FedRAMP Deadline Center
Critical overall dates from FedRAMP.gov for Rev5 and 20x under the Consolidated Rules for 2026. Each row below is copied from the official Important Deadlines page. Per-ruleset optional/obtain/maintain dates are not listed until that machine-readable source is pinned.
Educational resource only. scm.cc is not a FedRAMP Recognized Independent Assessor (3PAO) and is not FedRAMP-authorized; it grants no authorization, certification, or assessment outcome. FedRAMP.gov is the authoritative source. This is not legal advice.
Technical detail
The Deadline Center is a typed fact list (date, audience, path, what changes, recommended actions, official URL, retrieval date, last-verified). It is not a calendar of scm.cc estimates. The official page also defines Optional Adoption, Obtain, Maintain, and Grace Ends for each ruleset; those rows are absent here on purpose.
How to implement
Sort by date. Filter by path (20x, Rev5, overall). Confirm every date on FedRAMP.gov before using it in a plan. The Deadline Tracker tool (#555) should consume this same list, not a second hardcoded table.
Common mistakes
- Copying a date from a vendor blog instead of FedRAMP.gov. - Treating a Maintain date as if it had an invented extension. - Assuming every ruleset shares the default 2028-02-01 grace end.
Critical overall dates
Copied from FedRAMP.gov. Filter and sort stay on this table; they do not change FedRAMP's calendar.
| Date | Milestone | Path | Last verified |
|---|---|---|---|
| 2026-07-04 | New FedRAMP 20x applications must follow CR26 FedRAMP.gov: For FedRAMP 20x, all new applications for FedRAMP Certification MUST follow all applicable Consolidated Rules for 2026. What changes: New 20x certification applications are expected to follow applicable CR26 rules. Recommended: If applying on the 20x path after this date, confirm the current CR26 text on FedRAMP.gov before submitting. | 20x | 2026-10-11 |
| 2026-07-04 | Consolidated Rules for 2026 in effect for widespread adoption FedRAMP.gov: The Consolidated Rules for 2026 are in effect for widespread adoption. Providers are expected to begin adjusting to these rules as quickly as possible. What changes: CR26 is in effect for widespread adoption across Rev5 and 20x tracks. Recommended: Read the official deadlines page and the applicable CR26 rulesets. Begin adjusting procedures; do not treat a blog calendar as the source of truth. | overall | 2026-10-11 |
| 2027-01-01 | Active 20x offerings must follow CR26 (or corrective action) FedRAMP.gov: For FedRAMP 20x, all active FedRAMP Certified cloud service offerings MUST follow all applicable Consolidated Rules for 2026 or corrective action will be requested by FedRAMP. What changes: Maintain-phase: active 20x certified offerings are expected to follow applicable CR26 rules, or FedRAMP may request corrective action. Recommended: Map current evidence to CR26. Do not assume a grace period extends this date — read the official grace-end language on the same page. | 20x | 2026-10-11 |
| 2027-01-01 | New FedRAMP Rev5 applications must follow CR26 FedRAMP.gov: For FedRAMP Rev5, all new applications for FedRAMP Certification MUST follow all applicable Consolidated Rules for 2026. What changes: New Rev5 applications are expected to follow applicable CR26 rules. Recommended: Rev5 applicants should confirm CR26 applicability on FedRAMP.gov. Dual-running 20x OCR plus Rev5 ConMon is a transition pattern, not a substitute for this date. | rev5 | 2026-10-11 |
| 2027-06-11 | No new applications for FedRAMP Rev5 Certification FedRAMP.gov: No new applications for FedRAMP Rev5 Certification will be accepted. What changes: The Rev5 application window closes for new certifications on this date. Recommended: Teams still planning a first Rev5 package should confirm remaining options on FedRAMP.gov. scm.cc does not invent an alternate close date. | rev5 | 2026-10-11 |
| 2028-02-01 | Default CR26 grace periods expire FedRAMP.gov: All grace periods for the Consolidated Rules for 2026 expire and all cloud service offerings that are not fully following the Consolidated Rules for 2026 will lose their FedRAMP Certification. What changes: The default grace period is described as a hard deadline. Some other grace periods coincide with the next completed independent assessment — confirm which wording applies to each ruleset on FedRAMP.gov. Recommended: Treat this as the published default grace-end. Per-ruleset grace language can differ; load those dates from the official ruleset source when it is pinned. | overall | 2026-10-11 |
| 2028-12-31 | CR26 practices expire no later than this date FedRAMP.gov: All FedRAMP Practices outlined in the FedRAMP Consolidated Rules for 2026 will expire no later than December 31, 2028. Providers will need to update to future Consolidated Rules releases before this deadline. What changes: CR26 practices are time-bounded. Later Consolidated Rules releases are expected to supersede them. Recommended: Watch FedRAMP.gov for 2027/2028 rules releases. Do not treat CR26 as permanently frozen. | overall | 2026-10-11 |
Questions teams ask
- Are these dates official?
- They are copied from FedRAMP.gov Important Deadlines, last retrieved 2026-10-11. FedRAMP.gov remains authoritative if the page changes.
- Why is my ruleset’s Maintain date missing?
- Per-ruleset Optional / Obtain / Maintain / Grace Ends rows live in the Consolidated Rules machine-readable source. This Center only publishes the Critical Overall Dates table until that dump is pinned.
- Does scm.cc extend a missed deadline?
- No. FedRAMP.gov states there will be no extensions past the ending of the default grace period. scm.cc cannot grant, delay, or waive a date.
Related hub pages
Primary sources
- FedRAMP path & transition deadlines (Important Deadlines) (retrieved 2026-10-11)
- FedRAMP 20x overview & Core Principles (retrieved 2026-09-27)
Last verified 2026-10-11. FedRAMP.gov is authoritative.