Fedramp

FedRAMP Certification Skill

> Last verified: 2026-07-03

A comprehensive guide for helping users navigate FedRAMP authorization — from initial

readiness through ATO and ongoing continuous monitoring.

Quick Reference: What Does the User Need?

Identify the user's goal and jump to the appropriate section:

| User Goal | Go To |

|---|---|

| "Are we ready for FedRAMP?" / gap assessment | → Readiness & Gap Assessment |

| Writing SSP, POA&M, SAR, SAP, or other docs | → ATO Documentation |

| "Which controls apply to us?" / control mapping | → NIST 800-53 Control Mapping |

| Cloud architecture / AWS/Azure/GCP config | → Architecture Guidance |

| Already authorized, ongoing compliance | → Continuous Monitoring |

Current FedRAMP State (as of July 2026 — CR26)

> ⚠️ CR26 (FedRAMP Consolidated Rules for 2026): FedRAMP has restructured its authorization framework. FIPS 199-based baseline labels (Low/Moderate/High/LI-SaaS) are replaced with Certification Classes A–D (per notice NTC-0004; CR26 rules valid through December 31, 2028). Class labels change the *names* of the baselines, not their requirements. CSPs already authorized under the old labels retain their authorization through a transition period in which old and new labels are linked.

• Baseline: NIST SP 800-53 Rev 5 (fully in effect)
• Control counts (Rev 5): Low ≈ 156, Moderate = 323, High = 421 (legacy references; CR26 class-based counts being published by PMO)
• CR26 Certification Classes (official mapping, NTC-0004): A = new pilot/transitional baseline (entry via external frameworks such as SOC 2 Type II through Program Certification; holders have a 2-year window to obtain B/C/D), B = current LI-SaaS + Low baselines, C = current Moderate baseline (majority of federal deployments, incl. CUI), D = current High baseline.
• FedRAMP 20x: Now the primary authorization pathway — continuous authorization, modular API-driven submissions, automated evidence collection. Traditional SSP/SAP/SAR templates remain for legacy paths.
• FedRAMP Ready designation: Retires July 28, 2026. CSPs currently in FedRAMP Ready status must transition to FedRAMP 20x or initiate a full authorization package. No new FedRAMP Ready designations are being issued.
• JAB P-ATO: Fully suspended; FedRAMP PMO is the sole authorization body.
• OSCAL mandate: RFC-0024 requires all CSPs to submit machine-readable OSCAL packages by September 30, 2026.
• Security Inbox: All authorized CSPs must maintain a dedicated Security Inbox (no CAPTCHAs or barriers) for urgent vulnerability directives — effective January 5, 2026.
• Key templates updated: SSP, SAR, SAP, POA&M, CIS/CRM, IIW, ISCP — all updated to align with Rev 5 (Dec 2024 releases).

1. Readiness & Gap Assessment

Approach

• Clarify scope — Ask the user: What is the CSO (Cloud Service Offering)? IaaS/PaaS/SaaS? Target Certification Class under CR26?
• Identify authorization path — FedRAMP 20x (primary, preferred) vs. legacy Agency Authorization package (still available for complex systems during CR26 transition)
• Run through the readiness checklist — See references/readiness-checklist.md
• Surface gaps — Map current state to required controls; flag missing documentation, unimplemented controls, and architectural deficiencies
• Prioritize — Group gaps by: (a) blockers for readiness review, (b) items addressable before 3PAO assessment, (c) POA&M candidates

> FedRAMP Ready is retiring July 28, 2026. If a CSP is currently pursuing FedRAMP Ready, advise them to pivot immediately to FedRAMP 20x or begin a full authorization package.

Key Readiness Questions to Ask the User

• Are you targeting FedRAMP 20x (preferred) or a legacy authorization package?
• What cloud platform (AWS GovCloud, Azure Government, GCP, on-prem hybrid)?
• Are you leveraging any existing FedRAMP-authorized IaaS/PaaS (e.g., AWS GovCloud FedRAMP High)?
• Do you have FIPS 140-2/3 validated encryption in place?
• Is your authorization boundary defined and documented?
• Do you have a vulnerability scanning program (OS, DB, web app, container)?
• Are security policies and procedures documented?
• Do you have an Incident Response Plan (IRP) and Contingency Plan (CP) that have been tested?
• Are your authorization package artifacts in OSCAL format (mandatory by September 30, 2026)?

