For cloud service providers, the single biggest obstacle to getting FedRAMP authorized has always been the same: finding an agency willing to sponsor you.
Sponsorship has historically been the gate. A CSP could do everything right — invest hundreds of thousands of dollars in Rev5 preparation, complete a FedRAMP Ready assessment, even finish a full Security Assessment Plan, and still find themselves stuck, waiting for an agency with the budget and bandwidth to formally take them across the finish line. Over the past year, with federal staffing and budget shifts, that wait has gotten significantly harder for many providers.
In February 2026, FedRAMP proposed a fix: RFC-0023 — a new path called Rev5 Program Certification that would let FedRAMP directly certify qualifying CSPs without requiring an agency sponsor.
In March 2026, FedRAMP accepted it. But with major changes from the original proposal.
If you're a CSP trying to understand what this actually means for you: whether you qualify, what's required, and what to do next. Here's a clear-eyed summary of where the Rev5 Program Certification stands today.
What Is the Rev5 Program Certification?
The Rev5 Program Certification is a path to FedRAMP Certification that does not require an agency sponsor. Instead of a federal agency doing the initial assessment review, FedRAMP itself handles it.
This is a significant shift. Under the traditional "Agency Authorization" path, a sponsoring agency bears the cost and effort of reviewing the CSP's security package — a process that can cost hundreds of thousands of dollars in government resources and take months to years. Under Program Certification, FedRAMP does the review directly.
That's the good news. The harder news: because FedRAMP absorbs the review cost, the program is tightly scoped. Not every CSP qualifies, and not every impact level is available.
Who Qualifies for Rev5 Program Certification
The Rev5 Program Certification will be rolled out in stages. As of the Initial Outcome notice (NTC-0008) published March 6, 2026, here's where things stand:
Stage 1: Rev5 Class A Certification (Replaces FedRAMP Ready)
Starting around July 28, 2026, Rev5 Class A Certifications become available to CSPs that are currently FedRAMP Ready. Class A replaces the FedRAMP Ready designation entirely, and CSPs that qualify will be able to convert their FedRAMP Ready status to a Class A Certification through a relatively light-touch process.
CSPs that choose not to convert (or don't qualify) will have their status renamed "Legacy FedRAMP Ready" and eventually retired.
Stage 2: Rev5 Class B and Class C Certifications (Low and Moderate)
This is the stage most CSPs are asking about. Rev5 Class B (roughly equivalent to Low) and Class C (roughly equivalent to Moderate) Certifications will be available via the Program Certification path to CSPs that:
- Are willing to adopt the required Rev5 Balance Improvement Releases, AND
- Met at least one of the following criteria between January 1, 2025 and March 1, 2026:
- Listed as FedRAMP Ready on the FedRAMP Marketplace
- Listed as In Process on the FedRAMP Marketplace
- Completed a FedRAMP Ready assessment with a Readiness Assessment Report (RAR)
- Completed a full FedRAMP assessment with a Security Assessment Plan and Security Assessment Report (SAP/SAR)
This is the most important detail to understand. The sponsorless path is designed for CSPs who already invested significantly in Rev5 preparation before March 1, 2026 and got stuck. If you're starting a brand-new Rev5 journey today, you do not qualify for Stage 2 — you would need an agency sponsor, or you should consider pivoting to FedRAMP 20x.
Stage 3: Still Being Defined
In a future Stage 3, FedRAMP tentatively hopes to open Rev5 Class A Certifications to any CSP using an external security framework that is at least 80% compatible with Rev5, and Class B and C Certifications to certain GRC automation tools with proven agency demand. Requirements and timelines for Stage 3 will be established based on how Stages 1 and 2 go.
What's Excluded: Rev5 Class D (High Impact)
Class D Certifications — the equivalent of FedRAMP High — are not available through the sponsorless Program Certification path. High impact systems still require an agency sponsor.
FedRAMP's reasoning: High impact reviews are too expensive and time-consuming for FedRAMP to absorb directly at scale. If you need High impact authorization, the traditional Agency Authorization path remains your route.
One option FedRAMP has offered: CSPs unable to secure a sponsor for Class D can apply for a Class C Certification directly, and include any additional High-level control implementations as an addendum to their authorization package. Agencies can then evaluate those additional controls when deciding whether to use the service in a High-impact environment.
What Changed from the Original RFC-0023
Several requirements from the original February 2026 proposal were modified or dropped based on public comment:
"Trusted Assessor" requirement: dropped
RFC-0023 originally proposed that only assessors meeting specific criteria (being the primary assessor for at least 3 successful FedRAMP Certifications in the previous 12 months) could support Program Certification packages. FedRAMP agreed with public commenters that this requirement created unfair risk for CSPs — an assessor could lose their Trusted status mid-engagement, through no fault of the CSP. The Trusted Assessor requirement will not be implemented for Rev5 Program Certifications.
