What is on a FedRAMP authorization checklist in 2026?

Four stages. First, a FedRAMP Marketplace listing, which must exist before you apply (FRC-APP-MLF). Second, the certification package: an overview of the offering, a Security Decision Record that explains, verifies and validates each applicable rule, and a sample Ongoing Certification Report (FRC-CSO-PKG). Third, the application and the independent assessment your class requires (FRC-APP-AFC, FRC-APP-FIA). Fourth, the rules you keep following after certification: quarterly reports, significant change notifications, vulnerability detection and annual assessments.

Is there still an initial authorization package in 2026?

Yes. FedRAMP now calls it the FedRAMP Certification Package, the law's "authorization package". FRC-CSO-PKG sets its minimum content, and FRC-APP-FCP asks for a fresh package verified within the previous 7 days when you apply. On the Rev5 path the Certification Package Overview replaces the System Security Plan (CPO-CSO-OVR), and the Security Decision Record carries a summary of each control (SDR-CSF-CTF). Our package checklist spreadsheet lists the documents item by item.

How long does FedRAMP authorization take?

The Consolidated Rules do not set a review time, so this page does not estimate one. They do set windows: the package must be fresh within 7 days of applying (FRC-APP-FCP); a Class B, C or D offering needs an independent assessment completed within the previous 3 months (FRC-APP-FIA), and one up to 9 months old can be freshened with a review of changes (FRC-APP-USA); a Class A offering needs an alternative framework assessment from the past 12 months (FRC-CLA-ASF); and an Initial Implementation Phase listing must have an assessment scheduled within 2 years (MKT-IIP-DLA). The certification rules page explains the process step by step.

What is the FedRAMP 20x readiness checklist?

It is our evidence readiness checklist for the 20x path: a rehearsal before assessment that fixes the scope and rule version, walks one measure from implementation to effectiveness, checks that the Security Decision Record explains the evidence, and practices the package handoff for Class B or C. This page is the full list of what certification requires; the readiness checklist is how you test that you can prove it.

FedRAMP now calls them FedRAMP Recognized independent assessment services, listed on the Marketplace. Classes B, C and D must have one: a fresh independent assessment within 3 months of applying (FRC-APP-FIA) and an assessment of all applicable rules at least once a year (IVV-CSO-FIA), which on 20x includes every Key Security Indicator (IVV-CSX-AIA). For Class A the independent assessment is optional (FRC-APP-FIA, FRC-CLA-IVV) because the class builds on a SOC 2 Type II, Rev5 or GovRAMP assessment (FRC-CLA-ASF). In every class you submit the application yourself; an assessor cannot apply for you (FRC-APP-NTP).

FedRAMP authorization checklist

What you need for FedRAMP authorization in 2026, on the 20x path and the Rev5 path

In 2026 FedRAMP calls the outcome a FedRAMP Certification, and a Marketplace listing comes before the application. This page lives in the FedRAMP 20x hub but covers both paths: what a cloud service provider needs on the 20x path and on the Rev5 path under the Consolidated Rules for 2026 (CR26), each line linked to the rule it comes from.

FedRAMP release 2026.10.13.01Rules on this page last changed 2026-10-13Checked against FedRAMP/rules 2026-10-30

127 rules from the FedRAMP Consolidated Rules

FedRAMP 20x checklist

The 20x path certifies the offering against the Key Security Indicators and the provider rules of the Consolidated Rules for 2026. Stages 2 to 4 are written for Classes B, C and D, the classes their rule subsets name. Class A addresses only the rules listed in FRC-CLA-MFR, FRC-CLA-RFR and FRC-CLA-OFR, marked below.

1. List on the FedRAMP Marketplace

Listing comes first. FedRAMP does not accept a certification application from an offering that is not listed.

