The future of Rev5: FedRAMP says the path stays, but providers must change how they run it

In a short June 2026 video, a FedRAMP speaker said Rev5 will continue but not unchanged. Rev5 providers must adopt the 2026 Consolidated Rules on a fixed schedule, with the vulnerability rules next on December 7, 2026, or put their FedRAMP Certification at risk.

By FedXchange · June 17, 2026

FedRAMP's video, on its governance tracker page. The player loads from YouTube only when you press play.

The Federal Risk and Authorization Management Program (FedRAMP) posted a two-minute video, "The Future of Rev5," on June 17, 2026. Rev5 is FedRAMP's older path, built on Revision 5 of the National Institute of Standards and Technology (NIST) security control catalog. Under the FedRAMP Consolidated Rules for 2026 (CR26), FedRAMP calls its approval a "FedRAMP Certification," the term this post uses.

In short:

What FedRAMP said. Rev5 stays, but it changes. In the video, a FedRAMP speaker said: "Rev 5 does not continue on unchanged. Rev 5 must be changed."
Who it affects. Every cloud service provider that holds or seeks a Rev5 FedRAMP Certification, and the agencies that use those services.
What they must do. Read the CR26 rules, change how they find and report vulnerabilities, and change how they keep their package and continuous monitoring current. The speaker said providers that do not make these changes put their FedRAMP Certification at risk.
By when. The vulnerability rules are required from December 7, 2026. CR26 becomes mandatory on January 1, 2027. FedRAMP stops accepting new Rev5 Certification applications on June 11, 2027.

When the 2026 rules reach Rev5 providers

Sources: FedRAMP Notice 0013, FedRAMP's Rev5 Deadlines and Important Dates pages (read November 8, 2026), and the video.

Read the steps as text

June 16, 2026. Notice 0013 announces that CR26 will remove most FedRAMP-assigned control parameter values and most FedRAMP-specific control guidance from the Rev5 baselines.
July 4, 2026. Providers may start adopting the CR26 rulesets early.
December 7, 2026. The vulnerability detection and vulnerability evaluation rules are required. The grace period ends March 7, 2027.
January 1, 2027. CR26 is mandatory for all stakeholders. New Rev5 applications must meet it.
April 2, 2027. Collaborative Continuous Monitoring is expected for ongoing certification. Its grace period ends October 1, 2027.
June 11, 2027. FedRAMP stops accepting applications for new Rev5 Certifications.
July 1 and August 1, 2027. The Certification Package Overview rules, then the Security Decision Record and Certification Data Sharing rules, are expected for ongoing certification.
No later than 2029, likely. Existing Rev5 Certifications end. FedRAMP has not set the date.

Is Rev5 going away?

Not yet. FedRAMP will keep existing Rev5 Certifications, but it will stop taking new ones. FedRAMP's Important Dates page says that on June 11, 2027, "FedRAMP will no longer accept applications for new FedRAMP Rev5 Certifications."

FedRAMP Notice 0013, issued June 16, 2026, gives the outcome of the Rev5 baseline requests for comment, RFC-0026 through RFC-0030. It says FedRAMP is moving away from Rev5 faster by bringing the ideas of FedRAMP 20x, the newer path, into Rev5. It says the end date for existing Rev5 Certifications is not final, but will likely be no later than 2029. It adds that the Office of Management and Budget (OMB) may set an earlier date.

The notice makes two main changes to the Rev5 baselines:

Parameter values. FedRAMP removes most of the values it had assigned to control parameters. Providers set their own values and record them.
Control guidance. FedRAMP removes nearly all of its own control guidance. The requirements that guidance held move into the FedRAMP rules.

It also replaces the old templates with a new Certification Package of three documents: the Certification Package Overview, the Security Decision Record, and the Secure Configuration Guide.

In the video, the FedRAMP speaker said most current FedRAMP Certified services cannot keep a security approach that is "document based" with "once a year assessments." The speaker also called monthly vulnerability scans "absolutely untenable in today's day and age."

What must a Rev5 provider change first?

Vulnerability work is the next deadline. FedRAMP Notice 0014 moved the required date for the Vulnerability Detection and Response (VDR) and Vulnerability Evaluation and Reporting (VER) rules to December 7, 2026. It did so to match the Cybersecurity and Infrastructure Security Agency (CISA) Binding Operational Directive 26-04. A provider can keep its certification under a corrective action plan through March 7, 2027. After that, the notice says, certification "will be revoked" for offerings that do not follow these rules.

The speaker named the questions providers must answer for each vulnerability: is it internet reachable, and is it likely to be exploited? The VER rules make these questions required:

VER-EVA-EIR: decide whether each detected vulnerability is internet reachable.
VER-EVA-ELX: decide whether it is likely exploitable.
VER-EVA-EPA: estimate the likely impact on agency customers, and give it a rating from N0 to N5.
VER-TFR-MHR: report vulnerability work to all necessary parties at least once a month.

The VDR rules also set how often providers check their resources. For Rev5, rule VDR-TFR-MVF says Class C and Class D providers must verify and validate machine-based resources at least once a month. Class B providers should.

What changes in continuous monitoring and the package?

The speaker said that a year after the video, Rev5 providers "will be doing your continuous monitoring and your package different." FedRAMP's Rev5 Deadlines page shows when.

The Collaborative Continuous Monitoring (CCM) rules require an Ongoing Certification Report to all necessary parties every 3 months (rule CCM-OCR-AVL). Agencies must review each report (rule CCM-AGM-ROR). Class C and Class D providers must also hold a Quarterly Review every 3 months, and Class B providers should (rule CCM-QTR-MTG). Providers should follow these rules for ongoing certification by April 2, 2027, and must by October 1, 2027.

The Certification Package Overview rules are expected for ongoing certification by July 1, 2027. The Security Decision Record and Certification Data Sharing rules are expected by August 1, 2027. Several rulesets, including FedRAMP Certification, become required at the first independent assessment started after a set date. Notice 0013 described this as the first assessment completed after January 1, 2027. The current Rev5 Deadlines page says "started after."

What should providers and agencies do now?

Rev5 providers: read the CR26 rules for your class. Make the VDR and VER changes before December 7, 2026. Plan your first independent assessment started after January 1, 2027, around the FedRAMP Certification, Independent Verification and Validation, and Minimum Assessment Scope rules. Assessments started after July 1 and August 1, 2027, must also cover the Certification Package Overview and the Security Decision Record.
Providers planning a new Rev5 application: apply before June 11, 2027, or plan for FedRAMP 20x instead.
Agency security staff: expect Ongoing Certification Reports every 3 months, and plan staff time to review them.

Sources

Share this post:LinkedIn X Email

A weekly email on Fridays, an alert on the day the watch finds something new, or both. Free.