FedRAMP retires the third-party assessment organization (3PAO): what changes for independence and agency risk
The Federal Risk and Authorization Management Program (FedRAMP) has retired the third-party assessment organization (3PAO). Assessors now verify and validate instead of recommending approval, which helps independence, adds new pressures, and leaves the risk decision with the agency.
By FedXchange ·
The third-party assessment organization (3PAO) is gone. Under the Consolidated Rules for 2026 (CR26) from the Federal Risk and Authorization Management Program (FedRAMP), published June 24, 2026, the firms that test cloud services are now called independent assessment services, or independent assessors. Most coverage treats this as a new name. It is not. The assessor's job has changed, and that change shifts who is responsible for which risks. Every agency security office should understand it before its next authorization.
In short: when FedRAMP certifies a service itself, assessors no longer recommend whether it should be approved. FedRAMP decides. Assessors verify and validate, at a technical level, what the provider built. That is good for independence in some ways and creates new pressure points in others. For agencies, it means the risk decision is more clearly theirs, and the evidence they receive looks very different from the reports they are used to. It is one more step in a shift we described in FedRAMP moved the risk to agencies.
What actually changed
The legal basis shifted first. The 2011 FedRAMP memo built the program around third-party assessment by default. The FedRAMP Authorization Act and Office of Management and Budget (OMB) memo M-24-15 changed that: FedRAMP itself is now responsible for assessing cloud services, and it may use an independent assessment service to analyze, validate, and attest to the provider's materials on its behalf. FedRAMP says plainly that this is why both the name and the expectations changed (FedRAMP, Updating to 2026 Rules).
Here is how the role differs. The first two rows and the last two apply to every assessment. The recommendation, deliverables, and package rows apply when FedRAMP itself certifies the service (the Program Certification path).
| Topic | Before (3PAO) | Under CR26 (independent assessor) |
|---|---|---|
| Core job | Test whether each control is met | Verify the provider built what it documented, and validate that it actually works |
| Depth of evidence | Documents, interviews, screenshots, samples | Review of the real mechanisms, including code where appropriate; screenshots alone are not enough |
| Approval recommendation | Assessor recommended authorization | Assessor makes no overall recommendation; FedRAMP decides |
| Deliverables | Security Assessment Plan and Security Assessment Report | No separate plan or report; a summary for each practice and an overall summary go into the provider's Security Decision Record and package overview |
| Who owns the package | The assessor submitted its own plan and report | The provider owns it and deals with FedRAMP directly; the assessor joins FedRAMP's review to explain its findings |
| Templates | Required FedRAMP templates | No templates; required content plus a few machine-readable formats |
| Unwritten expectations | Common in practice | Banned: if no written FedRAMP rule requires it, assessors may not enforce it |
Sources: What's Changing, Independent Verification and Validation rules.
The Program Certification path. Source: FedRAMP Consolidated Rules for 2026.
Read the steps as text
- The provider hires the assessor. In practice, the cloud provider still selects and pays the independent assessor.
- The assessor verifies and validates. It tests the real mechanisms, including code where appropriate, against every FedRAMP rule that applies.
- Findings go into the provider's records. Summaries for each practice go into the provider's Security Decision Record. An overall summary, including failures and disputes, goes into the overview of the provider's certification package.
- The assessor checks its findings arrived intact. It must confirm they were included without inappropriate changes. The provider should not edit their substance.
- FedRAMP reviews and certifies. The assessor joins FedRAMP's review to explain its process, findings, and concerns. FedRAMP makes the decision.
- The agency decides its own use. The agency reads the package, configures and tests its own use of the service, and issues its own authorization to operate.
The older Agency Certification path still exists. There, agency authorizing officials still rely on assessors for complete recommendations in most cases, and can still ask for a traditional assessment plan, report, and static evidence. FedRAMP will still require an assessment and materials that follow FedRAMP's rules before it grants a certification.
