fedramp

1# FedRAMP Certification Skill
2 
3> **Last verified:** 2026-10-03
4 
5A comprehensive guide for helping users navigate FedRAMP authorization — from initial
6readiness through ATO and ongoing continuous monitoring.
7 
8## Quick Reference: What Does the User Need?
9 
10Identify the user's goal and jump to the appropriate section:
11 
12| User Goal | Go To |
13|---|---|
14| "Are we ready for FedRAMP?" / gap assessment | → [Readiness & Gap Assessment](#1-readiness--gap-assessment) |
15| Writing SSP, POA&M, SAR, SAP, or other docs | → [ATO Documentation](#2-ato-documentation) |
16| "Which controls apply to us?" / control mapping | → [NIST 800-53 Control Mapping](#3-nist-800-53-control-mapping) |
17| Cloud architecture / AWS/Azure/GCP config | → [Architecture Guidance](#4-architecture-guidance) |
18| Already authorized, ongoing compliance | → [Continuous Monitoring](#5-continuous-monitoring) |
19 
20---
21 
22## Current FedRAMP State (as of August 2026 — CR26)
23 
24> ⚠️ **CR26 (FedRAMP Consolidated Rules for 2026)**: FedRAMP has restructured its authorization framework. FIPS 199-based baseline labels (Low/Moderate/High/LI-SaaS) are replaced with **Certification Classes A–D** (per notice NTC-0004; CR26 rules valid through December 31, 2028). Class labels change the *names* of the baselines, not their requirements. CSPs already authorized under the old labels retain their authorization through a transition period in which old and new labels are linked.
25 
26- **Baseline**: NIST SP 800-53 **Rev 5** (fully in effect)
27…