Rev5 community update, May 2026: the CR26 public preview, a Cisco directive response, and early outcomes of RFCs 26 to 30

In its May 6, 2026, Rev5 update, FedRAMP said 91% of providers answered its Cisco emergency directive notice, walked through the public preview of the 2026 Consolidated Rules, and previewed dropping raw monthly scans unless an agency or contract asks for them.

By FedXchange · May 6, 2026

FedRAMP's video, on its governance tracker page. The player loads from YouTube only when you press play.

On May 6, 2026, the Federal Risk and Authorization Management Program (FedRAMP) held its monthly Rev5 community working group. Rev5 is the FedRAMP path built on Revision 5 of the National Institute of Standards and Technology (NIST) Special Publication 800-53 controls. FedRAMP 20x is the newer path for cloud-native services. FedRAMP staff covered an emergency directive, hiring, the public preview of the Consolidated Rules for 2026 (CR26), and early outcomes from five requests for comment (RFCs).

In short:

What FedRAMP said. CR26 folds every Rev5 Balance Improvement Release (BIR) into mandatory rules. A speaker previewed dropping raw monthly scans unless an agency or contract requires them. A provider's certification data belongs to the provider.
Who it affects. Every Rev5 cloud service provider, its independent assessor, and its agency customers.
What FedRAMP asked. Read the CR26 preview and comment on it. Prepare budgets for the BIRs now. Test the security inbox regularly from outside the company.
By when. A FedRAMP speaker said CR26 comes in on January 1, 2027, and is meant to last two years. FedRAMP's announcement says the rules take effect at the beginning of July 2026, with an optional transition in many cases through January 1, 2027. Each rule set will have an implementation date and a grace period.

How a Rev5 Balance Improvement Release becomes a CR26 rule

Source: FedRAMP Rev5 Community Update video (May 6, 2026).

Read the steps as text

Optional release. A Balance Improvement Release starts as an optional process, often with an open beta that providers sign up for.
Public preview. FedRAMP shows the draft rule in the CR26 public preview and takes comments on each page.
Mandatory rule. Under CR26, the release becomes part of the standard Rev5 rules for every provider.
Implementation date. The rule set takes effect on its implementation date.
Grace period. Providers have until the end of the grace period to implement it. A speaker said FedRAMP may pull certifications after that.

What did FedRAMP ask providers to do about the Cisco emergency directive?

The Cybersecurity and Infrastructure Security Agency (CISA) updated its emergency directive ED 25-03 on Cisco devices. FedRAMP answered with Notice 0010 on April 23, 2026. It named public-facing Cisco Firepower and Secure Firewall devices and told providers to report to FedRAMP by 5:00 p.m. Eastern time on April 29, 2026.

A FedRAMP speaker said 91% of service providers responded, about 10% better than an emergency test a couple of months earlier. The speaker asked providers to watch the RSS (Really Simple Syndication) feed on the FedRAMP notices page. The speaker also asked them to test their security inbox regularly, to make sure people outside the company can reach it.

What is in the CR26 public preview?

FedRAMP posted the public preview of CR26 on May 4, 2026. A speaker said FedRAMP is moving away from long narrative guides to rules. Each rule applies to Rev5 or 20x, to FedRAMP, agencies, assessors, or providers, and to Classes A, B, C, or D. A provider seeking Class B, for example, should be able to find the rules and templates for Class B alone.

The preview's announcement says the machine-readable rules come as JSON (JavaScript Object Notation) files, with a Markdown version. Comments on each page go through GitHub, and the announcement says they "won't be considered formal public comment." A speaker said FedRAMP's leadership team reviews those comments every week.

A speaker said CR26 "comes in" on January 1, 2027, and will be good for two years. FedRAMP's announcement gives more detail: the rules take effect at the beginning of July 2026, with an optional transition in many cases through January 1, 2027, and are supported until December 31, 2028.

A speaker said FedRAMP will no longer copy NIST's control text into its baseline. Providers should read the latest NIST Rev5 text directly. Another speaker said FedRAMP is mapping the 800-53 controls to the rules that cover them.

What did FedRAMP say about BIRs and Rev5's future?

A speaker said all BIRs become mandatory under CR26. Rev5 work done before CR26 will be called "legacy." The speaker said 20x is designed for cloud-native services and does not fit providers with their own data centers, so FedRAMP will keep both baselines for now. Rev5 providers should expect to adopt Significant Change Notifications (SCN) instead of significant change requests, the new incident communication procedures, and collaborative continuous monitoring.

A speaker said authorization data sharing is now called certification data sharing, and that FedRAMP's Connect.gov contract is ending, so providers will host their own repositories. Notice 0009 retires Connect.gov when Authorization Data Sharing becomes mandatory on August 1, 2027.

A speaker said FedRAMP planned to stop accepting new Rev5 packages by the end of 2027, with no end date yet for current ones. FedRAMP later set the date: Notice 0013 says it "will stop accepting new FedRAMP Rev5 Certification requests on June 11, 2027."

What came out of RFCs 26 to 30?

A speaker gave an early look at a combined notice for RFC-0026 through RFC-0030. These were previews in the video, not published outcomes. The speaker said:

Legacy Rev5 processes. This is the one term for Rev5 processes from before CR26.
Raw scans. Control CA-7 (continuous monitoring) will no longer require raw monthly scans, unless a contract or an agency requires them.
Continuous vetting. Personnel rules will be clarified to align with Trusted Workforce 2.0.
Nationality. In the question period, speakers said FedRAMP does not require providers' support staff to be United States persons. An agency may. A speaker said providers must clearly document the nationality of the people who affect their FedRAMP service.
Sampling. A provider that uses sampling should publish its method next to the results.
Directives. One control will name binding operational directives (BODs) as well as emergency directives.

FedRAMP published Notice 0013 on June 16, 2026. Its outcomes differ from this preview: it removes most FedRAMP-assigned control parameter values and most FedRAMP control guidance. The notice does not mention the items in the list above.

Who owns a provider's certification data?

A speaker said FedRAMP's position is that a provider's authorization data is its own. The provider chooses who sees it, including non-federal organizations. If a package holds controlled information about a specific agency, the provider must ask that agency how to handle it. A speaker said FedRAMP certification data is not Controlled Unclassified Information (CUI), and FedRAMP removed that marking from its templates.

A speaker said agencies are required by law to use current FedRAMP standards, and that some Office of Inspector General (OIG) reports have already found agencies not following FedRAMP policy.

What else did FedRAMP announce?

Hiring. General Schedule grade 15 (GS-15) positions in the FedRAMP Cybersecurity Service were open. A speaker said one announcement can fill up to four slots, in person in Washington, D.C., five days a week, for two-year terms. Current openings are at fedramp.gov/join.
Betas. A speaker said providers must fill out the sign-up form to join a BIR beta.

Sources

Share this post:LinkedIn X Email

A weekly email on Fridays, an alert on the day the watch finds something new, or both. Free.