# Boundera

> FedRAMP 20x authorization platform for KSI evidence, persistent validation, VDR workflows, authorization data sharing, trust center publishing, assessor collaboration, and continuous monitoring.

## Overview

Boundera helps cloud service providers prepare for FedRAMP 20x and Rev 5 by turning infrastructure, repository, document, and vulnerability evidence into authorization-ready workflows. This file is generated from the current website content index.

## Key Tools and Services

- [Free FedRAMP 20x Gap Assessment](https://boundera.io/fedramp-gap-assessment): Find a likely certification path and class, Marketplace listing gaps, and readiness across all 10 KSI families in about five minutes.
- [FedRAMP Consolidated Rules Explorer](https://boundera.io/consolidated-rules): Filter current 2026 requirements by certification type, path, service class, party, and force level, then export the scoped results.
- [FedRAMP Automation Platform](https://boundera.io/fedramp-automation): Automate KSI evidence, control validation, SSP and POA&M workflows, OSCAL output, reporting, and continuous monitoring.
- [FedRAMP Rev 5 Platform](https://boundera.io/rev5): Support control mapping, SSP generation, evidence workflows, POA&M operations, and continuous monitoring for Rev 5.
- [FedRAMP Advisory Services](https://boundera.io/fedramp-advisory-services): Get 20x and Rev 5 readiness, KSI automation, documentation, and 3PAO assessment support.
- [FedRAMP Marketplace Listing Guide](https://boundera.io/fedramp-marketplace-listing): Understand what an Initial Implementation Phase Marketplace listing requires under the Consolidated Rules for 2026 — no assessment, no independent assessor, and mandatory before applying for a FedRAMP Certification.
- [Boundera FedRAMP Trust Center](https://boundera.io/tc/fedramp-trust-center): View Boundera's public FedRAMP 20x certification scope, KSI results, documents, and machine-readable authorization data.

## Canonical Hubs

- [Homepage](https://boundera.io/)
- [FedRAMP 20x](https://boundera.io/fedramp-20x)
- [FedRAMP 20x KSI Atlas](https://boundera.io/fedramp-20x/ksi)
- [FedRAMP 20x Rules Atlas](https://boundera.io/fedramp-20x/rules)
- [FedRAMP 20x Glossary](https://boundera.io/fedramp-20x/glossary)
- [Blog](https://boundera.io/blog)
- [FedRAMP 20x Blog](https://boundera.io/blog/20x)
- [Rev 5 Blog](https://boundera.io/blog/rev5)
- [Resources](https://boundera.io/resources)
- [FedRAMP 20x Resources](https://boundera.io/resources/20x)
- [Rev 5 Resources](https://boundera.io/resources/rev5)
- [Request Demo](https://boundera.io/request-demo)

