FedRAMP 20x Glossary
A–Z terms used on this hub: 20x, CR26, KSIs, SDR, CCM, OCR, VDR/VER, classes A–D, ATO, Recognized Independent Assessor, 3PAO, advisor, Rev5, Marketplace. Each definition cites a registered official source. Missing terms (for example unpublished Class D rules) stay missing.
Educational resource only. scm.cc is not a FedRAMP Recognized Independent Assessor (3PAO) and is not FedRAMP-authorized; it grants no authorization, certification, or assessment outcome. FedRAMP.gov is the authoritative source. This is not legal advice.
Technical detail
Terms are a typed list (id, definition, official URL, last-verified, related term ids, related page slugs). Served as /api/fedramp-20x/glossary and DefinedTermSet JSON-LD. Related pages include planned stubs so links resolve.
A–Z
- 3PAO (older term)
Third-Party Assessment Organization — an older label for independent FedRAMP assessors. Current 20x language uses Recognized Independent Assessor. scm.cc is neither.
Source: FedRAMP 20x overview & Core Principles (verified 2026-09-27)
Related: ria
- Authorization to Operate (ATO)
An agency decision that a system may operate. FedRAMP Certification does not replace an agency ATO. scm.cc grants neither.
Source: FedRAMP 20x overview & Core Principles (verified 2026-09-27)
Related: fedramp-20xria
- Certification Class A
A FedRAMP 20x certification class. In the pinned CR26 catalog, KSI applicability for Class A is unmarked. Confirm current class wording on FedRAMP.gov.
Source: FedRAMP Certification reference (classes, KSI metrics window) (verified 2026-09-27)
- Certification Class B
A FedRAMP 20x certification class described in the FedRAMP Certification reference. Confirm current pairing and KSI markers on FedRAMP.gov.
Source: FedRAMP Certification reference (classes, KSI metrics window) (verified 2026-09-27)
- Certification Class C
A FedRAMP 20x certification class. The CR26 KSI catalog marks selected indicators for Class C. Class C also has a published KSI metrics window and VDR machine-resource cadence on FedRAMP.gov.
Source: FedRAMP Certification reference (classes, KSI metrics window) (verified 2026-09-27)
- Certification Class D
A FedRAMP 20x class label. This glossary does not invent Class D requirements; the class is treated as proposal-stage until FedRAMP.gov publishes a registered definition.
Source: FedRAMP Certification reference (classes, KSI metrics window) (verified 2026-09-27)
Related: class-c
- Collaborative Continuous Monitoring (CCM)
The 20x continuous-monitoring model. It is not the same as the Rev5 monthly ConMon package. CCM uses a quarterly Ongoing Certification Report plus a Quarterly Review.
Source: Collaborative Continuous Monitoring (CCM / Ongoing Certification Report) (verified 2026-09-27)
- Consolidated Rules for 2026 (CR26)
FedRAMP's 2026 consolidated ruleset that launched 20x practices (SDR, KSIs, CCM/OCR, VDR) alongside Rev5 transition dates. Confirm current text on FedRAMP.gov.
Source: FedRAMP launches Consolidated Rules for 2026 (CR26) (verified 2026-09-27)
Related: fedramp-20xrev5
- FedRAMP 20x
The U.S. government's modernized program for authorizing cloud services for federal use under the Consolidated Rules for 2026. It emphasizes Key Security Indicators, a Security Decision Record, and Collaborative Continuous Monitoring rather than a document-only, point-in-time review.
Source: FedRAMP 20x overview & Core Principles (verified 2026-09-27)
- FedRAMP advisor
A consultant who may help a provider prepare. An advisor is not an assessor and cannot issue FedRAMP Certification. Do not treat advisor lists as official assessor registries.
Source: FedRAMP 20x overview & Core Principles (verified 2026-09-27)
Related: ria
- FedRAMP Marketplace
The official listing of FedRAMP offerings at marketplace.fedramp.gov. scm.cc is not the Marketplace and does not list or certify products there.
Source: FedRAMP Marketplace (authoritative listings) (verified 2026-09-27)
Related: fedramp-20x
- FedRAMP Rev5
The Rev5 authorization path (NIST SP 800-53 Rev 5 baseline and monthly ConMon). It runs in parallel with 20x during transition. New Rev5 applications close on the date published on FedRAMP.gov (2027-06-11 as of the 2026-10-11 deadline page).
Source: FedRAMP path & transition deadlines (verified 2026-10-11)
- Key Security Indicator (KSI)
A machine-checkable security statement in the CR26 catalog. There are 10 families and 46 indicators. Official ids, names, and statements are quoted, not paraphrased, on the KSI pages.
Source: FedRAMP 20x Key Security Indicators (CR26) (verified 2026-09-27)
Related: fedramp-20xclass-c
- Ongoing Certification Report (OCR)
The 20x CCM package. Each mandated section is present or explicitly marked absent. A complete release posts next-report and next-review dates.
Source: Collaborative Continuous Monitoring (CCM / Ongoing Certification Report) (verified 2026-09-27)
Related: ccm
- Recognized Independent Assessor
The independent assessment organization FedRAMP recognizes for 20x assessments. scm.cc is not a Recognized Independent Assessor. Use official FedRAMP registries, not this glossary, to find one.
Source: FedRAMP 20x overview & Core Principles (verified 2026-09-27)
- Security Decision Record (SDR)
The 20x authorization narrative that replaces a classical System Security Plan on the 20x path. Schema-dated 2026-06-24 on FedRAMP.gov.
Source: Security Decision Record (replaces the SSP) (verified 2026-09-27)
Related: fedramp-20xato
- Vulnerability Detection and Response (VDR)
The 20x vulnerability program. Detection is ongoing. A finding without a PAIN evaluation has no remediation deadline — it is unevaluated, not silently due.
Source: Vulnerability Detection and Response (VDR/VER) (verified 2026-09-27)
Related: ver
- Vulnerability Evaluation Report (VER)
Machine-readable VDR reports (schema kinds such as VER-RPT-VDT). Used with published remediation timeframes; the report is not a FedRAMP authorization.
Source: Vulnerability Detection and Response (VDR/VER) (verified 2026-09-27)
Related: vdr
Questions teams ask
- Is this the official FedRAMP glossary?
- No. It is scm.cc’s sourced digest. FedRAMP.gov is authoritative.
- Why is there no RFC term?
- No RFC URL is in the official source registry yet, so the term is omitted rather than guessed.
Related hub pages
Primary sources
- FedRAMP 20x overview & Core Principles (retrieved 2026-09-27)
- FedRAMP launches Consolidated Rules for 2026 (CR26) (retrieved 2026-09-27)
- FedRAMP Certification reference (classes, KSI metrics window) (retrieved 2026-09-27)
- FedRAMP 20x Key Security Indicators (CR26) (retrieved 2026-09-27)
- Security Decision Record (replaces the SSP) (retrieved 2026-09-27)
- Collaborative Continuous Monitoring (CCM / Ongoing Certification Report) (retrieved 2026-09-27)
- Vulnerability Detection and Response (VDR/VER) (retrieved 2026-09-27)
- FedRAMP Marketplace (authoritative listings) (retrieved 2026-09-27)
Last verified 2026-09-27. FedRAMP.gov is authoritative.