4 posts
On June 24, 2026, FedRAMP officially released CR26. The class system is real on the Marketplace, the canonical site moved to fedramp.gov/2026, JSON schemas for machine-readable packages shipped, and the legacy docs got archived. Here's what changed between preview and final, what's binding, and what CSPs should actually do this quarter.
On May 4, 2026, FedRAMP launched the public preview of the Consolidated Rules for 2026 (CR26). Plain language requirements, machine-readable structure, a stable two-and-a-half-year content window, and a GitHub-driven feedback model. Here's what's actually in it and what CSPs should be doing right now.
A breakdown of FedRAMP NTC-0009, the outcome of RFC-0024 on machine-readable authorization packages for Rev5, including what changed, the new timelines, and what it means for CSPs, 3PAOs, and agencies.
A hands-on walkthrough of compliance-trestle and AWS Config rules turning your authorization package into a living, automated artifact, and why FedRAMP 20x is moving toward exactly this model.