FedRAMP compliance is undergoing one of its biggest restructurings in years through Change Request 26 (CR26), anchored by two critical notices published on February 25, 2026: NTC-0004 and NTC-0005. Together, they reshape how FedRAMP authorizations are labeled, how Marketplace participation works, and what providers should expect as rules consolidate in 2026.
At a practical level:
-
NTC-0004 standardizes authorization language into a single designation: “FedRAMP Certified”, and introduces Certification Classes A through D to reduce confusion in procurement.
-
NTC-0005 updates Marketplace participation rules, including removing pricing publication expectations, adjusting attestations, clarifying requirements for recognized assessors, and pushing toward more machine-readable requirements.
This article explains what changed, why it matters, and how to build a compliance roadmap before the end-of-June 2026 implementation window.
Understanding FedRAMP CR26: NTC-0004 and NTC-0005 overview
On February 25, 2026, FedRAMP published two interconnected notices that establish the direction for the 2026 Consolidated Rules. Both notices reflect initial outcomes from public comment periods that closed on February 19, 2026.
If you only read one section, read this
|
Change |
Notice |
Who it impacts |
Practical effect |
|
“FedRAMP Certified” becomes the official label |
NTC-0004 |
CSPs / agencies / procurement |
Standardize wording across proposals and websites. |
|
Certification Classes A–D replace “levels” |
NTC-0004 |
CSPs / agencies |
Clearer baseline labeling; less DoD Impact Level confusion. |
|
No Marketplace pricing publication |
NTC-0005 |
CSPs / 3PAOs / advisors |
Removes a major listing friction point. |
|
3PAO recognition requires 2 assessments every 2 years |
NTC-0005 |
3PAOs |
Forces market clarity; filters out “paper-only” recognition. |
|
Program Certification must pick Rev 5 or 20x |
NTC-0005 |
CSPs |
Prevents duplicative FedRAMP effort; requires a strategy choice. |
CR26 publication timeline and validity period
FedRAMP plans to publish the FedRAMP Consolidated Rules for 2026 (CR26) by the end of June 2026, and indicates the rules will remain valid until December 31, 2028.
That window matters because it gives organizations a stable runway to:
-
normalize new terminology and baseline labels across procurement, contracts, and customer-facing collateral
-
operationalize Marketplace participation requirements
-
modernize evidence workflows to keep packages current in a cloud environment that changes weekly, not annually.
What NTC-0004 changes: FedRAMP Certification terminology and Class structure
NTC-0004 addresses a persistent issue in federal procurement and vendor messaging: inconsistent authorization labels create confusion for agencies and CSPs. The notice establishes a simplified, unified naming approach.
Single official label: “FedRAMP Certified”
NTC-0004 establishes FedRAMP Certification (or FedRAMP Certified) as the single official label for all FedRAMP authorizations.
What this means in practice
-
Update external collateral to use “FedRAMP Certified” consistently, especially in proposals, security pages, and marketplace language.
-
Remove mixed language that implies separate “tiers” of legitimacy across authorization paths.
No separate “Validated” designation for 20x vs Rev 5
NTC-0004 eliminates separate designations such as “FedRAMP Validated” to distinguish between 20x and Rev 5. Instead, FedRAMP plans to differentiate paths using Marketplace filters rather than new labels.
Why this matters
-
The “label war” goes away.
-
Buyers can still filter for the path they need without forcing CSPs into confusing marketing language.
Certification Classes A through D replace “levels”
FedRAMP will avoid “levels” or numbered baseline labels to reduce confusion with DoD and DON Impact Levels. Instead, FedRAMP introduces Certification Classes A, B, C, and D.
This shift emphasizes an important point: baselines describe the scope and depth of assessment materials, not a universal judgment of “how secure” a system is.
Planned Class mapping for Rev 5
FedRAMP provides an initial mapping for Rev 5:
-
Class A: new pilot baseline
-
Class B: current Li-SaaS plus Low baseline requirements
-
Class C: current Moderate baseline requirements
-
Class D: current High baseline requirements
FedRAMP also indicates 20x requirements will be formalized in CR26 and aligned with the Rev 5 Classes.
Key clarification agencies should reinforce internally
FedRAMP reiterates that a FedRAMP Certification is not a blanket guarantee that a service is appropriate for a given FIPS 199 category within a specific agency environment. Agencies still authorize operation using the Risk Management Framework, and the FedRAMP package is meant to accelerate and standardize the agency’s review, not replace it.
