision Record
/api/v1/fedramp/20x/sdr.jsonAgency-gated, schema validated - Ongoing Certification Report
/api/v1/fedramp/20x/ocr.jsonSchema validated - Vulnerability Detail Report
/api/v1/fedramp/20x/vdr.jsonAgency-gated, schema validated - Historical vulnerability activity
/api/v1/fedramp/20x/ver-history.jsonAll-time feed, agency-gated, schema validated - Significant Change Notifications
/api/v1/fedramp/20x/scn.jsonSchema validated - Significant Change audit records
/api/v1/fedramp/20x/scn-audit.jsonAgency-gated, JSON and Markdown - Availability status
/api/v1/fedramp/20x/status.jsonCurrent and 30-day history - OSCAL component definition
/api/v1/fedramp/20x/oscal/component-definition.jsonWith detached signature - OSCAL assessment results
/api/v1/fedramp/20x/oscal/assessment-results.jsonWith detached signature - Signing key set
/api/v1/fedramp/20x/oscal/keys.jsonVerify any signature independently
Paths are served from your trust center's API host — for example /api/v1/fedramp/20x/manifest.json
What We Haven't Finished
A few items are in flight rather than shipped. We list them because an evaluator will find them anyway, and because a coverage page with no gaps is not a coverage page.
Nothing — the list is empty
The last roadmap item (Class A alternative-framework reciprocity intake, FRC-CLA) shipped in September 2026. This section stays on the page so the next gap has somewhere honest to live.
Be Ready Before the Deadline, Not After It
CR26 is mandatory on January 1, 2027. Bring your package, your indicators, and your assessors into one Trust Center that already speaks the 2026 rules.