Key takeaway: The FedRAMP Consolidated Rules for 2026 (CR26) identify 24 rules that apply directly to federal agencies: 13 mandatory (MUST/MUST NOT) and 11 recommended (SHOULD/SHOULD NOT). AGU rules are live now with no grace period. VER-AGM takes effect December 7, 2026 under NTC-0014 and CISA BOD 26-04. CCM-AGM phases in through mid-2027.
The three rules most agencies will break: requiring additional information beyond FedRAMP (AGU-AGC-NAR), requiring a specific certification type or path in procurement (AGU-AGC-TPP), and blocking a certified offering from following FedRAMP rules, which has no head-of-agency exception (AGU-USE-AFR).
The rules
What CR26 Means for Agencies
The FedRAMP Consolidated Rules for 2026 are machine-readable, version-controlled, and publicly maintained at github.com/FedRAMP/rules. They do not create 24 brand-new legal duties. They make explicit what was already embedded in OMB Memorandum M-24-15, FISMA, OMB Circular A-130, and FIPS-200, and they assign those obligations directly to agencies.
Of the 246 total FedRAMP rules across 17 families, 24 apply directly to agencies: 13 are mandatory (MUST/MUST NOT) and 11 are recommended (SHOULD/SHOULD NOT). The mandatory rules are enforceable obligations. The recommended rules describe how FedRAMP expects a mature agency program to operate, and the two VER-AGM rules carry a hard external date through CISA BOD 26-04 that makes them functionally mandatory by December 7, 2026.
Three rule families, one program
| Family | Rules | Status |
|---|---|---|
| AGU, Agency Use of FedRAMP Certified Cloud Services | 20 rules | Live, July 4, 2026. No grace period. |
| CCM-AGM, Collaborative Continuous Monitoring, Agency Guidance | 2 rules | Phasing in by provider type through mid-2027. |
| VER-AGM, Vulnerability Evaluation and Reporting, Agency Guidance | 2 rules | Effective December 7, 2026 (NTC-0014). Grace period to March 7, 2027. |
AGU is live now. If your agency already uses FedRAMP certified cloud services and has not verified compliance with its 20 rules, you are already out of alignment.
Your duties
The 13 Mandatory Obligations
Maintain agency-wide FedRAMP policy
Your agency policy must align with M-24-15. This is the umbrella rule from which all other AGU obligations follow.
Make your GRC tooling machine-readable
Internal governance, risk, compliance, and inventory tools must produce and ingest machine-readable artifacts in the formats FedRAMP specifies. A spreadsheet-based program does not satisfy this rule.
Notify FedRAMP when you authorize a cloud service
On authorizing use of any cloud service within FedRAMP scope, notify FedRAMP with the required information set.
Notify FedRAMP after requesting additional information
Notification follows the request. No pre-approval is needed. Clarifying questions and general questions about Certification Data are exempt.
Do not require information beyond FedRAMP requirements
Agencies MUST NOT require information or materials beyond what FedRAMP requires without a demonstrable-need determination by the agency head or authorized delegate, plus FedRAMP notification afterward. Clarifying questions and general questions about Certification Data are exempt.
Do not require a specific Certification Type or Path
Agencies MUST NOT require Rev5, 20x, Program Authorization, or Agency Authorization without a demonstrable-need determination and FedRAMP notification. Procurement language is the most common place this rule is broken.
Follow the current rules when sponsoring
When initiating an agency-sponsored FedRAMP Certification, follow the most recent FedRAMP Consolidated Rules.
Complete the ATO process for systems that include certified offerings
FedRAMP Certification is not Authorization to Operate. Every federal information system that incorporates a certified cloud service offering still needs its own completed ATO.
Allow certified offerings to follow FedRAMP rules
This rule carries no head-of-agency exception. Agency requirements that conflict with FedRAMP rules are impermissible, full stop.
Notify FedRAMP about rescission-level concerns
When an Ongoing Certification Report, Quarterly Review, or other Certification Data raises concerns that would likely result in ATO rescission, notify FedRAMP.
