FedRAMP's September Rev5 update: 36 Lost Sponsor and Ready Conversion forms, reviews near 30 days, and removals for unanswered messages

FedRAMP accepted 36 Lost Sponsor and Ready Conversion forms in three weeks and warned these packages may wait 60 to 90 days, behind agency-sponsored ones. It also removed providers from the Marketplace that did not answer its security inbox messages for months.

By FedXchange · November 7, 2026

FedRAMP's video, on its governance tracker page. The player loads from YouTube only when you press play.

The Federal Risk and Authorization Management Program (FedRAMP) held its monthly Rev5 Community Update on September 2, 2026. Rev5 is the older FedRAMP path, built on Revision 5 of the National Institute of Standards and Technology (NIST) control catalog. Under the FedRAMP Consolidated Rules for 2026 (CR26), FedRAMP calls its approval a "FedRAMP Certification," the term this post uses.

In short:

Lost Sponsor and Ready Conversion. A temporary pipeline lets some providers seek a Rev5 Class B or Class C Program Certification, a certification FedRAMP grants without an agency sponsor. It opened August 10, 2026. By September 1, FedRAMP had 36 eligible forms. These providers must still meet every requirement, and they agree to follow the CR26 rules by February 19, 2027.
Slower reviews. FedRAMP's target is a review in under 30 days. It had 22 packages waiting and no new staff. A FedRAMP leader said agency-sponsored packages come first, so pipeline packages may wait 60 to 90 days.
Security inbox. FedRAMP removed providers from the FedRAMP Marketplace that had not answered its messages for six months or more. Providers must make sure their security inbox can receive mail from outside their company.
Vulnerabilities. A FedRAMP leader reminded providers that a gap in a control is a vulnerability, and that the vulnerability rules take effect December 7, 2026.

How a Lost Sponsor or Ready Conversion package moves through FedRAMP

Sources: the FedRAMP Rev5 Community Update video (September 2, 2026) and FedRAMP's Choosing a Certification Path page.

Read the steps as text

Check eligibility. Between January 2025 and March 2026, the service lost its sponsor while In Process, finished a full assessment, finished a Readiness Assessment Report (RAR), or became FedRAMP Ready.
Submit the form. The provider sends the Lost Sponsor Form or the Ready Conversion Form with evidence. The pipeline opened August 10, 2026.
Kickoff meeting. The provider books a meeting with the Rev5 leadership team. FedRAMP confirms eligibility and asks about the state of the provider's security work.
Build the package. FedRAMP sets up access to Connect.gov, the repository that holds the package, usually within two to three days. The provider uploads its documents.
Review. After an intake check finds all documents present, the review clock starts. The requirements are the same as for an agency-sponsored package, except for the agency authorization to operate.
Meet CR26 by February 19, 2027. Applicants agree to follow all updated Rev5 rules by this date.

Does our service qualify for the Lost Sponsor or Ready Conversion pipeline?

FedRAMP's Choosing a Certification Path page sets four tests. Between January 2025 and March 2026, the service must have done one of these:

Been In Process on the Marketplace and then lost its sponsor (Lost Sponsor).
Completed a full assessment, with a Security Assessment Plan and Security Assessment Report (SAR), under an informal agreement to go In Process later (Lost Sponsor).
Completed a FedRAMP Ready assessment with a RAR (Ready Conversion).
Achieved FedRAMP Ready on the Marketplace (Ready Conversion).

The pipeline came from Notice 0008, the outcome of a request for comment on Rev5 Program Certifications. It is open for Class B or Class C only.

A FedRAMP staff member said some applicants gave a start date instead of a completion date to fit the window, and were turned away at the kickoff meeting.

From August 10 to September 1, FedRAMP accepted 36 forms: 20 Ready Conversion and 16 Lost Sponsor. It had held 29 kickoff meetings with 5 more pending. Six complete packages were in the review queue, and about 10 more were being built.

The pipeline gives a chance to earn a certification, not a certification. A FedRAMP leader stressed that a RAR alone is not enough. A provider whose assessor checked only the RAR controls has more work to do. Providers that kept up their documentation in FedRAMP formats move fastest.

In the video, a FedRAMP leader said FedRAMP would likely close the pipeline in mid to late October 2026 if new forms stopped arriving. On November 7, 2026, FedRAMP's page still showed only the latest closing date: the pipelines close June 11, 2027, when FedRAMP stops accepting new Rev5 applications. Its timeline also says that CR26 becomes mandatory for all stakeholders on January 1, 2027.

How long will a Rev5 review take now?

FedRAMP showed its Rev5 review numbers for fiscal year 2026, which began October 1, 2025. The clock starts when a complete package enters the review queue. It pauses while FedRAMP waits on the provider for small fixes, and stops for serious problems.

Rev5 packages completed by quarter, fiscal year 2026

Q1 was affected by the 2025 government shutdown. Q4 was in progress. Source: FedRAMP Rev5 Community Update video and description, September 2, 2026.