Marketplace listing (MKT)

Show the offering is for direct agency use, or for indirect use inside another provider's offering.
MKT-IIP-AGUAgency Use CasesMUST
Address the Marketplace listing rules, starting with public information, before you request a new listing or an update.
MKT-CSO-MLRMarketplace Listing RequirementsMUST
Publish up-to-date public information about the offering in human-readable and JSON form: FedRAMP ID, service and deployment model, contacts, Trust Center link, next report date and assessor.
CDS-CSO-PUBPublic InformationMUSTClass A: MUST
Request the listing through the FedRAMP Marketplace Provider Listing Request Form; FedRAMP does not take listing requests by email.
MKT-CSO-PMLProvider Marketplace Listing RequestsMUST
Put the FedRAMP ID on all certification data once FedRAMP assigns it; use a placeholder until then.
CDS-CSO-FIDAlways Include FedRAMP IDMUST
While listed in the Initial Implementation Phase, document progress toward certification in your Trust Center or website and update it at least quarterly.
MKT-IIP-DCPDemonstrating Continuous ProgressMUST
Show that a Class B, C or D assessment is scheduled within 2 years of your Initial Implementation Phase listing.
MKT-IIP-DLADeadline for AssessmentMUST2 years
Be listed in the Marketplace before you apply for certification.
FRC-APP-MLFMarketplace Listing FirstMUST

3. Assessment and application, by class

Every class applies the same way. What differs is the independent assessment the rules ask for, and how much of the verification and validation must be automated.

Every class

Seek either a Rev5 or a 20x Program Certification for an offering, never both.
FRC-CSO-POPPick One Program Certification TypeMUST NOT
Complete the FedRAMP Certification Application Form in full to request the initial assessment.
FRC-APP-AFCApplying for FedRAMP CertificationMUST
Apply yourself; a third party, including your assessor, cannot apply for you.
FRC-APP-NTPNo Third-Party ApplicantsMUST NOT
Supply a fresh package that shows the offering's status as verified and validated by you within the previous 7 days.
FRC-APP-FCPFresh FedRAMP Certification PackageMUST
Stay responsible for the accuracy and completeness of everything in the package, including what third parties supplied.
FRC-CSO-MRAMaintain Responsibility and AccountabilityMUST

Class A

Built on a recent SOC 2 Type II, FedRAMP Rev5 or GovRAMP assessment.

Hold a completed FedRAMP Rev5 (including Ready), SOC 2 Type II or GovRAMP certification or assessment from the past 12 months.
FRC-CLA-ASFApproved Alternative Security FrameworksMUST
Supply that framework's materials: the SOC 2 report and bridge letter, or the Readiness Assessment Report and Security Assessment Plan.
FRC-CLA-EAMExternal Assessment MaterialsMUST
Address the mandatory Class A rules: the FRC-CLA subset plus the package, JSON, scope, public data, Trust Center, inbox, incident, detection, reporting and assessment rules it lists, and seven KSIs.
FRC-CLA-MFRMandatory FedRAMP Rules for Class AMUST
Address the recommended Class A rules: availability reporting, package maintenance, incident reports and vulnerability timeframes.
FRC-CLA-RFRRecommended FedRAMP Rules for Class ASHOULD
Address the optional Class A rules, such as quarterly reviews, validated cryptography and KSI metrics.
FRC-CLA-OFRAddress Optional FedRAMP Rules for Class AMAY
Meet the expectations of the underlying framework in the persistent independent assessment.
IVV-CSX-AIAAnnual Independent Assessments for 20xMUST
Supply a fresh independent assessment by a FedRAMP Recognized assessor completed in the previous 3 months.
FRC-APP-FIAFresh Independent AssessmentMAY3 months
Have the package independently verified and validated by a FedRAMP Recognized assessor before submission.
FRC-CLA-IVVOptional Independent Verification and ValidationMAY
Automate verification and validation of the Key Security Indicators.
FRC-CSX-VVKAutomated Verification and Validation of Key Security IndicatorsMAY

Class B

The first class with a FedRAMP independent assessment of the KSIs.

Supply a fresh independent assessment by a FedRAMP Recognized assessor completed in the previous 3 months.
FRC-APP-FIAFresh Independent AssessmentMUST3 months
Complete an independent assessment of all applicable rules at least once per year.
IVV-CSO-FIAFedRAMP Independent AssessmentsMUST1 year
Include all Key Security Indicators in that assessment at least once per year.
IVV-CSX-AIAAnnual Independent Assessments for 20xMUST1 year
Apply all Key Security Indicators to everything inside the Minimum Assessment Scope.
FRC-CSX-MASApplication within MASSHOULD
Run at least 1 automated verification and validation method per KSI.
FRC-CSX-VVKAutomated Verification and Validation of Key Security IndicatorsSHOULD
Automate verification and validation of the Security Decision Record for FedRAMP rules.
FRC-CSX-VVRAutomated Verification and Validation of FedRAMP RulesSHOULD
Freshen a stale initial assessment with a review of changes, unless it is more than 9 months old.
FRC-APP-USAUpdating Stale AssessmentsMAY

Class C

Two automated methods per KSI and daily metrics.

