FedRAMP’s Consolidated Rules for 2026 (CR26), effective July 2026, changes how cloud service providers (CSPs) achieve and maintain FedRAMP certifications. It also gives federal agencies more autonomy to adopt cloud services. Focusing on CSPs, this guide covers CR26’s impact, new CSP responsibilities, and how to operationalize compliance on Amazon Web Services (AWS). It applies when you build and maintain a FedRAMP certified cloud service offering on either AWS GovCloud (US) or the AWS US East and US West Regions.
How CR26 impacts CSPs, SIs, ISVs, and agencies
CR26 impacts organizations differently based on their role and responsibilities in the “FedRAMP ecosystem”:
- CSPs (package owners with cloud service offerings built on AWS): Target audience for new operating model. CR26 introduces new responsibilities, such as direct-to-agency change notifications.
- System integrators (SIs) and independent software vendors (ISVs) (Without FedRAMP Certification): Benefits indirectly from faster cloud adoption while remaining dependent on CSP authorization and customer responsibilities.
- Federal agencies: Gains autonomy and transparency over a CSP’s certification, shifting from centralized oversight to direct interactions and independent adoption decisions.
What changed: From “authorization to certification”
Under the legacy model, CSPs obtained a Joint Authorization Board (JAB) Provisional Authority to Operate (P-ATO) or individual agency Authorities to Operate (ATOs) through an Authorizing Official (AO). The following table summarizes the key structural changes from the legacy FedRAMP model to CR26:
| Aspect | Legacy model | CR26 model |
| Status Type | FedRAMP Authorization | FedRAMP Certification |
| Governance | Single AO | Direct CSP-to-agency notification |
| Categorization | High, Moderate, Low Impact Levels | Class D, Class C, Class B |
| Agency Role | Awaiting centralized approval | Independent adoption decisions |
Compliance changes now flow directly to agencies (instead of intermediaries) for agency-level ATO decisions. This new level of transparency is backed by annual assessments from independent assessors (contracted by the CSP), collaborative Continuous Monitoring (CONMON), and Significant Change Notifications (SCNs), as outlined on FedRAMP.gov.
These programmatic changes also establish clear responsibilities for CSPs across the supply chain:
- Separation of obligations and reporting: Control inheritance remains intact, but SCNs and collaborative CONMON are communicated directly to agencies, not to CSP dependencies.
- Certification compared to ATO: Certification belongs to the CSP. The ATO belongs to the agency.
Key CSP responsibilities under CR26
As a CSP you might face increased operational demands under CR26, from collaborative CONMON to machine-readable artifacts. AWS offers services that map to these requirements, helping you as a CSP to respond to the CR26 requirements with automation. The following are four CR26 requirements with sample AWS services for you to consider.
Requirement #1: Maintain FedRAMP certification continuously
CR26 compliance treats certification as a continuously validated state grounded on three CSP obligations:
- Maintain NIST 800-53 Rev. 5 controls appropriate to your certification class.
- Complete annual Independent Assessor assessments with ongoing control evidence collection.
- Monitor and respond to compliance drift continuously across your boundary components.
Consider the following AWS services to help meet this CR26 requirement:
| AWS Service | How it helps the CSP’s CONMON |
| Amazon Inspector | Automates vulnerability scanning and feeds Common Vulnerabilities and Exposures (CVE) findings into the CONMON reports. |
| AWS Security Hub | Provides cloud security posture management (CSPM) capabilities aggregating findings and automating NIST 800-53 Rev. 5 checks. |
| AWS Systems Manager | Automates patching and delivers audit-ready evidence for reporting. |
| Amazon GuardDuty | Machine learning (ML)-driven threat detection identifying real-time indicators of compromise. |
| AWS Config | NIST 800-53 configuration tracking and drift detection. |
| AWS CloudTrail | Logs API activity across the authorization boundary for Independent Assessor audits. |
| AWS IAM Identity Center | Fine-grained policies, multi-factor authentication (MFA), role-based access control (RBAC), and session management. |
Requirement #2: Issue significant change notifications (SCNs)
When reportable changes occur on a certified cloud service offering, as a CSP you must issue an SCN directly to subscribing agencies and the FedRAMP Program Management Office (PMO). The SCN details the update and its security impact. Key SCN tiers (per FedRAMP.gov) are:
- Adaptive change: Non-disruptive, standard feature updates or low-risk enhancements within the authorization boundary.
- Transformative change: Major architectural overhauls (for example, shifting system architecture, or replacing cryptographic modules) that alter the authorization boundary.
- Routine recurring change: Operational maintenance (for example, routine patching, certificate renewals) recurring regularly without explicit notification filings.
FedRAMP’s machine-readable JSON Schema (SCN-CSO-INF) governs SCNs and supports automated ingestion, validation, and risk evaluation. This reduces the need for manual document approvals. Each JSON notification includes content, such as scope and categorization (for example, identifying change type as adaptive or transformative).