Show the numbers

	Packages completed
Q1 (Oct-Dec 2025)	13
Q2 (Jan-Mar 2026)	22
Q3 (Apr-Jun 2026)	33
Q4 (Jul 2026 to date)	14

Quarter	Average days in queue	Packages waiting
Q1	21	8 on average
Q2	23	7 on average
Q3	28	7 on average
Q4 to date	30	22 at the time of the meeting

FedRAMP had cleared a backlog of more than 80 packages in July and August 2025. The goal now is a review in under 30 days. A FedRAMP staff member said time on pause adds only about two days to the average, because most providers answer quickly. Stops happen once or twice a month and come from a government lead.

A FedRAMP leader explained why the numbers will rise. FedRAMP opened the pipeline expecting to hire more than 15 staff, and had hired no one. The leader decided to prioritize agency-sponsored Rev5 packages, so pipeline packages may wait 60 to 90 days. The leader said this had not yet affected FedRAMP 20x, the newer path.

Why did FedRAMP remove some providers from the Marketplace?

FedRAMP removed some providers after they failed its last quarterly security inbox test and never answered repeated contact. FedRAMP did not give a count in the video. Staff said they searched their support records for other contacts and asked agency customers who they talked to. A FedRAMP leader said this applies to providers that failed to communicate for six months or more, not to a single missed message. FedRAMP said it would notify the agencies listed as using those services.

Providers that answered late were asked for a corrective action plan (CAP). Corrective action plans are now visible on the Marketplace, and agencies can filter by them.

The rules are now called Addressing FedRAMP Communication, formerly the FedRAMP Security Inbox rules. Providers must keep an inbox for FedRAMP's messages, and must receive them without asking FedRAMP to solve a CAPTCHA or log in to a portal. FedRAMP's 20x Class C version of these rules says a provider must act on an emergency test message by 3:00 p.m. Eastern Time on the second business day, unless the message gives another time.

A FedRAMP leader said the most common failure is an inbox that blocks mail from outside the company. Test regularly that your security inbox accepts mail from gsa.gov and fedramp.gov. When the security inbox fails, FedRAMP writes to the sales inbox.

What counts as a vulnerability under the 2026 rules?

FedRAMP's definition of vulnerability comes from the law, 6 U.S.C. 650(25). It covers any weakness in hardware, software, a process, or a procedure that could defeat security controls. It includes gaps in Rev5 controls, misconfigurations, weak credentials, and insecure services. A FedRAMP leader said a finding that the provider agrees is a gap is a vulnerability, and should be tracked like one.

The Vulnerability Detection and Response (VDR) and Vulnerability Evaluation and Reporting (VER) rules take effect December 7, 2026. Notice 0014 moved that date from June 1, 2027, to match the Cybersecurity and Infrastructure Security Agency (CISA) Binding Operational Directive 26-04. The notice gives a grace period through March 7, 2027, under a corrective action plan. A FedRAMP leader said FedRAMP will move its dates if CISA moves its own.

A partial rollout of VDR or VER is itself a vulnerability. The leader said providers that have documented their gaps and plans by December 8 will likely not be asked for a corrective action plan. Providers with nothing documented will be asked for one and placed in public remediation. Our post on how FedRAMP will enforce the VDR and VER rules covers the later dates.

Answers from the questions:

A provider may scan a representative sample of identical resources. CR26 rule VDR-TFR-PSD says a Class C provider should scan at least every three days, and a Class B provider at least every seven days.
A reason for not meeting a "should" rule goes in a security decision record, or in the control narrative until the provider adopts those rules.
Moving to a new rule set, such as VDR, is a significant change. It does not need a new independent assessment.

What else did FedRAMP announce?

Assessor meetings. FedRAMP added a monthly assessor community update on the third Wednesday, starting September 16, 2026. It also planned recorded Friday question sessions after each update.
RFC-0032, Offerings By Government. This request for comment (RFC) covers services an agency runs for other agencies. FedRAMP would rely on the operating agency's own authorization to operate (ATO). A FedRAMP leader said about 8 such services are on the Marketplace, out of an estimated 50 to 80. Comments closed September 8, 2026.
Coming requests for comment. The Phase 4 pilot for FedRAMP 20x appeared as RFC-0033 and the Technical Advisory Group as RFC-0034. Both closed October 9, 2026. A request for comment to retire FedRAMP Tailored for Low-Impact Software-as-a-Service (LI-SaaS) did not appear on FedRAMP's list as of November 7, 2026.

What should providers and agencies do now?

Pipeline applicants: finish a complete package in FedRAMP formats, and plan to meet CR26 by February 19, 2027.
Providers in the review queue: answer pause requests quickly. Expect reviews to take longer than 30 days.
All providers: test your security inbox from an outside address, and keep its contact current with FedRAMP.
Agency security staff: check the Marketplace for corrective action plans and removals among services you use. A Program Certification means no agency sponsored the service, so your agency still makes its own risk decision.

Sources

Share this post:LinkedIn X Email

A weekly email on Fridays, an alert on the day the watch finds something new, or both. Free.