TL;DR: FedRAMP’s Consolidated Rules for 2026 (CR26) have been in force since July 4, 2026. Four things changed: (1) “Authorization” is now “Certification,” (2) the Low/Moderate/High impact levels became lettered Certification Classes, with a new Class A entry path for providers holding a recent SOC 2 Type II, GovRAMP or FedRAMP Rev5, (3) narrative controls gave way to Key Security Indicators (KSIs), which are evidence you can draw from AWS services you already run, and (4) certification packages are submitted as machine-readable JSON validated against FedRAMP’s published schemas. Optional adoption and initial certifications under CR26 opened July 4, 2026; ongoing certification maintenance moves to CR26 on January 1, 2027. Below: what each change means technically, and what your AWS environment needs to look like before you engage a 3PAO.
Why CR26 Is Not Just a Version Number
FedRAMP has been evolving since the FedRAMP Authorization Act codified the program in 2022. The Consolidated Rules for 2026 (CR26) are not a minor update. They are the biggest structural overhaul FedRAMP has had since it started.
The old model had a built-in problem. Documentation was narrative written by people, assessment meant other people reading that prose, and the result was expensive to produce, slow to review and hard to compare across Cloud Service Providers.
CR26 moves from narrative-based assurance to telemetry-based assurance, and that changes how your AWS environment should be configured today.
The Four Changes, Explained
1. “FedRAMP Authorization” → “FedRAMP Certification”
This is a terminology change with real procedural implications. Under the old model, “Authorization” implied a one-time stamp of approval. Under CR26, “Certification” implies ongoing conformance. CSPs that achieve certification are “FedRAMP Certified,” and that status is maintained through continuous conformance evidence, not a point-in-time assessment.
What this means for your team: Start thinking of your FedRAMP posture as a live monitoring obligation, not a project with a ship date. The monitoring gap between certifications is now evidence, not a grace period.
2. Low / Moderate / High → Lettered Certification Classes
The legacy impact levels are replaced by Certification Classes. Per FedRAMP’s outcome notice for RFC-0020 (NTC-0004), the mapping is:
- Class A: a new entry class with no legacy equivalent. A SOC 2 Type II, GovRAMP or FedRAMP Rev5 completed in the last 12 months qualifies for Class A entry with no agency sponsor. Class A providers still have to address the CR26 Key Security Indicators, and certification carries a defined period in which to reassess for a higher class.
- Class B: absorbs the current Low and LI-SaaS baselines: federal information where a breach would cause limited harm.
- Class C: absorbs the current Moderate baseline: the majority of federal agency workloads, including PII and CUI.
A further class covering today’s High baseline sits above these and is outside the scope of this post. Class A is the new entry point for commercial SaaS companies pursuing FedRAMP for the first time; Class C is where the majority of federal agency procurement conversations happen. If you are a GovCon contractor or ISV with federal customers, your path to market runs through Class A into B or C.
Practical implication: If you are in a pipeline with a federal agency partner, confirm which Certification Class they require, and which AWS regions and GovCloud configurations satisfy their requirements.
3. Narrative Controls → Key Security Indicators (KSIs)
This is the most architecturally significant change in CR26.
Under the previous model, a CSP would write a human-authored narrative for each control family explaining how they satisfied the requirement. A 3PAO would read those narratives, interview your team, review screenshots, and render a judgment. That took months, and the finished document was out of date the day it was signed.
Under CR26, security requirements are expressed as Key Security Indicators: outcome statements that a 3PAO validates against evidence from your environment rather than against a narrative. KSIs were introduced in FedRAMP 20x as part of Continuous Authorization work. CR26 requires KSI information even for a Class A certification, and the bar for automated validation rises with the class: Class A providers may automate verification, Class B providers should, and Class C providers must use at least two automated methods per indicator and supply six months of historical metrics. The Class A indicator set covers change management, cloud-native architecture, cybersecurity education, identity and access management, incident response and service configuration.
FedRAMP does not publish an AWS-service checklist. What follows is our mapping of where the evidence for those indicators typically lives in an AWS account:
- AWS CloudTrail: API call logging enabled for all regions? S3 object-level events logged? Log file validation active? CloudTrail data sent to CloudWatch Logs with no gaps?