## Top/Recent FedRAMP 20x Blog Posts

- [FedRAMP VDR and VER: What CSPs Must Do Before December 7, 2026](https://boundera.io/blog/20x/fedramp-vdr-ver-december-2026-deadline): FedRAMP Notice NTC-0014 makes the Vulnerability Detection and Response (VDR) and Vulnerability Evaluation and Reporting (VER) rulesets mandatory on December 7, 2026 for every certified or in-process cloud service offering, Rev 5 and 20x alike, with certification revocable after March 7, 2027. Remediation deadlines now come from certification class, potential agency impact, internet-reachability, and exploitability instead of scanner severity. Published 2026-08-13T12:00:00.000Z 7 min read
- [Run FedRAMP 20x KSI Checks in CI: The Boundera GitHub Action](https://boundera.io/blog/20x/fedramp-20x-ksi-github-action): Boundera's open-source FedRAMP 20x KSI GitHub Action evaluates your Terraform IaC against KSI-MLA-EVC and KSI-CNA-RNT on every commit, posts a pass/fail Check Run, and uploads a hash-verified evidence pack a 3PAO can review. It runs entirely in your own GitHub Actions runner with no vendor server, so evidence never leaves GitHub infrastructure. It is MIT-licensed, live on the GitHub Marketplace, and currently alpha (v0.1.0) covering two infrastructure-configuration KSIs. Published 2026-06-04T12:00:00.000Z 7 min read
- [How to Implement FedRAMP 20x KSI Checks (Checks as Objects)](https://boundera.io/blog/20x/fedramp-20x-ksi-checks-implementation): Model each FedRAMP 20x KSI check as a first-class object with a stable identity, declared inputs, a validation method, a structured machine-readable result, a cadence, an owner, and a failure path. Each check reads current state from an authoritative source and asserts one condition; results roll up deterministically into a KSI assertion. This makes evidence regenerable on demand, runs on the 7-day (Low) / 3-day (Moderate) cadence, and treats any failed or broken validation as a vulnerability. Published 2026-06-04T12:00:00.000Z 14 min read
- [How to Collect and Automate FedRAMP 20x KSI Evidence](https://boundera.io/blog/20x/fedramp-20x-ksi-evidence-automation): FedRAMP 20x KSI evidence is validated proof that each Key Security Indicator is met, and it must be both machine-readable and human-readable, regenerable on demand, and produced by persistent validation rather than screenshots. You automate it by connecting cloud config, vulnerability scanners, and your identity provider, mapping each signal to a KSI validation, and emitting a structured package on schedule. Machine-based resources must be validated at least every 7 days at Low and every 3 days at Moderate; non-machine validations at least every 3 months. Published 2026-06-04T12:00:00.000Z 15 min read
- [How Much Does FedRAMP Cost in 2026?](https://boundera.io/blog/20x/fedramp-cost-2026): Most CSPs should budget ~$250K-$2M+ for initial FedRAMP authorization plus $200K-$500K/year for continuous monitoring, depending on impact level and path. Rev 5 Moderate typically runs $500K-$1.5M to reach ATO; FedRAMP 20x is expected to land materially lower. Published 2026-06-04T12:00:00.000Z 13 min read
- [How to Get FedRAMP 20x Certified: A Step-by-Step Guide for CSPs](https://boundera.io/blog/20x/how-to-get-fedramp-20x-certified): FedRAMP 20x readiness starts with eligibility, class selection, boundary definition, KSI mapping, evidence sources, persistent validation, VDR, authorization data sharing, and current KSI evidence exports. Published 2026-05-23T12:00:00.000Z 13 min read
- [FedRAMP 20x + Authorization Act Updates: What Changed and What CSPs Should Do Next](https://boundera.io/blog/20x/fedramp-20x-authorization-act-updates): FedRAMP is moving toward faster, more automated evidence-driven workflows. CSPs should tighten boundary clarity, machine-readable evidence, and repeatable control narratives. Published 2025-03-03T12:00:00.000Z 9 min read
- [FedRAMP 20x SSP Automation: What Still Matters After Control Narratives](https://boundera.io/blog/20x/fedramp-20x-ssp-automation-control-narratives): The important thing is not that every package looks identical; the important thing is that the required information is accurate, current, understandable, and available in both human-readable and machine-readable forms when required. Published 2026-07-27T19:25:47.049Z 1 min read
- [FedRAMP 20x KSI Evidence Workflow: Verification, Validation, and History](https://boundera.io/blog/20x/fedramp-20x-ksi): Treat each indicator as a repeatable evidence workflow with implementation proof, effectiveness proof, automation, and retained history. Published 2026-07-13T14:04:05.825Z 5 min read
