FedRAMP's July Rev5 update: up to four dates for each ruleset, providers set their own control parameters, and templates go legacy

In its July 1, 2026 Rev5 Community Update, FedRAMP explained that each Rev5 ruleset in the 2026 Consolidated Rules has its own dates, up to four of them. New Rev5 packages must reach FedRAMP by June 11, 2027, providers now set most control parameters, and old templates went legacy.

By FedXchange · July 1, 2026

FedRAMP's video, on its governance tracker page. The player loads from YouTube only when you press play.

The Federal Risk and Authorization Management Program (FedRAMP) held its monthly Rev5 Community Update on July 1, 2026, a week after the FedRAMP Consolidated Rules for 2026 (CR26) were published. Rev5 is the older FedRAMP path, built on Revision 5 of the National Institute of Standards and Technology (NIST) control catalog. Under CR26, FedRAMP calls its approval a "FedRAMP Certification," the term this post uses.

In short:

Who it affects: cloud service providers that hold or seek a Rev5 FedRAMP Certification, and the agencies that use their services.
Each ruleset has its own dates. Each Rev5 ruleset lists up to four dates: optional adoption, obtaining a new certification, maintaining a current one, and the end of the grace period. Providers must look up each ruleset that applies to them.
June 11, 2027. This is the last day FedRAMP accepts new Rev5 Certification packages. A FedRAMP staff member stressed that the package must reach FedRAMP by then, not only the agency.
Vulnerability rules move up. The Vulnerability Detection and Response (VDR) and Vulnerability Evaluation and Reporting (VER) rules are mandatory on December 7, 2026. The grace period ends March 7, 2027.
Providers set their own parameters. FedRAMP removed most of the control values it used to assign. Providers must state the values they choose.
Templates are legacy. The old Word and Excel templates moved to FedRAMP's legacy documentation.

The four kinds of dates on a Rev5 ruleset

Source: FedRAMP's Rev5 Deadlines page for the Consolidated Rules for 2026, and the July 1, 2026 Rev5 Community Update video.

Read the steps as text

Optional adoption. A provider may adopt the ruleset in full from this date. For most Rev5 rulesets it is July 4, 2026.
Obtaining a certification. A provider that applies for a new certification after this date must follow the ruleset, or FedRAMP denies the certification.
Maintaining a certification. A provider with a current certification should follow the ruleset by this date. If it does not, it needs a corrective action plan.
Grace period ends. A provider with a current certification must follow the ruleset by this date, or FedRAMP revokes the certification.

Which dates apply to our Rev5 service?

In the video, a FedRAMP staff member said FedRAMP did not want one date for everything. It set each ruleset's dates around FedRAMP needs, what providers must do, and other federal requirements. The Rev5 Deadlines page lists them. Some examples, as of November 8, 2026:

Ruleset	Obtaining	Maintaining	Grace period ends
Vulnerability Detection and Response	December 7, 2026	December 7, 2026	March 7, 2027
Incident Evaluation and Communication	January 1, 2027	January 1, 2027	June 1, 2027
Minimum Assessment Scope	January 1, 2027	January 1, 2027	First independent assessment started after January 1, 2027
Certification Data Sharing	January 1, 2027	August 1, 2027	February 1, 2028
Security Decision Record	January 1, 2027	August 1, 2027	First independent assessment started after August 1, 2027

The staff member called out two rulesets:

Certification Data Sharing. A provider that seeks a new certification after January 1, 2027 cannot use Connect.gov to hold its package. A current provider must move off it later. The staff member said that at the end of the grace period, Connect.gov for FedRAMP goes away, so a provider that is not ready is likely to need a corrective action plan and could lose its agencies' authorizations to operate (ATOs).
Minimum Assessment Scope. A provider moves to the new scope at its first assessment after January 1, 2027, so it does not redo work between assessments.

FedRAMP's Important Dates page adds that CR26 takes mandatory effect for all stakeholders on January 1, 2027.

Why must a new Rev5 package reach FedRAMP by June 11, 2027?

FedRAMP stops accepting new Rev5 Certification applications on June 11, 2027. Notice 0013 says the end date for existing Rev5 Certifications is not final, but is likely to be no later than 2029.

The staff member said a provider whose work plan with its agency ends close to or after June 11, 2027 should work with the agency to finish sooner, or plan a move to FedRAMP 20x, the newer path. FedRAMP 20x does not yet offer Class D, the level for the most sensitive work. In the question period, a FedRAMP staff member said the 20x Class D path will likely come in the 2027 rules, and must open before June 11, 2027. FedRAMP has since proposed how it will build 20x Class D in RFC-0033, and its Choosing a Certification Path page lists 20x Class D as "Coming In 2027."

