Ongoing certification on schedule
Quarterly Ongoing Certification Reports, monthly VER and annual assessment evidence from the same record.
Continuous monitoring →- Home
- FedRAMP Rev5
FedRAMP Rev5, run on the 2026 rules
Rev5 is FedRAMP's legacy Certification Type, and today the only path for offerings that run their own infrastructure or need Class D. NISTcompliance.ai runs the 2026 obligations on top of the package you already maintain: quarterly reports, VDR and VER, a package in human-readable and JSON formats, and the evidence your assessor checks every year.
Runs inside Quzara Cybertorch: FedRAMP Certified, Rev5 Class D (High)SOC 2 Type 2New Rev5 applications close Jun 11, 2027
What NISTcompliance.ai does
Every Rev5 obligation, from one record
VDR and VER by Dec 7, 2026
Risk-rated triage on your Class timeframes, with Known Exploited Vulnerability due dates tracked.
VDR and VER →Machine-readable packages
Your certification package in human-readable and JSON formats, kept consistent by automation.
Packages →Trust Center
Certification data and reports for the agencies that use your offering.
Trust Center →Assessor workspace
Evidence your independent assessor can trace every year.
Assessor workspace →Managed remediation
Quzara engineers who work the findings queue with you when the date is close.
Managed remediation →B, C, DRev5 Certification Classes
Jun 11, 2027FedRAMP stops accepting new Rev5 applications
Dec 31, 2028Existing Rev5 Certifications stay active until at least this date
Dec 7, 2026VDR and VER become mandatory
Sources: FedRAMP Rev5, What is changing, NTC-0014. Sources checked Oct 23, 2026. Not a substitute for the official text.
Ongoing certification
What each Rev5 Class delivers, and how often
Swipe to see every column
| Deliverable | Cadence | Class B | Class C | Class D |
|---|---|---|---|---|
| Ongoing Certification Report (CCM-OCR-AVL) | Every 3 months | Must | Must | Must |
| Synchronous Quarterly Review (CCM-QTR-MTG) | Every 3 months | Should | Must | Must |
| Human-readable VER report (VER-TFR-MHR) | At least monthly | Must | Must | Must |
| VER history in JSON (VER-TFR-MRH) | B monthly, C every 14 days, D every 7 days | Should | Should | Should |
| Independent assessment (IVV-CSO-FIA, IVV-CSF-MCA) | At least yearly; all controls within 3 years | Must | Must | Must |
| Package refresh (CPO-CSF-CPM) | B and C yearly, D every 6 months | Must | Must | Must |
Sources: Rev5 CCM rules, Rev5 VER rules, Rev5 IVV rules, CPO rules. Sources checked Oct 23, 2026. Not a substitute for the official text.
Certification package
What the Rev5 package now contains
CPO-CSO-OVRMUST
Certification Package Overview
Replaces the base System Security Plan and is supplied in human-readable and JSON formats.
SDR-CSO-FRRMUST
Security Decision Record
Documents security decisions, supplied in human-readable and JSON formats.
FRC-CSF-BSLMUST
Class baselines
Each Rev5 Class lists the minimum NIST SP 800-53 Rev. 5 controls your Security Decision Record must include.
CPO-CSF-CPMMUST
Keep it current
Class B and C packages are refreshed at least yearly, Class D at least every 6 months.
2026 CHANGESGUIDANCE
JSON by default
FedRAMP moved to simplified JSON documents, with OSCAL optional in some cases.
2026 CHANGESGUIDANCE
Accepted weaknesses
POA&Ms were eliminated and replaced by a list of accepted weaknesses.
REV5 DEADLINESFACT
When it applies
New applications use the CPO and SDR from Jan 1, 2027. Existing providers should adopt the CPO by Jul 1, 2027 and the SDR by Aug 1, 2027, and must by the first independent assessment that starts after those dates.
Sources: CPO rules, SDR rules, Rev5 Certification rules, What is changing, Rev5 deadlines. Sources checked Oct 23, 2026. Not a substitute for the official text.
Move to 20x
Four steps from Rev5 to 20x
FedRAMP expects to retire Rev5 as a new Certification Type in mid-2027. Much of your Rev5 evidence carries over, because each Key Security Indicator lists related NIST SP 800-53 controls.
Inventory
Pull your current controls, evidence, scans and POA&M into one workspace.
Map to KSIs
Each KSI lists related NIST SP 800-53 controls, so existing Rev5 evidence maps to indicators and gaps show up clearly.
Meet the clock
Stand up VDR and VER on your Class timeframes before Dec 7, 2026.
Share and assess
Publish through a trust center, start Ongoing Certification Reports and prepare the annual assessment.
Sources: Certification Types, Updating to 2026 rules, NTC-0014. FedRAMP Consolidated Rules for 2026, checked Oct 23, 2026. Not a substitute for the official rules.
The Rev5 clock
Dates on the Rev5 calendar
Optional
Optional adoption opens
Providers may adopt the Consolidated Rules for 2026.
Mandatory
VDR and VER
Required to obtain or maintain FedRAMP Certification. Grace period ends Mar 7, 2027.
New applications
2026 rules required
New Rev5 applications must follow the Consolidated Rules for 2026.
Cutoff
Rev5 applications close
FedRAMP stops accepting applications for new Rev5 Certifications.
Existing
Rev5 stays active
Existing Rev5 Certifications remain active until at least this date.
Sources: Rev5 deadlines, FedRAMP Rev5, What is changing. Sources checked Oct 23, 2026. Not a substitute for the official text.
Go deeper
FedRAMP guides
FedRAMP 20x Roadmap
Phases, dates and what is due next across 20x and Rev5.
Read the guide →OSCAL Automation for FedRAMP 20x and Rev5
How machine-readable packages work under the 2026 rules.
Read the guide →FedRAMP Certification Cost in 2026
Budget ranges and the drivers behind them.
Read the guide →Questions
Common questions
Is FedRAMP Rev5 going away?
Rev5 is the legacy Certification Type. FedRAMP will stop accepting applications for new Rev5 Certifications on Jun 11, 2027, and existing Rev5 Certifications remain active until at least Dec 31, 2028.
Does Rev5 still need an agency sponsor?
Yes. Rule FRC-APS-ATO requires the agency sponsor to complete its Authorization to Operate process and send FedRAMP a signed letter. FedRAMP opened only extremely limited Rev5 pipelines without a sponsor in 2026.
Do Rev5 providers still keep a POA&M?
Not once you adopt the 2026 rules. FedRAMP eliminated POA&Ms and replaced them with a list of accepted weaknesses.
Can Rev5 evidence be reused for KSIs?
Much of it. The FedRAMP KSI reference lists related NIST SP 800-53 controls for each indicator, so existing control evidence maps to indicators. KSIs still expect persistent, automated validation rather than point-in-time documents.
Book a demo
Keep Rev5 certified
We will map your current package to the 2026 rules and the dates that apply to you.