FedRAMP 20x Changelog
Changelog of the same sourced intelligence updates as /latest, oldest-to-newest in the machine feed and newest-first on the page. Not a git log of scm.cc.
Educational resource only. scm.cc is not a FedRAMP Recognized Independent Assessor (3PAO) and is not FedRAMP-authorized; it grants no authorization, certification, or assessment outcome. FedRAMP.gov is the authoritative source. This is not legal advice.
Technical detail
Identical INTELLIGENCE_UPDATES list as the Latest page. RSS and Atom serialize that list. No silent rewriting: a row that cannot be sourced is not published.
Updates
2026-10-11 · deadline · verified 2026-10-11
Official CR26 overall dates re-verified
- What happened:
- scm.cc re-read FedRAMP.gov Important Deadlines (Critical Overall Dates) on 2026-10-11.
- What changed:
- The published overall table still lists 2026-07-04 CR26 widespread effect, 2027-01-01 Rev5 new-app and 20x maintain cliffs, 2027-06-11 Rev5 application close, 2028-02-01 default grace end, and 2028-12-31 CR26 practice expiry. Per-ruleset obtain/maintain rows remain on FedRAMP.gov only.
- Who is affected:
- Cloud service providers on Rev5 and 20x tracks.
- What to do:
- Confirm every calendar date on FedRAMP.gov before using it in a plan. See the Deadline Center.
2026-09-27 · rule-change · verified 2026-09-27
CR26 Key Security Indicators pinned (46 indicators / 10 families)
- What happened:
- The official KSI reference was retrieved and pinned as the scm.cc catalog source.
- What changed:
- Ten families and 46 indicators (ids, names, statements, Class C markers, related SP 800-53 citations) are treated as official text. scm.cc family titles remain authored display labels.
- Who is affected:
- Teams implementing or assessing 20x KSIs, especially Class C.
- What to do:
- Read the KSI hub. Do not treat authored family titles as FedRAMP requirement text.
2026-06-25 · announcement · verified 2026-09-27
FedRAMP launches Consolidated Rules for 2026
- What happened:
- FedRAMP published the Consolidated Rules for 2026 (CR26) announcement.
- What changed:
- 20x practices (SDR, KSIs, CCM/OCR, VDR) are collected as consolidated rules rather than a Rev5-only control baseline.
- Who is affected:
- Providers pursuing or holding FedRAMP authorization on Rev5 or 20x.
- What to do:
- Read the CR26 announcement and the 20x overview. Map current evidence to KSIs and the SDR, not only 800-53 Rev5.
2026-06-24 · transition · verified 2026-09-27
Collaborative Continuous Monitoring / OCR reference
- What happened:
- FedRAMP published the Collaborative Continuous Monitoring reference (schema dated 2026-06-24).
- What changed:
- 20x continuous monitoring is a quarterly Ongoing Certification Report plus a Quarterly Review, not only a monthly Rev5 package.
- Who is affected:
- Authorized offerings moving to or already on 20x CCM.
- What to do:
- Keep Rev5 monthly packages until that path closes for the offering. Add the quarterly OCR without dropping ConMon.
Collaborative Continuous Monitoring (CCM / Ongoing Certification Report)
2026-06-24 · certification · verified 2026-09-27
Security Decision Record reference (replaces the SSP on the 20x path)
- What happened:
- FedRAMP published the 20x Security Decision Record reference (schema dated 2026-06-24).
- What changed:
- On the 20x path the SDR is the authorization narrative artifact in place of a classical SSP.
- Who is affected:
- 20x applicants and assessors assembling the authorization package.
- What to do:
- Use the SDR explainer and the pinned schema fields. Do not call an SSP export a 20x SDR.
Questions teams ask
- Does this changelog include scm.cc product releases?
- No. It is FedRAMP 20x source changes we have verified, not the product git log.
Related hub pages
Primary sources
- FedRAMP 20x overview & Core Principles (retrieved 2026-09-27)
- FedRAMP launches Consolidated Rules for 2026 (CR26) (retrieved 2026-09-27)
- Security Decision Record (replaces the SSP) (retrieved 2026-09-27)
- Collaborative Continuous Monitoring (CCM / Ongoing Certification Report) (retrieved 2026-09-27)
- FedRAMP 20x Key Security Indicators (CR26) (retrieved 2026-09-27)
- FedRAMP path & transition deadlines (retrieved 2026-10-11)
Last verified 2026-10-11. FedRAMP.gov is authoritative.