Collaborate with FedRAMP on conflicts
When agency-specific security determinations conflict with the FedRAMP Certification Package, work it through FedRAMP rather than imposing requirements unilaterally. This is the formal mechanism for pushing back on a provider.
Review the Secure Configuration Guide and configure to it
Review provider-supplied Secure Configuration Guides and configure relevant security settings accordingly. Re-review when the guide version changes or a Security Change Notice shifts customer configuration responsibilities.
Review each Ongoing Certification Report
Understand how changes to the offering may affect the federal information systems that include it in their authorization boundary.
- Applies to 20x providers from January 2027
- Applies to Rev5 providers from April 2027, with grace to October 2027
Where programs fail
The Three Rules Your Agency Will Break by Habit
Most agency security teams run into problems here because the habits these rules target are deeply ingrained.
Requiring additional information
Sending a security questionnaire to a cloud provider is a reflex for most ISSO teams. Under CR26, that questionnaire is a compliance event. Before any additional-information request goes out, your agency needs a classification step: is this a clarifying question (exempt), an additional-information request (notify FedRAMP afterward, no determination needed), or an additional requirement (agency head or delegate determination required, then notify FedRAMP)? The compliant path is narrower than most teams expect.
Requiring a specific certification type or path
Procurement language is the most common place this rule breaks. Specifying “FedRAMP High authorized” or “Rev5 only” in a solicitation, without a recorded demonstrable-need determination and FedRAMP notification, puts the agency out of compliance. Your contracts and procurement officers need to know about this rule.
Blocking a provider from following FedRAMP rules
Unlike NAR and TPP, this rule has no head-of-agency exception. If an agency requirement conflicts with FedRAMP rules, the agency requirement loses. There is no carve-out.
The compliant flow when you genuinely need more
- 1Classify the ask
Clarification (exempt), additional-information request, or additional requirement / required type-path.
- 2Additional-information request
Submit the request, then notify FedRAMP afterward via the Additional Information form (NAI, MUST). No pre-determination needed.
- 3Additional requirement or required type/path
Agency head or delegate records a demonstrable-need determination, then notify FedRAMP (NAR/TPP).
- 4Keep the record
The request, the determination where one applied, and the notification.
Next hard date
The December 7 Deadline: VDR and VER
Vulnerability Detection and Response (VDR) and Vulnerability Evaluation and Reporting (VER) apply to every FedRAMP Certified offering, all classes, Rev5 and 20x.
December 7, 2026 is the date VER-AGM takes effect under NTC-0014, FedRAMP's response to CISA BOD 26-04.
- Dec 7, 2026Next
VDR and VER take effect
Applies to every offering obtaining or maintaining certification (NTC-0014, FedRAMP's response to CISA BOD 26-04). The VER-AGM agency rules start here.
- Jan 1, 2027Next
CR26 mandatory
Collaborative Continuous Monitoring obtain date for Rev5 providers. 20x providers start CCM-AGM-ROR review this month.
- Mar 7, 2027Next
VDR and VER grace period ends
After this date FedRAMP Certification can be revoked for providers that have not adopted the rulesets.
- Apr 2, 2027Next
CCM maintain date, Rev5
Rev5 providers reach the maintain date for CCM, with grace to October 1, 2027.
Your agency obligations under VER-AGM
- Filter the provider's vulnerability report to vulnerabilities relevant to your use case and FISMA system
- Compare provider PAIN ratings against your agency's own impact determination
- Update your agency POA&Ms based on the filtered view
- Where relevant under agency security policy, feed provider vulnerability data into your POA&Ms (including accepted vulnerabilities you continue to carry)
The two VER-AGM rules are SHOULD under CR26 alone, but BOD 26-04 does not offer the same flexibility. A grace period to March 7, 2027 applies under NTC-0014.
What providers must send you (per VER)
Each VDT record must include: tracking ID, detection time and source, evaluation time, internet-reachability and exploitability determination, PAIN rating (N1 to N5, current and historical), each completed impact reduction with timing, overdue status with explanation, and final disposition. Accepted vulnerabilities are reported separately as AVI records.
