fedramp

FedRAMP Certification Skill

Last verified: 2026-07-03

A comprehensive guide for helping users navigate FedRAMP authorization — from initial readiness through ATO and ongoing continuous monitoring.

Quick Reference: What Does the User Need?

Identify the user's goal and jump to the appropriate section:

User Goal	Go To
"Are we ready for FedRAMP?" / gap assessment	→ Readiness & Gap Assessment
Writing SSP, POA&M, SAR, SAP, or other docs	→ ATO Documentation
"Which controls apply to us?" / control mapping	→ NIST 800-53 Control Mapping
Cloud architecture / AWS/Azure/GCP config	→ Architecture Guidance
Already authorized, ongoing compliance	→ Continuous Monitoring

---

Current FedRAMP State (as of July 2026 — CR26)

⚠️ CR26 (FedRAMP Consolidated Rules for 2026): FedRAMP has restructured its authorization framework. FIPS 199-based baseline labels (Low/Moderate/High/LI-SaaS) are replaced with Certification Classes A–D (per notice NTC-0004; CR26 rules valid through December 31, 2028). Class labels change the names of the baselines, not their requirements. CSPs already authorized under the old labels retain their authorization through a transition period in which old and new labels are linked.

• Baseline: NIST SP 800-53 Rev 5 (fully in effect)
• Control counts (Rev 5): Low ≈ 156, Moderate = 323, High = 421 (legacy references; CR26 class-based counts being published by PMO)
• CR26 Certification Classes (official mapping, NTC-0004): A = new pilot/transitional baseline (entry via external frameworks such as SOC 2 Type II through Program Certification; holders have a 2-year window to obtain B/C/D), B = current LI-SaaS + Low baselines, C = current Moderate baseline (majority of federal deployments, incl. CUI), D = current High baseline.
• FedRAMP 20x: Now the primary authorization pathway — continuous authorization, modular API-driven submissions, automated evidence collection. Traditional SSP/SAP/SAR templates remain for legacy paths.
• FedRAMP Ready designation: Retires July 28, 2026. CSPs currently in FedRAMP Ready status must transition to FedRAMP 20x or initiate a full authorization package. No new FedRAMP Ready designations are being issued.
• JAB P-ATO: Fully suspended; FedRAMP PMO is the sole authorization body.
• OSCAL mandate: RFC-0024 requires all CSPs to submit machine-readable OSCAL packages by September 30, 2026.
• Security Inbox: All authorized CSPs must maintain a dedicated Security Inbox (no CAPTCHAs or barriers) for urgent vulnerability directives — effective January 5, 2026.
• Key templates updated: SSP, SAR, SAP, POA&M, CIS/CRM, IIW, ISCP — all updated to align with Rev 5 (Dec 2024 releases).

---

1. Readiness & Gap Assessment

Approach

1. Clarify scope — Ask the user: What is the CSO (Cloud Service Offering)? IaaS/PaaS/SaaS? Target Certification Class under CR26?
2. Identify authorization path — FedRAMP 20x (primary, preferred) vs. legacy Agency Authorization package (still available for complex systems during CR26 transition)
3. Run through the readiness checklist — See references/readiness-checklist.md
4. Surface gaps — Map current state to required controls; flag missing documentation, unimplemented controls, and architectural deficiencies
5. Prioritize — Group gaps by: (a) blockers for readiness review, (b) items addressable before 3PAO assessment, (c) POA&M candidates

FedRAMP Ready is retiring July 28, 2026. If a CSP is currently pursuing FedRAMP Ready, advise them to pivot immediately to FedRAMP 20x or begin a full authorization package.

Key Readiness Questions to Ask the User

• Are you targeting FedRAMP 20x (preferred) or a legacy authorization package?
• What cloud platform (AWS GovCloud, Azure Government, GCP, on-prem hybrid)?
• Are you leveraging any existing FedRAMP-authorized IaaS/PaaS (e.g., AWS GovCloud FedRAMP High)?
• Do you have FIPS 140-2/3 validated encryption in place?
• Is your authorization boundary defined and documented?
• Do you have a vulnerability scanning program (OS, DB, web app, container)?
• Are security policies and procedures documented?
• Do you have an Incident Response Plan (IRP) and Contingency Plan (CP) that have been tested?
• Are your authorization package artifacts in OSCAL format (mandatory by September 30, 2026)?