What NTC-0005 changes: Marketplace rules and assessment requirements
NTC-0005 focuses on Marketplace participation and recognition mechanics. The theme is consistent: remove friction where it blocks adoption, and tighten expectations where it reduces clarity.
Pricing information will not be requested or published
FedRAMP will not request, store, or publish pricing information for cloud services, independent assessors, or advisory services on the FedRAMP Marketplace.
Practical impact
-
CSPs and partners can participate without exposing pricing details in a centralized government listing.
-
Agencies lose a “one-stop price lookup,” but FedRAMP now has a clear explanation for why pricing is not available through Marketplace.
Advisory attestations become optional
FedRAMP plans to rewrite advisory service attestation requirements as optional, removing the mandate for advisory services to maintain positive CSP attestations to be listed.
Practical impact
-
Lower barrier to entry for advisory service listings
-
Less relationship-driven gatekeeping for Marketplace inclusion
Independent assessor recognition: 2 assessments every 2 years
FedRAMP plans to require recognized independent assessors to complete at least two assessments (initial or annual) every two years to maintain recognition, with clock start rules and a grace period. A path is also planned to avoid loss of recognition if the assessor demonstrates intent to perform required assessments but timelines are outside their control.
Practical impact
-
The Marketplace should better reflect who is actively assessing versus who sought recognition without ongoing assessment activity.
-
Agencies and CSPs get a clearer signal of assessor operational credibility.
“Ongoing demand” narrowed to providers without an agency ATO
FedRAMP updates the “Demonstration of Ongoing Demand” rule to apply only to cloud services without an agency Authorization to Operate, while clarifying it is meant to justify the use of government resources, not punish providers.
Program Certification must pick Rev 5 or 20x
FedRAMP clarifies “Pick One: 20x or Rev 5” applies specifically to Program Certification (FedRAMP as sponsor). A CSP could pursue a second path via an agency-sponsored authorization, but maintaining both separately would be complex and likely confusing.
Continuous progress measured against CSP-stated goals
FedRAMP clarifies that “continuous progress” will be measured against goals the cloud service provider includes in Ongoing Authorization Reports. FedRAMP frames this as a transparency and customer-facing opportunity.
Target Authorization Time penalties clarified
FedRAMP clarifies it will not apply penalties for minor issues that are easy to correct. The penalty intent is for situations where packages are demonstrably insufficient or require repeated information requests that prevent timely decision-making.
JSON schema for required web information
CR26 will include a JSON schema for required website information for independent assessors and advisory services, along with validation guidance. This is a clear signal toward machine-readable Marketplace participation requirements.
Why the ecosystem is shifting from documents to data
These notices are not only about labels and Marketplace mechanics. They sit inside a broader FedRAMP shift that the ecosystem has been openly discussing: traditional, monolithic Word-based SSP workflows do not scale for modern cloud change rates.
In FedRAMP Community Working Group discussions, industry experts emphasized a move toward:
-
service-specific security artifacts instead of one “everything SSP”
-
API-driven, machine-readable packages that can be ingested and validated
-
automation beyond format choices so updates are frequent and reliable
-
a hard operational reality: if timely package updates become an expectation, manual document maintenance becomes a compliance risk
A key takeaway: OSCAL is a data format, not an automation strategy. Real scalability comes from tooling and engineering workflows that generate evidence as a side effect of normal operations.
If you want help translating these expectations into a scoped evidence architecture for your environment, Book a Readiness Call and we will pressure test your package model, service boundaries, and update cadence.
Impact on cloud security strategy by organization type
Cloud Service Providers (CSPs): marketing, packaging, and path strategy
What to change now
-
Standardize collateral and proposal language to FedRAMP Certified.
-
Prepare customer-facing explanations for Certification Classes A–D, including how they map to Low, Moderate, and High expectations.
-
Decide whether your Program Certification strategy will be Rev 5 or 20x, and document the rationale.
-
Treat “continuous progress” as a customer-visible signal, not only an internal compliance artifact.
-
Start planning for service-scoped evidence and faster change transparency, especially if your offerings are modular.
Agencies and procurement teams: simplified labels, better filters, clearer expectations
What to reinforce internally
-
Use “FedRAMP Certified” as the umbrella label, and rely on Marketplace filters to differentiate paths.