Output Format

• Produce a gap table: Control Family | Current State | Gap | Priority | Owner
• Summarize top 5–10 high-priority gaps as prose
• Note the target Certification Class and whether FedRAMP 20x is feasible

2. ATO Documentation

The core FedRAMP authorization package consists of:

Authorization Package
├── System Security Plan (SSP) + Appendices A–Q
├── Security Assessment Plan (SAP) + Appendices A–D  [3PAO-prepared]
├── Security Assessment Report (SAR) + Appendices A–F  [3PAO-prepared]
└── Plan of Action & Milestones (POA&M)  [SSP Appendix O]

> Important: CSPs must use official FedRAMP PMO templates. OSCAL-format submissions are mandatory by September 30, 2026.

> Templates: https://www.fedramp.gov/documents-templates/

Document Guidance

For detailed guidance on each document type, read the appropriate reference file:

• SSP → references/ssp-guide.md
• POA&M → references/poam-guide.md
• SAP / SAR → references/sap-sar-guide.md
• Supporting appendices → references/appendices-guide.md

General Writing Principles for All ATO Docs

• Describe only what is implemented — Do not document planned or aspirational controls; these trigger findings and must go in POA&M instead
• Be specific — Reference exact tools, filenames, section numbers, policy names; vague language causes findings
• Mind the verbs — Each control requirement uses specific verbs (track, document, enforce, test). Address each verb explicitly
• Shared responsibility — For any customer-configurable or shared control, create a clear "Customer Responsibility" section
• Keep it consistent — Architecture diagrams, data flows, inventory, and control statements must all be internally consistent

3. NIST 800-53 Control Mapping

Control Families (Rev 5)

| ID | Family | Notes |

|---|---|---|

| AC | Access Control | IAM, RBAC, least privilege, remote access |

| AT | Awareness & Training | Security + privacy training (new in Rev 5) |

| AU | Audit & Accountability | Log retention, SIEM, audit review |

| CA | Assessment, Authorization & Monitoring | ConMon, 3PAO, ATO |

| CM | Configuration Management | Baselines, change control, CMDB |

| CP | Contingency Planning | BCP/DR, tested annually |

| IA | Identification & Authentication | MFA, PIV, FIPS 140-2/3 crypto |

| IR | Incident Response | IRP, tested annually, reporting SLAs |

| MA | Maintenance | Remote maintenance controls |

| MP | Media Protection | Data at rest, media sanitization |

| PE | Physical & Environmental | Datacenters; often inherited from IaaS |

| PL | Planning | SSP, rules of behavior |

| PM | Program Management | Enterprise-level security program |

| PS | Personnel Security | Screening, termination procedures |

| PT | PII Processing & Transparency | New family in Rev 5 — privacy controls |

| RA | Risk Assessment | Vulnerability scanning, MITRE ATT&CK scoring |

| SA | System & Services Acquisition | SDLC, supply chain |

| SC | System & Communications Protection | Encryption in transit, network segmentation |

| SI | System & Information Integrity | Patching, malware, integrity monitoring |

| SR | Supply Chain Risk Management | New family in Rev 5 — SCRM |

CR26 Certification Class Mapping

Under CR26, the FedRAMP PMO is aligning control baselines to Certification Classes. When users describe their system, map to a class:

• Class A (Pilot/Transitional): New baseline introduced under 20x — entry into the federal market via external frameworks (initially SOC 2 Type II) through Program Certification; Class A holders have a 2-year window to obtain a Class B, C, or D certification through full assessment
• Class B (replaces LI-SaaS + Low): Systems handling non-sensitive federal information where a breach would cause limited harm
• Class C (replaces Moderate): Most common — the majority of federal cloud deployments, including systems handling CUI
• Class D (replaces High): Federal information where compromise has severe or catastrophic effect (e.g., law enforcement, financial, health data)

> Legacy references: Many existing FedRAMP documents still reference Low/Moderate/High/LI-SaaS. These map to LI-SaaS/Low → Class B, Moderate → Class C, High → Class D (Class A is new — it has no legacy equivalent). During the CR26 transition, old and new labels are linked. Advise CSPs to check fedramp.gov for the latest.

Mapping Workflow

• Ask: What types of federal data will the system process/store/transmit?
• Determine target Certification Class (A, B, C, or D) under CR26
• Select NIST 800-53 Rev 5 baseline using the class mapping (B ↔ Low, C ↔ Moderate, D ↔ High)
• Cross-reference with FedRAMP parameter requirements (FedRAMP often sets stricter parameters than base NIST)
• For inherited controls, identify which are fully/partially inherited from leveraged FedRAMP IaaS/PaaS and document in CIS/CRM workbook

Rev 4 → Rev 5 Key Changes to Highlight

• New control families: PT (Privacy), SR (Supply Chain)
• Password controls revised: No more forced rotation schedules; requires compromised-password lists and password strength meters (NIST 800-63b alignment)
• Privacy integrated: AT-3 now mandates privacy training; many families have privacy-specific enhancements
• Threat-based methodology: MITRE ATT&CK framework informs control prioritization

4. Architecture Guidance

Authorization Boundary

The boundary defines what is IN scope for FedRAMP. This is one of the most common sources of findings and delays.

