FedRAMP Equivalency: What DoW Cloud Contractors Prove
FedRAMP equivalency is the mechanism that lets a Department of War (DoW) contractor use a cloud service that does not hold its own FedRAMP authorization, provided the contractor can prove that cloud meets the FedRAMP security baseline required for defense data. The idea sounds like a shortcut, and that is exactly where contractors get into trouble, because equivalency is not a lighter version of FedRAMP. It requires proving the same security baseline, backed by the same kind of evidence, with the responsibility shifted onto the contractor rather than a sponsoring agency. This guide explains what equivalency actually demands, what evidence you have to hold, and why the ground under it is moving in 2026. Elevate Consult works with DoW contractors on exactly this problem, and the pattern is consistent: teams underestimate equivalency because the word implies a discount that the requirement does not deliver. What FedRAMP Equivalency Means FedRAMP equivalency comes from DFARS 252.204-7012, the defense contracting clause that governs how contractors safeguard Covered Defense Information (CDI). When a contractor uses an external cloud service to store, process, or transmit CDI, that clause requires the cloud offering to meet security requirements equivalent to the FedRAMP Moderate baseline, the reference point the clause was written around, and it attaches specific obligations for cyber incident reporting, malicious software handling, and media preservation. The critical word is equivalent, not authorized. A cloud provider can hold a full FedRAMP authorization, which is the clean path, or a contractor can demonstrate that a non-authorized cloud is equivalent to what FedRAMP requires. Equivalency exists so contractors are not blocked when a needed cloud service has not gone through the FedRAMP program itself. What it does not do is lower the security bar. Equivalency still means meeting FedRAMP’s security requirements, proven independently, not a reduced standard. What You Actually Have to Prove The December 2023 DoW CIO memo on FedRAMP Moderate Equivalency set out what equivalency requires, and it set the bar far higher than most contractors expected. The memo’s effect is that equivalency is close to full authorization in substance, with the government sponsorship step removed and the burden placed on the contractor. Its central mechanics are confirmed by Elevate’s own FedRAMP and defense-compliance advisors. There is an important wrinkle in 2026. That memo references the FedRAMP Moderate baseline, but FedRAMP’s own rules have since changed, and the memo has not been updated to match. Equivalency in current practice therefore does not hinge on a static Moderate checklist. It hinges on an independent assessment of the baseline requirements, documented so that an assessor can map the cloud’s implementation up to what FedRAMP now requires. In practice, that means a few things together. The cloud offering is reviewed by an independent third-party assessor, the same kind of assessor a full FedRAMP effort uses, rather than self-attested. That review produces a complete body of evidence, the security documentation, assessment results, and remediation tracking that let an assessor confirm the implementation meets FedRAMP’s requirements. And the contractor holds that evidence and keeps it current, because under DFARS the contractor, not the cloud provider, is accountable to the government for it. The uncomfortable consequence is that equivalency removes the sponsor and the government authorization decision, but it does not remove the security work or the assessment. A contractor hoping equivalency means “use any commercial cloud and write a memo” has misread the requirement, and that misreading is the single most common and most expensive mistake in this area. It helps to be concrete about what the body of evidence contains, because the phrase sounds abstract until an assessor asks for it. In substance it is the same documentation set a full FedRAMP effort produces: a description of the system and its authorization boundary, the security control implementation detail, the independent assessment results, and a live record of open weaknesses with remediation plans and dates. The contractor has to be able to produce this on request and show it is current, which means equivalency is not a document you file once but a package you maintain as the cloud environment and the threat landscape change. The boundary question deserves particular attention. Equivalency applies to the cloud offering as it handles Covered Defense Information, so the scope of what must be assessed is defined by where CDI actually flows. A contractor that has not mapped that boundary precisely tends to either over-scope, paying to assess systems that never touch defense data, or under-scope, leaving a gap that surfaces during an audit. Getting the boundary right is the difference between an equivalency effort that is merely expensive and one that is both expensive and incomplete. Equivalency Compared to Full Authorization The table below sets equivalency against a full FedRAMP authorization on the dimensions that matter to a DoW contractor making the decision. Dimension FedRAMP authorization FedRAMP equivalency Security bar Full FedRAMP requirements Same requirements, no reduction Who runs the assessment FedRAMP-recognized third-party assessor FedRAMP-recognized third-party assessor Government sponsor or ATO Required Not required Who holds the risk Cloud provider and authorizing agency The contractor using the cloud Reusability across agencies Broad, listed on the Marketplace Limited, contractor-specific evidence The interpretive point is that the only column that genuinely favors equivalency is the sponsor row. Everything else is either identical or worse for the contractor, because the risk and the evidence burden move onto the contractor and the result does not carry the broad reusability of a listed authorization. Equivalency is a legitimate mechanism, but it is a mechanism for a specific situation, not a cheaper substitute for authorization. Where Equivalency Fits Against CMMC and NIST 800-171 DoW contractors routinely confuse equivalency with their own compliance obligations, so it helps to place it precisely. Equivalency is a requirement on the cloud service you use. CMMC and NIST SP 800-171 are requirements on your own systems that handle Controlled Unclassified Information. They stack: your environment has to meet 800-171 and, increasingly, prove it through CMMC, and any cloud you use for CDI has to
FedRAMP Certification Timeline: How Long Each Phase Really Takes
The honest answer to the FedRAMP certification timeline question has two halves that most guides blur together: the program milestones, which are fixed dates FedRAMP publishes, and the phase durations, which are estimates that depend entirely on your service. Under the Consolidated Rules for 2026 (CR26), the fixed dates changed and the duration math changed with them, so timelines built on the old JAB and Rev5-only model now mislead. This guide separates the two cleanly: the CR26 dates you can plan against with certainty, and the phase durations you should treat as ranges, not promises. If you are choosing between paths, the FedRAMP certification timeline is one of the strongest deciding factors, because FedRAMP 20x and Rev5 move at very different speeds under CR26. For the terminology and path structure behind the dates below, see the FedRAMP ATO and certification path guide. The Fixed Dates: CR26 Program Milestones These are the dates FedRAMP has published. They are the same for everyone, and they are the backbone any FedRAMP certification timeline hangs from. Every date below is from the official CR26 rules. Date Milestone Why it matters to your timeline July 4, 2026 Optional early adoption; all new 20x applications must follow CR26 You can begin transitioning now July 6, 2026 Initial Implementation Marketplace listings open The journey now starts with a listing, not an application July 28, 2026 FedRAMP Ready goes Legacy No