The following AWS services can be used to satisfy this CR26 requirement:
| AWS Service | How it helps the CSP’s SCNs |
| AWS CodePipeline and AWS CodeCommit | Evaluates continuous integration and continuous delivery (CI/CD) pipelines and deployments against SCN criteria and automates pre-production “is this reportable?” decisions. |
| AWS Lambda and Amazon EventBridge | Event-driven automation tracks infrastructure changes and evaluates CR26 criteria to trigger SCN generation. |
| AWS Step Functions | Orchestrates end-to-end SCN workflows while logging executions for audit evidence. |
Requirement #3: Provide direct transparency to agencies
Agencies receive compliance data from CSPs directly through two primary mechanisms:
| Mechanism | Frequency | Purpose |
| Significant Change Notifications | As changes occur | Informs agencies of security impacts and changes with immutable audit logging. |
| Collaborative CONMON Briefings | Quarterly | Share vulnerability scans, remediation timelines, SCNs, and CONMON metrics. |
CR26 requires CSPs to use a “FedRAMP compatible Trust Center” that shares data with federal agencies so they can make their authorization decisions. Examples of data to share are historical FedRAMP certification data and per-service certification material.
Review the following AWS services to help meet this CR26 requirement:
| AWS Service | How it helps the CSP |
| Amazon Simple Storage Service (Amazon S3) | Encrypted storage for SCN packages, JSON artifacts, and reports. |
| Amazon Simple Email Service (Amazon SES) and Amazon Simple Notification Service (Amazon SNS) | Multi-channel notifications with delivery confirmation for auditable SCN distribution. |
| AWS Quick | Visualizes vulnerability trends, patch rates, and SCN history. |
| AWS Security Hub | Provides quantitative severity and remediation metrics for quarterly CONMON briefings. |
| AWS CloudTrail | Records multi-account AWS API activity to provide forensic evidence of control effectiveness. |
Requirement #4: Maintain machine-readable compliance artifacts
CR26 mandates machine-readable artifacts, like the NIST Open Security Controls Assessment Language (OSCAL) format, to govern authorization boundaries and control inheritance, which differ in scope from event-driven SCN schemas:
- JSON data (Macro-level): Programmatic access to authorization data and compliance structure via a structured, machine-readable repository (such as OSCAL).
- SCN Schemas (Micro-level): Event-driven standards for post-authorization deltas, and formats notifications for material updates, controls, and evidence without redefining overall posture.
The following AWS services help CSPs meet this CR26 requirement:
| AWS Service | How it helps the CSP |
| Amazon Bedrock | Adaptable service to assist manual reviews with transformation of legacy SSPs and Security Assessment Reports (SARs) into JSON/XML (e.g. OSCAL) and human-readable summaries (aligned with Certification Package Overview and Security Decision Record). |
| AWS Lambda | Serverless event-driven pipelines converting AWS Security Hub, AWS Config, and AWS Audit Manager data into JSON artifacts (e.g. OSCAL). |
| Amazon S3 (with versioning) | Stores JSON artifacts (e.g. OSCAL) with immutable version history for Independent Assessor and agency traceability. |
| AWS Lambda and AWS Glue | Converts compliance data to JSON schemas (e.g. OSCAL) and maps catalogs to control evidence through batch pipelines. |
| Kiro | Adaptable service to generate code for JSON schema (e.g. OSCAL) parsing, validation, and document assembly to speed up internal automation. |
| AWS Organizations and service control policies (SCPs) | Enforces account-level perimeter guardrails, preventing out-of-boundary or unauthorized service provisioning. |
| AWS Config (Advanced Queries) | Cross-account inventory tracking to verify deployments against boundary documentation. |
How a CSP can automate the CR26 schema and operationalize it
Automating a CSP’s role within CR26 starts with ingesting the schema and designing a decision tree that governs the end-to-end change classification and response process. For example, a production change enters the flow and is tested against “Does it add a new service or expand the capability boundary?”. Following the CSP’s change management policy, the change is then classified as adaptive or transformative in the workflow. This triggers the CSP’s system to automatically generate an SCN package based on the FedRAMP-compatible schema.
Ultimately, the objective of automating the workflow is to restructure internal data models and compliance operations for continuous execution rather than one-time gating, such as:
- Impact-level restructuring: Taxonomy alignment including crosswalk table mapping legacy tier to new classes (High, Moderate, and Low map to Class D, Class C, and Class B).
- SCN pipeline: Automate change detection, SCN artifact generation, and trust center updates.
- Quarterly collaborative CONMON: Shift from ad hoc reporting to recurring deliverables, delivering continuous control telemetry instead of manual attestations.
- Continuous certification and annual Independent Assessor audits: Operational FedRAMP status through annual Independent Assessor assessments and continuous evidence collection.
The bottom line
FedRAMP’s CR26 drives transparency and rapid adoption by shifting to direct, machine-readable compliance while maintaining security rigor.
Organizations investing in automation, clear documentation, and proactive agency engagement are well positioned. By using AWS services, you can compress implementation timelines, transition to automated continuous assurance, and deliver an observable, verifiable security posture.
To start operationalizing CR26 on AWS, explore the AWS Compliance Center and AWS GovCloud (US) resources, or contact your AWS account team for a CR26 readiness assessment.