- AWS Config: Config rules active and recording? No recording gaps in the last 90 days? Non-compliant resources remediating within defined windows?
- AWS Security Hub: All standards enabled (AWS FSBP + CIS)? Security Hub aggregating findings across all member accounts in your AWS Organization?
- AWS IAM: Root account access keys absent? MFA enforced on root? No IAM users with administrator permissions unreviewed in 90+ days? Access keys rotated?
- AWS KMS: All S3 buckets with regulated data encrypted with KMS (not SSE-S3)? RDS and DynamoDB tables with PII encrypted at rest? Key rotation enabled?
These are not new checks. They are checks that responsible AWS teams run today. CR26 makes them the formal evidence a 3PAO reviews, instead of a prose narrative about whether you do them.
4. Machine-Readable Packages, Not Word Documents
CR26 rule FRC-CSO-PKG requires providers to supply certification-package information as JSON documents that validate against FedRAMP’s published JSON schemas. The 20x rules and KSI definitions are maintained publicly on FedRAMP’s GitHub. OSCAL is not mandated. FedRAMP’s RFC-0024 outcome names it as one industry-partner format among several. Two consequences follow:
- For compliance automation tools: The package format is a schema, not a template. Any tool that emits schema-valid JSON can produce the submission directly from live evidence.
- For your compliance engineering team: Requirements are now diffable. You can track what changed between rule versions in a pull request, rather than comparing two PDFs paragraph by paragraph.
Your CR26 KSI-Readiness Checklist (5 Items)
Before engaging a 3PAO under CR26 rules, confirm these five items in your AWS environment:
- CloudTrail enabled in all regions. Not just us-east-1. Multi-region trail with S3 bucket, log file validation enabled, and CloudWatch Logs integration active.
- AWS Config recording in all regions. Config recorder active and recording all resource types. No gaps in the last 90 days. Non-compliant Config rules remediated or documented with risk acceptance.
- Security Hub enabled with all standards active. AWS Foundational Security Best Practices + CIS AWS Foundations Benchmark both enabled. Security Hub aggregating findings from all member accounts in your Organization.
- IAM: no root access keys. Root account has no active access keys. MFA enabled on root. No IAM users with administrator permissions unreviewed in 90+ days.
- KMS encryption on all regulated data stores. All S3 buckets with federal data encrypted with AWS KMS. RDS and DynamoDB tables with PII encrypted at rest. KMS key rotation enabled.
These five items map to the identity and access management, service configuration and incident-response evidence a 3PAO will look for in a Class A, B or C engagement under CR26. Finding gaps now costs a few remediation sprints. Finding them during a 3PAO engagement costs months and billable assessor time.
The Timeline: In Force Since July 4, 2026; Ongoing Maintenance From January 1, 2027
Per the CR26 rules page, optional adoption and initial certifications under CR26 opened on July 4, 2026. From January 1, 2027, maintaining an ongoing certification runs under CR26, and the grace period ends with the first FedRAMP independent assessment started after that date. The rules are valid through December 31, 2028. RFC-0024’s outcome notice adds staged dates through 2027 for significant-change notifications, collaborative continuous monitoring and authorization data sharing.
If your federal contract pipeline has a Q1 or Q2 2027 timeline, plan to certify under CR26 rather than a legacy path. Run a pre-certification readiness check now, before the 3PAO engagement. Most AWS teams skip that step and regret it when a preliminary assessment surfaces a long list of open CloudTrail and Config findings.
Find Your KSI Gaps Before a 3PAO Does
ComplyRim’s Compliance Readiness Snapshot (CRS) runs 200+ read-only automated checks across eight AWS service families (IAM, S3, CloudTrail, VPC, EC2, RDS, KMS and AWS Config) and delivers the report in under 30 minutes. It uses a read-only IAM role deployed via CloudFormation. CRS does not scan Security Hub or DynamoDB, so item 3 and the DynamoDB part of item 5 above remain a manual check.
The output is a scored readiness report with a prioritized remediation roadmap organized by framework (SOC 2, ISO 27001, HIPAA, PCI DSS, ISO 42001, FedRAMP and CMMC).
CRS is not a 3PAO and does not issue a FedRAMP Certification. It is the pre-certification scan that shows where your KSI gaps are before you spend 3PAO budget finding them.
Run your KSI readiness check on AWS Marketplace →
