Propelling Change: FedRAMP Launches Consolidated Rules for 2026
June 25, 2026
For years, the cloud community has called for FedRAMP modernization. Incremental operational changes helped but were not enough to deliver the speed, clarity, and scalability that agencies and cloud service providers need. Over the past year, FedRAMP has been hyper-focused on fixing what’s broken. We’ve drastically updated the way we do business and how we’re showing up to our stakeholders in a way that most efficiently aligns with the vision and mission in the law and policy.
Today marks that turning point for FedRAMP and the cloud community.
FedRAMP 20x is now widely available!
FedRAMP 20x is no longer just a pilot. It is now a widely available FedRAMP Certification path for cloud service providers that are ready to demonstrate their security through clearer, more measurable, and more reusable evidence.
The Consolidated Rules for 2026 are the foundation for that shift. They bring the requirements for FedRAMP 20x into one stable ruleset and establish the expectation FedRAMP will use to review submissions going forward.
This is a major milestone for the FedRAMP community. Over the past year, FedRAMP worked in public with agencies, cloud service providers, independent assessors, advisors, and other stakeholders to test new approaches, gather feedback and refine the rules. The final rules reflect lessons from the FedRAMP 20x pilots, public requests for comment, discussion forum activity, and stakeholder feedback.
A giant thank you to our dedicated stakeholders who participated and gave input and feedback on the Consolidated Rules for 2026 as they were being drafted over the last year.
A few 20x dates matter right away:
- July 6, 2026: Marketplace listings open for any cloud service providers who want to enter into the initial implementation stage.
- August 3, 2026: FedRAMP 20x Class A pipeline opens.
- August 31, 2026: FedRAMP 20x Class B and Class C pipelines open.
Providers interested in FedRAMP 20x should begin reviewing the Consolidated Rules for 2026 now! The better teams understand the new rules, the better prepared they will be to submit strong packages, support agency reuse, and maintain certification over time.
FedRAMP Rev5 is changing too!
FedRAMP 20x is the new way, but Rev5 is not disappearing overnight.
Rev5 remains part of the FedRAMP Certification landscape during this transition, especially for cloud service providers already working through the legacy process with an agency sponsor. At the same time, the Consolidated Rules for 2026 introduces clear deadlines, updated expectation, alignment with 20x rules, and a defined end date for new Rev5 Certification submissions.
That means Rev5 providers should not wait to understand the new rules. The Consolidated Rules for 2026 are now the central reference point for how FedRAMP will evaluate certification submissions and manage ongoing requirements.
A few Rev5 dates matter right away:
- July 6, 2026: Marketplace listings open for any cloud service providers who want to enter into the initial implementation stage.
- July 28, 2026: FedRAMP Ready goes Legacy. No new FedRAMP Ready submissions will be accepted after this date.
- August 10, 2026: Temporary Rev5 Program Certification pipelines open for eligible Class B and Class C providers through the Ready Conversion and Lost Sponsor paths.
- January 1, 2027: The Consolidated Rules for 2026 becomes mandatory for all stakeholders. Current Rev5 Certifications must adopt new rules by this date!
- June 11, 2027: FedRAMP will no longer accept applications for new Rev5 Certifications.
Current Rev5 Certified systems must begin adopting the new rules immediately to align with the new applicable rules outlined in the Consolidated Rules for 2026.
Enhancing the certification experience
Over the coming months, we will improve our internal workflows to increase delivery speed, process consistency, and public transparency. These improvements will enable a decentralized, scalable, and streamlined FedRAMP Certification process. Here are highlights of what you can expect.
A Little Help from FedRAMP
In 2024, FedRAMP launched help.fedramp.gov as a centralized repository for information and tools for stakeholders. In 2026, we are reviving this site into a reliable, stronger resource with a wealth of tips, FAQs, articles, and guidance for the broader FedRAMP community. Updates to help.fedramp.gov will work to support adoption of the Consolidated Rules and aid in the ruleset adjustment period.
Forms Over Emails
The shared inbox at info@fedramp.gov has helped FedRAMP stay connected to the community, but it is not a scalable intake model for every type of request. FedRAMP will begin shifting more intake processes from open-ended email to structured forms that collect the information needed to route requests, answer questions, and support stakeholders more consistently. Over time, emails sent to info@fedramp.gov will receive an automated bounceback pointing to resources on fedramp.gov or help.fedramp.gov where you can get what you need done more quickly and seamlessly.
Launching the Legacy Page
FedRAMP is also preserving retired templates, playbooks, and guidance in a new Legacy Documentation Reference. We are standing up a new page for these archived materials: fedramp.gov/legacy. As those legacy practices and processes expire, we will remove and collect them into this designated page. The goal is to preserve useful history without letting outdated materials create confusion about current requirements.
Long Overdue Brand Guide
The current FedRAMP Brand Guide was last updated in 2022 and a lot has changed since then. We’ve been working slowly behind the scenes to refresh the guide with updated logo treatments, the latest terminology and to fill in all the gaps that were missing since the guide was first released in 2012. A new guide will be available this summer.
Engaging with our stakeholders
June was a huge month for FedRAMP. We took a break from hosting our monthly community updates to focus on the release of the Consolidated Rules for 2026. But that didn’t stop the team from being a social butterfly this month. The FedRAMP Events page is the best source for where we’ve been (GSA AI Symposium, FSCAC Public Meeting, etc., just to name a few!) and where we’re showing up next. Discussions are early, but we’ve been invited to take over a day at a highly-attended annual industry event at the end of September, making it our inaugural FedRAMP Industry Day. Stay tuned for more details.
We’re not taking the summer off. We will walk stakeholders through the new Consolidated Rules for 2026 content publicly, beginning with our monthly Rev5 Community Update next week on Wednesday, July 1, 2026, at 1pm ET followed by other events listed on the calendar in July.
Keep building with us
The Consolidated Rules for 2026 give FedRAMP and the cloud community a clearer foundation for the next phase of modernization. Now the work shifts to adoption: helping stakeholders understand the rules, improving supporting tools and resources, automating workflows, and continuing to make FedRAMP clearer, faster, more transparent, and more reusable. And of course, stand by for updates on the FedRAMP 20x Phase 4 Class D pilot.
If you are wanting some more of that good stuff, check out the following resources here:
- Review the FedRAMP Consolidated Rules for 2026.
- Track important dates for the Consolidated Rules for 2026.
- Review the machine-readable structured rules in JSON.
- Review the enhanced markdown version for use with AI agents.
- Follow FedRAMP Public Notices and community updates.
- Finally, send us feedback when something is unclear.
Thank you to everyone who helped us get here.
Cheers to the next two years of clearer rules, better delivery, and a more modern FedRAMP.