Reports are delivered at minimum monthly (human-readable) and persistently (machine-readable, validated against FedRAMP-published VDT and AVI JSON schemas). Class D providers detect on the tightest cadence (SHOULD): daily for machine-based resources, every 7 days for drift-prone resources, monthly for non-drift resources. See the FedRAMP VDR and VER requirements guide and the VDR and VER hub page.
For continuous monitoring across your FedRAMP certified cloud environments, Cybertorch provides FedRAMP Certified Class D (High) SOC-as-a-Service staffed by U.S. citizen analysts who integrate with your agency's incident intake and triage workflows.
Continuous monitoring
The Quarterly CCM Rhythm
For every Class B to D provider your agency uses, the CCM cycle runs as follows:
- 1Provider publishes the OCR
Every three months; next publish date is public (CCM-OCR-NRD).
- 2Agency reviews it
CCM-AGM-ROR, MUST. Does anything change the risk tolerance documented in your ATO? Weight review depth by Security Category (CCM-AGM-CSC, SHOULD).
- 3Quarterly Review meeting
Provider hosts. Mandatory for Class C/D, SHOULD for Class B, MAY for Class A. Occurs 3 to 10 business days after OCR publication. Your designated Senior Official attends (AGU-USE-DSO, SHOULD).
- 4Escalate if needed
AGU-USE-NFC, MUST. Notify FedRAMP when concerns would likely lead to ATO rescission. Notify the provider as well (AGU-USE-NPC, SHOULD).
The 8 things every OCR must contain
Per CCM-OCR-AVL, verify that your provider's report addresses all eight before marking it as reviewed:
- 1Changes to Certification Data since the last OCR
- 2Planned changes over the next 3+ months
- 3Accepted vulnerabilities (current status)
- 4Transformative changes made or planned
- 5Updated security, configuration, and usage recommendations
- 6Full list of agencies directly using the product
- 7FedRAMP Reportable Incidents, or attestation that none occurred
- 8Lessons learned and changes made or planned after Reportable Incidents
If a provider's OCR does not address all eight, it is not a compliant OCR. Your agency review should verify this before marking the report as reviewed.
What to demand
What Your Providers Must Give You
Once your agency is a customer, you are a “necessary party” (FRD-ANP) under CR26. These are provider obligations, but knowing them tells you what to demand and what to escalate when a provider denies access.
| Rule | Class | Requirement |
|---|---|---|
| CDS-TRC-USH | B to D | Uninterrupted access to Certification Data. No per-request manual approvals. |
| CDS-TRC-PAC | B to D | Documented programmatic access to all Certification Data, including human-readable materials. |
| CDS-CSO-HAD | B to D | Historical OCR snapshots, kept for the life of the certification. |
| CDS-UTC-AAD | All | Provider must notify FedRAMP within 5 business days of denying an agency access request. |
| CDS-TRC-ACL | B to D (SHOULD) | Six months of access summaries; your portion available to you on request. |
| CDS-TRC-SSM | B to D (SHOULD) | Self-service user management within the trust center. |
Rev5 migration watch (CDS-CSF-TCM): When a Rev5 provider migrates from USDA Connect to a trust center, they must notify your agency and leave forwarding instructions in the old secure folders. Every ingestion path changes at once. Watch for the migration notice.
On responsible sharing (CDS-CSO-RIS): Providers must share enough for authorization decisions but should not include exploit-enabling detail. Expect abstraction in vulnerability reports. AGU-USE-RCF is the formal mechanism to push back when abstraction becomes insufficiency.
