Latest FedRAMP 20x
Official FedRAMP 20x developments we can source: CR26 launch, SDR and CCM references, the pinned KSI catalog, and the overall deadline table. RFCs, Class D status, Marketplace listing counts, and assessor-registry news are omitted until a registered official source exists.
Educational resource only. scm.cc is not a FedRAMP Recognized Independent Assessor (3PAO) and is not FedRAMP-authorized; it grants no authorization, certification, or assessment outcome. FedRAMP.gov is the authoritative source. This is not legal advice.
Technical detail
Each update is a typed record (what happened, what changed, who is affected, what to do, official URL, last-verified). The same list drives this page, the changelog, RSS/Atom, and /api/fedramp-20x/updates.
How to implement
Read newest first. Confirm every item on FedRAMP.gov. Subscribe via RSS or Atom. Source monitoring (#560) should append rows here rather than inventing a second feed.
Common mistakes
- Treating this feed as FedRAMP.gov itself. - Filling Class D or RFC gaps with rumor. - Citing a vendor blog as the official source.
Updates
2026-10-11 · deadline · verified 2026-10-11
Official CR26 overall dates re-verified
- What happened:
- scm.cc re-read FedRAMP.gov Important Deadlines (Critical Overall Dates) on 2026-10-11.
- What changed:
- The published overall table still lists 2026-07-04 CR26 widespread effect, 2027-01-01 Rev5 new-app and 20x maintain cliffs, 2027-06-11 Rev5 application close, 2028-02-01 default grace end, and 2028-12-31 CR26 practice expiry. Per-ruleset obtain/maintain rows remain on FedRAMP.gov only.
- Who is affected:
- Cloud service providers on Rev5 and 20x tracks.
- What to do:
- Confirm every calendar date on FedRAMP.gov before using it in a plan. See the Deadline Center.
2026-09-27 · rule-change · verified 2026-09-27
CR26 Key Security Indicators pinned (46 indicators / 10 families)
- What happened:
- The official KSI reference was retrieved and pinned as the scm.cc catalog source.
- What changed:
- Ten families and 46 indicators (ids, names, statements, Class C markers, related SP 800-53 citations) are treated as official text. scm.cc family titles remain authored display labels.
- Who is affected:
- Teams implementing or assessing 20x KSIs, especially Class C.
- What to do:
- Read the KSI hub. Do not treat authored family titles as FedRAMP requirement text.
2026-06-25 · announcement · verified 2026-09-27
FedRAMP launches Consolidated Rules for 2026
- What happened:
- FedRAMP published the Consolidated Rules for 2026 (CR26) announcement.
- What changed:
- 20x practices (SDR, KSIs, CCM/OCR, VDR) are collected as consolidated rules rather than a Rev5-only control baseline.
- Who is affected:
- Providers pursuing or holding FedRAMP authorization on Rev5 or 20x.
- What to do:
- Read the CR26 announcement and the 20x overview. Map current evidence to KSIs and the SDR, not only 800-53 Rev5.
2026-06-24 · transition · verified 2026-09-27
Collaborative Continuous Monitoring / OCR reference
- What happened:
- FedRAMP published the Collaborative Continuous Monitoring reference (schema dated 2026-06-24).
- What changed:
- 20x continuous monitoring is a quarterly Ongoing Certification Report plus a Quarterly Review, not only a monthly Rev5 package.
- Who is affected:
- Authorized offerings moving to or already on 20x CCM.
- What to do:
- Keep Rev5 monthly packages until that path closes for the offering. Add the quarterly OCR without dropping ConMon.
Collaborative Continuous Monitoring (CCM / Ongoing Certification Report)
2026-06-24 · certification · verified 2026-09-27
Security Decision Record reference (replaces the SSP on the 20x path)
- What happened:
- FedRAMP published the 20x Security Decision Record reference (schema dated 2026-06-24).
- What changed:
- On the 20x path the SDR is the authorization narrative artifact in place of a classical SSP.
- Who is affected:
- 20x applicants and assessors assembling the authorization package.
- What to do:
- Use the SDR explainer and the pinned schema fields. Do not call an SSP export a 20x SDR.
Questions teams ask
- Where is the Class D announcement?
- Not listed. Class D is not described by a registered source in this corpus, so the feed stays silent rather than guessing.
- Is this an official FedRAMP RSS feed?
- No. It is scm.cc’s sourced digest. FedRAMP.gov is authoritative.
Related hub pages
Primary sources
- FedRAMP 20x overview & Core Principles (retrieved 2026-09-27)
- FedRAMP launches Consolidated Rules for 2026 (CR26) (retrieved 2026-09-27)
- Security Decision Record (replaces the SSP) (retrieved 2026-09-27)
- Collaborative Continuous Monitoring (CCM / Ongoing Certification Report) (retrieved 2026-09-27)
- FedRAMP 20x Key Security Indicators (CR26) (retrieved 2026-09-27)
- FedRAMP path & transition deadlines (retrieved 2026-10-11)
Last verified 2026-10-11. FedRAMP.gov is authoritative.