new Ready submissions; the on-ramp is 20x Class A August 3, 2026 20x Class A pipeline opens First applications for market-entry certification August 10, 2026 Ready Conversion and Lost Sponsor pipelines open Limited sponsorless Rev5 Class B and C applications August 31, 2026 20x Class B and C pipeline opens Full 20x class lineup available January 1, 2027 Mandatory adoption; all new Rev5 applications must follow CR26 Legacy processes end for new work June 11, 2027 End of new Rev5 Certifications Rev5 closes to new applicants February 1, 2028 All CR26 grace periods expire Offerings not following CR26 lose certification Read this table as the boundary conditions on your plan, not the plan itself. The August 31, 2026 opening of the 20x Class B and C pipeline was confirmed directly by FedRAMP at its July 2026 community working group, and it is the date most new cloud-native providers will actually build toward. The June 11, 2027 Rev5 cutoff is the one that forces decisions: a service that requires Rev5 has to start before it, and starting late compresses everything that follows against a hard wall. The Three Deadline Types You Have to Track CR26 does not use one deadline per rule. It uses three, and confusing them is a common way to misread the FedRAMP certification timeline. Every ruleset in CR26 carries its own set. The Obtain date is when a rule becomes mandatory for a new certification: to obtain a certification after that date, you must follow the rule. The Maintain date is when an already-certified provider must be following the rule to keep its certification, after which FedRAMP can request corrective action. The Grace Ends date is the hard backstop: a certified offering not following the rule by then loses its certification until it complies, with no extensions past the default grace period. The practical consequence is that “the deadline” depends on which side of it you sit. A provider seeking a new certification plans against Obtain dates. A provider already certified plans against Maintain and Grace Ends dates. The overall grace backstop for CR26 adoption is February 1, 2028, after which any offering not fully following the rules loses its certification. These dates load programmatically from the machine-readable ruleset, so a compliance team can track them as data rather than reading them out of a document. The Certification Journey, Phase by Phase The sequence of the FedRAMP certification timeline changed under CR26. The steps below run in order, and each one depends on the previous being done well. Phase one is the Marketplace listing. Under CR26 the journey now begins with an Initial Implementation Phase listing, which FedRAMP describes as always the first step toward certification. You do not need a complete package or a full Trust Center to list; you need to show you are working toward certification, and you commit to beginning an assessment within two years. For the listing rules themselves, see the FedRAMP Marketplace listing guide. Phase two is building the certification package. This is where the two types diverge most. On 20x, you instrument your systems and produce machine-readable evidence against the Key Security Indicators. On Rev5, you document control implementations against NIST 800-53 Rev 5. In both cases the evidence lives in the new JSON schemas: a public Certification Package Overview with your metadata, and a Security Decision Record with your implementation detail. For exactly what each type must produce, see the FedRAMP certification requirements guide. Phase three is the independent assessment. A FedRAMP Recognized Assessor, the CR26 term for the role formerly called a 3PAO, validates your evidence. This assessor must be independent of any firm that advised you, which is a scheduling fact as much as a compliance one: the assessor’s availability is a real variable in your timeline. Phase four is submission and review. You submit your application, FedRAMP runs its review, and, on the Agency path, your sponsoring agency grants an agency-specific ATO before FedRAMP issues the Certification. On the sponsorless Program path, you submit directly to FedRAMP. Phase five is continuous monitoring, which never ends and keeps the FedRAMP certification timeline open indefinitely. Certification starts the recurring obligations of Collaborative Continuous Monitoring rather than closing the project. The timeline does not stop at the certificate; it changes shape. FedRAMP Certification Timeline: How Long Each Phase Takes Here is where honesty matters most. FedRAMP does not publish official per-phase durations, and any guide that quotes a precise month count is presenting an estimate as a fact. What follows are ranges that depend on your certification type, your Class, and your operational maturity, offered
FedRAMP Marketplace Listing: New Rules and How CSPs Get Visible
The FedRAMP Marketplace is the federal government’s authoritative catalog of cloud service offerings, independent assessors, and advisors, and as of July 6, 2026 it does something it never did before: it lists cloud service providers that are still early in implementation, before they hold any certification. For a cloud service provider (CSP), that changes the marketplace from a trophy case you enter at the end of the process into a visibility channel you can earn near the start of it. This guide covers what the FedRAMP Marketplace shows buyers today, the listing rules the Consolidated Rules for 2026 (CR26) introduced, and the strategy that gets you listed without getting rejected. One framing note before the details. Most searches for the FedRAMP Marketplace are lookups: an agency confirming a vendor’s status, or a vendor checking a competitor. If that is you, the first section answers it quickly. The rest of the article is for the CSPs on the other side of the search box, the ones who want to be the result. What the FedRAMP Marketplace Shows Buyers The marketplace at fedramp.gov is the authoritative place to confirm whether a cloud service offering holds a FedRAMP designation, is working toward certification, or is connected to agency reuse. Under CR26 it carries three directories that matter to a CSP’s go-to-market picture. The products directory lists cloud service offerings, searchable by certification status, certification class, service model, deployment model, and business function. The agencies directory shows federal agencies and the certifications associated with them, which is where reuse relationships become visible. The assessors directory lists FedRAMP Recognized Assessors, the independent role formerly known as a 3PAO, and the marketplace also lists advisory services under their own rules. Two implications follow for providers. First, agencies filter: a listing with accurate class, model, and function data surfaces in searches a sloppy listing never enters. Second, buyers verify: claims like FedRAMP Compliant or FedRAMP Equivalent have no official standing, and the marketplace is exactly where a skeptical buyer goes to check them. There is a third, quieter implication. Because assessors and advisory services are listed under their own marketplace rules, the directory also works as a vetting tool in the other direction: a CSP choosing help can check whether an assessor holds current FedRAMP Recognition and whether an advisory firm meets the marketplace’s publication requirements. The same transparency that disciplines your listing disciplines the vendors selling to you. If your sales deck says one thing and your marketplace entry says another, the marketplace wins the argument. For the full map of what the designations mean now, see the FedRAMP Authorized vs Ready guide. The Change: Listed Before Certified Under the legacy program, marketplace visibility effectively required being deep in the process or done with it. CR26 opened a new front door. Since July 6, 2026, FedRAMP allows providers in the Initial Implementation Phase to be listed on the marketplace under a dedicated set of rules. The commercial logic is straightforward. The gap between deciding to pursue FedRAMP and holding a certification is measured