FedRAMP to assessors and advisors: providers must verify their own work, keep packages current, and name an agency use

In its October 2026 assessor and advisor update, FedRAMP said cloud providers cannot hand verification to their assessor, must keep certification packages current on a set schedule, and must show an agency use case. Phase 4 outreach to assessors was behind schedule; FedRAMP has since set new dates.

By FedXchange · November 6, 2026

FedRAMP's video, on its governance tracker page. The player loads from YouTube only when you press play.

The Federal Risk and Authorization Management Program (FedRAMP) held its monthly update for independent assessors and advisors on Wednesday, October 21, 2026. A FedRAMP leader covered five points. Cloud service providers must verify and validate their own security work and cannot hand that job to their assessor. Certification packages must stay current on a fixed schedule. Every package must state how federal agencies would use the service. Services that hold no FedRAMP Certification may sit inside a provider's Minimum Assessment Scope if the provider documents the risk. And Phase 4 of FedRAMP 20x, the program's newer, automation-based path, was behind schedule at the meeting.

Who this affects: cloud providers preparing or holding a FedRAMP Certification under the FedRAMP Consolidated Rules for 2026 (CR26), the assessors and advisors who work with them, and agency staff who read their packages.

What to do now: providers must write their own verification and validation into each Security Decision Record entry, set up a package update schedule that meets their class, and state an agency use case in every new package. Assessment organizations that have assessed more than 20 cloud service offerings should check the email address on their FedRAMP Marketplace listing. FedRAMP's Phase 4 status page says the FedRAMP Director planned to send invitations there from October 27 to November 3, 2026.

Can a provider leave verification to its assessor?

No. The video's description puts it plainly: "Verification and validation responsibilities cannot be offloaded entirely to assessors." The FedRAMP leader said some providers believed they could hand both jobs to the assessor, and that this is not the case. The provider is responsible for attesting to its own security practices.

The CR26 Security Decision Record rules (rule SDR-CSO-FRR) set out the layers. A Security Decision Record (SDR) replaced the traditional System Security Plan. For each FedRAMP rule that applies, the provider must explain how it follows the rule, verify that the implementation fits the rule, and validate that it works as intended. The record must then hold the assessor's independent verification and validation, and the provider's responses to the assessor's comments.

Who verifies what in a Security Decision Record

Source: FedRAMP Consolidated Rules for 2026, rule SDR-CSO-FRR, and the October 21, 2026 Assessor and Advisor Community Update.

Read the steps as text

The provider explains. For each rule that applies, the provider explains how it follows the rule, or why it does not and the resulting risk to customers.
The provider verifies. The provider shows that its implementation is appropriate for the rule.
The provider validates. The provider shows that the implementation is in place and working as intended.
The assessor checks independently. The independent assessor verifies and validates the provider's work and gives the provider a summary.
The provider responds. The provider records the assessor's findings and any responses or clarifications in the Security Decision Record.

In the question period, an assessor asked whether Rev5 packages need verification and validation statements for every control objective. (Rev5 is the path based on Revision 5 of the National Institute of Standards and Technology (NIST) security control catalog.) The FedRAMP leader said yes, but added that some objectives matter far more than others. FedRAMP's data formats show how to structure the data at the top level, not a required layout. A provider may use different formats for different controls.

How often must a certification package be updated?

Under the old Rev5 approach, a package often stayed unchanged after the assessor signed it. The FedRAMP leader said such a package grows out of date within months, as new features ship that it does not describe. CR26 sets a maximum time between package updates. The Certification Package Overview rules (CPO-CSX-CPM for 20x and CPO-CSF-CPM for Rev5) give these limits:

Certification	Update the package at least once every
20x Class A	3 months (should, not must)
20x Class B	1 month
20x Class C	2 weeks
20x Class D	1 week
Rev5 Class B	1 year
Rev5 Class C	1 year
Rev5 Class D	6 months

The Rev5 rule calls its limits the worst case and asks providers to update far more often, at least after every transformative significant change. For 20x, FedRAMP expects providers to use automation to update the package as changes occur.