Supply a fresh independent assessment by a FedRAMP Recognized assessor completed in the previous 3 months.
FRC-APP-FIAFresh Independent AssessmentMUST3 months
Complete an independent assessment of all applicable rules at least once per year.
IVV-CSO-FIAFedRAMP Independent AssessmentsMUST1 year
Include all Key Security Indicators in that assessment at least once per year.
IVV-CSX-AIAAnnual Independent Assessments for 20xMUST1 year
Apply all Key Security Indicators to everything inside the Minimum Assessment Scope.
FRC-CSX-MASApplication within MASSHOULD
Run at least 2 automated verification and validation methods per KSI.
FRC-CSX-VVKAutomated Verification and Validation of Key Security IndicatorsMUST
Automate verification and validation of the Security Decision Record for FedRAMP rules.
FRC-CSX-VVRAutomated Verification and Validation of FedRAMP RulesSHOULD
Freshen a stale initial assessment with a review of changes, unless it is more than 9 months old.
FRC-APP-USAUpdating Stale AssessmentsMAY

Class D

Four automated methods per KSI; the highest assurance class.

Supply a fresh independent assessment by a FedRAMP Recognized assessor completed in the previous 3 months.
FRC-APP-FIAFresh Independent AssessmentMUST3 months
Complete an independent assessment of all applicable rules at least once per year.
IVV-CSO-FIAFedRAMP Independent AssessmentsMUST1 year
Include all Key Security Indicators in that assessment at least once per year.
IVV-CSX-AIAAnnual Independent Assessments for 20xMUST1 year
Apply all Key Security Indicators to everything inside the Minimum Assessment Scope.
FRC-CSX-MASApplication within MASSHOULD
Run at least 4 automated verification and validation methods per KSI.
FRC-CSX-VVKAutomated Verification and Validation of Key Security IndicatorsMUST
Automate verification and validation of the Security Decision Record for FedRAMP rules.
FRC-CSX-VVRAutomated Verification and Validation of FedRAMP RulesSHOULD
Freshen a stale initial assessment with a review of changes, unless it is more than 9 months old.
FRC-APP-USAUpdating Stale AssessmentsMAY

129 rules from the FedRAMP Consolidated Rules

FedRAMP Rev5 (CR26) checklist

Rev5 certifications are Class B, C or D; the Class A rules in the file apply to 20x only. The shared rules are the same as on the 20x path. Lines marked Rev5 only come from the Rev5-specific rules, which have no Atlas page yet and link to FedRAMP's text.

3. Assessment and application, by class

Every class applies the same way. What differs is the independent assessment the rules ask for, and how much of the verification and validation must be automated.

Every class

Seek either a Rev5 or a 20x Program Certification for an offering, never both.
FRC-CSO-POPPick One Program Certification TypeMUST NOT
Complete the FedRAMP Certification Application Form in full to request the initial assessment.
FRC-APP-AFCApplying for FedRAMP CertificationMUST
Apply yourself; a third party, including your assessor, cannot apply for you.
FRC-APP-NTPNo Third-Party ApplicantsMUST NOT
Supply a fresh package that shows the offering's status as verified and validated by you within the previous 7 days.
FRC-APP-FCPFresh FedRAMP Certification PackageMUST
Stay responsible for the accuracy and completeness of everything in the package, including what third parties supplied.
FRC-CSO-MRAMaintain Responsibility and AccountabilityMUST

Class B

The smallest Rev5 control set, assessed every year.