in months, and under the old model those months were invisible: no listing, no signal to agencies doing market research, nothing to point procurement teams toward. An Implementation Phase listing converts that dead time into presence. Agencies scanning the marketplace for upcoming options can find you, and your federal pipeline conversations gain a verifiable reference instead of a promise. The listing is not a certification and does not claim to be one. It signals a commitment in progress, backed by obligations that CR26 makes explicit, which is the subject of the next section. Where you sit in the certification journey itself, type, class, and path, is covered in the FedRAMP ATO and certification path guide. Who Should List Now, and Who Should Wait The timing question has three honest answers. A provider with a committed certification plan, a scoped boundary, and executive sign-off should list as early as the five rules can be met, because visibility compounds: every quarter listed and progressing is a quarter of agency market research you appear in. A provider still deciding whether to pursue FedRAMP at all should wait, because the listing starts a public two-year clock and a quarterly reporting cadence, and a stalled or withdrawn listing is a worse signal than no listing. And a provider mid-assessment already has stronger news coming soon; for them the Implementation listing is usually redundant unless the assessment is many months out. The common failure is listing as a marketing reflex before the program behind it exists. The marketplace makes commitments public and dated, which is precisely why a well-run listing builds credibility and a hollow one destroys it. The Listing Rules: What FedRAMP Requires From Providers The CR26 marketplace listing rules for the Implementation Phase are a compact preview of the discipline the whole program expects. Five obligations apply. A website with machine-readable listing data. Your site must publicly host specific information about the cloud service offering, part of it in a JSON file that validates against FedRAMP’s published schema. Human-readable and machine-readable versions must be consistent with each other. Proof of eligibility. You must show the offering is eligible for a FedRAMP Certification, including an eligible government-wide use case. A niche tool with no plausible federal buyer does not qualify for the shelf space. A FedRAMP-compatible Trust Center. CR26 defines the Trust Center as the secure repository where you store and share your FedRAMP Certification Data, and it must follow the certification data sharing rules to count as compatible. Standing this up early is not wasted work: it is the same infrastructure your certification and monitoring phases will use. Quarterly progress updates. You commit to reporting progress toward certification each quarter, measured against your own stated goals. The marketplace is not a parking spot; listings are expected to move. A two-year clock to assessment. You commit to beginning an assessment for a FedRAMP Certification within two years of the initial listing. FedRAMP’s own guidance notes that with
FedRAMP Certification Requirements: What the CR26 Rulebook Demands
The FedRAMP certification requirements a cloud service provider had to meet a year ago are not the ones the program enforces today. The Consolidated Rules for 2026 (CR26) launched officially on June 24, 2026 and become mandatory on January 1, 2027, and they replaced the old control-count model with a rulebook, a set of Key Security Indicators, and two very different evidence paths depending on how your service is built. This guide lays out the current FedRAMP certification requirements for cloud service providers (CSPs): what governs certification now, what a FedRAMP 20x service must demonstrate, what a Rev5 service must document, and what applies to every provider regardless of type. The single most important shift to internalize: FedRAMP certification requirements are no longer one long checklist applied uniformly. They branch by certification type, so the first real requirement is knowing which set applies to you. For the terminology behind the rename from authorization to certification, see the FedRAMP Authorized vs Ready guide. The Rulebook Replaced the Checklist Under the legacy program, requirements meant a fixed number of NIST 800-53 controls tied to your impact level, documented in a large System Security Plan and tested once. CR26 reframes requirements as a machine-readable rulebook: a structured set of FedRAMP Requirements covering everything from certification data sharing to minimum assessment scope to continuous monitoring, expressed so that both humans and systems can read them. This matters for how you plan. Requirements are now versioned, addressable, and consistent across providers, which removes much of the interpretive guesswork that used to sit between a CSP and its assessor. It also means a requirement can be satisfied by evidence a machine produces, not only by prose a human writes. The rulebook still traces back to recognized security fundamentals, so the FedRAMP controls to NIST 800-53 mapping guide remains the bridge between the control language your team already knows and the requirement language CR26 uses. Because the requirements branch by type, the rest of this guide follows that branch: the 20x model first, the Rev5 model second, then the requirements common to both. Before that, one clarification that saves confusion later. The rulebook did not throw away the security concepts underneath the old controls; it reorganized how you prove them. A firewall rule, an access policy, or a logging configuration that satisfied a NIST control still satisfies the corresponding requirement. What changed is the unit of proof, from a narrative that describes the control to, on the 20x side, evidence that a system emits. Teams that already run a mature control environment are closer to meeting the new requirements than the unfamiliar vocabulary suggests. FedRAMP 20x Requirements: Key Security Indicators FedRAMP 20x is the cloud-native certification type, served by the sponsorless Program path at Class A, B, or C. Its defining requirement is not a control count but a set of Key Security Indicators (KSIs): outcome-focused statements of security capability that a provider demonstrates through automated, machine-readable evidence rather than narrative description. CR26 defines 46 Key Security Indicators organized into 10 families. The families are the map of what a 20x service must show: KSI family What it covers Cloud Native Architecture Secure-by-design architecture and isolation Service Configuration Hardened, correctly configured services Identity and Access Management Authentication, authorization, and access control Monitoring, Logging, and Auditing Visibility into system and security activity Change Management Controlled, tracked changes to the environment Policy and Inventory Documented policy and a current asset inventory Recovery Planning Backup, recovery, and resilience Incident Response Detection, response, and communication Supply Chain Risk Management of third-party and dependency risk Cybersecurity Education Training tied to roles and risk The table is the shape of the 20x requirement set, and the strategic reading is that the model rewards providers whose security is already instrumented. A KSI is satisfied by showing, through data your systems generate, that the capability is real and persistent, not by asserting it in a document. For a team already running strong automation, this converts existing telemetry into certification evidence. For a team that treats security as periodic paperwork, it exposes the gap. The FedRAMP compliance checklist sequences the work of getting from today’s posture to a KSI-ready one. The practical requirement hidden inside the KSI model is traceability. Each indicator has to connect to a live source of evidence, and that evidence has to be current, not a screenshot from last quarter. A requirement stated as a capability means the assessor is looking for proof the capability operates