Overview

FedRAMP is going through the largest change in its history. The Consolidated Rules for 2026 become mandatory on January 1, 2027, retiring long-familiar artifacts, revising core terminology, and steering the program toward the automated, data-driven FedRAMP 20x model, with Rev5 sunsetting by the close of 2028. This intermediate course sets out what changes and on what schedule, sets Rev5 authorization against 20x certification, and works through the modernized package approach built on Security Decision Records, structured data, and Key Security Indicators.

Participants finish by drafting a workable Rev5-to-20x transition roadmap. Because the program bears on industry as much as on government, the course serves agency staff alongside the cloud service providers and contractors who have to meet the new requirements — and the live format lets both perspectives be aired in the same room.

Syllabus

Module 1: CR26 Foundations and the FedRAMP Transition Timeline

Examine the changes introduced by CR26 and the key milestones and dates in the FedRAMP transition timeline.

Module 2: From Rev5 Authorization to 20x Certification

Explore how FedRAMP 20x shifts the program from the Rev5 authorization model toward a certification-based approach.

Module 3: Certification Classes, Scope, and Boundary Changes

Review the new certification classes and evaluate how changes to system scope and authorization boundaries affect certification.

Module 4: Modernizing Packages with Security Decision Records and Structured Data

Use Security Decision Records and structured data to replace or modernize traditional authorization package artifacts.

Module 5: Key Security Indicators and Automated Validation

Examine Key Security Indicators and the role of continuous automated validation in demonstrating security performance.

Module 6: Ongoing Certification, Reporting, and Agency Collaboration

Maintain certification through continuous reporting, evidence updates, and collaboration with participating agencies.

Module 7: Building a Rev5-to-20x Transition Roadmap

Develop a practical roadmap for migrating systems, documentation, processes, and stakeholders from Rev5 to FedRAMP 20x.

Module 8: Developing a CR26 Transition Strategy Capstone

Produce a comprehensive CR26 transition strategy that addresses certification scope, documentation, automation, reporting, and implementation priorities.