Rev5 community update, April 2026: new certification labels, the end of FedRAMP Ready, and the 2027 deadlines

In its April 1, 2026, Rev5 update, FedRAMP walked through four notices: the move to FedRAMP Certification and Classes A to D, the end of FedRAMP Ready on July 28, 2026, Marketplace limits, and 2027 deadlines that make every Rev5 Balance Improvement Release mandatory.

By FedXchange · April 1, 2026

FedRAMP's video, on its governance tracker page. The player loads from YouTube only when you press play.

On April 1, 2026, the Federal Risk and Authorization Management Program (FedRAMP) held its monthly Rev5 community working group. Rev5 is the FedRAMP path built on Revision 5 of the National Institute of Standards and Technology (NIST) Special Publication 800-53 controls. FedRAMP staff walked through the outcomes of four requests for comment (RFCs) and what they mean for cloud service providers. At the start, a speaker said in the video: "There's no April Fool's jokes."

In short:

What FedRAMP said. FedRAMP authorization would be labeled FedRAMP Certification. Classes A, B, C, and D would replace Low, Moderate, and High. FedRAMP Ready would retire. Every current Rev5 Balance Improvement Release (BIR) would become mandatory in 2027.
Who it affects. Every Rev5 cloud service provider, the independent assessors who assess them, and the agencies that use their services.
What they must do. Providers must adopt Significant Change Notifications (SCN) and the other BIRs on the dates in FedRAMP's Notice 0009. Class D (High) services must provide comprehensive machine-readable authorization data. Other classes must move from Word and Excel files to semi-structured text.
By when. The first BIR deadline is January 1, 2027. The machine-readable deadline is November 1, 2027.

Rev5 deadlines FedRAMP set in Notice 0009

Source: FedRAMP Notice 0009, Initial Outcome from RFC-0024 Rev5 Machine-Readable Packages (March 25, 2026). The dates apply to active certified services.

Read the steps as text

January 1, 2027. Significant Change Notifications become mandatory for all Rev5 services. Minimum Assessment Scope applies by the next annual assessment.
April 2, 2027. Collaborative Continuous Monitoring becomes mandatory.
June 1, 2027. Vulnerability Detection and Response becomes mandatory.
August 1, 2027. Authorization Data Sharing becomes mandatory, and FedRAMP retires the Connect.gov portal.
November 1, 2027. From this date, Class D (High) services provide comprehensive machine-readable data, and Classes A, B, and C semi-structured text, before or during their next annual assessment.

What did FedRAMP rename, and why?

The update covered Notice 0004, the outcome of RFC-0020, FedRAMP Authorization Designations. At the time of the video, FedRAMP's materials still used "FedRAMP authorization." The notice said the single label would become "FedRAMP Certification" or "FedRAMP Certified," and FedRAMP's pages now use FedRAMP Certification, the current term. The notice said the new labels would come in the Consolidated Rules for 2026 (CR26). FedRAMP 20x, mentioned below, is FedRAMP's newer path for cloud-native services.

A FedRAMP speaker said the law defines a FedRAMP authorization as a certification. The notice quotes the law: "a certification that a cloud computing product or service has completed a FedRAMP authorization process." The speaker said the old term caused confusion between a FedRAMP decision and an agency's own authorization to operate.

The notice also replaced the Low, Moderate, and High labels with classes:

Class A: a new pilot baseline.
Class B: the former Low and Low-Impact Software as a Service (LI-SaaS) baselines.
Class C: the former Moderate baseline.
Class D: the former High baseline.

The speaker said the class shows how much information is in the package, not how secure the service is. The notice says FedRAMP does not have the authority to decide whether a service fits a given Federal Information Processing Standard (FIPS) 199 category; each agency's authorizing official decides that.

What happens to FedRAMP Ready and sponsorless Rev5 certifications?

The video covered Notice 0008, the outcome of RFC-0023, Rev5 Program Certifications. A program certification means FedRAMP, not an agency sponsor, does the initial review.

The notice says FedRAMP will retire FedRAMP Ready on July 28, 2026, and "No FedRAMP Ready submissions will be accepted after this date." Rev5 Class A certifications become available at that time. Class B and C program certifications come in a later stage. They are limited to services that adopt the required BIRs and that, between January 1, 2025, and March 1, 2026, were FedRAMP Ready or In Process, or had completed a readiness or full assessment. Class D still requires an agency sponsor.

A FedRAMP speaker stressed that this path is for providers who had already done the Rev5 work, such as those whose agency sponsor withdrew. The speaker said new providers should not start a Rev5 package just to reach it.

The notice also dropped the proposed "trusted assessor" requirement. The speaker said any FedRAMP-recognized assessor can assess these packages.

What changed for the Marketplace and dual paths?

Notice 0005, the outcome of RFC-0021, Expanding the FedRAMP Marketplace, removed the pricing proposal. The notice says FedRAMP "will not request, store, or publish pricing information for cloud services." It also says "The limit on Program Certification to either Rev5 or 20x will remain in place …" A speaker explained that a provider may hold an agency-sponsored Rev5 certification and a 20x program certification, but FedRAMP will not give one provider program certifications on both paths.

What must Rev5 providers do about machine-readable packages?

Notice 0009 is the outcome of RFC-0024, Rev5 Machine-Readable Packages. A speaker said it was shown on the slide in bright red because providers need to read it. The BIRs carry the core machine-readable data, so FedRAMP will require them of everyone. Class D services must go further, to a comprehensive machine-readable package.

The speaker said everyone else will need to produce semi-structured text, such as plain text and Markdown, instead of Word documents and Excel spreadsheets. The notice says FedRAMP will retire the Word (DOCX) and Excel (XLSX) file formats in favor of text-based ones.

The description of the video says SCN becomes a mandatory BIR in 2027. A speaker said providers that opt in early must fill out FedRAMP's form; the form is not optional. Three betas were open at the time: Authorization Data Sharing, Vulnerability Detection and Response (VDR), and Collaborative Continuous Monitoring (CCM), each started on February 2, 2026.

What else did FedRAMP announce?

Hiring. The description says FedRAMP planned to hire 15 people at grades GS-13 to GS-15 of the General Schedule, in the Washington, D.C., area, through the FedRAMP Cybersecurity Service. A speaker said they are two-year terms. Details are at fedramp.gov/join.
Notices. A speaker pointed providers to the new FedRAMP notices page and its RSS (Really Simple Syndication) feed for official updates.
More RFCs. The video mentioned RFC-0025, a review of the public comment process, and RFC-0026, which clarifies control CA-7 (Continuous Monitoring). A speaker said agency customers must get access to a provider's continuous monitoring information.

FedRAMP's 20x page now says FedRAMP will stop accepting new Rev5 Certifications on June 11, 2027. Notice 0013, published on June 16, 2026, gives the same date.

Sources

Share this post:LinkedIn X Email

A weekly email on Fridays, an alert on the day the watch finds something new, or both. Free.