continuously, so the underlying requirement is really an instrumentation requirement: log it, monitor it, and be able to produce the record on demand. Providers that map each KSI family to the specific system that already generates its evidence turn the assessment into a data-collection exercise rather than a writing project. Providers that discover, mid-assessment, that a family has no evidence source behind it face the most expensive kind of gap, the kind that requires building a capability rather than documenting one. FedRAMP Rev5 Requirements: The Documented Package FedRAMP Rev5 is the certification type for services that operate their own infrastructure or specialized compute, served by the Agency path and the only route to Class D. Its requirements are the modernized descendant of the traditional model, built on NIST SP 800-53 Rev 5 controls and a documented evidence package. A Rev5 provider must produce a System Security Plan that defines the authorization boundary and documents how each applicable control is implemented, a Security Assessment Plan and Security Assessment Report from an independent assessor, and a Plan of Action and Milestones tracking findings to remediation. The requirements around that package have not softened: reviewers judge submissions on clarity, completeness, conciseness, and consistency, and the most common failure remains a mismatch between the boundary diagram, the data-flow diagram, and the control narrative. One deadline shapes any Rev5 requirements plan: FedRAMP stops accepting applications for new Rev5 Certifications on June 11, 2027, so a service that requires Rev5 has a fixed window to meet these requirements in. The Rev5
FedRAMP Compliance Checklist: Every Step From Scoping to Certification
A FedRAMP compliance checklist is only useful if it describes the program that exists today, and most of the checklists you will find online do not. The Consolidated Rules for 2026 (CR26) launched officially on June 24, 2026 and become mandatory on January 1, 2027, retiring the JAB, the Provisional ATO, and the FedRAMP Ready designation that older checklists are built around. What follows is a phase-by-phase FedRAMP compliance checklist written against the launch version of the new rules, for cloud service provider (CSP) teams that need to plan real work in the order it actually happens. Each phase below opens with the checklist items and closes with the context your team needs to complete them. Work the phases in order: every item in a later phase gets cheaper when the earlier phases are done well. For how the terminology shifted underneath the process, see the FedRAMP Authorized vs Ready guide. Why Old FedRAMP Compliance Checklists Fail in 2026 Before the checklist itself, clear three retired items out of any plan you inherited. The Joint Authorization Board was discontinued in 2024, and the Provisional ATO retired with it, so any checklist step that routes through JAB prioritization or FedRAMP Connect describes a closed door. FedRAMP Ready stopped accepting submissions on July 28, 2026, so a checklist that ends at Ready status ends at a designation that no longer accepts entrants. And the end state itself was renamed: FedRAMP Authorized is now FedRAMP Certified, with the new term still satisfying the statutory concept of FedRAMP authorization. The cost of following a stale FedRAMP compliance checklist is not cosmetic. Teams that build toward retired milestones buy assessments the program will not accept, write documents against the wrong evidence model, and discover the gap at submission time, which is the most expensive moment to discover anything. For the full picture of what replaced the old designations and paths, the FedRAMP ATO and certification path guide covers the transition end to end. Phase 1: Scope and Categorize Your Service This is the foundation phase of the FedRAMP compliance checklist, and the phase where shortcuts create the most rework later. The boundary is the item that decides the cost of everything downstream. A clean, deliberately scoped boundary is cheaper to document, cheaper to assess, and cheaper to monitor than a sprawling one, and reviewers still evaluate packages on how consistently the boundary, the diagrams, and the narrative agree with each other. Note that FIPS 199 categorization did not go away under CR26: impact levels still exist as security categories, and they are a separate dimension from the certification Classes covered in the next phase. For a typical SaaS provider, the boundary conversation usually turns on three practical questions. Which supporting services sit inside the boundary versus outside it as external dependencies. Where administrative access enters, since management planes and support tooling that touch federal data belong inside. And how the AI or analytics components handle data, because training pipelines, inference services, and logging paths that see federal data are boundary components whether or not the original architecture treated them that way. Settling those three questions on paper before Phase 2 prevents the most common late-stage surprise, which is an assessor expanding your scope after the budget was set. Phase 2: Choose Your Type, Class, and Path CR26 replaced the old path debate with a structured choice. Your FedRAMP compliance checklist for this phase is a set of decisions, and the honest sequence is that each decision narrows the next one. Type follows architecture more than preference. A cloud-native service points to 20x and the Program path, which removes the agency-sponsor search that used to be the least controllable line in a FedRAMP budget. Self-hosted infrastructure or a mission-critical Class D use case points to Rev5 and an agency relationship, with the June 11, 2027 cutoff as the planning boundary. Elevate’s FedRAMP consulting and advisory services exist for exactly this mapping decision, and the Rev5 authorization and transition strategy service covers the scenario where Rev5 and its deadline are unavoidable. Phase 3: Build the Evidence The evidence model is where the two certification types diverge most, so this section of the FedRAMP compliance checklist splits by type. Checklist item FedRAMP Rev5 FedRAMP 20x Core artifact System Security Plan (SSP) against NIST SP 800-53 Rev 5 Machine-readable evidence against Key Security Indicators (KSIs) Control documentation Control-by-control implementation narrative Automated demonstration of security posture Assessment inputs Security Assessment Plan (SAP) and Security Assessment Report (SAR) KSI-focused validation by the assessor Findings tracking Plan of Action and Milestones (POA&M), remediation tiered by severity Persistent detection and response with tracked remediation Best suited for Teams with strong documentation practices Teams with strong automation practices The table is a planning instrument, not a menu: your type from Phase 2 already picked your column. On the Rev5 side, the quality bar for the package has not moved, and reviewers still judge documents on clarity, completeness, conciseness, and consistency, with mismatches between diagrams and narrative remaining the classic package killer. On the 20x side, the work shifts from writing about controls to producing evidence from the systems themselves, which converts automation you already run into certification material. Map your controls early either way: the FedRAMP controls to NIST 800-53 mapping guide covers the control families the Rev5 model documents and the 20x model measures against. Whichever column applies, close this phase with three items that are type-independent: Phase 4: Assessment and Certification With evidence built, the FedRAMP compliance checklist moves to independent validation and submission. The advisor-versus-assessor separation deserves the emphasis. Part of the reason FedRAMP retired the 3PAO label was to keep advisory work and independent assessment clearly distinct, and the separation protects you: an assessor that helped design your controls cannot credibly challenge them. Elevate operates as an advisor by design and stays separate from your independent assessor. Phase 5: Keep the Certification Valid Certification starts an obligation rather than ending a project, and a FedRAMP compliance checklist that stops
