The FedRAMP Certification Process
The 20x process is the journey on the Get Certified hub: class, path, KSIs, SDR, evidence, independent assessment where required, then a government certification decision. This page does not replace FedRAMP.gov procedures.
Educational resource only. scm.cc is not a FedRAMP Recognized Independent Assessor (3PAO) and is not FedRAMP-authorized; it grants no authorization, certification, or assessment outcome. FedRAMP.gov is the authoritative source. This is not legal advice.
Technical detail
Reuse CERTIFICATION_JOURNEY_STAGES. scm.cc does not submit packages or perform assessments.
Related product: Evidence QA (check collected evidence before you engage a Recognized Independent Assessor). Canonical page https://scm.cc/evidence-qa. scm.cc is not an assessor and grants no authorization.
Certification journey
- Determine applicability
Confirm the offering is a cloud service seeking federal use and which FedRAMP path (20x vs Rev5) applies. FedRAMP.gov is the rule.
- Determine certification class
Classes A–D are defined on FedRAMP.gov. Class D stays proposal-stage here until a registered definition exists.
- Choose a path
20x vs Rev5 during transition. Dual cadence is common; do not drop monthly ConMon because an OCR exists.
- Define the offering boundary
The authorization boundary belongs in the SDR, not in a slide. Confirm inheritance vs customer responsibility.
- Implement requirements
Map CR26 practices and KSIs onto the offering. Quote official KSI statements; do not paraphrase them as weaker text.
- Implement KSIs
Ten families, 46 indicators in the pinned CR26 catalog. Class C markers live on the indicator pages.
- Establish the Security Decision Record
On the 20x path the SDR replaces a classical SSP. Use the pinned 2026-06-24 schema fields.
- Persistent validation
CCM quarterly OCR plus, where still required, Rev5 monthly ConMon. Cadences are sourced, not estimated.
- Gather evidence
Strong vs weak evidence is described on the evidence page. Missing stays missing — never a fabricated green.
- Find a Recognized Independent Assessor (where required)
Use official FedRAMP registries. scm.cc is not an assessor and does not rank or endorse 3PAOs.
- Independent assessment
An independent assessment is performed by a Recognized Independent Assessor, not by this site.
- Resolve findings
VDR/VER and POA&M handle unevaluated vs dated findings. An unevaluated finding has no invented deadline.
- Submit the package
Follow FedRAMP.gov submission instructions. scm.cc can help assemble working artifacts; it does not submit or sponsor a package.
- Certification decision
FedRAMP Certification is a government decision. It does not replace an agency ATO. scm.cc grants neither.
- Marketplace listing
Official listings live at marketplace.fedramp.gov. This hub is not the Marketplace.
- Ongoing certification
Stay on published CCM/Rev5 cadences and CR26 dates. See deadlines and stay-certified.
Questions teams ask
- Is this the official FedRAMP process document?
- No. It restates the hub journey with citations. Follow FedRAMP.gov for submission steps.
Related hub pages
Primary sources
- FedRAMP 20x overview & Core Principles (retrieved 2026-09-27)
- FedRAMP Certification reference (classes, KSI metrics window) (retrieved 2026-09-27)
- FedRAMP launches Consolidated Rules for 2026 (CR26) (retrieved 2026-09-27)
- Security Decision Record (replaces the SSP) (retrieved 2026-09-27)
- Collaborative Continuous Monitoring (CCM / Ongoing Certification Report) (retrieved 2026-09-27)
- FedRAMP 20x Key Security Indicators (CR26) (retrieved 2026-09-27)
- FedRAMP Marketplace (authoritative listings) (retrieved 2026-09-27)
Last verified 2026-09-27. FedRAMP.gov is authoritative.