FedRAMP Day, June 2026: Rev5 ends for new applicants, CR26 replaces the security plan, and vulnerability rules follow BOD 26-04

At FedRAMP Day on June 23, 2026, FedRAMP and the Federal CIO told agencies to update their policies: new Rev5 applications end June 11, 2027, CR26 is mandatory January 1, 2027, and the vulnerability rules start December 7, 2026.

By FedXchange · July 20, 2026

FedRAMP's video, on its governance tracker page. The player loads from YouTube only when you press play.

The Federal Risk and Authorization Management Program (FedRAMP) held its fourth FedRAMP Day on June 23, 2026, at the General Services Administration (GSA). The audience was agency staff: chief information officers (CIOs), chief information security officers, and FedRAMP's agency liaisons. The day covered the FedRAMP Consolidated Rules for 2026 (CR26), which FedRAMP launched two days later, on June 25. Under CR26, FedRAMP calls its approval a "FedRAMP Certification," the term this post uses.

In short:

Rev5 is ending for new services. Rev5 is the older FedRAMP path, built on Revision 5 of the National Institute of Standards and Technology (NIST) control catalog. FedRAMP stops accepting new Rev5 applications on June 11, 2027. Agencies sponsoring a Rev5 service now should finish. New services should use FedRAMP 20x, the newer path.
CR26 is mandatory on January 1, 2027. Existing Rev5 Certifications stay active until at least December 31, 2028, but must adopt the new rules.
The paperwork changes. A Certification Package Overview and a Security Decision Record replace the System Security Plan.
Vulnerabilities come first. FedRAMP's vulnerability rules start December 7, 2026, the date in the Cybersecurity and Infrastructure Security Agency (CISA) directive for agencies.
Agencies must act. The Federal CIO's advice, in the video: "Update your policies. Rev 5 is going away."

Key dates from the Consolidated Rules for 2026

Sources: FedRAMP's Important Dates page, its June 25, 2026 launch announcement, and Notice 0014.

Read the steps as text

June 25, 2026. FedRAMP launches the Consolidated Rules for 2026.
July 4, 2026. Optional early adoption begins.
July 28, 2026. FedRAMP Ready becomes legacy. FedRAMP accepts no new FedRAMP Ready submissions.
August 3, 2026. FedRAMP starts accepting applications for 20x Class A Certifications.
December 7, 2026. The vulnerability detection and vulnerability reporting rules become mandatory.
January 1, 2027. The Consolidated Rules for 2026 take mandatory effect. Some rule sets have later dates.
March 7, 2027. The grace period for the vulnerability rules ends. Services that do not follow them lose certification.
June 11, 2027. FedRAMP stops accepting applications for new Rev5 Certifications.

Can our agency still sponsor a Rev5 cloud service?

Yes, for now. FedRAMP's Important Dates page says it stops accepting applications for new Rev5 Certifications on June 11, 2027. A FedRAMP help article says the package must be "in active review by the FedRAMP PMO by 11 June 2027."

In the video, the FedRAMP Director gave agencies this advice:

Already sponsoring a Rev5 service? Finish it before that date, especially at Class D, the highest class.
Only talking with a provider? Send it to FedRAMP 20x instead.
Starting a Class D sponsorship in the fall? The FedRAMP Director said it may be better to wait for 20x Class D, or to join its pilot. FedRAMP later proposed that pilot in RFC-0033.

The FedRAMP Director said ending Rev5 was not his own decision but the direction FedRAMP had been given. The Federal CIO said he would have pushed harder, earlier, to set an end date for Rev5.

For low-risk trials, the speakers pointed to 20x Class A. A provider brings its existing commercial security certifications, and an agency can use the service for prototypes and pilots with low-impact data. FedRAMP began accepting Class A applications on August 3, 2026. The Federal CIO said agencies should use Class A to test small companies' products, rather than asking those companies to pay for a full certification first.

FedRAMP's What's Changing page says existing Rev5 Certifications remain active until at least December 31, 2028, unless FedRAMP directs otherwise.

What must agencies change in their own policies?

The speakers' main message was that agencies must change how they treat outside cloud services. The Federal CIO said agencies with policies that still require Rev5 documents should update them. The FedRAMP Director noted that Office of Management and Budget (OMB) memorandum M-24-15 already told agencies to align their policies with FedRAMP's changes.

The FedRAMP Director drew a line between two kinds of systems:

Systems an agency builds and runs follow the Risk Management Framework and OMB Circular A-130.
Commercial cloud services an agency uses can be reviewed through FedRAMP's faster process, which looks at security capabilities.