-
Avoid treating baselines as pre-approved risk acceptance at a given FIPS 199 category.
-
Reward vendors who provide service-scoped artifacts and clear change transparency, because it reduces review effort and improves operational confidence.
3PAOs and independent assessors: recognition signals become performance-based
For recognized assessors, the “two assessments every two years” requirement is a meaningful signal: FedRAMP is aligning recognition with actual ongoing assessment work.
Advisory services: lower friction for listings
Optional attestations reduce barriers to listing, while machine-readable website requirements still create a clear “minimum bar” for participation.
Building your CR26 compliance roadmap before June 2026
CR26 is close enough that waiting for final rules is not a strategy. You can execute most readiness work now and adjust once CR26 publishes.
1) Fix terminology and procurement alignment (next 2 to 4 weeks)
-
Replace mixed “authorized/validated/approved” language with FedRAMP Certified across your website, proposals, and sales collateral.
-
Create a one-page buyer explainer: “What FedRAMP Certified means, what it does not mean, and how Classes A–D map to review scope.”
2) Decide your authorization path story (next 30 days)
-
If you are pursuing Program Certification, choose Rev 5 or 20x and align product, security, and sales teams on one narrative.
-
If your customers request both, document why, and identify where dual-path maintenance creates operational risk.
3) Treat “continuous progress” as measurable and publishable (next 30 to 60 days)
-
Draft Ongoing Authorization Report goals that are specific, measurable, and defensible.
-
Avoid vague goals that can’t be supported by evidence and change logs.
4) Modernize evidence production (next 60 to 120 days)
If your evidence workflow is still “update SSP in Word, update artifacts, hope it stays consistent,” you are exposed to drift.
A modern evidence model should include:
-
service boundaries and shared-responsibility mapping
-
machine-readable inventories that can generate deltas after changes
-
a change-to-evidence pipeline that identifies impacted controls and owners
-
repeatable “quality gates” before submission to reduce rework and penalty risk
If you want a practical roadmap tailored to your stack, products, and target baselines, Book a Readiness Call and we will build a phased plan that aligns engineering, security, and compliance teams on one execution track.
5) Implement submission quality gates to avoid avoidable delays (ongoing)
FedRAMP clarified that penalties are not aimed at minor fixes. They are aimed at repeatedly insufficient submissions. This is a strong signal to implement internal submission QA: completeness checks, evidence traceability checks, and version consistency checks before you submit.
Key takeaways
-
CR26 introduces major FedRAMP modernization, anchored by NTC-0004 and NTC-0005.
-
NTC-0004 standardizes authorization language to FedRAMP Certified and introduces Certification Classes A–D.
-
NTC-0005 reduces Marketplace listing friction (including removing pricing publication expectations) while tightening participation clarity and pushing more machine-readable requirements.
-
The broader ecosystem is converging on the same operational conclusion: compliance packages must evolve from manual documents to data-driven, service-scoped, automation-ready evidence.
-
Teams that modernize evidence workflows early will reduce rework, improve customer trust, and move faster in federal procurement.
FAQs
What is the new official term for a FedRAMP authorization?
FedRAMP’s planned single official label is FedRAMP Certification (or FedRAMP Certified).
Will FedRAMP create separate labels for 20x vs Rev 5, like “validated”?
No. FedRAMP plans no separate designations like “FedRAMP Validated.” Differentiation will be via Marketplace filters.
What are FedRAMP Certification Classes (A–D)?
FedRAMP plans to label baselines as Certification Classes A–D instead of “levels,” emphasizing scope and depth of assessment materials rather than overall “security quality.”
Will FedRAMP publish pricing for CSPs, assessors, or advisory services in the Marketplace?
No. FedRAMP plans to not request, store, or publish pricing information in the FedRAMP Marketplace.
Are advisory services required to maintain positive attestations to be listed?
FedRAMP plans to make advisory attestations optional, not required for listing.
How does an independent assessor maintain FedRAMP recognition under the initial outcome?
FedRAMP plans to require an assessor to complete at least two assessments every two years, with clock start rules, a grace period, and an “intent” path where timelines are outside their control.
When will CR26 be published, and how long will it be valid?
FedRAMP plans to publish CR26 by the end of June 2026, and indicates the rules will be valid through December 31, 2028.