FedRAMP Sponsor Requirements in 2026: The Paths to Certify Without an Agency Partner
For most of the program’s history, finding a FedRAMP sponsor was the single hardest part of reaching the federal market, and the large majority of authorizations ran through an agency willing to shepherd a provider through the process. That dependency stopped a lot of capable cloud service providers before they started, because a strong product does not help if no agency will put its name on the risk. Under the Consolidated Rules for 2026 (CR26), that barrier is finally falling, and FedRAMP has opened certification paths that do not require a FedRAMP sponsor at all. This guide explains what changed, when each new path opens, who qualifies, and how to choose the route that fits your service. The timing matters because the change is not theoretical. FedRAMP finalized CR26 at the end of June 2026, opened the first sponsorless pipelines in early August 2026, and set mandatory adoption for January 1, 2027. If you have been waiting for an agency partner, or you lost one this past year, the practical question is no longer whether you can certify without a FedRAMP sponsor, but which of the new paths to use and how fast you can move. Why the FedRAMP Sponsor Barrier Is Falling in 2026 The FedRAMP sponsor requirement was never a security control. It was a structural feature of how the program assigned accountability, and removing it is the most consequential access change FedRAMP has made in years. Understanding why it existed, and what replaced it, grounds the decisions that follow. The Historical Sponsor Bottleneck Under the legacy model, a cloud service provider could not complete an authorization without a federal agency willing to sponsor the effort and issue an Authority to Operate. The agency took on the risk of the provider’s security posture, which meant the provider had to build an agency relationship, tailor its solution to that agency’s mission, and convince a government team to spend its own time and political capital on the review. For new entrants this was a chicken-and-egg problem: agencies preferred vendors already close to authorized, and getting there required an agency. The result was a market where the security work was often the manageable part and the FedRAMP sponsor was the wall. This bottleneck shaped the entire ecosystem in ways that had nothing to do with security. Providers spent months on business development before a single control was assessed, many well-built services never entered the market for lack of a partner, and some lost their FedRAMP sponsor mid-process to a contracting delay, resetting years of investment. The FedRAMP sponsor requirement, in short, was the main reason the program felt slow and exclusive even to mature security teams. What CR26 Changes CR26 introduces a Program Certification path in which a provider submits its certification package directly to FedRAMP, and FedRAMP performs the review and issues the certification without a FedRAMP sponsor. This sits alongside the traditional Agency Certification path, which still exists for providers who want or need a sponsor. The older Joint Authorization Board route no longer exists, so the Program path is now the primary sponsorless option. For a fuller picture of the rules that govern both paths, Elevate’s breakdown of FedRAMP CR26 covers the consolidated ruleset in detail. The program is also steering new entrants toward FedRAMP 20x, its cloud-native certification type, and away from the document-heavy Rev5 process. FedRAMP and federal agencies are actively encouraging entry through 20x, and the sponsorless Program path is the mechanism that makes it possible. The net effect is a genuine structural shift: a provider with a mature, cloud-native service can now begin certification on its own schedule rather than waiting for an agency to say yes. The Cost of Waiting The sponsorless window is open now, and the transition timeline gives providers a clear reason to move. CR26 takes mandatory effect on January 1, 2027, and FedRAMP stops accepting applications for new Rev5 certifications on June 11, 2027, even as it supports existing Rev5 certifications through the end of 2028. Providers who move during the early-adoption window secure a first-mover position before a wave of new entrants uses the same paths. Waiting also carries a competitive cost that is easy to underestimate. Providers who enter first are listed and citable while competitors are still assembling packages, and in a market where agencies increasingly discover services through the FedRAMP Marketplace, being early is a real advantage. The stable CR26 baseline through December 31, 2028 also means the rules will not shift underneath you for more than two years, which removes the usual reason to delay. The Sponsorless Paths and When They Open FedRAMP opened its new pipelines on a firm public schedule that it confirmed in its latest 20x Community Working Group meeting and publishes on its official important-dates page. The table below shows the milestones that matter for a provider certifying without a FedRAMP sponsor. Date What opens Who it is for July 6, 2026 Initial Implementation Marketplace listing Any provider starting the process; listing is now the first step July 28, 2026 FedRAMP Ready becomes Legacy New entrants redirected to a FedRAMP 20x Class A Certification August 3, 2026 FedRAMP 20x Class A pipeline New entrants with a qualifying prior audit August 10, 2026 Temporary Rev5 Program pipelines (Ready Conversion, Lost Sponsor) Providers with an active FedRAMP Ready or a lost sponsor August 31, 2026 FedRAMP 20x Class B and C pipeline Providers pursuing enterprise-tier 20x certification The pattern is deliberate. New entrants without prior FedRAMP investment start with a FedRAMP 20x Class A Certification when that pipeline opens on August 3, then move up to Class B or C after August 31. Providers who already spent money on Rev5, by earning a FedRAMP Ready or getting deep into an agency review before losing their sponsor, get temporary pipelines on August 10 so that investment is not wasted. The three subsections below explain each route and who qualifies. FedRAMP 20x Program Certification FedRAMP 20x is the cloud-native certification type, and its
FedRAMP Consultant: What CR26 Changes About the Advisor Role for CSPs
Hiring a FedRAMP consultant in 2026 is a different decision than it was a year ago, because the Consolidated Rules for 2026 (CR26) rewrote the vocabulary, the deliverables, and the vetting criteria that separate a current advisor from a dangerous one. FedRAMP itself no longer uses the language most consultants were trained on, and it now tells cloud service providers directly that an advisor still speaking the old terminology is a warning sign. For a CSP evaluating who to trust with a federal market entry, that single shift reorders the whole vetting process. This article explains what FedRAMP actually recognizes as an advisor, what CR26 changed about the terminology and deliverables that advisor must master, and how to test a candidate before you sign. Why the FedRAMP Consultant Decision Changed Under CR26 The market word is consultant. FedRAMP’s word is Advisor, and under CR26 the gap between a current Advisor and an outdated one is now measurable in the terminology they use in the first conversation. FedRAMP renamed the game, and the terminology is now a vetting test CR26 did not invent the advisory role. FedRAMP has long listed Advisory Services in its Marketplace, and it still does, though it lists them without any formal quality review or endorsement. What CR26 changed is the entire model an advisor has to be fluent in. The program retired the vocabulary that defined FedRAMP for a decade and replaced it with a new structure built around Certification, Classes, and measurable security outcomes. FedRAMP has been unusually blunt about what this means for hiring. Its own guidance states that