FedRAMP 20x checklist tool

The get-certified journey stages as a printable checklist. Stages are educational. They are not an official FedRAMP form.

Educational resource only. scm.cc is not a FedRAMP Recognized Independent Assessor (3PAO) and is not FedRAMP-authorized; it grants no authorization, certification, or assessment outcome. FedRAMP.gov is the authoritative source. This is not legal advice.

Technical detail

Rendered from the same journey records as /get-certified. No extra requirements are added here.

How to implement

Use it as a reading list. Confirm each stage against FedRAMP.gov before you put it in a customer plan.

Related hub pages

Primary sources

FedRAMP 20x overview & Core Principles (retrieved 2026-09-27)
FedRAMP 20x Key Security Indicators (CR26) (retrieved 2026-09-27)
FedRAMP Certification reference (retrieved 2026-09-27)
Security Decision Record (retrieved 2026-09-27)
Collaborative Continuous Monitoring (retrieved 2026-09-27)
FedRAMP Marketplace (retrieved 2026-09-27)
FedRAMP path & transition deadlines (retrieved 2026-09-27)

Last verified 2026-09-27. FedRAMP.gov is authoritative.

Explore the knowledge hub

Assessor training

Get Certified

Stay Certified

Implementation

Marketplace

Marketplace

Intelligence

Free Tools

Journey stages

Determine applicability
Confirm the offering is a cloud service seeking federal use and which FedRAMP path (20x vs Rev5) applies. FedRAMP.gov is the rule.
Determine certification class
Classes A–D are defined on FedRAMP.gov. Class D stays proposal-stage here until a registered definition exists.
Choose a path
20x vs Rev5 during transition. Dual cadence is common; do not drop monthly ConMon because an OCR exists.
Define the offering boundary
The authorization boundary belongs in the SDR, not in a slide. Confirm inheritance vs customer responsibility.
Implement requirements
Map CR26 practices and KSIs onto the offering. Quote official KSI statements; do not paraphrase them as weaker text.
Implement KSIs
Ten families, 46 indicators in the pinned CR26 catalog. Class C markers live on the indicator pages.
Establish the Security Decision Record
On the 20x path the SDR replaces a classical SSP. Use the pinned 2026-06-24 schema fields.
Persistent validation
CCM quarterly OCR plus, where still required, Rev5 monthly ConMon. Cadences are sourced, not estimated.
Gather evidence
Strong vs weak evidence is described on the evidence page. Missing stays missing — never a fabricated green.
Find a Recognized Independent Assessor (where required)
Use official FedRAMP registries. scm.cc is not an assessor and does not rank or endorse 3PAOs.
Independent assessment
An independent assessment is performed by a Recognized Independent Assessor, not by this site.
Resolve findings
VDR/VER and POA&M handle unevaluated vs dated findings. An unevaluated finding has no invented deadline.
Submit the package
Follow FedRAMP.gov submission instructions. scm.cc can help assemble working artifacts; it does not submit or sponsor a package.
Certification decision
FedRAMP Certification is a government decision. It does not replace an agency ATO. scm.cc grants neither.
Marketplace listing
Official listings live at marketplace.fedramp.gov. This hub is not the Marketplace.
Ongoing certification
Stay on published CCM/Rev5 cadences and CR26 dates. See deadlines and stay-certified.

This is a reading list, not a readiness score and not a certification forecast.