Output Format

• Produce a gap table: Control Family | Current State | Gap | Priority | Owner
• Summarize top 5–10 high-priority gaps as prose
• Note the target Certification Class and whether FedRAMP 20x is feasible

---

2. ATO Documentation

The core FedRAMP authorization package consists of:

Authorization Package
├── System Security Plan (SSP) + Appendices A–Q
├── Security Assessment Plan (SAP) + Appendices A–D  [3PAO-prepared]
├── Security Assessment Report (SAR) + Appendices A–F  [3PAO-prepared]
└── Plan of Action & Milestones (POA&M)  [SSP Appendix O]

Important: CSPs must use official FedRAMP PMO templates. OSCAL-format submissions are mandatory by September 30, 2026. Templates: https://www.fedramp.gov/documents-templates/

Document Guidance

For detailed guidance on each document type, read the appropriate reference file:

• SSP → references/ssp-guide.md
• POA&M → references/poam-guide.md
• SAP / SAR → references/sap-sar-guide.md
• Supporting appendices → references/appendices-guide.md

General Writing Principles for All ATO Docs

1. Describe only what is implemented — Do not document planned or aspirational controls; these trigger findings and must go in POA&M instead
2. Be specific — Reference exact tools, filenames, section numbers, policy names; vague language causes findings
3. Mind the verbs — Each control requirement uses specific verbs (track, document, enforce, test). Address each verb explicitly
4. Shared responsibility — For any customer-configurable or shared control, create a clear "Customer Responsibility" section
5. Keep it consistent — Architecture diagrams, data flows, inventory, and control statements must all be internally consistent

---

3. NIST 800-53 Control Mapping

Control Families (Rev 5)

ID	Family	Notes
AC	Access Control	IAM, RBAC, least privilege, remote access
AT	Awareness & Training	Security + privacy training (new in Rev 5)
AU	Audit & Accountability	Log retention, SIEM, audit review
CA	Assessment, Authorization & Monitoring	ConMon, 3PAO, ATO
CM	Configuration Management	Baselines, change control, CMDB
CP	Contingency Planning	BCP/DR, tested annually
IA	Identification & Authentication	MFA, PIV, FIPS 140-2/3 crypto
IR	Incident Response	IRP, tested annually, reporting SLAs
MA	Maintenance	Remote maintenance controls
MP	Media Protection	Data at rest, media sanitization
PE	Physical & Environmental	Datacenters; often inherited from IaaS
PL	Planning	SSP, rules of behavior
PM	Program Management	Enterprise-level security program
PS	Personnel Security	Screening, termination procedures
PT	PII Processing & Transparency	New family in Rev 5 — privacy controls
RA	Risk Assessment	Vulnerability scanning, MITRE ATT&CK scoring
SA	System & Services Acquisition	SDLC, supply chain
SC	System & Communications Protection	Encryption in transit, network segmentation
SI	System & Information Integrity	Patching, malware, integrity monitoring
SR	Supply Chain Risk Management	New family in Rev 5 — SCRM

CR26 Certification Class Mapping

Under CR26, the FedRAMP PMO is aligning control baselines to Certification Classes. When users describe their system, map to a class:

• Class A (Pilot/Transitional): New baseline introduced under 20x — entry into the federal market via external frameworks (initially SOC 2 Type II) through Program Certification; Class A holders have a 2-year window to obtain a Class B, C, or D certification through full assessment
• Class B (replaces LI-SaaS + Low): Systems handling non-sensitive federal information where a breach would cause limited harm
• Class C (replaces Moderate): Most common — the majority of federal cloud deployments, including systems handling CUI
• Class D (replaces High): Federal information where compromise has severe or catastrophic effect (e.g., law enforcement, financial, health data)

Legacy references: Many existing FedRAMP documents still reference Low/Moderate/High/LI-SaaS. These map to LI-SaaS/Low → Class B, Moderate → Class C, High → Class D (Class A is new — it has no legacy equivalent). During the CR26 transition, old and new labels are linked. Advise CSPs to check fedramp.gov for the latest.

Mapping Workflow

1. Ask: What types of federal data will the system process/store/transmit?
2. Determine target Certification Class (A, B, C, or D) under CR26
3. Select NIST 800-53 Rev 5 baseline using the class mapping (B ↔ Low, C ↔ Moderate, D ↔ High)
4. Cross-reference with FedRAMP parameter requirements (FedRAMP often sets stricter parameters than base NIST)
5. For inherited controls, identify which are fully/partially inherited from leveraged FedRAMP IaaS/PaaS and document in CIS/CRM workbook

Rev 4 → Rev 5 Key Changes to Highlight

• New control families: PT (Privacy), SR (Supply Chain)
• Password controls revised: No more forced rotation schedules; requires compromised-password lists and password strength meters (NIST 800-63b alignment)
• Privacy integrated: AT-3 now mandates privacy training; many families have privacy-specific enhancements
• Threat-based methodology: MITRE ATT&CK framework informs control prioritization

---

4. Architecture Guidance

Authorization Boundary

The boundary defines what is IN scope for FedRAMP. This is one of the most common sources of findings and delays.