- [FedRAMP 20x vs Rev 5: KSI Validation vs Control Narratives](https://boundera.io/blog/20x/fedramp-20x-vs-rev5-ksi-validation-control-narratives): In 2026, both paths use the SDR. The difference is that 20x summarizes how KSIs are measured and validated, while Rev5 summarizes how controls are implemented, verified, and validated. Published 2026-07-09T14:12:00.000Z 7 min read
- [FedRAMP 20x OSCAL Evidence Automation: A Practical Workflow](https://boundera.io/blog/20x/fedramp-20x-oscal-evidence-automation): A 20x package is a set of FedRAMP Certification Data that a cloud service provider maintains over time and shares with FedRAMP, agencies, and other necessary parties. Published 2026-07-06T14:08:39.215Z 6 min read
- [How to Track FedRAMP 20x Changes Before They Affect Your Authorization Plan](https://boundera.io/blog/20x/fedramp-20x-change-tracking-authorization-plan): Build a weekly workflow that reviews official FedRAMP changelog, notice, and rule updates, classifies impact, and sends possible significant changes to the right owner before implementation starts. Published 2026-07-02T19:58:52.252Z 6 min read
- [FedRAMP CR26 Transition: What the 2026 Rules Change for Rev 5 and 20x](https://boundera.io/blog/20x/fedramp-cr26-transition-rev5-20x): FedRAMP says the temporary Rev5 Program pipelines for Class B and C close on June 11, 2027, when new Rev5 certification applications stop. Published 2026-06-29T15:48:14.975Z 4 min read
- [What FedRAMP 20x Marketplace Movement Means for CSP Readiness](https://boundera.io/blog/20x/fedramp-20x-marketplace-movement-csp-readiness): Readiness here is mostly operational: get the listing live, keep the public data surface synchronized, publish dated progress, and keep the package fresh enough to defend on demand. Published 2026-06-25T14:18:00.000Z 4 min read
- [How to Prepare a FedRAMP 20x Authorization Data Sharing Workflow](https://boundera.io/blog/20x/fedramp-20x-authorization-data-sharing-workflow): FedRAMP 20x authorization data sharing should be run as an operating workflow: keep public service information, trust-center access, package overview metadata, restricted certification data, and machine-readable outputs synchronized from controlled source records. Published 2026-06-22T20:39:59.545Z 7 min read
- [SOC 2 to FedRAMP 20x Class A: What Can Carry Forward](https://boundera.io/blog/20x/soc-2-to-fedramp-20x-class-a): SOC 2 Type II external assessment materials for this FedRAMP Class A path include a complete report and supporting audit documentation when applicable. Published 2026-07-27T19:13:12.568Z 1 min read
- [GovRAMP to FedRAMP 20x Class A: What Changes in the Evidence Package](https://boundera.io/blog/20x/govramp-to-fedramp-20x-class-a): Providers seeking a FedRAMP Class A Certification MUST supply materials from their alternative security framework assessment to all necessary parties. Published 2026-07-27T18:02:37.198Z 1 min read
- [The FedRAMP Consolidated Rules Explorer: Every 2026 Rule, Scoped to You](https://boundera.io/blog/20x/consolidated-rules-explorer): The Consolidated Rules Explorer turns the 2026 FedRAMP Consolidated Rules — 249 requirements across 17 rulesets — into a filterable matrix. Set four filters (party, certification type, path, and service class) and it returns exactly what's mandatory, recommended, or optional for you, each with verbatim rule text, deadlines, and NIST SP 800-53 mappings. It reads from the FedRAMP/rules source of truth and exports any scoped view to CSV or JSON. Published 2026-07-09T14:00:00.000Z 14 min read
- [FedRAMP Continuous Monitoring Automation for 20x ATO](https://boundera.io/blog/20x/fedramp-continuous-monitoring-automation): FedRAMP continuous monitoring automation collects Key Security Indicator (KSI) evidence directly from your cloud control plane on every infrastructure change. In FedRAMP 20x, Moderate machine validations are expected at least once every 3 days — a cadence that only works when evidence collection is wired into CI/CD. Published 2026-06-04T12:00:00.000Z 9 min read
- [FedRAMP 20x Toolkit: Open-Source KSI Mappings & Example Packages](https://boundera.io/blog/20x/fedramp-20x-toolkit): Boundera's open-source FedRAMP 20x Toolkit gives CSPs practitioner-grade AWS-to-KSI evidence mappings for the IAM and MLA families and machine-readable example packages (a sample KSI package and an SSP fragment) to use as references. It is MIT-licensed and alpha (v0.1.x), targets FRMR v0.9.43-beta, and covers two of the eleven KSI families publicly. A KSI-specific package validator is on the roadmap. Published 2026-06-04T12:00:00.000Z 7 min read

