FedRAMP 20x has changed the vocabulary as well as the process – the System Security Plan and POA&M you spent years maintaining are being retired. This pack is rebuilt for the FedRAMP Consolidated Rules launched in June 2026. 52 editable templates, downloadable the moment you check out. On this page:
- What is in the FedRAMP Consolidated Rules pack
- The Rev5 sunset has dates, and they are closer than they look
- Who needs FedRAMP Consolidated Rules
- How the documents map to the framework
- Frequently asked questions
- Related toolkits
What is in the FedRAMP Consolidated Rules pack
The pack covers both the new 20x artefacts and the Rev5 baseline set, because most providers are running both during the transition:
- Certification Package Overview – the 20x replacement for the System Security Plan as the top-level package document
- Security Decision Record – where security decisions and their rationale are captured, in place of narrative buried in an SSP
- Accepted Weaknesses List – the successor to the Plan of Action and Milestones
- Ongoing Certification – the continuous approach that replaces periodic reauthorization
- Eight JSON companions built on FedRAMP own published schemas, for the machine-readable submissions 20x moves towards
- The full NIST SP 800-53 Rev 5 baseline set – 18 control-family policies covering the families a FedRAMP baseline draws on
- Plans – configuration management, contingency, incident response, continuous monitoring, supply chain risk management and awareness training
- Assessment – security assessment plan and report, and the 3PAO engagement material
- Workbooks – the control implementation summary, customer responsibility matrix and the inventory workbooks
The Rev5 sunset has dates, and they are closer than they look
FedRAMP launched the Consolidated Rules on 25 June 2026, and the timetable is published. From 7 December 2026 providers adopt the Vulnerability Detection and Response and Vulnerability Evaluation and Reporting rulesets. From 1 January 2027 the Consolidated Rules are mandatory. From 11 June 2027 no new Rev5 applications are accepted. Grace periods end on 1 February 2028, and Rev5 sunsets entirely on 31 December 2028.
The substantive change is not just naming. FedRAMP 20x moves toward machine-readable, continuously validated evidence rather than large narrative documents assessed periodically. That is why the JSON companions matter – they are built on FedRAMP own schemas rather than being a generic export.
For a provider already authorized under Rev5, the practical question is when to convert. Starting early means running both vocabularies for a period, which this pack supports by including the Rev5 baseline set alongside the FedRAMP Consolidated Rules artefacts rather than replacing it outright.
Who needs FedRAMP Consolidated Rules
Cloud service providers pursuing a FedRAMP authorization for the first time, who should build directly to 20x rather than to a regime being retired. Providers already authorized under Rev5 with a conversion to plan before the 2028 sunset. 3PAOs and consultants supporting either. And providers holding GovRAMP or StateRAMP authorizations who want to reuse evidence through reciprocity.
How the FedRAMP Consolidated Rules maps to the framework
The shift from documents to records is the thing to understand. An SSP was a narrative you wrote and an assessor read; a Security Decision Record is a structured artefact capturing a decision and its justification at the point it is made. Providers who treat the new templates as renamed old ones produce packages that read as retrofits, which is visible to a reviewer.
Frequently asked questions
Do we still need an SSP and POA&M?
During the transition, in practice yes – but they are being retired. The Certification Package Overview replaces the SSP and the Accepted Weaknesses List replaces the POA&M. Both vocabularies are included here.
What are the key dates?
7 December 2026 for the vulnerability rulesets, 1 January 2027 for mandatory Consolidated Rules, 11 June 2027 for the last Rev5 applications, 1 February 2028 for the end of grace periods and 31 December 2028 for full Rev5 sunset.
What are the JSON companions?
Machine-readable files built on FedRAMP own published schemas, supporting the continuous, automated validation approach 20x is moving to rather than periodic document review.
Does this cover GovRAMP or TX-RAMP?
Not directly, though the control evidence is largely reusable through reciprocity. See the GovRAMP and TX-RAMP Toolkit.
How many documents are included?
52 editable templates, including the eight JSON companions and the 18 control-family policies.
Related toolkits
Government cloud authorization overlaps across programmes. See the GovRAMP and TX-RAMP Toolkit for state and local, the NIST SP 800-53 Toolkit for the underlying catalogue, the CMMC Toolkit for defense contracts and the SOC2 Toolkit for commercial customers. The NIST CSF toolkit gives the framework-level view above the authorisation package.
Implementing for clients? The Consultant Package licenses all 86 toolkits and assessment tools on this site for unlimited client engagements, under one firm-wide licence. One payment of $1,399, no subscription and no per-client fee.
Delivery, format and licence
Your FedRAMP Consolidated Rules downloads immediately after checkout as native Microsoft Word and Excel files. Nothing is watermarked or locked, so you can rebrand the documents, bring them under your own document control and revise them for as long as you need them.
One-time purchase. No subscription and no annual renewal. Because the source files behind the FedRAMP Consolidated Rules are yours, revising a procedure after an audit finding or a change of scope is an internal edit rather than another purchase.
Reviews
There are no reviews yet.