December 7, 2026
Vulnerability Detection and Response and Vulnerability Evaluation and Reporting take effect (Notice NTC-0014). Grace period to March 7, 2027.
FedRAMP 20x Knowledge Hub, Consolidated Rules 2026
The FedRAMP 20x Hub
Federal cloud authorization, rebuilt around continuous validation, machine-readable data and Key Security Indicators. This hub organizes Quzara's FedRAMP 20x guidance in three layers: strategic foundations, technical infrastructure, and AI automation engines. Cybertorch is FedRAMP Certified Class D (High) on Azure Government (Marketplace ID FR2214150164, DoD IL-4), and NISTcompliance.ai operates inside that boundary.
Phase 3wide-scale adoption, active now
Dec 7, 2026VDR and VER take effect
Jan 1, 2027CR26 mandatory
A to Dcertification classes
Dates checked against fedramp.gov on October 14, 2026.
Section 01
Strategic foundations: the 20x modernization framework
Understand the policy shifts, the phased rollout and the class structure that govern federal cloud certification under Consolidated Rules 2026.
Framework explainer
What Is FedRAMP 20x?
How 20x moves federal cloud authorization from point-in-time documentation to continuous, automated validation.
Read the explainer Timeline and milestonesFedRAMP 20x Roadmap
Phases 1 through 4, the CR26 rule dates, and the proposed Class D pilot, with what is due next.
View the roadmap Class structureCertification Classes A Through D
How the four classes work, which paths each one uses, and how to choose a class from the agencies you serve.
Compare the classes Continuous changeSignificant Change Notices
The CR26 notify-after model that replaces prior approval: change types, notice timing and what a notice contains.
Understand SCNs Policy intelligenceRFC and Policy Tracker
The Requests for Comment, notices and rulesets that shape provider requirements, with what each means in practice.
Track the changes Mandatory rulesVDR and VER Hub
Vulnerability Detection and Response and Vulnerability Evaluation and Reporting, effective December 7, 2026 under Notice NTC-0014.
Review the rules
Section 02
Technical infrastructure: machine-readable packages and telemetry
How software-defined architecture, NIST OSCAL and verifiable evidence replace Word and Excel artifacts.
Schema architecture
OSCAL for FedRAMP
The NIST OSCAL models, how a package fits together, and how CR26 Certification Data Sharing makes machine-readable data a requirement.
Learn OSCAL Continuous validationKey Security Indicators
The CR26 indicators, organized in 10 themes, that replace narrative control prose with measurable security outcomes.
Explore the KSIs Inheritance architectureInheritable FedRAMP Controls
Reduce the surface area of your own certification by inheriting operational security controls from Cybertorch, FedRAMP Certified Class D (High).
View inheritance
Section 03
AI automation engines: NISTcompliance.ai and Cybertorch
Cybertorch produces the evidence from 24/7 U.S. citizen SOC operations. NISTcompliance.ai turns that evidence into packages, narratives and assessor-ready records. AI drafts and compares, and people decide.
NISTcompliance.ai
OSCAL Automation Engine
Generate OSCAL packages from your control evidence and vulnerability feeds, inside the Cybertorch FedRAMP boundary.
Explore the OSCAL engine Package accelerationAI SSP and POA&M Generation
AI-assisted drafting of SSP narratives and POA&M reconciliation across FedRAMP, CMMC Level 2 and FISMA.
View AI generation Assessor surfaceAuditor Co-Pilot
Give 3PAO, C3PAO and agency assessors a way to query your evidence with AI. Answers cite their sources, and people make every determination.
Explore the Co-Pilot
Plan ahead
Dates that matter
The dates below come from FedRAMP. The roadmap page has the full list.
January 1, 2027
CR26 requirements become mandatory for providers seeking certification, including Significant Change Notification and Minimum Assessment Scope.
June 11, 2027
FedRAMP stops accepting Rev5 Certification applications. Active Rev5 certifications continue under the CR26 Rev5 deadlines.
2027
20x Class D Program Certification arrives, preceded by a pilot proposed in RFC-0033 for FY27 Q1 to Q2.
Primary sources CR26 Rev5 deadlines, Notice NTC-0014, RFC-0033, Choose a path.
Architect your FedRAMP 20x path
From Class A on-ramps to Class D operations, Quzara and NISTcompliance.ai provide the advisory, engineering and continuous assurance pipeline. Engage Quzara through our GSA HACS vehicle or directly.