On that page, FedRAMP also describes the limited Rev5 Program Certification, which needs no agency sponsor. In the video, a FedRAMP staff member said it is meant for providers that lost a sponsor after doing most of the work, for Class B and Class C only. A FedRAMP staff member added that providers would need to show proof that they lost their sponsor. Those pipelines opened August 10, 2026 and close June 11, 2027.

What changed in the notices since May?

FedRAMP covered four notices:

Notice 0011 (May 27, 2026), the outcome of RFC-0025 on the request for comment (RFC) process. FedRAMP will keep at most three RFCs open at once, add a summary of comment themes to each outcome, and may in rare cases extend the 30-day comment window.
Notice 0012 (June 3, 2026), the outcome of RFC-0031 on incident communication. "Potential Adverse Impact" became "Potential Agency Impact," to focus on how an incident affects agencies. Reporting times depend on the provider's assessment of the incident and its class.
Notice 0013 (June 16, 2026), the outcome of the Rev5 baseline RFCs, RFC-0026 through RFC-0030. FedRAMP removed most FedRAMP-assigned control parameter values and most FedRAMP-specific control guidance.
Notice 0014 (June 16, 2026), FedRAMP's response to the Cybersecurity and Infrastructure Security Agency (CISA) Binding Operational Directive 26-04. It moved the VDR and VER rules from June 1, 2027 to December 7, 2026. After March 7, 2027, FedRAMP revokes the certification of any service that does not follow them. The video's description dates this notice June 16, 2025; the notice itself says 2026.

What does setting our own parameters mean?

Many NIST controls let the organization choose a value, such as how often to review something. FedRAMP used to set most of those values. A FedRAMP staff member said in the video that the fixed values led to less secure results, because providers reported that they met a value even when it no longer fit a cloud service in 2026.

Now the provider chooses the value wherever NIST allows. The provider must still state each value it uses and its objective. An agency can still configure its own tenant to meet its own requirements.

Two answers from the question period:

Changing a value later must follow the significant change notification process. A FedRAMP staff member said a tighter value is unlikely to cause concern, but a looser one may affect security and needs evaluation.
Control text comes from NIST. A FedRAMP staff member said FedRAMP's machine-readable files give the control ID only, plus any guidance FedRAMP still adds.

What did FedRAMP say about vulnerabilities and plans of action?

A FedRAMP staff member said the VDR and VER reporting rules will replace the plan of action and milestones (POA&M) in its current form. A provider may keep a POA&M format if its reports meet the minimum information the rules require. Providers may move to the new process in phases or all at once, as long as they follow VDR and VER by December 7, 2026.

On the VER rule that tells providers to assume an exploit is automatable, a FedRAMP staff member said a provider may show evidence that it is not. The staff member added that fixing the vulnerability may take less work.

On cryptography, a FedRAMP staff member noted that many Federal Information Processing Standard (FIPS) 140-2 modules were about to become historical. The NIST Cryptographic Module Validation Program moved FIPS 140-2 certificates to its Historical List after September 21, 2026. The staff member said providers should record the risk either way: keep using a historical module until a FIPS 140-3 version is validated, or use a module still in review.

What else did FedRAMP announce?

Templates. All old templates moved to FedRAMP's legacy documentation, each marked as being replaced. FedRAMP does not plan new templates. It released limited schemas, which providers are expected to expand. The rules are also published in JSON, a machine-readable format.
Forms. FedRAMP receives about 14,000 unique support tickets a year, sorted by hand. It is moving requests from its email inbox to forms that route each request to the right team. Agencies were asked to use the pilot form to submit authorizations to operate.
Marketplace classes. FedRAMP converted listings in bulk, so a Moderate service became Class C. A provider listed in the wrong class should write to info@fedramp.gov. A provider with a FedRAMP Ready listing must apply for 20x Class A.
Hiring. FedRAMP was reviewing GS-15 and GS-14 applicants and hoped to post GS-13 jobs. See FedRAMP's jobs page.
Trivia. FedRAMP posted a CR26 trivia game. Our CR26 study guide covers it.

What should providers and agencies do now?

Providers: check the dates on every ruleset that applies to your service, and plan for the earliest one.
Providers seeking a new Rev5 Certification: make sure the package can reach FedRAMP before June 11, 2027, or plan for 20x.
All Rev5 providers: record the control parameter values you choose, and send changes through the significant change process.
Agency security staff: ask your providers for their transition plans a month before they change processes, and attend their continuous monitoring meetings. Our post on how FedRAMP will enforce the VDR and VER rules covers the vulnerability dates.

Sources

Share this post:LinkedIn X Email

A weekly email on Fridays, an alert on the day the watch finds something new, or both. Free.