FedRAMP's October Rev5 update: an N0 vulnerability rating, self-managed Marketplace listings, and longer review holds

FedRAMP added an N0 rating for flaws extremely unlikely to harm agencies, requires a public JSON file for each Marketplace listing change, and says Rev5 packages on hold wait about a month. Certified providers should meet the vulnerability rules by December 7, 2026, or file a corrective action plan.

By FedXchange · November 6, 2026

FedRAMP's video, on its governance tracker page. The player loads from YouTube only when you press play.

The Federal Risk and Authorization Management Program (FedRAMP) held its monthly Rev5 Community Update on October 7, 2026. Rev5 is the path built on Revision 5 of the National Institute of Standards and Technology (NIST) control catalog, Special Publication (SP) 800-53. The meeting covered four changes that matter to cloud service providers and the agencies that use them.

In short:

Marketplace listings. A provider that wants a new FedRAMP Marketplace listing, or any change to an existing one, must publish its listing as a JavaScript Object Notation (JSON) file on a web server it controls. FedRAMP staff said they now apply this rule to everyone, with no more exceptions.
Vulnerability ratings. Providers may now rate a vulnerability N0 when exploitation is extremely unlikely to have any adverse effect on agencies. Ratings must reflect the likely impact, not every possible one.
Review times. Rev5 package reviews average about 35 days against a 30-day goal. Packages on hold now wait about a month for the provider to answer. FedRAMP staff asked providers in the review queue to answer reviewer questions quickly.
Deadline. Providers with a current FedRAMP Certification should meet the Vulnerability Detection and Response (VDR) and Vulnerability Evaluation and Reporting (VER) rules by December 7, 2026. After that date, FedRAMP requires a corrective action plan, and the grace period ends March 7, 2027.

How do we change our Marketplace listing now?

The FedRAMP Consolidated Rules for 2026 (CR26) took effect for the Marketplace on July 4, 2026. Rule MKT-CSO-MLR says a provider must address rule CDS-CSO-PUB (Public Information) to apply for a new listing or to change an existing one. CDS-CSO-PUB requires the provider to publish its public information in both readable and JSON formats. That includes the FedRAMP ID, the service description, contacts, the list of services in scope, and a logo link.

A FedRAMP leader said in the video that the old way, by email and support ticket, did not scale. FedRAMP cannot keep more than 500 listed providers current by hand. Staff said the number of listings in the Initial Implementation Phase grew from 71 earlier that week to 76 on the day of the meeting.

How a provider changes its Marketplace listing under CR26

Sources: the video; FedRAMP rules MKT-CSO-MLR, MKT-CSO-PML, CDS-CSO-PUB, and FRC-CSO-JSN.

Read the steps as text

Publish the JSON file. The provider hosts its public listing data as JSON on a web server it controls, with proper cross-origin resource sharing (CORS) and Content-Type settings.
Validate it first. FedRAMP provides a JSON schema and a validator. Engineers should check the file before it is submitted.
Submit the address. The provider sends the file's address through the listing request form on the FedRAMP Help Desk, not by email.
FedRAMP checks the file. FedRAMP validates the file when it is submitted. Staff said the first change takes a few days.
The Marketplace rebuilds. FedRAMP rebuilds the Marketplace daily, or sometimes every two days, and pulls the provider's current data.

Some details from the questions:

Use the form, not email. The listing request form is on the FedRAMP Help Desk. FedRAMP does not accept listing requests by email.
The file can live anywhere the provider controls. It does not have to be on the company's main website.
Basic Markdown works. FedRAMP removes scripts and may not show embedded images.
FedRAMP owns some fields. The certification class shown on the Marketplace comes from FedRAMP, not from the provider's file.
The logo must display in a browser without processing. The rule prefers a transparent Portable Network Graphics (PNG) file. A FedRAMP leader warned that white text on a transparent background will not show on the Marketplace.
There is no rush. A provider that does not want to change its listing can leave it as it is until the Certification Data Sharing rules apply to it. Staff asked providers to plan the work over the next few weeks.

