20x Deadlines¶
This is a top level overview of deadlines that apply within each specific ruleset for providers.
Optional Adoption Allowed - Providers may adopt this ruleset in its entirety after this date for both initial and ongoing FedRAMP Certification.
Obtaining Initial Certification - If a provider applies for initial FedRAMP Certification after this date, the ruleset MUST be adopted or FedRAMP Certification will be denied.
Maintaining Ongoing Certification - Providers with an existing FedRAMP Certification SHOULD adopt the ruleset by this date; if it is not adopted by this data, a corrective action plan to adopt the ruleset by the end of the grace period will be required to maintain FedRAMP Certification.
Grace Period Ends - Providers with an existing FedRAMP Certification MUST adopt the ruleset by this date or FedRAMP Certification will be revoked.
| Ruleset | Optional Adoption Allowed | Obtaining Initial Certification | Maintaining Ongoing Certification | Grace Period Ends |
|---|---|---|---|---|
| Addressing FedRAMP Communication (AFC) | 2026-01-05 | 2026-01-05 | 2026-07-01 | |
| Secure Configuration Guide (SCG) | 2026-03-01 | 2026-03-01 | 2026-07-01 | |
| Marketplace Listing (MKT) | 2026-07-04 | 2026-07-04 | 2026-07-04 | 2026-07-04 |
| Vulnerability Detection and Response (VDR) | 2026-07-04 | 2026-12-07 | 2026-12-07 | 2027-03-07 |
| Vulnerability Evaluation and Reporting (VER) | 2026-07-04 | 2026-12-07 | 2026-12-07 | 2027-03-07 |
| Collaborative Continuous Monitoring (CCM) | 2026-07-04 | 2026-07-04 | 2027-01-01 | On the first FedRAMP independent assessment started after 2027-01-01 |
| Certification Data Sharing (CDS) | 2026-07-04 | 2026-07-04 | 2027-01-01 | On the first FedRAMP independent assessment started after 2027-01-01 |
| Cryptographic Module Use (CMU) | 2026-07-04 | 2026-07-04 | 2027-01-01 | On the first FedRAMP independent assessment started after 2027-01-01 |
| Certification Package Overview (CPO) | 2026-07-04 | 2026-07-04 | 2027-01-01 | On the first FedRAMP independent assessment started after 2027-01-01 |
| FedRAMP Certification (FRC) | 2026-07-04 | 2026-07-04 | 2027-01-01 | On the first FedRAMP independent assessment started after 2027-01-01 |
| Incident Evaluation and Communication (IEC) | 2026-07-04 | 2026-07-04 | 2027-01-01 | On the first FedRAMP independent assessment started after 2027-01-01 |
| Independent Verification and Validation (IVV) | 2026-07-04 | 2026-07-04 | 2027-01-01 | On the first FedRAMP independent assessment started after 2027-01-01 |
| Minimum Assessment Scope (MAS) | 2026-07-04 | 2026-07-04 | 2027-01-01 | On the first FedRAMP independent assessment started after 2027-01-01 |
| Significant Change Notification (SCN) | 2026-07-04 | 2026-07-04 | 2027-01-01 | On the first FedRAMP independent assessment started after 2027-01-01 |
| Security Decision Record (SDR) | 2026-07-04 | 2026-07-04 | 2027-01-01 | On the first FedRAMP independent assessment started after 2027-01-01 |