Mandatory adoption of future Balance Improvement Releases: dropped
The original proposal required CSPs to participate in the first beta of every future mandatory or optional Balance Improvement Release. That requirement was removed.
Machine-readable package requirements for Rev5 Program Certification: dropped (for this specific path)
Machine-readable requirements still apply to other aspects of FedRAMP, but the specific LPC-GEN-LMR requirement from RFC-0023 will not be implemented for Rev5 Program Certifications.
December 16, 2026 deadline: extended
The original RFC proposed a hard submission deadline of December 16, 2026. The final outcome extended this significantly — the sponsorless path will now remain available for the entire remaining lifecycle of Rev5 Certification, which is currently planned to end in late 2027 (FY27 Q3–Q4) as part of FedRAMP 20x Phase 5.
This last change is important. Earlier coverage of RFC-0023 (including some that's still circulating) references the December 16, 2026 deadline. That deadline has been superseded.
What Balance Improvement Releases Are Required
The one requirement that was not softened is the Balance Improvement Release adoption requirement. To qualify for Rev5 Program Certification, CSPs must adopt the following Balance Improvement Releases:
- Minimum Assessment Scope — Replaces the traditional authorization boundary approach with a more flexible, modern scoping model.
- Authorization Data Sharing — Standardizes how authorization packages are shared with agencies.
- Collaborative Continuous Monitoring — Replaces single-agency lead ConMon with a shared, distributed model.
- Significant Change Notifications — Replaces the legacy Significant Change Request (pre-approval) process with a notify-and-proceed model.
- Vulnerability Detection and Response — A modernized approach to vulnerability management that replaces traditional POA&M tracking.
FedRAMP was explicit on this point: Program Certification exists only because of the Balance Improvement Releases. The entire reason FedRAMP can absorb the assessment review cost for Program Certification is because these improvements reduce the government's review burden. CSPs that can't or won't adopt them will need to pursue the traditional Agency Authorization path instead.
Most of these Balance Improvement Releases entered wide release, open beta, or closed beta in early 2026 and are already available for adoption.
How This Fits Into the Broader FedRAMP Landscape
The Rev5 Program Certification is a release valve, not a long-term plan. FedRAMP has been clear that FedRAMP 20x is the future — wide-scale adoption of 20x Low and Moderate opens in Q3–Q4 2026, and new Rev5 authorizations will stop being accepted by the end of 2027.
The Program Certification path exists specifically to help CSPs who are already far down the Rev5 road, and who would otherwise face a difficult choice between finding a sponsor that doesn't exist, or abandoning their Rev5 investment and starting over with 20x.
If you qualify for Program Certification, it's a real opportunity. If you don't, your better move is almost certainly to begin preparing for FedRAMP 20x. (See What Is FedRAMP 20x? and How to Prepare for FedRAMP 20x in 2026.)
Who Should Pursue Rev5 Program Certification
Strong fit:
- CSPs who were FedRAMP Ready or In Process on the Marketplace between January 1, 2025 and March 1, 2026
- CSPs who completed a FedRAMP Ready RAR or a full Rev5 SAP/SAR during that window
- CSPs targeting Low or Moderate impact (Class B or C)
- CSPs willing and able to adopt the five required Balance Improvement Releases
Not a fit:
- CSPs just beginning their federal compliance journey in 2026
- CSPs targeting FedRAMP High (Class D) — traditional sponsor path still required
- CSPs unable to adopt the required Balance Improvement Releases
What to Do Next
The formal criteria, requirements, and application process for Rev5 Program Certification will be published as part of the FedRAMP Consolidated Rules for 2026 (CR26), expected by the end of June 2026. FedRAMP has asked stakeholders not to reach out about Program Certification details until those rules are published.
In the meantime, the most useful things a qualifying CSP can do are:
- Confirm your eligibility. Document exactly when your FedRAMP Ready, In Process, RAR, or SAP/SAR milestone occurred. If it falls between January 1, 2025 and March 1, 2026, you're a candidate for Stage 2.
- Begin adopting the required Balance Improvement Releases. Adoption isn't instantaneous — Minimum Assessment Scope, Collaborative Continuous Monitoring, and Vulnerability Detection and Response in particular require meaningful operational changes. Starting now means being ready when the Consolidated Rules drop.
- Understand your current Rev5 gaps honestly. Program Certification doesn't lower the bar on the underlying security controls — it just changes who reviews them. A clear, control-level picture of your current readiness is the best input to every decision you'll make in the next six months.
- Keep an eye on the June 2026 Consolidated Rules publication. That's when the formal application process opens.