Because the file is public and machine-readable, agency governance, risk, and compliance (GRC) tools can read it too, not only FedRAMP.

What changed in the vulnerability rules?

The CR26 changelog entry dated October 5, 2026 changed seven rules. The meeting reviewed four of them:

Rule	What changed
VER-EVA-EPA (Estimate Potential Agency Impact)	Adds N0 to the Potential Agency Impact N-ratings (PAIN), which run N0 to N5. The provider estimates the likely potential agency impact.
FRC-CSO-JSN (FedRAMP JSON Schemas)	Public JSON data must have proper CORS and Content-Type settings so web applications can use it.
CDS-CSO-PUB (Public Information)	The logo link must be a properly named image file.
CMU-CSO-UVM (Using Validated Cryptographic Modules)	A note: new algorithms added in an update to a validated module are not validated.

Before N0, the lowest rating was N1, minimal customer effects. A FedRAMP leader said N0 gives providers a way to rate a flaw that will cause no harm, instead of defaulting to N1. Now a false positive can simply be rated N0. Staff said no remediation timeframes changed, and N0 has none.

The word "likely" matters. The rules define it as a reasonable degree of probability based on context. A provider should not rate a flaw N5 only because a widely used database is affected. It should estimate what would likely happen to agencies using its service.

Staff also explained rule VER-EVA-GRV: providers should group related vulnerabilities, such as all the vulnerabilities in one version of a container image deployed 8,000 times, and treat the group as one item.

What does the Rev5 review queue look like?

Staff gave these numbers, and called them approximate because the Rev5 team lead was away:

Average Rev5 review time: about 35 days, against a 30-day goal. This includes time in the queue and time on hold.
Packages in active review: about 11. On hold: 4.
Average time on hold: about one week in the second quarter of this year, two weeks in the third, and about a month in the fourth.
Coming soon: about 30 to 40 packages from the Ready Conversion and Lost Sponsor pipelines, which let some providers apply for a Rev5 Class B or C Program Certification without an agency sponsor.

FedRAMP stops accepting applications for new Rev5 certifications on June 11, 2027. Staff asked providers to submit early, and to ask for a phone call when a question from a reviewer is unclear. Follow-up email may come from Zendesk or from gsa.gov.

Should a Rev5 provider move to FedRAMP 20x?

FedRAMP leaders urged Rev5 providers to start working toward FedRAMP 20x now. A provider can hold both a Rev5 and a 20x FedRAMP Certification. In the video, a FedRAMP leader said Rev5 stays in effect through December 31, 2028, after correcting an earlier answer of 2029. Rev5 providers are not required to implement Key Security Indicators (KSIs), which belong to 20x.

A provider that wants 20x Class D should start with 20x Class C. Request for comment (RFC) RFC-0033 proposes that a service hold a 20x Class C Certification without corrective action for 6 months before it becomes eligible for Class D. The video description lists the requests for comment on the 20x Phase 4 Pilot (RFC-0033) and the Technical Advisory Group (RFC-0034) as closing soon. Both closed October 9, 2026. The description also lists a coming request for comment to retire FedRAMP Tailored for Low-Impact Software-as-a-Service (LI-SaaS).

What should agencies and providers do now?

Providers: meet the VDR and VER rules by December 7, 2026, or have a corrective action plan ready. A FedRAMP leader said the Cybersecurity and Infrastructure Security Agency (CISA) will ask agencies on that date to show their cloud services meet these requirements, and an agency may not give the three-month grace that FedRAMP gives.
Providers: build the public JSON listing file with your engineers, and test it with FedRAMP's validator before you submit it.
Providers in the Rev5 queue: answer reviewer questions within days, not weeks.
Agency security staff: read a provider's corrective action plan as a statement of known risk and a plan to fix it, not as an automatic disqualification. Make your own risk decision from it.
Agency security staff: expect N0 ratings in vulnerability reports, and ask how the provider decided the impact was unlikely.

Sources

Share this post:LinkedIn X Email

A weekly email on Fridays, an alert on the day the watch finds something new, or both. Free.