The FedRAMP leader gave an example. A provider that finishes its assessment in July and applies in August must keep its package current in between. Changes still go through the significant change notification (SCN) process, and the package must reflect each one.

What counts as an agency use case?

A package for Rev5 or 20x must describe how agencies would use the service. The Marketplace rule MKT-IIP-AGU requires the provider to show either direct use, where an agency uses the service in a federal information system that will receive an agency authorization to operate, or indirect use, where the service is part of another cloud service that agencies use. FedRAMP staff said the reason is legal: FedRAMP may spend federal funds only on services inside its statutory scope. They said the explanation does not need to be complicated. If the service does something agencies do, say so. If no one in the room can see why an agency would buy it, the provider should reconsider the FedRAMP path.

Must every service in the Minimum Assessment Scope be FedRAMP Certified?

No. The FedRAMP leader said FedRAMP itself never required this; the former Joint Authorization Board (JAB) did. Under the Minimum Assessment Scope rules (rule MAS-CSO-TPR), a provider must document each third-party service it uses, the reason for using it, and the steps that reduce the possible impact on federal customer data. The example given was a content delivery network (CDN) that serves a public web page. A service without FedRAMP Certification is acceptable there. FedRAMP has proposed that Class D providers should give more detail about these services.

The FedRAMP leader advised providers bringing a commercial service to government to do the minimum needed to get certified. They should not switch to the government version of every underlying service by default. An agency that wants a change can ask for it in its contract.

On moving a Rev5 package to the Minimum Assessment Scope, FedRAMP staff said a provider may use a significant change notification or combine the move with its annual assessment. The FedRAMP leader suggested doing it in steps.

Why do Marketplace numbers show low 20x use?

The FedRAMP leader said 20x pilot adoption is ahead of FedRAMP's expectations. Three points explain the Marketplace numbers:

FedRAMP cannot make agencies report their use of services, so its use data is incomplete.
More than a third of Rev5 services have never been reused. Of the roughly 100 Rev5 services certified in 2025, fewer than a third have been reused, though each has held its certification for at least 10 months.
As of October 21, no full, CR26-compliant 20x Class B or Class C Certification existed. Every Class B and C listing was a pilot. (Classes run from A, the lowest, to D, the highest.)

FedRAMP staff said they plan to show three certification types on the Marketplace: Rev5, 20x, and 20x pilot.

Where does Phase 4 stand?

Request for comment (RFC) RFC-0033 set Phase 4 of FedRAMP 20x to include an engagement track for the assessors of the self-hosted or hybrid-hosted Rev5 Class C and D providers chosen for the provider track. It planned notices on October 12, an opt-in deadline of October 16, and first meetings from October 19 to 23.

Phase 4 assessor track: planned and actual

Sources: RFC-0033, the October 21, 2026 Assessor and Advisor Community Update, and FedRAMP's Phase 4 status page.

Read the steps as text

October 12, planned. RFC-0033 planned to notify qualifying assessors of the opt-in.
October 16, planned. RFC-0033 set this as the deadline to respond.
October 19 to 23, planned. RFC-0033 planned the first round of meetings with assessors.
October 21, actual. FedRAMP said the assessor track had not started and no assessor had been left out.
October 27 to November 3, new plan. The FedRAMP Director emails eligible assessment organizations at the address on their Marketplace listing.

At the meeting, FedRAMP said it had emailed the eight or nine cloud providers that met the criteria for the provider track, through each one's FedRAMP Security Inbox. The FedRAMP leader said only one had replied by the meeting. FedRAMP now keeps a Phase 4 status page that it calls the main source for current Phase 4 dates. Since the meeting, that page says FedRAMP identified 12 qualifying providers and 4 agreed to take part. It also changed the assessor criteria from RFC-0033: FedRAMP will ask 8 assessment organizations that have each assessed more than 20 cloud service offerings.

Sources

Share this post:LinkedIn X Email

A weekly email on Fridays, an alert on the day the watch finds something new, or both. Free.