Notice 0013: FedRAMP drops most of its Rev5 parameter values, and providers set their own

▶ Play the video: FedRAMP Public Notice-0013: Initial Outcome of the Rev5 Family of RFCs 0026 - 0039

On June 17, 2026, the Federal Risk and Authorization Management Program (FedRAMP) posted a short video about FedRAMP Notice 0013, which it issued on June 16, 2026. The notice gives the initial outcome of five requests for comment (RFCs) on the Rev5 security control baselines, RFC-0026 through RFC-0030. (The video's title says "0026 - 0039"; the notice covers RFC-0026 through RFC-0030.) Rev5 is FedRAMP's older path, built on Revision 5 of the National Institute of Standards and Technology (NIST) Special Publication 800-53 controls. This post uses "FedRAMP Certification," the current term under the FedRAMP Consolidated Rules for 2026 (CR26).

In short:

• What FedRAMP said. FedRAMP removes most of the values it had assigned to control parameters in every Rev5 baseline, and nearly all of its FedRAMP-specific control guidance.
• Who it affects. Every cloud service provider that holds or seeks a Rev5 FedRAMP Certification, and the agencies that review their packages.
• What they must do. Set their own organization-defined parameter values, based on what they actually do, and document them in the system security plan (SSP) or a future Security Decision Record.
• By when. An existing Rev5 offering must adopt the changes at its first independent assessment completed after January 1, 2027. A new Rev5 offering that applies after January 1, 2027, must meet all of them.

Why is FedRAMP removing its own parameter values?

Many NIST controls let the organization define a value, such as how often to review logs or scan systems. FedRAMP had filled in those values for every provider. The notice says that "establishing a 'minimum bar' for control parameters also effectively establishes a ceiling." Its example: a value that requires an action "at least every 30 days" becomes a goal to do it only every 30 days, even for a provider that could do it daily.

In the video, a FedRAMP speaker said the values made sense in FedRAMP's early years, before there was established trust in how cloud services for the government would work. The speaker said that over time the minimum bar became a ceiling, and that many tasks FedRAMP sets at 30 days should happen continuously. Another speaker said many providers already do these tasks far more often than once a year.

The speakers also tied the change to FedRAMP 20x, the newer path. One said FedRAMP no longer cares what a provider plans to do; it wants to know how often the provider actually did it.

What else changes in the Rev5 baselines?

• Control guidance. FedRAMP removes nearly all FedRAMP-specific guidance that added rules to the Rev5 baselines. Those requirements move into CR26, which applies to both 20x and Rev5. The notice says control guidance "will primarily be limited to tips and helpful information."
• Templates. Three primary documents replace the legacy templates: the Certification Package Overview (most of the SSP and the service boundary), the Security Decision Record (the control parts of the SSP and the Security Assessment Report), and the Secure Configuration Guide (the Control Implementation Summary and Customer Responsibility Matrix).
• Machine-readable data. The package rules set the minimum information and give a simple JSON (JavaScript Object Notation) schema for sharing it.

What should agencies and assessors expect?

Parameter values will differ from one provider to the next. A speaker in the video said FedRAMP wants those values well defined so that FedRAMP and agencies can find them quickly. Another speaker said the change should force the engineering team and the governance, risk, and compliance (GRC) team to agree on what the provider really does, instead of copying a value into the SSP.

The notice also sets the outer dates for Rev5. FedRAMP will stop accepting requests for new Rev5 Certifications on June 11, 2027. The end date for existing Rev5 Certifications is not final; the notice says it is "likely to be no later than 2029," and that the Office of Management and Budget (OMB) may set it at any time.

Sources

• FedXchange tracker: FedRAMP Public Notice-0013 video (June 17, 2026)
• YouTube: FedRAMP Public Notice-0013: Initial Outcome of the Rev5 Family of RFCs
• FedRAMP Notice 0013: Initial Outcome of Rev5 Baseline RFCs (FedRAMP's page)
• FedRAMP RFC-0026: Clarifying CA-7 Continuous Monitoring Expectations for Rev5 Providers
• FedRAMP RFC-0027: FedRAMP Rev5 Security Controls Baseline Update for AC, AT, AU, CA, and CM Control Families
• FedRAMP RFC-0028: FedRAMP Rev5 Security Controls Baseline Update for CP, IA, IR, MA, and MP Control Families
• FedRAMP RFC-0029: FedRAMP Rev5 Security Controls Baseline Update for PE, PL, PM, PS, and PT Control Families
• FedRAMP RFC-0030: FedRAMP Rev5 Security Controls Baseline Update for RA, SA, SC, SI, and SR Control Families (FedRAMP's page)
• FedRAMP Consolidated Rules for 2026