Ownership
Roles: Who Owns What
| Role | Primary Responsibilities |
|---|---|
| Authorizing Official | Signs ATOs; owns NFC decisions (AGU-USE-NFC) |
| Designated Senior Official | Represents agency at Quarterly Reviews; leads OCR review (AGU-USE-DSO, SHOULD) |
| CISO | Compliance policy, risk thresholds, program tracking across all certified services |
| ISSO / Tenant Admins | SCG configuration settings, system-level review, day-to-day configuration compliance |
| SOC Provider | Incident intake; triage against agency systems |
| FedRAMP Liaison | Shared inbox; ATO filings; NAI/NFC notifications to FedRAMP |
| Head-of-Agency Delegate | NAR/TPP demonstrable-need determinations (the only authorized path to requiring extras) |
Start now
90-Day Action Plan
Inventory and close the ATO loop
Build a complete inventory: every FedRAMP-certified service your agency uses, keyed by FedRAMP ID, linked to every FISMA system that includes it. Confirm each of those systems has a completed ATO (AGU-USE-ABU). Certification is not Authorization. Without this record you cannot run the rest of the program.
Name and connect
Designate your Senior Official and FedRAMP Liaison. Set up a shared agency inbox. Request trust-center access as a necessary party for all Class B to D providers you are currently authorized to use.
Govern requests
Stand up the additional-request gate and the FedRAMP notification log (covering NAR, NAI, TPP, and NAA). Before any security team sends a questionnaire or demands additional information from a provider, it passes through this gate. This is how you prevent AGU-AGC-NAR violations before they happen.
Start the rhythm
Calendar every provider's next OCR and Quarterly Review date (CCM-AGM-ROR, AGU-USE-ROR). Review SCGs per tenant (AGU-USE-RSG). Confirm your GRC tooling can produce and ingest FedRAMP machine-readable artifacts (AGU-AGC-GRC). The program runs on cadence. Build the calendar first.
For agencies looking to automate machine-readable compliance tracking and artifact ingestion, NISTcompliance.ai is built to handle the GRC data flows CR26 requires, including OSCAL and FedRAMP-format outputs, and it operates inside the Cybertorch FedRAMP boundary.
Build the agency program before the deadline
Quzara works directly with federal agency security teams on FedRAMP authorization, continuous monitoring, and the structural changes CR26 imposes on agency programs. Our advisory practice covers AGU governance setup, ATO boundary documentation, CCM rhythm design, and VER and VDR program readiness. Engage Quzara through our GSA HACS vehicle or directly.
Schedule a Strategy SessionAgency obligation breakdownQuestions
Agency FedRAMP Obligations FAQ
How many FedRAMP rules apply directly to federal agencies?
Twenty-four. Thirteen are mandatory (11 MUST and 2 MUST NOT) and eleven are recommended (10 SHOULD and 1 SHOULD NOT). They sit in three families: AGU (20 rules), CCM-AGM (2 rules) and VER-AGM (2 rules).
Are the agency use rules in effect now?
Yes. The AGU family took effect on July 4, 2026 with no grace period, so an agency already using FedRAMP certified cloud services is already expected to meet its mandatory rules.
Does FedRAMP Certification replace our Authorization to Operate?
No. Under AGU-USE-ABU, every federal information system that includes a certified cloud service offering still needs its own completed ATO. Certification is not authorization.
Can we require a specific certification type or path in a solicitation?
Not without a recorded demonstrable-need determination by the agency head or delegate and notification to FedRAMP afterward (AGU-AGC-TPP, MUST NOT). That covers requiring Rev5, 20x, Program Authorization or Agency Authorization.
Can we still send a security questionnaire to a cloud provider?
Clarifying questions and general questions about Certification Data are exempt. An additional-information request requires notifying FedRAMP afterward (AGU-AGC-NAI). An additional requirement requires a demonstrable-need determination first and notification afterward (AGU-AGC-NAR).
What happens on December 7, 2026?
The Vulnerability Detection and Response (VDR) and Vulnerability Evaluation and Reporting (VER) rulesets take effect under Notice NTC-0014, with a grace period to March 7, 2027. The two VER-AGM agency rules are SHOULD under the rules text, and the ruleset effective date is mandated by CISA BOD 26-04.
Sources
FedRAMP Consolidated Rules 2026.10.13.01 (rule IDs verified October 23, 2026), CR26 Rev5 deadlines, Notice NTC-0014, OMB M-24-15. Dates checked against fedramp.gov on October 14, 2026.