FedRAMP's September update for assessors and advisors: plan for 20x now, read the definitions, and stop following ghost rules

FedRAMP told assessors and advisors to move their training and business to 20x before June 2027, when Agency Certification ends and Rev5 stops taking new applications. It said written rules and definitions are the only rules, with no unwritten ones.

By FedXchange · November 7, 2026

FedRAMP's video, on its governance tracker page. The player loads from YouTube only when you press play.

The Federal Risk and Authorization Management Program (FedRAMP) held its monthly Assessor and Advisor Community Update on Wednesday, September 16, 2026. The audience was independent assessment services, the firms once called third-party assessment organizations (3PAOs), and the advisory firms that help cloud service providers prepare. A FedRAMP leader, who referred to himself as the FedRAMP Director, covered the assessor's new role, the end of Agency Certification, the move to FedRAMP 20x, and how to read the rules.

In short:

Who owns the package. The cloud service provider signs the contract with the agency and is fully responsible for the completeness and accuracy of its materials. The assessor checks the provider's work and helps the provider get it right.
Agency Certification ends. The FedRAMP leader said there will be no more Agency Certifications after June 2027. The FedRAMP timeline says FedRAMP stops accepting new Rev5 certifications on June 11, 2027. Rev5 is the older path built on Revision 5 of the National Institute of Standards and Technology (NIST) control catalog.
Assessors must be ready for 20x. The FedRAMP leader said an assessor that cannot support 20x by June 2027 will not be allowed to keep its FedRAMP Recognition, because 20x will be the only path for assessments. Advisors should not start new Rev5 engagements.
No ghost rules. FedRAMP will base every issue it raises on a written rule. The FedRAMP definitions are rules too.
Comment on RFC-0033. FedRAMP asked assessors to comment early on the assessor part of request for comment (RFC) RFC-0033. Comments closed October 9, 2026.

A note on terms: under the FedRAMP Consolidated Rules for 2026 (CR26), "FedRAMP authorization" became "FedRAMP Certification". Older documents, such as the 2024 memo from the Office of Management and Budget (OMB), still say "authorization". An agency's own authorization to operate (ATO) is a separate decision, and it keeps its name.

From an agency ATO to a FedRAMP Certification in 2027

Source: the September 16, 2026 Assessor and Advisor Community Update video.

Read the steps as text

The agency sets the rules. The provider's agency ATO follows the agency's own process, often based in part on FedRAMP's legacy rules.
The assessor follows the agency process. The assessor may still write a full security assessment report with recommendations, because the agency expects one.
The agency grants its ATO. An Agency Certification from FedRAMP needs an agency ATO first.
The provider applies to FedRAMP. FedRAMP checks the package against its current rules, including CR26 rules the agency did not require.
Gaps are rejected. FedRAMP rejects the certification until the provider puts the missing policies, procedures, and practices in place.
The assessor checks the difference. The assessor's job becomes an assessment of the gap between what the agency asked for and what FedRAMP requires.

What does an independent assessor do now?

The FedRAMP leader explained the history. FedRAMP began in 2011 with 3PAOs that decided whether a service met FedRAMP requirements. The FedRAMP Authorization Act of 2022 used different words. It said FedRAMP may use independent assessment services to analyze, validate, and attest to the quality and compliance of security assessment materials that providers supply. That is why the name and the role changed.

FedRAMP chose to have providers hire the assessor, not to hire assessors itself. Under the old approach, the provider paid, but the assessor wrote a report mostly for the agency or the former Joint Authorization Board (JAB). Now the assessor works for the provider. Its main job is to verify and validate the provider's materials and practices. Its second job is to help the provider make those materials complete and of good quality.

The provider stays fully responsible. In the video, the FedRAMP leader said that if a provider submits false materials, that is not the assessor's fault. A provider that makes false claims to the government faces penalties. The provider decides whether it meets the rules, and it may disagree with the assessor. FedRAMP then relies on the assessor's assurance, along with other customers.

The leader gave an example of the value. An assessor found that whole groups of a provider's services had not been turned on in an automated tool. The provider turned them on and the problem was fixed. The goal, the leader said, is that federal staff do not spend public time finding problems a provider should have found first.

What happens to Agency Certification?

It is ending. The FedRAMP leader said many providers signed agency contracts two years ago under the old rules, so assessors will see mixed work, especially from January to June 2027.

For an Agency Certification, the assessor follows the agency's process. The leader said assessors will probably keep using FedRAMP's legacy materials and a full security assessment report, because the agency uses that work to make its own decision. When the provider then applies to FedRAMP, it must meet FedRAMP's current rules. The leader gave February 2027 as an example: by then a number of CR26 rules apply, and FedRAMP will reject a package that has not adopted them, even if the agency did not care about them. CR26 becomes mandatory for all stakeholders on January 1, 2027, according to the FedRAMP timeline.

For a Program Certification, which FedRAMP grants without an agency sponsor, the assessor works with the provider against FedRAMP's rules only. Agencies are not part of that relationship. The leader described it as the future of the program.

How should assessors and advisors prepare for 20x?

