How to Get FedRAMP Certified
An educational map of the FedRAMP 20x certification journey. Each stage links to deeper hub pages (some still in progress). scm.cc is not a Recognized Independent Assessor and grants no certification, ATO, or Marketplace listing. FedRAMP.gov is authoritative.
Educational resource only. scm.cc is not a FedRAMP Recognized Independent Assessor (3PAO) and is not FedRAMP-authorized; it grants no authorization, certification, or assessment outcome. FedRAMP.gov is the authoritative source. This is not legal advice.
Technical detail
Stages are a typed list (id, title, summary, href). Hrefs are IA routes so stubs resolve. This page does not score readiness and does not replace the certification process page, checklist, or tools.
How to implement
Walk the ordered stages. Confirm class and path on FedRAMP.gov. Use the KSI hub and SDR explainer for implementation. Engage a Recognized Independent Assessor from official registries when the path requires one.
Common mistakes
- Treating this map as a FedRAMP authorization procedure. - Skipping class selection and copying a Class C KSI set onto every offering. - Calling scm.cc or an advisor an assessor.
Related product: Evidence QA (check collected evidence before you engage a Recognized Independent Assessor). Canonical page https://scm.cc/evidence-qa. scm.cc is not an assessor and grants no authorization.
Certification journey
- Determine applicability
Confirm the offering is a cloud service seeking federal use and which FedRAMP path (20x vs Rev5) applies. FedRAMP.gov is the rule.
- Determine certification class
Classes A–D are defined on FedRAMP.gov. Class D stays proposal-stage here until a registered definition exists.
- Choose a path
20x vs Rev5 during transition. Dual cadence is common; do not drop monthly ConMon because an OCR exists.
- Define the offering boundary
The authorization boundary belongs in the SDR, not in a slide. Confirm inheritance vs customer responsibility.
- Implement requirements
Map CR26 practices and KSIs onto the offering. Quote official KSI statements; do not paraphrase them as weaker text.
- Implement KSIs
Ten families, 46 indicators in the pinned CR26 catalog. Class C markers live on the indicator pages.
- Establish the Security Decision Record
On the 20x path the SDR replaces a classical SSP. Use the pinned 2026-06-24 schema fields.
- Persistent validation
CCM quarterly OCR plus, where still required, Rev5 monthly ConMon. Cadences are sourced, not estimated.
- Gather evidence
Strong vs weak evidence is described on the evidence page. Missing stays missing — never a fabricated green.
- Find a Recognized Independent Assessor (where required)
Use official FedRAMP registries. scm.cc is not an assessor and does not rank or endorse 3PAOs.
- Independent assessment
An independent assessment is performed by a Recognized Independent Assessor, not by this site.
- Resolve findings
VDR/VER and POA&M handle unevaluated vs dated findings. An unevaluated finding has no invented deadline.
- Submit the package
Follow FedRAMP.gov submission instructions. scm.cc can help assemble working artifacts; it does not submit or sponsor a package.
- Certification decision
FedRAMP Certification is a government decision. It does not replace an agency ATO. scm.cc grants neither.
- Marketplace listing
Official listings live at marketplace.fedramp.gov. This hub is not the Marketplace.
- Ongoing certification
Stay on published CCM/Rev5 cadences and CR26 dates. See deadlines and stay-certified.
Questions teams ask
- Does following this journey certify my product?
- No. FedRAMP Certification is a government decision after an independent assessment where required. This page is a map.
- Why do some stage links say the guide is in progress?
- Those IA routes are stubs so links never 404. Built pages replace stubs as their stories ship.
Assessor skills training
Self-serve scm.cc courses with labs on labeled test data, quizzes, an exam, and a shareable scm.cc training certificate. First fundamentals lesson is free. $299 per course; $799 full track.
This is scm.cc skills training. Completing a course or receiving an scm.cc training certificate does not make you a FedRAMP Recognized Independent Assessor, is not a FedRAMP credential, and is not government recognition. Official recognition requires A2LA accreditation (REC-IAS-ACC) and FedRAMP Recognition. FedRAMP.gov is the authoritative source. This is not legal advice.
Open the training catalogOfficial Recognition pathFramework quizConMon product pricing
Related hub pages
Primary sources
- FedRAMP 20x overview & Core Principles (retrieved 2026-09-27)
- FedRAMP Certification reference (classes, KSI metrics window) (retrieved 2026-09-27)
- FedRAMP launches Consolidated Rules for 2026 (CR26) (retrieved 2026-09-27)
- Security Decision Record (replaces the SSP) (retrieved 2026-09-27)
- Collaborative Continuous Monitoring (CCM / Ongoing Certification Report) (retrieved 2026-09-27)
- FedRAMP 20x Key Security Indicators (CR26) (retrieved 2026-09-27)
- FedRAMP Marketplace (authoritative listings) (retrieved 2026-09-27)
Last verified 2026-09-27. FedRAMP.gov is authoritative.