Supply a fresh independent assessment by a FedRAMP Recognized assessor completed in the previous 3 months.
FRC-APP-FIAFresh Independent AssessmentMUST3 months
Complete an independent assessment of all applicable rules at least once per year.
IVV-CSO-FIAFedRAMP Independent AssessmentsMUST1 year
Include the Rev5 controls FedRAMP lists for your class in that assessment at least once per year.
IVV-CSF-AIAAnnual Independent Assessments for Rev5MUST1 yearRev5 only
Have every applicable Rev5 control assessed within 3 years, across assessments if needed.
IVV-CSF-MCAMandatory Control AssessmentMUST3 yearsRev5 only
Re-assess every control with a negative finding at the next assessment.
IVV-CSF-ACFAssessment of Rev5 Controls with FindingsMUSTRev5 only
Include all applicable Rev5 controls in each assessment.
IVV-CSF-PCAPreferred Control AssessmentSHOULDRev5 only
Freshen a stale initial assessment with a review of changes, unless it is more than 9 months old.
FRC-APP-USAUpdating Stale AssessmentsMAY

Class C

A larger control set, assessed every year.

Supply a fresh independent assessment by a FedRAMP Recognized assessor completed in the previous 3 months.
FRC-APP-FIAFresh Independent AssessmentMUST3 months
Complete an independent assessment of all applicable rules at least once per year.
IVV-CSO-FIAFedRAMP Independent AssessmentsMUST1 year
Include the Rev5 controls FedRAMP lists for your class in that assessment at least once per year.
IVV-CSF-AIAAnnual Independent Assessments for Rev5MUST1 yearRev5 only
Have every applicable Rev5 control assessed within 3 years, across assessments if needed.
IVV-CSF-MCAMandatory Control AssessmentMUST3 yearsRev5 only
Re-assess every control with a negative finding at the next assessment.
IVV-CSF-ACFAssessment of Rev5 Controls with FindingsMUSTRev5 only
Include all applicable Rev5 controls in each assessment.
IVV-CSF-PCAPreferred Control AssessmentSHOULDRev5 only
Freshen a stale initial assessment with a review of changes, unless it is more than 9 months old.
FRC-APP-USAUpdating Stale AssessmentsMAY

Class D

The largest control set and the shortest package maintenance cycle.

Supply a fresh independent assessment by a FedRAMP Recognized assessor completed in the previous 3 months.
FRC-APP-FIAFresh Independent AssessmentMUST3 months
Complete an independent assessment of all applicable rules at least once per year.
IVV-CSO-FIAFedRAMP Independent AssessmentsMUST1 year
Include the Rev5 controls FedRAMP lists for your class in that assessment at least once per year.
IVV-CSF-AIAAnnual Independent Assessments for Rev5MUST1 yearRev5 only
Have every applicable Rev5 control assessed within 3 years, across assessments if needed.
IVV-CSF-MCAMandatory Control AssessmentMUST3 yearsRev5 only
Re-assess every control with a negative finding at the next assessment.
IVV-CSF-ACFAssessment of Rev5 Controls with FindingsMUSTRev5 only
Include all applicable Rev5 controls in each assessment.
IVV-CSF-PCAPreferred Control AssessmentSHOULDRev5 only
Freshen a stale initial assessment with a review of changes, unless it is more than 9 months old.
FRC-APP-USAUpdating Stale AssessmentsMAY

Three questions

Which path am I on?

Is this a new offering with no FedRAMP status?

Start on the 20x path. Get listed on the Marketplace in the Initial Implementation Phase, then build the package around the Key Security Indicators for the class you are targeting.

Do you hold a Rev5 authorization today?

You are on the Rev5 (CR26) path. Keep the certification and adopt the Consolidated Rules on FedRAMP's dates. One offering cannot hold both a Rev5 and a 20x Program Certification (FRC-CSO-POP), so a move to 20x is a new application.

Rev5 under the Consolidated Rules

Do you hold FedRAMP Ready status?

Convert to a certification by the later of your annual assessment's expiry or November 17, 2026 (FRC-CSF-RDY). FedRAMP's note on that rule says the simplest conversion is usually a 20x Class A certification, which builds on your existing assessment.