Independent assessment services must keep training materials on their internal processes. The FedRAMP leader said he believed A2LA (the American Association for Laboratory Accreditation) reviews them from time to time. Assessors and advisors should now update their training, processes, and business development for FedRAMP 20x. FedRAMP 20x is the newer path, built on Key Security Indicators (KSIs), the measured security outcomes that take the place of control narratives.

The leader said June 2027 was nine months away. An assessor that has not moved to 20x by then will lose its FedRAMP Recognition, he said. He called new Rev5 advisory engagements very high risk, while noting that FedRAMP cannot give business advice. The Recognition rules for independent assessment services set the requirements for that status.

What are ghost rules, and are they gone?

Ghost rules were unwritten expectations. A provider got verbal feedback from FedRAMP staff, then different feedback the next time. Advisors and assessors turned that experience into unwritten advice: certain words a package had to contain to pass. The leader said FedRAMP took part in creating this, and has worked to end it.

Now, if FedRAMP raises an issue with a submission, the issue must rest on a written rule. In answer to a question, the leader said an email from FedRAMP staff that is not backed by a public rule does not bind a provider. Providers may push back and escalate when they think a reviewer is wrong.

The rules are also not traps. The leader's example from the video: if a rule says "paint your walls blue," it means paint your walls blue. A good faith attempt to meet a rule will not be thrown out of the process. At worst it becomes a vulnerability to fix. A submission that ignores the rules will be rejected, with the reason.

How should we read the rules?

Read the definitions. The leader said FedRAMP's definitions are rules, and they are the sole source for definitions. For example, "vulnerability" covers more than scanner findings. It includes weaknesses in controls and KSIs.
Read every narrative in the consolidated rules. Experience with the old program is not enough, because the rules are new.
Use artificial intelligence (AI) tools to read the rules alongside their definitions and explain them, then check the result. The leader said the rules were written for this, and that AI should help people, not replace their judgment.
Ask in public. Check the rules and the FedRAMP community discussions on GitHub before you email FedRAMP. A public answer helps everyone. Use email only for sensitive matters. The leader said he answers public GitHub questions before email, and that FedRAMP's changelog will now credit people who find serious problems.

What did FedRAMP ask about RFC-0033?

RFC-0033, "20x Phase 4 Development Tracks for 20x Class D", includes a track for direct engagement with independent assessment services. The leader said FedRAMP wants to meet several assessors at the same time. It plans to meet providers one at a time, because providers may not speak openly about strategy in front of competitors. He asked assessors to say in their comments whether group meetings would work.

The comment period closed October 9, 2026. FedRAMP's later meetings with assessors are covered in our post on the October assessor and advisor update.

Which certification should a provider seek?

Answers from the question period:

Rev5 Class D and the "pick one" rule. A provider must not seek both a Rev5 and a 20x Program Certification for the same service. A Rev5 Class D today comes from an Agency Certification, so its provider may also get a 20x Class C Program Certification.
Class D after June 2027. A provider that wants Class D should get a 20x Class C first. RFC-0033 proposes that, after the Phase 4 pilot, a service hold 20x Class C without corrective action for 6 months before it applies for Class D.
Past metrics. The leader said a new provider does not need months of past metrics to apply. It must show it can collect and keep them. The note on rule SDR-CSX-KMT in the Security Decision Record rules says the same: a provider needs the mechanisms in place and must agree to meet the requirement.
Agency ATOs still matter. FedRAMP does not issue ATOs. Each agency still grants its own. OMB memo M-24-15 says agencies must obtain and maintain a FedRAMP authorization when a cloud service falls within FedRAMP's scope. The memo also says FedRAMP does not apply to every use of an internet-based service.

What else did FedRAMP say about the assessor's work?

Assess what the provider does. Assessors verify and validate what the provider says it does to meet a control, and report gaps. They do not test every assessment objective one by one.
Advising and assessing. One team cannot be both a provider's advisor and its assessor on the same work. During an assessment, the assessor and provider may discuss gaps openly. The assessor's work is done when both agree the system is ready, or the provider declines further advice.
Penetration tests. FedRAMP does not require a formal third-party penetration test, but the leader said one can help show a provider takes security seriously.
Users and non-users. In the KSIs, "users" generally means human users or something acting like one. "Non-users" means accounts for paths not designed for human interaction.
Transformative changes. The provider decides how much assessor review a change needs. The annual assessment is now called the FedRAMP independent assessment, because it will not always be annual.
Assessor findings. An assessor may say a KSI is not effective. FedRAMP decides whether that matters if the provider disagrees.

What should assessors, advisors, and agencies do now?

Assessors: update your training and processes for 20x before June 2027, and read the Recognition rules.
Advisors: do not plan new Rev5 engagements. Help clients move to 20x, starting at Class C for those aiming at Class D.
Assessors with Agency Certification work: check that your contract covers the agency's process, and plan for a gap assessment against FedRAMP's current rules after the agency ATO.
Everyone: keep the definitions open, ask questions in the public GitHub community, and do not follow a rule you cannot find in writing.
Agency security staff: expect assessment results written for the provider, not a recommendation to the agency. The risk decision and the ATO remain yours.

Sources

Share this post:LinkedIn X Email

A weekly email on Fridays, an alert on the day the watch finds something new, or both. Free.