if an advisor offers to help you obtain a FedRAMP Authorization, or talks about impact levels of Low, Moderate, and High, that is an immediate warning that they are not following changes to FedRAMP, because FedRAMP no longer uses that terminology. The words a consultant chooses are now a live test of whether they are current or coasting on legacy knowledge. For the full picture of the rules driving this shift, see Elevate’s explainer on what the 2026 Consolidated Rules actually mean for cloud providers. The core problem: stale advisors are actively dangerous now An outdated advisor used to be merely inefficient. Under CR26, an outdated advisor is a liability, because the deliverables themselves changed. A consultant who builds you a traditional System Security Plan, sets up a continuous monitoring program in the old sense, and prepares a Plan of Action and Milestones is preparing artifacts that no longer match the program. Each of those has a CR26 replacement, and evidence assembled against the old model is rework waiting to happen. The risk compounds because FedRAMP moved from a requirements checklist to a capabilities model. A CSP that hires an advisor still thinking in terms of satisfying a static control list, rather than demonstrating measurable security outcomes, ends up with a program built on the wrong foundation. Fixing that after the fact costs far more than vetting properly at the start. Currency is also not a one time check. FedRAMP now communicates through community discussions and frequent updates rather than a static rulebook, so a capable advisor tracks those changes and can explain the reasoning behind them. Elevate’s recap of the 2026 Community Working Group updates for CSPs is one example of the moving context a current advisor is expected to follow closely. The cost of hiring the wrong advisor The cost of a stale advisor shows up in three ways. First, wasted effort: artifacts prepared against retired terminology and structures that have to be rebuilt. Second, lost time against hard deadlines, which matters because the CR26 transition runs on a fixed calendar that closes legacy paths on specific dates. Third, reputational exposure with the agency customer, because a provider whose advisor misunderstands the current program signals immaturity at exactly the moment it needs to signal readiness. None of these are hypothetical. They follow directly from the terminology and deliverable changes CR26 introduced, which is why the vetting bar is higher now than it has ever been. Consider the practical sequence: a provider engages a firm on the strength of a polished pitch, spends a quarter assembling a System Security Plan and a monitoring program in the legacy sense, then discovers at review time that the program expects a Security Decision Record and an outcomes based demonstration through Key Security Indicators. The wasted quarter is not just cost, it is a missed window against a calendar that does not pause, and it often lands at the exact moment an agency customer is deciding whether the provider looks ready. Vetting for CR26 currency at the start is the cheapest insurance against that outcome. Consultant vs Advisor vs Assessor: What FedRAMP Actually Recognizes Before vetting anyone, a CSP needs to understand the roles FedRAMP recognizes, because the market blurs three very different functions into the single word consultant. The FedRAMP Advisor (advisory service) The Advisor, or advisory service, is the role most buyers mean when they search for a FedRAMP consultant. An Advisor guides you through preparation, helps you understand the requirements, and coaches your team toward a defensible submission. FedRAMP acknowledges that providers new to the program will almost always benefit from a high quality advisory service, even though all the official guidance is publicly available. The important caveat is that FedRAMP lists advisory services in its Marketplace for public convenience only, without quality review and without endorsement. A Marketplace listing is not a credential. It confirms that the firm asked to be listed, nothing more, which puts the entire burden of quality assessment on you. The independent assessor, and why the two are not interchangeable The independent assessor is a separate, accredited role. Independent assessors are A2LA accredited, which advisors are not, and they perform the independent evaluation of your service. An advisor coaches; an assessor judges. A CSP works with an independent assessor regardless of whether it also hires an advisor, and the knowledge gained through that assessor partnership is part of the
FedRAMP Automation: When OSCAL Actually Saves You Time
FedRAMP automation is sold as a guaranteed shortcut to faster authorization, but the truth is more conditional: the underlying technology, OSCAL, only saves time under specific circumstances, and for some providers it adds work instead of removing it. The market is full of urgency-driven messaging tied to a 2026 deadline, yet FedRAMP itself has already softened the rule that drove most of that panic. This piece cuts through the noise. It explains where OSCAL genuinely accelerates FedRAMP readiness, where it does not, and how to decide whether adopting it now is a smart investment or premature overhead for your specific situation. What FedRAMP Automation Actually Means, and Where OSCAL Fits Before deciding whether automation saves you time, it helps to be precise about what is actually being automated. The confusion in this space comes from treating OSCAL and automation as the same thing. They are not. OSCAL Is the Format, Not the Automation OSCAL, the Open Security Controls Assessment Language, is a set of machine-readable formats developed by NIST in collaboration with FedRAMP. It expresses security control information as structured data in JSON, XML, or YAML rather than as narrative text in Word documents and spreadsheets. The critical point that vendor marketing tends to blur is that OSCAL is a language, not a tool. It ships with no automation capabilities of its own. By itself, OSCAL saves no time at all. The time savings come from the tooling that produces and consumes OSCAL, which is why FedRAMP has been explicit that it will not build that software and that industry must provide it. Our OSCAL explainer covers the format itself in depth. What OSCAL Structures OSCAL covers the entire lifecycle of security documentation through a layered set of models. Understanding these models clarifies where automation becomes possible, because each model is a place where structured data can replace manual effort. OSCAL model What it represents Catalog The control catalog, such as NIST 800-53 in machine-readable form Profile A tailored baseline selection for a specific use case Component Definition Reusable components and how they satisfy controls System Security Plan The system’s documented control implementation Assessment Plan and Results What is assessed, how, and the resulting findings POA&M The Plan of Action and Milestones The Component Definition model is where much of the genuine time savings live, because it lets you describe a reusable component once and import it across multiple authorization packages instead of rewriting the same control implementations by hand. The Mandate Is Real, but Narrower Than the Panic Suggests A great deal of FedRAMP automation marketing rests on the claim that machine-readable packages became mandatory for every provider in 2026. That framing is now outdated, and acting on it without understanding what actually changed can lead you to spend money on a timeline that does not apply to you. What RFC-0024 Originally Proposed In January 2026, FedRAMP released RFC-0024, which proposed requiring machine-readable authorization packages for all Rev5 providers, with an initial compliance date of September 30, 2026 and a final deadline of September 30, 2027 after which non-compliant services would lose certification. This is the version that drove the wave of deadline-focused messaging, and it is the version most third-party content still repeats. What FedRAMP Actually Decided