He said an agency's own System Security Plan should hold only what the agency controls. For example, it should not copy a provider's training statement. It should say how the agency will review the training metrics the provider gives and what it will do if the provider falls short. He also said, in the video: "Do not use controls as a checklist."

Speakers stressed that agencies keep the legal duty to manage their own risk. FedRAMP can take away a service's certification, but it holds no contract with the provider. The FedRAMP Director said an agency's own contract is its main lever, so its contracts should require providers to keep their FedRAMP Certification.

Asked about a new version of OMB Circular A-130, last updated in 2016, the Federal CIO called it a priority and "a massive, massive undertaking." He gave no date.

What changes in a Rev5 certification package?

CR26 replaces the System Security Plan and its appendices with a Certification Package Overview and a Security Decision Record, according to FedRAMP's What's Changing page. Word and Excel templates give way to simple machine-readable files in JSON format. Plans of action and milestones (POA&Ms) are replaced with a list of Accepted Weaknesses.

The FedRAMP Director explained the thinking:

Show what was done. For each rule, the provider explains what it does, then verifies and validates that it works.
No assessment plan or report. The independent assessor checks the provider's verification and validation through real tests, not screenshots.
The provider is responsible. He said only the provider answers for false claims to the government, not the assessor.
No boundary diagram required. The Minimum Assessment Scope no longer requires a diagram of every system, port, and data flow. Providers must be able to report their boundary from current data.
Quarterly meetings. Collaborative continuous monitoring moves from monthly meetings to quarterly reviews.

The Rev5 Class C rules for collaborative continuous monitoring require a Quarterly Review every 3 months (CCM-QTR-MTG) and an Ongoing Certification Report every 3 months (CCM-OCR-AVL). The provider must also offer a way to send questions between meetings (CCM-OCR-FBM).

Most of these changes are staggered. FedRAMP's Rev5 Deadlines page sets these dates for existing services:

Rule set	Should adopt by	Must adopt by
Vulnerability Detection and Response; Vulnerability Evaluation and Reporting	December 7, 2026	March 7, 2027
Minimum Assessment Scope	January 1, 2027	First independent assessment started after January 1, 2027
Collaborative Continuous Monitoring	April 2, 2027	October 1, 2027
Certification Package Overview	July 1, 2027	First independent assessment started after July 1, 2027
Security Decision Record	August 1, 2027	First independent assessment started after August 1, 2027

How do FedRAMP's vulnerability rules relate to BOD 26-04?

CISA released Binding Operational Directive (BOD) 26-04, "Prioritizing Security Updates Based on Risk," on June 10, 2026. It tells agencies to begin evaluating and fixing vulnerabilities on its timelines by December 7, 2026.

The FedRAMP Director said CISA directives bind agencies, not commercial providers. FedRAMP links the two through its own rules. Notice 0014 moved the start of the Vulnerability Detection and Response (VDR) and Vulnerability Evaluation and Reporting (VER) rules to December 7, 2026, to match the directive. Services that miss that date can keep their certification under a corrective action plan until March 7, 2027. After that, FedRAMP revokes it.

In the video, a CISA vulnerability management leader said scoring every vulnerability by severity alone was a mistake. The directive asks agencies to weigh whether a flaw is reachable from the internet, is in CISA's Known Exploited Vulnerabilities catalog, and can be exploited automatically.

FedRAMP's timeframes for cloud services are tighter. A FedRAMP staff member gave an example. Under rule VDR-TFR-PVR for Rev5 Class D, a provider should partially mitigate an internet-reachable, likely exploitable vulnerability with the highest Potential Agency Impact rating, PAIN-5, to a lower rating within 12 hours.

The FedRAMP Director said a vulnerability is more than a software flaw. A gap in a control, missing multi-factor authentication, or untrained users all count. Under the VER rules, providers must tell agencies the possible risk to their data. An agency can then decide, for example, to stop sending new data to a service until the provider fixes a flaw.

What else did FedRAMP announce?

Services run by agencies. The FedRAMP Director said FedRAMP and its board were working on simpler rules for cloud services that agencies offer to other agencies. FedRAMP later published RFC-0032, Offerings By Government.
A new technical advisory group. He planned a group of agency staff who do FedRAMP work each day, to help write guidance and playbooks. FedRAMP later proposed changes to its Technical Advisory Group in RFC-0034, with agency security staff working at FedRAMP on detail.
Staffing. He said FedRAMP had 15 open positions, to reach about 40 people.
Data formats. CR26 is published as a JSON file, not spreadsheets. It includes basic schemas for each machine-readable deliverable.

Sources

Share this post:LinkedIn X Email

A weekly email on Fridays, an alert on the day the watch finds something new, or both. Free.