The rules for staying FedRAMP Recognized were mostly moved into the new format with few changes. Assessors still need accreditation from the American Association for Laboratory Accreditation (A2LA), a yearly surveillance review, and a full reassessment every two years. What is new or newly explicit:
- Use it or lose it. An assessor must complete at least two Class B, C, or D assessments every two years to keep recognition. FedRAMP calls this the one significant change.
- Two-year advisory cooling-off. An assessor may not assess a cloud service within two years after advising or consulting on it.
- Performance standards that name assessment integrity (findings not influenced by provider demands) and chain of custody for both assessor documents and provider evidence.
- Invalid work. Deliverables from staff who lack the required qualifications do not count.
- Foreign interest reporting every year, and within 48 hours of any change in foreign ownership or control.
Source: FedRAMP Recognition and Independent Verification and Validation rules.
Read the steps as text
- June 24, 2026. FedRAMP publishes the Consolidated Rules for 2026.
- July 4, 2026. The recognition rules take effect, including the two-assessment minimum and the two-year advisory bar. The verify-and-validate method applies to new certifications under FedRAMP 20x, the program's newer, automation-based path.
- January 1, 2027. The verify-and-validate method applies to new Rev5 certifications (the long-standing path based on Revision 5 of the National Institute of Standards and Technology (NIST) security control catalog, SP 800-53), and to ongoing assessments that start after this date.
What it means for independence
CR26 strengthens independence on paper in three real ways, but it does not touch the oldest problem: in practice, the provider still hires and pays the assessor.
Where independence gets stronger
There is no recommendation to negotiate over. Under the old model, the assessor's recommendation was the deliverable the provider was paying for. That gave the provider a reason to press for "recommend." With no overall recommendation, the assessor's product is a description of what was tested and what was found. There is less to bargain over.
Advising and assessing are formally split. CR26 defines advisors as their own category of participant, separate from assessors, and bars an assessor from assessing a service it advised within the prior two years. FedRAMP's 20x guidance puts it simply: assessors may recommend better practices, but should not design the provider's solution and then certify their own work (20x Assessments). Assessors may still share advice during an engagement, but not where it would compromise objectivity. FedRAMP's example of crossing the line is telling a provider "if you implement it like this then you will pass."
Deeper testing is harder to stage. Requiring assessors to examine real mechanisms rather than screenshots, and to trace automated checks from data source to dashboard, makes it harder for a provider to show only what looks good. A dashboard that reports success is no longer evidence by itself.
No recommendation to bargain over
The assessor reports what it tested and found. FedRAMP makes the decision.
A two-year bar after advising
An assessor may not assess a service it advised or consulted on in the past two years.
Findings the provider should not edit
FedRAMP's 20x guidance keeps provider and assessor records distinct and says the provider should not edit the substance of findings.
The assessor checks the package
The assessor confirms its findings reached the certification package without inappropriate changes.
Where new pressure appears
The provider now holds the assessor's work. Findings live inside the provider's records and certification package, not in a report the assessor submits. CR26 guards this: assessors must confirm their findings were included without inappropriate changes, and FedRAMP's 20x guidance says records must stay distinct and the provider should not edit the substance of the assessor's findings. Those are good rules. But custody has moved to the party being assessed, and the safeguard depends on the assessor checking and speaking up.
Close collaboration makes roles harder to tell apart. FedRAMP says 20x assessments may be iterative and collaborative, benefit from early and frequent contact, and may take place in a shared platform. That is efficient. It also makes it hard for anyone outside to tell helpful feedback from coaching a provider to pass.
The assessor must audit the provider's own measuring tools. In 20x, the provider chooses how to measure its security outcomes. If an assessor lacks the engineering skill to test those tools, it ends up trusting them. That is a competence problem that turns into an independence problem.
Commercial pressure is unchanged. In practice, the provider still selects and pays the assessor, and the new two-assessments-every-two-years rule adds a volume incentive for smaller firms. Fewer firms may have the skills for 20x work, which leaves agencies and providers fewer assessors to choose from. None of this is new, but CR26 does not address it.