After the public comment period closed, FedRAMP published its initial outcome and significantly revised the proposal in response to near-universal concern about the complexity and cost of converting legacy materials. The comprehensive machine-readable requirement now applies only to Rev5 Class D, the High baseline. For other Rev5 providers, FedRAMP committed to gradual adoption over a much longer period while still expecting all Rev5 providers to modernize within roughly two years. The final requirements and timelines were folded into the Consolidated Rules for 2026, and our FedRAMP CR26 breakdown covers where those rules landed. Where 20x Fits The picture differs for FedRAMP 20x, which was built around machine-readable submissions and automated validation from the start. RFC-0024 applied only to the Rev5 process and never governed 20x. If you are pursuing 20x, machine-readable data is not an optional add-on; it is the foundation of the path, validated through Key Security Indicators. The table below summarizes who actually faces what. Provider type Machine-readable requirement Practical timeline FedRAMP 20x Required by design, validated through KSIs In effect for the 20x path Rev5 Class D (High) Comprehensive per-service materials required Phased, with changes integrated twice yearly Other Rev5 (lower classes) Gradual modernization expected Within roughly two years, per CR26 The takeaway is that the existential deadline most providers were warned about does not apply to most providers. That changes the OSCAL decision from a panic into a deliberate question of timing and return. When FedRAMP Automation Saves You Time OSCAL and the tooling around it deliver real, sometimes dramatic, time savings, but only when the conditions favor it. These are the situations where adopting automation pays off. When You Run Multiple Offerings The strongest case for OSCAL is repetition. If you maintain several cloud service offerings, each with its own System Security Plan, the traditional approach forces you to document the same shared controls and components over and over in separate Word documents. OSCAL’s reusable component model lets you define a component once and import it across every package, which eliminates the copy-paste burden that consumes enormous effort at scale. The more offerings you maintain, the larger this saving becomes. When You Will Maintain Authorization Over Time Authorization is not a one-time event. Continuous monitoring, annual assessments, and significant change updates all require touching your documentation repeatedly over the life of the authorization. When your compliance data lives as structured information, updates propagate cleanly and validation runs automatically, which compounds the savings across every maintenance cycle. The reuse benefit that looks modest at initial authorization grows substantial over a multi-year authorization lifecycle. When You Have Tooling and a Mature Program OSCAL only saves time when paired with a platform or scripting pipeline that produces and validates it, and when the underlying security program is already
ISO 27001 vs NIST 800-53: How Much Transfers to Your FedRAMP Effort
ISO 27001 vs NIST 800-53 is the comparison that actually determines how much of your existing security program transfers when you pursue FedRAMP, because FedRAMP is built directly on the NIST 800-53 control catalog. The honest answer is encouraging at the foundation and sobering in the details. The two frameworks overlap heavily in concept, but the control-by-control mapping is partial, and FedRAMP demands a depth of technical implementation and a set of federal-specific controls that ISO 27001 never asks for. There is also a new development worth knowing, because a 2026 FedRAMP rule now creates a formal, if narrow, path to reuse an ISO 27001 certification for a temporary federal authorization. This piece breaks down exactly what overlaps, what does not, and how to sequence the work so your ISO 27001 investment does as much FedRAMP duty as it legitimately can. What Each Framework Actually Is, and Why the Comparison Matters for FedRAMP The two frameworks were built for different purposes, and that difference explains both the overlap and its limits. One is a globally portable management system; the other is a prescriptive federal control catalog. ISO 27001 in Brief ISO 27001 is an international standard for building and operating an information security management system. The 2022 version specifies 93 Annex A controls organized across four themes, Organizational, People, Physical, and Technological, alongside mandatory management clauses 4 through 10 that govern the ISMS itself. It is risk-driven by design, which means it tells you to identify risks and select controls to address them rather than dictating a fixed list of safeguards for every system. Certification comes from an accredited independent auditor on a three-year cycle. Our guide on ISO 27001 implementation covers how the risk treatment foundation gets built. NIST 800-53 in Brief NIST SP 800-53 is the US federal control catalog, and Revision 5 contains 1,196 controls across 20 control families. Unlike ISO 27001, it is prescriptive: it specifies which controls an organization must implement based on the impact level assigned to the system through a formal categorization process. A Low baseline involves roughly 125 controls, a Moderate baseline roughly 325, and a High baseline roughly 421. NIST 800-53 is not a standalone certification you earn; instead, it serves as the control foundation for federal compliance programs, including FISMA and FedRAMP. Why FedRAMP Makes This Comparison Concrete For a cloud vendor, the ISO 27001 vs NIST 800-53 comparison is not academic, because FedRAMP adopts NIST 800-53 as its control catalog. When you pursue FedRAMP, you are implementing a NIST 800-53 baseline plus FedRAMP-specific requirements layered on top. That is why the question “how much ISO 27001 work can I reuse in FedRAMP” reduces to “how much does ISO 27001 overlap with NIST 800-53.” Under the current FedRAMP structure, the former Moderate baseline corresponds to Class C, and our breakdown of the FedRAMP CR26 consolidated rules explains how those classes map to the legacy impact levels. Dimension ISO 27001:2022 NIST 800-53 Rev 5 Origin International standard (ISO/IEC) US federal standard (NIST) Structure 93 Annex A controls plus management clauses 4-10 1,196 controls across 20 families Approach Risk-based management system Prescriptive control catalog Certification Accredited independent auditor, three-year cycle No standalone certification; basis for FedRAMP and FISMA Role in FedRAMP Not a federal requirement on its own The control foundation FedRAMP is built on The structural contrast in that table is the root of everything that follows. A management system that selects controls based on risk will never line up perfectly with a catalog that prescribes hundreds of specific controls by mandate. How Much Overlaps: The Honest Number The overlap between the two frameworks is real and substantial, but the figure you will see quoted depends entirely on what is being measured. Treating any single percentage as gospel is a mistake. High Overlap at the Concept Level At the level of broad security domains, the overlap is high. Industry analyses place it as high as the mid-90s when the question is whether both frameworks address a given concept such as access control, incident response, or risk management. Both standards are fundamentally risk-driven and cover the same core territory of information security, so at this altitude they look very similar. This is why teams with a mature ISO 27001 program often recognize most of the FedRAMP control families immediately. Lower Overlap at the Control Level The picture changes when you map specific controls one to one. At that resolution, estimates drop, commonly to around 80 percent, because NIST 800-53 is far more granular and a single ISO 27001 control often corresponds to several NIST controls or only to a control enhancement. The authoritative reference here is NIST’s own published crosswalk