FedRAMP authorization, answered from the rules

What is on a FedRAMP authorization checklist in 2026?: Four stages. First, a FedRAMP Marketplace listing, which must exist before you apply (FRC-APP-MLF). Second, the certification package: an overview of the offering, a Security Decision Record that explains, verifies and validates each applicable rule, and a sample Ongoing Certification Report (FRC-CSO-PKG). Third, the application and the independent assessment your class requires (FRC-APP-AFC, FRC-APP-FIA). Fourth, the rules you keep following after certification: quarterly reports, significant change notifications, vulnerability detection and annual assessments.
Is there still an initial authorization package in 2026?: Yes. FedRAMP now calls it the FedRAMP Certification Package, the law's "authorization package". FRC-CSO-PKG sets its minimum content, and FRC-APP-FCP asks for a fresh package verified within the previous 7 days when you apply. On the Rev5 path the Certification Package Overview replaces the System Security Plan (CPO-CSO-OVR), and the Security Decision Record carries a summary of each control (SDR-CSF-CTF). Our package checklist spreadsheet lists the documents item by item. Download the package checklist (XLSX)
How long does FedRAMP authorization take?: The Consolidated Rules do not set a review time, so this page does not estimate one. They do set windows: the package must be fresh within 7 days of applying (FRC-APP-FCP); a Class B, C or D offering needs an independent assessment completed within the previous 3 months (FRC-APP-FIA), and one up to 9 months old can be freshened with a review of changes (FRC-APP-USA); a Class A offering needs an alternative framework assessment from the past 12 months (FRC-CLA-ASF); and an Initial Implementation Phase listing must have an assessment scheduled within 2 years (MKT-IIP-DLA). The certification rules page explains the process step by step. FedRAMP certification rules
What is the FedRAMP 20x readiness checklist?: It is our evidence readiness checklist for the 20x path: a rehearsal before assessment that fixes the scope and rule version, walks one measure from implementation to effectiveness, checks that the Security Decision Record explains the evidence, and practices the package handoff for Class B or C. This page is the full list of what certification requires; the readiness checklist is how you test that you can prove it. FedRAMP 20x evidence readiness checklist
Do I need a 3PAO?: FedRAMP now calls them FedRAMP Recognized independent assessment services, listed on the Marketplace. Classes B, C and D must have one: a fresh independent assessment within 3 months of applying (FRC-APP-FIA) and an assessment of all applicable rules at least once a year (IVV-CSO-FIA), which on 20x includes every Key Security Indicator (IVV-CSX-AIA). For Class A the independent assessment is optional (FRC-APP-FIA, FRC-CLA-IVV) because the class builds on a SOC 2 Type II, Rev5 or GovRAMP assessment (FRC-CLA-ASF). In every class you submit the application yourself; an assessor cannot apply for you (FRC-APP-NTP).

FedRAMP 20x evidence readiness checklistRehearse scope, verification, validation, KSI summaries and package access before the assessment.FedRAMP ConMon checklist for Rev5 and CR26Vulnerability work, reporting, quarterly reviews, package maintenance and the phased adoption dates.FedRAMP initial authorization package checklist (XLSX)The document-by-document package checklist, as a spreadsheet.

Not sure of your class? Take the free FedRAMP 20x gap assessment, or browse every Key Security Indicator.

What you need for FedRAMP authorization in 2026, on the 20x path and the Rev5 path

FedRAMP 20x checklist

1. List on the FedRAMP Marketplace

Marketplace listing (MKT)

2. Build the certification package

Security Decision Record and package overview

KSI validation and evidence

Vulnerability detection, response and reporting (VDR and VER)

Certification data sharing (CDS)

FedRAMP communication (AFC)

3. Assessment and application, by class

Every class

AClass A

BClass B

CClass C

DClass D

4. After certification

Ongoing Certification Reports and Quarterly Reviews (CCM)

Significant change notifications (SCN)

Continuous monitoring cadences

Incident evaluation and communication (IEC)

FedRAMP Rev5 (CR26) checklist

1. List on the FedRAMP Marketplace

Marketplace listing (MKT)

2. Build the certification package

Security Decision Record and package overview

Control evidence for assessors

Vulnerability detection, response and reporting (VDR and VER)

Certification data sharing (CDS)

FedRAMP communication (AFC)

3. Assessment and application, by class

Every class

BClass B

CClass C

DClass D

4. After certification

Ongoing Certification Reports and Quarterly Reviews (CCM)

Significant change notifications (SCN)

Continuous monitoring cadences

Changing certification class

Incident evaluation and communication (IEC)

Which path am I on?

Is this a new offering with no FedRAMP status?

Do you hold a Rev5 authorization today?

Do you hold FedRAMP Ready status?

FedRAMP authorization, answered from the rules

Keep going

Class A

Class B

Class C

Class D

Class B

Class C

Class D