FedRAMP Trivia: a short study guide to the Consolidated Rules for 2026

FedRAMP played a quick trivia game on its Consolidated Rules for 2026 (CR26). The six clues cover vulnerability response, Marketplace listing, the new certification package, two Key Security Indicator themes, and incident reporting. Here is what each rule set requires.

By FedXchange · November 6, 2026

FedRAMP's video, on its governance tracker page. The player loads from YouTube only when you press play.

The Federal Risk and Authorization Management Program (FedRAMP) published a short video on October 22, 2026, of its staff playing a trivia game before a meeting. Every clue came from the FedRAMP Consolidated Rules for 2026 (CR26). The game is public at FedRAMP's trivia page, which calls it "Ruleset RAMPpardy" and draws a new board from a question bank each time.

In short, the clues point to the rules that most change daily work for cloud service providers. Optional adoption of CR26 began July 4, 2026. The rules become mandatory for all stakeholders on January 1, 2027, and each rule set has its own dates. Cloud service providers must meet these rules to get and keep FedRAMP Certification. Agency security staff should know them, because they change what a certification package and an incident report look like.

The six trivia clues and the CR26 rules behind them

The clues in the order they were played. Source: the clues and responses in FedRAMP's trivia game, checked against the CR26 rule pages on fedramp.gov.

Read the steps as text

Weaknesses in the offering. Vulnerability Detection and Response (VDR): find and manage vulnerabilities all the time.
Prerequisite before package materials. A FedRAMP Marketplace listing, under the Marketplace Listing (MKT) rules.
Monitoring, logging, and auditing. MLA, a Key Security Indicator (KSI) theme.
Replaces the system security plan. The Certification Package Overview (CPO) and the Security Decision Record (SDR).
Identity and access management. IAM, another KSI theme.
Initial, ongoing, and final reports. Incident Evaluation and Communication (IEC).

What does each rule set ask of a cloud provider?

Vulnerability Detection and Response (VDR). The clue asked for the rule set that makes providers "continuously identify, analyze, prioritize, and respond to weaknesses." The rule set covers far more than scanning. FedRAMP says it includes all efforts to find weaknesses in a system. Even an out-of-date control statement in the Security Decision Record counts as a vulnerability. FedRAMP marks VDR as required by the Cybersecurity and Infrastructure Security Agency (CISA) Binding Operational Directive 26-04. It applies to new and ongoing certifications from December 7, 2026, with a grace period that ends March 7, 2027. Another clue in the game's question bank makes a related point: VDR uses no plan of action and milestones (POA&M) template.

Marketplace listing first. Rule FRC-APP-MLF says providers must be listed in the FedRAMP Marketplace before they apply for FedRAMP Certification. To get listed, a provider must meet the public information rule in Certification Data Sharing and must ask through FedRAMP's Marketplace provider listing request form. FedRAMP does not accept listing requests by email.

The new package. The Certification Package Overview gives a short summary of the offering in human-readable and JavaScript Object Notation (JSON) formats. For Rev5, the older certification type based on Revision 5 of the National Institute of Standards and Technology (NIST) control catalog, it replaces the base system security plan. The Security Decision Record replaces the traditional system security plan with a record of the provider's security decisions that it keeps current. For each rule, the provider explains how it follows the rule or why it does not, with verification and validation by the provider, and independent verification and validation. The game's answer named both documents together. For Rev5, both apply to new certifications from January 1, 2027.

What are the KSI themes in the game?

Key Security Indicators are the measurable security outcomes that FedRAMP 20x, the program's newer certification type, asks providers to show, instead of a list of specific security requirements to meet. CR26 groups them into themes with three-letter names. The game asked about two:

MLA, Monitoring, Logging, and Auditing. These indicators cover a list of the event types to log, a Security Information and Event Management (SIEM) system or similar for central logs that resist tampering, regular log review and audit, and regular testing of configurations, especially infrastructure as code.
IAM, Identity and Access Management. These indicators cover automated account management, passwordless sign-in where feasible (otherwise strong passwords with phishing-resistant multifactor authentication), least privilege, just-in-time access, secure sign-in for non-user accounts, and disabling or otherwise securing privileged accounts after suspicious activity.

FedRAMP's trigram list names the other themes, such as CMT for Change Management and SCR for Supply Chain Risk.

How must a provider report an incident under CR26?

The last clue was worth 500 points and went to the meeting's chat. Viewers first answered with other rule sets, Certification Data Sharing and Significant Change Notification (SCN). The answer was Incident Evaluation and Communication. FedRAMP renamed these rules from "Response" to "Communication" on July 2, 2026. They grew out of request for comment RFC-0031 and Notice 0012.

A provider must first decide whether an incident affects, or is likely to affect, the confidentiality or integrity of federal customer data. If so, it is a FedRAMP Reportable Incident. The provider rates it on the Potential Agency Impact N-rating (PAIN) scale from 1 to 5, or treats it as PAIN-5 if it does not estimate. It then sends an initial report, ongoing reports until the incident is resolved, and a final report once recovery is complete. The deadlines depend on the class and the PAIN rating. For a PAIN-5 incident, Class A and B providers send ongoing reports within 1 business day and the final report within 3 business days. Class C providers have 6 hours for each, and Class D providers have 3 hours. The initial report comes first and fastest:

Hours to send the initial incident report for a PAIN-5 incident

Class A providers should send the report; Classes B, C, and D must. Source: CR26 rule IEC-CSO-IIR.

Show the numbers

	Hours
Class A	6
Class B	6
Class C	1
Class D	0.3

For Rev5, these rules apply to new certifications from January 1, 2027, and the grace period for existing ones ends June 1, 2027.

How can staff play the game?

A FedRAMP staff member said in the video that "you can play FedRAMP trivia anytime you want" at FedRAMP's trivia page. The board has 25 clues in categories such as The Agency, The Package, and Welcome to Whoville (stakeholders and roles). It is a quick way for a security team to test what it knows before the January 1, 2027, deadline. For implementation work, FedRAMP says to use the machine-readable rules on GitHub, not the website.

Sources

Share this post:LinkedIn X Email

A weekly email on Fridays, an alert on the day the watch finds something new, or both. Free.