between SP 800-53 Rev 5 and ISO/IEC 27001:2022, which maps the relationships directly. NIST attaches an explicit warning to that crosswalk: do not assume equivalency based solely on the relationship tables, because mappings are not always one to one and the analysis can be subjective. The table below shows where the overlap concentrates and where it thins out. Security domain Overlap with NIST 800-53 What it means for reuse Access control High Existing ISO controls map closely Cryptography High Strong conceptual alignment Incident management High Comparable objectives and evidence Risk assessment High Both are risk-driven at the core Audit logging High Direct control correspondence Privacy controls Low NIST has them; ISO 27001 has no direct counterpart Program management Low NIST-specific, no ISO equivalent The pattern is consistent: the technical and governance domains transfer well, while the federal-specific control families have no ISO counterpart and represent net-new work. What Transfers Well from ISO 27001 to FedRAMP Understanding what genuinely carries over lets you avoid rebuilding work you have already done. The transfer is strongest in two areas. Policy and Governance Foundation The management-system discipline that ISO 27001 forces you to build is a genuine head start for FedRAMP. A documented risk assessment methodology, defined risk ownership, established policies, internal audit processes, and management review cadence all map to expectations FedRAMP shares. If
FedRAMP vs CMMC: When Cloud Vendors Need One, the Other, or Both
FedRAMP vs CMMC is one of the most common points of confusion for cloud vendors entering the federal market, and getting it wrong is expensive in both directions. The two frameworks sound similar, both involve federal cybersecurity, both reference NIST standards, and both gate access to government business. But they govern different things, serve different customers, and are required under different circumstances. This piece breaks down exactly what each framework covers, when your business needs one, when it needs the other, and the specific scenario where you genuinely need both. What FedRAMP and CMMC Actually Are The fastest way to cut through the confusion is to understand that these frameworks answer two different questions. FedRAMP asks whether a cloud service is safe for a federal agency to use. CMMC asks whether a defense contractor is protecting sensitive government information across its own systems. What FedRAMP Governs FedRAMP, the Federal Risk and Authorization Management Program, governs cloud service providers that sell cloud products to federal agencies. If your business offers software as a service, infrastructure, or a platform that a federal agency will use to store or process its information, that use is within the scope of FedRAMP, and the agency can only adopt your service if it holds a FedRAMP Certification. The framework is built on the NIST SP 800-53 control catalog and exists so that agencies can rely on a single, standardized security assessment instead of evaluating every vendor independently. Our guide on FedRAMP for SaaS providers covers the foundational requirements in depth. What CMMC Governs CMMC, the Cybersecurity Maturity Model Certification, governs contractors in the Defense Industrial Base that handle sensitive government information under Department of War (DoW) contracts. It applies to your organization as a whole, or to the specific systems that store, process, or transmit Federal Contract Information and Controlled Unclassified Information. CMMC Level 2 is built on the NIST SP 800-171 control set and exists to verify that defense contractors actually implement the safeguards their contracts require, replacing the prior self-attestation model with third-party assessment. The CMMC certification requirements walk through what contractors must have in place before engaging an assessor. Side-by-Side Comparison The table below summarizes the core distinctions that determine which framework applies to your business. Dimension FedRAMP CMMC What it governs Cloud services sold to federal agencies Defense contractors handling FCI and CUI Primary customer Any federal agency using your cloud service The Department of War and its supply chain Underlying standard NIST SP 800-53 NIST SP 800-171 (Level 2) Information protected Federal data inside your cloud system Federal Contract Information and Controlled Unclassified Information Who assesses FedRAMP and recognized Independent Assessors C3PAOs at Level 2, DIBCAC at Level 3 Tiers Certification Classes A through D Levels 1, 2, and 3 Outcome FedRAMP Certification CMMC Certificate of Status A useful way to remember the distinction: FedRAMP certifies a product, while CMMC certifies an organization’s handling of information. The first travels with your cloud offering; the second travels with your role in the defense supply chain. The Core Difference: Cloud Service vs Defense Supply Chain The single most important distinction is the customer relationship each framework addresses. FedRAMP is about selling a cloud service to the government. CMMC is about being a contractor or subcontractor in the defense supply chain. These are not the same business activity, and many vendors occupy only one of them. A commercial SaaS company selling a project management tool to a civilian federal agency needs to think about FedRAMP, not CMMC, because it is providing a cloud service but is not a defense contractor handling CUI. A precision machining shop that manufactures parts for a defense prime and receives controlled technical drawings needs to think about CMMC, not FedRAMP, because it handles CUI but does not sell a cloud service to the government. The frameworks only converge in a specific set of circumstances, which is where most of the genuine confusion lives. When You Need FedRAMP FedRAMP becomes mandatory when a federal agency intends to use your cloud service within its information systems. The trigger is the agency’s use of your product, not your company size or your industry. You need FedRAMP when your business offers a cloud product that federal agencies will adopt to store, process, or transmit their information. This includes SaaS applications, cloud infrastructure, and platform services. The required assurance tier depends on the sensitivity of the data the agency will entrust to your system, ranging from the entry-level Class A through Class D for the most sensitive unclassified data, under the new Certification Class structure that replaced the former Low, Moderate, and High impact levels. If you are evaluating this path, our breakdown of the FedRAMP CR26 consolidated rules explains how the current framework is structured. What does not trigger FedRAMP is selling a non-cloud product, or selling a cloud product exclusively to commercial customers with no federal agency use. The framework is specific to cloud services consumed by the federal government. When You Need CMMC CMMC becomes mandatory when your DoW contract requires it, which happens when you handle Federal Contract Information or Controlled Unclassified Information in the course of performing that contract. The trigger is contract language combined with the type of information you handle. You need CMMC when you are a defense contractor or subcontractor and the relevant DFARS clause appears in your contract. Level 1 applies to contractors handling only Federal Contract Information and permits self-assessment. Level 2 applies to contractors handling Controlled Unclassified Information and, for most defense work, requires assessment by a Certified Third-Party Assessment Organization. Level 3 applies to the most sensitive programs and involves government-led assessment. Prime contractors must flow these requirements down to subcontractors based on the actual information each one handles, which means CMMC obligations cascade through the entire defense supply chain. Selecting the right assessor is its own challenge, and our guide on how to choose a CMMC C3PAO covers the criteria that matter. What does not trigger CMMC is performing federal