The provider still pays
In practice, the provider selects and pays the assessor, as it always has.
Findings sit in the provider's records
Custody of the assessor's work has moved to the party being assessed.
Shared platforms mix the roles
Close, repeated work together makes coaching hard to tell apart from feedback.
Testing the provider's own tools
The assessor must understand the provider's automation well enough to test it, or it ends up trusting it.
The net effect: independence now rests less on the assessor's formal sign-off and more on the integrity of its technical findings and on FedRAMP's review of them.
What it means for agency risk
The chain of accountability is now clearer: the assessor reports facts, FedRAMP certifies the service, and the agency decides whether that service fits its own use. FedRAMP's 20x guidance ends on exactly that division of labor (20x Assessments). For an authorizing official, that has four practical consequences.
1. No one hands you a recommendation anymore. On the Program Certification path, there is no assessor verdict to lean on. What you get is FedRAMP's certification plus the assessor's summaries, including failures and areas of dispute. Those disputes are the most valuable thing in the package. Read them first.
2. The package is presumed adequate, and asking for more has a process. FedRAMP tells agencies to treat the certification package as presumptively adequate evidence of the provider's work. If an agency has a demonstrable need for more, it must follow the Agency Use rules and notify FedRAMP as required (Initial Agency Authorization). Reflexively demanding a traditional assessment report is no longer the default move.
3. The evidence looks different. For 20x services, expect machine-readable results, live validations, and trend data instead of a static report and screenshots. That can be better evidence. It is only better if your team can read it. An agency that cannot interpret Key Security Indicators or continuous validation data is, in effect, accepting risk it has not examined.
4. The agency's authorization to operate is still the agency's. A FedRAMP certification is reusable evidence about the provider, not an approval of your use. You still categorize the system, tailor controls, configure the service, test your own integrations, and document residual risk under the NIST Risk Management Framework. FedRAMP also notes that agencies following legacy processes have drawn audit findings from OMB, Inspectors General, and the Government Accountability Office (GAO) (FedRAMP, Federal Agencies).
The risk to watch is a gap between two assumptions. FedRAMP may assume agencies will scrutinize the assessor's findings. Agencies may assume FedRAMP's certification means someone already did. If both assume the other is looking, nobody is.
What agency security teams should do now
- Update your authorization procedures so they no longer expect an assessor recommendation or a Security Assessment Report on the Program Certification path.
- Read the assessor's overall summary first, especially failures and disputes, and record how each one is handled in your residual-risk write-up.
- Check the assessor, not just the provider. Confirm it is FedRAMP Recognized and not listed as in remediation on the FedRAMP Marketplace, and ask whether it advised on the service in the past two years.
- Ask how the assessor tested the provider's measuring tools. For 20x services, the right answer describes data sources, logic, coverage, and what happens when a check fails, not just a dashboard.
- Build skills to read living evidence. Someone on your team needs to interpret machine-readable results and Key Security Indicators, or you are accepting unexamined risk.
- Use the Agency Use rules when you truly need more than the package provides, and notify FedRAMP as required, rather than asking for legacy documents by habit.
- Secure your own part of the system. Configuration against the provider's secure configuration guide, identity and logging integration, and your own continuous monitoring still decide most of your real exposure.
- Plan for January 1, 2027. Rev5 services starting new assessments after that date will arrive with the new style of evidence.
The bottom line
Under CR26, assessors report what they tested and found, and they no longer recommend approval. Removing the recommendation, separating advisors, and demanding technical depth all make the assessor's work more honest. But the assessor is still paid by the provider, its findings now live in the provider's records, and 20x invites close collaboration. The safeguards are real, and they only work if FedRAMP and agencies actually read what assessors find. Agencies can no longer rely on "the 3PAO recommended it." That is a good change only if agency security teams read the assessor's findings themselves and decide what risk to accept.
Sources
Get new posts and federal governance by email
A weekly email on Fridays, an alert on the day the watch finds something new, or both. Free.