## Resources

- [The FedRAMP 20x Executive Playbook](https://boundera.io/resources/20x/fedramp-20x-executive-playbook): A field guide to building a machine-readable FedRAMP 20x program: how to automate evidence and continuous validation without faking the attestation. Covers treating every check as a first-class object, deriving control status from live state, and keeping humans on the attestations machines can't make. Format: PDF. Category: Guides & Playbooks.
- [SSP Appendix A - Moderate FedRAMP Security Controls](https://boundera.io/resources/rev5/ssp-appendix-a-moderate-fedramp): Complete System Security Plan Appendix A template for FedRAMP Moderate baseline. Includes all 325 required security controls with implementation guidance and examples. Format: DOCX. Category: Templates.
- [FedRAMP Moderate Readiness Assessment Report (RAR) Template](https://boundera.io/resources/rev5/fedramp-moderate-rar-template): Readiness Assessment Report template for FedRAMP Moderate. Use this to assess your organization's preparedness before starting formal authorization. Format: DOCX. Category: Checklists.
- [FedRAMP High Baseline System Security Plan (SSP)](https://boundera.io/resources/rev5/fedramp-high-baseline-ssp): Complete SSP template for FedRAMP High baseline with 421 security controls. Required for systems processing highly sensitive federal data. Format: DOCX. Category: Templates.
- [FedRAMP Initial Authorization Package Checklist](https://boundera.io/resources/rev5/fedramp-authorization-package-checklist): Comprehensive checklist of all required documents for FedRAMP initial authorization. Ensure your package is complete before submission. Format: XLSX. Category: Checklists.
- [CSP Authorization Playbook](https://boundera.io/resources/rev5/csp-authorization-playbook): Step-by-step playbook for Cloud Service Providers pursuing FedRAMP authorization. Covers Agency and JAB paths with detailed guidance. Format: PDF. Category: Guides & Playbooks.
- [FedRAMP 20x Incident Reports (IIR, OIR, FIR) Example](https://boundera.io/resources/20x/fedramp-20x-incident-report-examples): Follow fictional incident information from Initial through Ongoing and Final reports, including timelines, PAIN ratings, impact, activity, recovery, and root cause. Format: ZIP. Category: Certification Data Examples.
- [FedRAMP 20x Significant Change Notification (SCN) Examples](https://boundera.io/resources/20x/fedramp-20x-significant-change-notification-examples): Follow a synthetic transformative-change lifecycle and contrast it with a rough adaptive notification that demonstrates a completeness failure. Format: ZIP. Category: Certification Data Examples.
- [FedRAMP 20x Historical VER Activity Example](https://boundera.io/resources/20x/fedramp-20x-historical-vulnerability-activity-example): See how recent active and accepted vulnerability records can be assembled into an automation-friendly historical VER snapshot. Format: ZIP. Category: Certification Data Examples.
- [FedRAMP 20x Accepted Vulnerability Information Example](https://boundera.io/resources/20x/fedramp-20x-accepted-vulnerability-information-example): Examine how accepted vulnerability records can pair technical evaluation fields with explicit rationale and accountable senior-official acceptance. Format: ZIP. Category: Certification Data Examples.
- [FedRAMP 20x Vulnerability Detail Report Example](https://boundera.io/resources/20x/fedramp-20x-vulnerability-detail-report-example): Study three synthetic vulnerability records showing detection, internet reachability, likely exploitability, completed evaluation, and current rating fields. Format: ZIP. Category: Certification Data Examples.
- [FedRAMP 20x Ongoing Certification Report (OCR) Example](https://boundera.io/resources/20x/fedramp-20x-ongoing-certification-report-example): See how an OCR can summarize a reporting period's changes, planned work, accepted vulnerabilities, incidents, recommendations, and feedback mechanism. Format: ZIP. Category: Certification Data Examples.
- [FedRAMP 20x Security Decision Record (SDR) Example](https://boundera.io/resources/20x/fedramp-20x-security-decision-record-example): Explore a substantial SDR example containing FedRAMP rule records, KSI summaries, validation statements, evidence references, tests, and historical metrics. Format: ZIP. Category: Certification Data Examples.
- [FedRAMP 20x Certification Package Overview (CPO) Example](https://boundera.io/resources/20x/fedramp-20x-certification-package-overview-example): See how a FedRAMP 20x Certification Package Overview can organize offering metadata, documentation links, service scope, contacts, and third-party resources. Format: ZIP. Category: Certification Data Examples.
- [Sample Security Policy Library (20+ Policies)](https://boundera.io/resources/rev5/security-policy-library): Collection of 20+ required security policies and procedures for FedRAMP. Includes Access Control, Incident Response, Change Management, and more. Format: ZIP. Category: Policy Examples.
- [FedRAMP Readiness Assessment Checklist](https://boundera.io/resources/rev5/fedramp-readiness-checklist): Self-assessment checklist to determine if your organization is ready to begin FedRAMP authorization. Covers technical, operational, and business readiness. Format: PDF. Category: Checklists.
- [FedRAMP Low Baseline System Security Plan (SSP)](https://boundera.io/resources/rev5/fedramp-low-baseline-ssp): SSP template for FedRAMP Low baseline with 125 security controls. Ideal for systems processing publicly releasable information. Format: DOCX. Category: Templates.
- [FedRAMP LI-SaaS Baseline System Security Plan](https://boundera.io/resources/rev5/fedramp-li-saas-baseline-ssp): Tailored SSP template for Low Impact SaaS applications. Streamlined baseline for simple SaaS products. Format: DOCX. Category: Templates.
- [FedRAMP Budget & Timeline Calculator](https://boundera.io/resources/rev5/fedramp-budget-timeline-calculator): Interactive spreadsheet to estimate FedRAMP authorization costs and timeline based on your baseline level and current readiness. Format: XLSX. Category: Planning Tools.
- [Evidence Collection Guide by Control Family](https://boundera.io/resources/20x/evidence-collection-guide): Comprehensive guide showing what evidence is needed for each NIST 800-53 control family. Includes automated evidence sources. Format: PDF. Category: Guides & Playbooks.

## Machine-Readable Links

- Sitemap: https://boundera.io/sitemap.xml
- Robots: https://boundera.io/robots.txt
- Author graph: https://boundera.io/author.json
- Concise LLM context: https://boundera.io/llms.txt
- Full LLM context: https://boundera.io/llms-full.txt