Independent by design
We explain the questions cloud providers and federal teams need to work through. We do not represent FedRAMP, GSA, an agency or any assessment body. The name FedRAMP identifies the subject of this publication; it does not imply endorsement.
How to use these guides
- Start with the guide that matches your role and decision.
- Follow its official sources and check applicability, scope and effective dates.
- Treat our preparation checklists as working aids, not complete compliance requirements.
- Use the official Marketplace for current listings. We do not maintain a copied assessor database.
Primary sources used
FedRAMP Consolidated Rules for 2026
The current program rule collection and its applicability.
FedRAMP, U.S. General Services Administration · Access checked 2026-11-04
FedRAMP scope and applicability
Which agency cloud use cases fall within the program.
FedRAMP, U.S. General Services Administration · Access checked 2026-11-04
Choosing a certification path
Available Program and Agency Certification routes.
FedRAMP, U.S. General Services Administration · Access checked 2026-11-04
Choosing a certification type
The distinction between 20x and Rev5.
FedRAMP, U.S. General Services Administration · Access checked 2026-11-04
Understanding certification classes
Why certification class and agency system impact are different decisions.
FedRAMP, U.S. General Services Administration · Access checked 2026-11-04
Minimum Assessment Scope
Official scope rules for an assessment boundary.
FedRAMP, U.S. General Services Administration · Access checked 2026-11-04
Using a 20x certification package
The information provided by a 20x package.
FedRAMP, U.S. General Services Administration · Access checked 2026-11-04
Using a Rev5 certification package
The information provided by a Rev5 package.
FedRAMP, U.S. General Services Administration · Access checked 2026-11-04
Using FedRAMP as a federal agency
Agency use of provider assurance and agency-specific decisions.
FedRAMP, U.S. General Services Administration · Access checked 2026-11-04
Assessor Marketplace listing rules
Recognition and listing requirements for independent assessors.
FedRAMP, U.S. General Services Administration · Access checked 2026-11-04
Official FedRAMP Marketplace
Current cloud service and assessor listings.
FedRAMP, U.S. General Services Administration · Access checked 2026-11-04
Important dates for the 2026 rules
Program transition milestones; not a substitute for rule-specific dates.
FedRAMP, U.S. General Services Administration · Access checked 2026-11-04
20x provider update deadlines
Type-specific transition dates and applicability.
FedRAMP, U.S. General Services Administration · Access checked 2026-11-04
Rev5 provider update deadlines
Type-specific transition dates and applicability.
FedRAMP, U.S. General Services Administration · Access checked 2026-11-04
Consolidated Rules changelog
Changes to the rules and deadlines after initial publication.
FedRAMP, U.S. General Services Administration · Access checked 2026-11-04
Agency POA&M guidance
Agency-owned actions and risk records during ongoing use.
FedRAMP, U.S. General Services Administration · Access checked 2026-11-04
DFARS 252.204-7012
Contract-specific treatment of covered defense information and external cloud services.
U.S. Department of Defense / Acquisition.gov · Access checked 2026-11-04
ISO/IEC 27001 overview
The scope and purpose of an information security management system.
International Organization for Standardization · Access checked 2026-11-04
NIST Risk Management Framework
The distinct system-lifecycle decisions in risk management.
National Institute of Standards and Technology · Access checked 2026-11-04
AICPA SOC 2 description criteria
Service-organization description criteria for SOC 2 reporting.
AICPA & CIMA · Access checked 2026-11-04
AICPA SOC 1 overview
The financial-reporting assurance purpose of SOC 1.
AICPA & CIMA · Access checked 2026-11-04
OMB memorandum M-24-15: FedRAMP policy
The program purpose and benefit of reusable cloud assurance.
U.S. Office of Management and Budget · Access checked 2026-11-04