Key principles:

• Everything that processes, stores, or transmits federal data must be inside the boundary
• External services connected to in-scope systems must be FedRAMP-authorized OR documented with compensating controls
• Boundary must be depicted in a clear network/data flow diagram (required in SSP)

Cloud Platform Considerations

AWS GovCloud (US)

• AWS GovCloud is FedRAMP High authorized — most PE and some SC controls are fully inherited
• Use AWS Config, CloudTrail, GuardDuty, Security Hub to satisfy AU, RA, SI controls
• Ensure use of GovCloud region endpoints (not standard commercial) to stay in boundary
• FIPS endpoints available for IA controls

Azure Government

• Azure Government is FedRAMP High authorized
• Azure Policy + Defender for Cloud maps well to CM, RA, SI
• Use Azure Blueprints / Policy Initiatives aligned to FedRAMP Moderate/High

Google Cloud (FedRAMP-authorized regions)

• Assured Workloads for FedRAMP compliance
• Chronicle SIEM for AU controls

Architecture Patterns That Support FedRAMP

• Zero Trust — aligns directly with AC, IA, SC control families
• Immutable infrastructure — simplifies CM (configuration drift is a common finding)
• Centralized logging — SIEM/log aggregation addresses AU family comprehensively
• Automated vulnerability scanning — Required; must cover OS, DB, web app, and containers (if used)
• OSCAL-native tooling — Invest now; OSCAL submission is mandatory September 30, 2026

Common Architecture Findings

• Undocumented external connections leaving the boundary
• FIPS-non-compliant encryption algorithms in transit or at rest
• Overly broad IAM roles / lack of least privilege
• Missing MFA on privileged accounts
• Vulnerability scans not covering all boundary components
• Logging gaps (not all components sending logs to centralized SIEM)
• Authorization packages not in OSCAL format ahead of September 2026 mandate

---

5. Continuous Monitoring

Once authorized, CSPs must maintain compliance through ConMon activities:

Monthly Requirements

• Vulnerability scan results submitted to agency AOs
• POA&M updates (open findings, remediation progress)
• Inventory updates (new/removed assets)
• ConMon Monthly Executive Summary (template updated Nov 2024)

Annual Requirements

• Full security assessment by 3PAO using Annual Assessment Controls Selection Worksheet
• Updated SSP and appendices
• Tested IRP and CP
• SAR and updated POA&M

POA&M Management

• All open findings must have: risk level, owner, milestone dates, remediation plan
• Vendor Dependencies (VDs): when a finding depends on a third-party fix — document and track
• Deviation Requests (DRs): false positives and risk adjustments require AO approval
• SLA for remediation (FedRAMP ConMon Performance Management Guide): High = 30 days, Moderate = 90 days, Low = 180 days from identification. Where Critical is distinguished from High (e.g., scanner ratings), treat it as High-or-stricter (≤30 days, prioritized immediately)

---

Output Formatting Guide

Match output format to request type:

Request Type	Preferred Format
Gap assessment	Table + prose summary
SSP control narrative	Prose paragraphs (one per control/enhancement)
POA&M entry	Structured table row with all required fields
Architecture review	Bullet findings + recommended remediations
Control mapping question	Table: Control ID | Requirement | How to Implement
Readiness overview	Executive summary prose + priority action list

When generating document content, always note: "Use official FedRAMP templates from fedramp.gov — this content should be inserted into the appropriate template section."

---

Reference Files

Load these when more depth is needed:

• references/readiness-checklist.md — Full readiness checklist (75+ items)
• references/ssp-guide.md — SSP section-by-section writing guide
• references/poam-guide.md — POA&M structure, field definitions, SLA table
• references/sap-sar-guide.md — SAP/SAR overview and review tips for CSPs
• references/appendices-guide.md — Guide to all SSP appendices (A–Q)
• references/control-families.md — Deep-dive on each of the 20 control families

---

This skill provides general compliance information, not legal advice. Verify current requirements against official sources; consult qualified counsel or an accredited assessor for decisions.