The Consolidated Rules for 2026 are FedRAMP's single, current set of requirements for getting and keeping FedRAMP certification. They replace long narrative documents with short, numbered rules.
How they are organized
Rules are grouped into rulesets by topic, then into subsets by task or role. Each rule has a stable ID in the form SET-SUBSET-KEY, such as VDR-RPT-VDT. Each rule's force follows familiar wording:
- MUST / MUST NOT: absolute requirements. Missing one can lead to corrective action or denial of certification.
- SHOULD / SHOULD NOT: exceptions may be valid, but the provider must explain its approach.
- MAY: optional, though decisions should still be explained.
The website is a readable reference. The machine-readable JSON rules on FedRAMP's GitHub are the source of truth.
Key dates
- July 4, 2026: The rules take effect for any offering seeking or maintaining certification.
- August 3, 2026: The 20x Class A pipeline opens. Class B and C pipelines open August 31, 2026.
- January 1, 2027: Enforcement begins, and current Rev5 certifications must adopt the rules.
- June 11, 2027: FedRAMP stops accepting new Rev5 certifications.
- December 31, 2028: Existing Rev5 certifications stay active until at least this date, unless FedRAMP directs otherwise.
What's changing
The rules bring new terms. "Authorization" becomes Certification, impact levels become Classes A to D, and continuous monitoring becomes Ongoing Certification. Word and Excel templates give way to JSON documents, and the list of planned fixes (POA&Ms) is replaced by a list of Accepted Weaknesses.
Sources
Related Articles
- What is FedRAMP 20X, and how is it different from Rev5?
- Does my SaaS company need FedRAMP to sell to federal agencies?
- What are FedRAMP 20X Classes A, B, C and D?
- Which FedRAMP 20X class does my product need?
- What are Key Security Indicators (KSIs) in FedRAMP 20X?
- What does continuous validation mean in FedRAMP 20X?
- What's the difference between FedRAMP and SOC 2?
- Does our SOC 2 or ISO 27001 work count toward FedRAMP?
- Do I need an agency sponsor for FedRAMP 20X?