Key principles:

• Everything that processes, stores, or transmits federal data must be inside the boundary
• External services connected to in-scope systems must be FedRAMP-authorized OR documented with compensating controls
• Boundary must be depicted in a clear network/data flow diagram (required in SSP)

Cloud Platform Considerations

AWS GovCloud (US)

• AWS GovCloud is FedRAMP High authorized — most PE and some SC controls are fully inherited
• Use AWS Config, CloudTrail, GuardDuty, Security Hub to satisfy AU, RA, SI controls
• Ensure use of GovCloud region endpoints (not standard commercial) to stay in boundary
• FIPS endpoints available for IA controls

Azure Government

• Azure Government is FedRAMP High authorized
• Azure Policy + Defender for Cloud maps well to CM, RA, SI
• Use Azure Blueprints / Policy Initiatives aligned to FedRAMP Moderate/High

Google Cloud (FedRAMP-authorized regions)

• Assured Workloads for FedRAMP compliance
• Chronicle SIEM for AU controls

Architecture Patterns That Support FedRAMP

• Zero Trust — aligns directly with AC, IA, SC control families
• Immutable infrastructure — simplifies CM (configuration drift is a common finding)
• Centralized logging — SIEM/log aggregation addresses AU family comprehensively
• Automated vulnerability scanning — Required; must cover OS, DB, web app, and containers (if used)
• OSCAL-native tooling — Invest now; OSCAL submission is mandatory September 30, 2026

Common Architecture Findings

• Undocumented external connections leaving the boundary
• FIPS-non-compliant encryption algorithms in transit or at rest
• Overly broad IAM roles / lack of least privilege
• Missing MFA on privileged accounts
• Vulnerability scans not covering all boundary components
• Logging gaps (not all components sending logs to centralized SIEM)
• Authorization packages not in OSCAL format ahead of September 2026 mandate

5. Continuous Monitoring

Once authorized, CSPs must maintain compliance through ConMon activities:

Monthly Requirements

• Vulnerability scan results submitted to agency AOs
• POA&M updates (open findings, remediation progress)
• Inventory updates (new/removed assets)
• ConMon Monthly Executive Summary (template updated Nov 2024)

Annual Requirements

• Full security assessment by 3PAO using Annual Assessment Controls Selection Worksheet
• Updated SSP and appendices
• Tested IRP and CP
• SAR and updated POA&M

POA&M Management

• All open findings must have: risk level, owner, milestone dates, remediation plan
• Vendor Dependencies (VDs): when a finding depends on a third-party fix — document and track
• Deviation Requests (DRs): false positives and risk adjustments require AO approval
• SLA for remediation (FedRAMP ConMon Performance Management Guide): High = 30 days, Moderate = 90 days, Low = 180 days from identification. Where Critical is distinguished from High (e.g., scanner ratings), treat it as High-or-stricter (≤30 days, prioritized immediately)

Output Formatting Guide

Match output format to request type:

| Request Type | Preferred Format |

|---|---|

| Gap assessment | Table + prose summary |

| SSP control narrative | Prose paragraphs (one per control/enhancement) |

| POA&M entry | Structured table row with all required fields |

| Architecture review | Bullet findings + recommended remediations |

| Control mapping question | Table: Control ID \| Requirement \| How to Implement |

| Readiness overview | Executive summary prose + priority action list |

When generating document content, always note: *"Use official FedRAMP templates from fedramp.gov — this content should be inserted into the appropriate template section."*

Reference Files

Load these when more depth is needed:

• references/readiness-checklist.md — Full readiness checklist (75+ items)
• references/ssp-guide.md — SSP section-by-section writing guide
• references/poam-guide.md — POA&M structure, field definitions, SLA table
• references/sap-sar-guide.md — SAP/SAR overview and review tips for CSPs
• references/appendices-guide.md — Guide to all SSP appendices (A–Q)
• references/control-families.md — Deep-dive on each of the 20 control families

> *This skill provides general compliance information, not legal advice. Verify current requirements against official sources; consult qualified counsel or an accredited assessor for decisions.*