FedRAMP Day, March 2026: FedRAMP's Director previews the Consolidated Rules and tells agencies to stop approving every provider change

At FedRAMP Day on March 26, 2026, FedRAMP's Director listed the changes later set in the 2026 Consolidated Rules, from quarterly reviews to vulnerability response. A panel told agencies that providers notify them of significant changes instead of asking for approval.

By FedXchange · May 29, 2026

FedRAMP's video, on its governance tracker page. The player loads from YouTube only when you press play.

On March 26, 2026, the Federal Risk and Authorization Management Program (FedRAMP) held FedRAMP Day, an invitation-only event at the headquarters of the Bureau of Alcohol, Tobacco, Firearms and Explosives (ATF). The video's description says nearly 200 federal technology staff attended. FedRAMP posted part of the morning sessions on May 29, 2026. The recording does not include the afternoon on artificial intelligence (AI).

The event came before the FedRAMP Consolidated Rules for 2026 (CR26). Speakers then used the older term "FedRAMP authorized." Under CR26, the current terms are "FedRAMP Certification" and "FedRAMP Certified."

In short:

What FedRAMP said. FedRAMP's Director previewed changes that CR26 later set as rules: a security inbox, secure configuration guides, a minimum assessment scope, quarterly reviews instead of monthly meetings, broader vulnerability response, and data sharing through machine-readable tools.
Who it affects. Agency chief information officers, chief information security officers, and agency liaisons, and the cloud service providers they use.
What they must do. Under CR26's agency use rules, agencies must keep agency-wide policy aligned with Office of Management and Budget (OMB) Memorandum M-24-15. The video's description says a FedRAMP Board panel stressed the direction to align internal policies with FedRAMP's significant change notification process.
By when. The Director said FedRAMP publicly targeted the end of June 2026 for CR26. FedRAMP issued it on June 25, 2026. Optional adoption began July 4, 2026, and the rules become mandatory for all FedRAMP stakeholders on January 1, 2027.

The FedRAMP changes covered at FedRAMP Day, March 2026

Sources: the video and the CR26 rulesets on fedramp.gov. Names follow CR26.

Read the steps as text

Security inbox. Every provider keeps an inbox so FedRAMP can reach it, for example when the Cybersecurity and Infrastructure Security Agency (CISA) issues an emergency directive.
Secure configuration guide. The provider tells agencies how to configure its service securely.
Minimum assessment scope. The assessment focuses on federal customer data. Diagrams are a visual aid, not a requirement.
Collaborative continuous monitoring. Providers share ongoing data. Class C and D providers must meet with agencies every quarter instead of every month.
Vulnerability detection and response. Providers assess every weakness that could lead to a compromise, not only listed vulnerabilities.
Data sharing. Class B, C, and D providers make certification data available to agency tools through programmatic access.
Significant change notification. Providers notify agencies of significant changes instead of asking for approval.

What changes did FedRAMP's Director describe?

The Director said FedRAMP announced FedRAMP 20x a year earlier, on March 24, and that the modernization began on paper on July 25, 2024. That is the date of M-24-15. The Director compared it to M-22-09, the 2022 zero trust memorandum, and said agencies took years to adopt it.

Security inbox. The Director said that when FedRAMP emailed every certified provider about a recent CISA emergency directive, something like 50 emails bounced. CR26 now has FedRAMP Security Inbox rules.
Secure configuration guide. The Director said it differs from the customer responsibility matrix. It tells the agency how to configure the service securely. The Director said most cloud security problems come from agency configuration, not the provider. CR26 sets Secure Configuration Guide rules.
Minimum assessment scope. The Director called it the new boundary guidance. CR26 defines the Minimum Assessment Scope as the boundary of the assessment and of the certification.
Collaborative continuous monitoring. The Director said monthly meetings move to quarterly. Under the CR26 rules, Class C and D providers must hold a Quarterly Review every 3 months, and every provider must supply an Ongoing Certification Report every 3 months.
Vulnerability detection and response. The Director called it the most important change for the next year. The rules are not limited to traditional scanning.
Data sharing. The Director called this the authorization data sharing standard. In CR26 it is Certification Data Sharing: providers with Class B, C, or D certifications must use a FedRAMP-compatible trust center.

What did the Director say about agency responsibility?

The Director quoted OMB Memorandum M-26-05, issued January 23, 2026. The memo says: "Each agency head is ultimately responsible for assuring the security of software and hardware that is permitted to operate on the agency's network." It goes on: "Each agency should validate provider security utilizing secure development principles and based on a comprehensive risk assessment."

The Director said this means an agency's job is a risk assessment, not a compliance checklist. The Director also said agencies must still configure and manage the services they use, and that an Inspector General (IG) has already placed a corrective action plan on one agency office for not doing a small continuous monitoring task FedRAMP required.

What did the panel say about significant change notifications?

The Director led a panel with FedRAMP's security director, a CISA official who sits on the FedRAMP Board, and a third panelist who works at OMB. The Director said that when agencies use a commercial service, they pay for maintenance, updates, and security fixes. Agencies should assess how the provider makes changes, decide whether that fits their risk appetite, and then let the provider make them.

The CISA official said CISA adds about 20 known exploited vulnerabilities to its Known Exploited Vulnerabilities catalog every month. The official said the provider doing the patching is a large security gain in most cases. The official said they joined the Board to help FedRAMP move at the speed of technology. FedRAMP's security director said they helped write the change. All three panelists said they supported notifications over requests for approval.

Under CR26's Significant Change Notification rules, providers must notify all necessary parties within 10 business days after finishing an adaptive change. For a transformative change, they give notice before they start.

What else did FedRAMP say was coming?

20x pilots. The Director said around 30 participants showed the approach worked at low impact. Phase 2, which FedRAMP was finishing, moved toward Moderate, or Class C.
FedRAMP Cybersecurity Service. The Director said FedRAMP had approval to hire 15 people on two-year terms in the excepted service. The first year would be at FedRAMP and the second on detail to agencies. FedRAMP's May 28, 2026, announcement said this hiring was planned.
Agency support. FedRAMP's chief of staff described an agency support group, like open office hours, probably on the fourth Wednesday of each month.

Sources

Share this post:LinkedIn X Email

A weekly email on Fridays, an alert on the day the watch finds something new, or both. Free.