Key takeaway: As of October 14, 2026, fedramp.gov lists 35 Requests for Comment (RFCs) and 16 public notices. One RFC is open: RFC-0035, Cryptographic Module Use Rules Updates, with comments due November 17, 2026. The next hard date for providers is December 7, 2026, when the Vulnerability Detection and Response (VDR) and Vulnerability Evaluation and Reporting (VER) rules take effect under Notice NTC-0014. There is no September 2026 OSCAL deadline: RFC-0024 proposed one, and Notice NTC-0009 and Consolidated Rules 2026 (CR26) replaced it.
This tracker follows each RFC from proposal to notice to rule and shows the dates a provider has to plan against. It is built from the fedramp.gov RFC and notice indexes and carries the date it was last checked.
Dates checked against fedramp.gov on October 14, 2026. fedramp.gov is the authoritative source.
One RFC is open on fedramp.gov. Three recent RFCs have closed and are waiting on an outcome notice.
Three RFCs have closed without a posted outcome. FedRAMP announces outcomes in a notice.
Proposed three tracks: a Class D cloud-hosted pilot limited to 10 participants, a track for self-hosted and hybrid-hosted services, and a track for independent assessment services. As proposed, pilot applicants needed a CR26-compliant 20x Class C Certification before December 1, 2026. No outcome is posted yet.
Proposes a Technical Advisory Group of agency security staff on details of up to six months at FedRAMP, with an initial cohort of up to 10 members and a cohort opening planned for October 2026. No outcome is posted yet.
Proposes a certification pathway for cloud services that federal agencies operate for other agencies, mapped from the operating agency's ATO impact level: Low to Class B, Moderate to Class C and High to Class D. No outcome is posted yet.
RFC-0033 scheduled a full Class D pilot requirements RFC for October 14, 2026. It was not on the RFC index when this page was checked. FedRAMP has said 20x Class D Program Certification is coming in 2027, and Rev5 Class D requires Agency Certification.
Primary sources FedRAMP RFC index, RFC-0035, RFC-0033, RFC-0034, RFC-0032.
These dates come from the notices that announced RFC outcomes and from the CR26 deadlines page. They are fixed rules, not forecasts.
| Date | What takes effect | Who it applies to | Status |
|---|---|---|---|
| Jul 4, 2026 | 20x rules in effect: incident evaluation and response (NTC-0012), Certification Data Sharing and Significant Change Notification to obtain certification. | Providers seeking a 20x Certification. | In effect |
| Dec 7, 2026 | VDR and VER become mandatory (NTC-0014). Legacy monthly vulnerability scanning is no longer enough. | Every offering obtaining or maintaining FedRAMP Certification, Rev5 and 20x. | Next |
| Jan 1, 2027 | CR26 applies to every new Rev5 application, and to existing Rev5 offerings at the first independent assessment completed after this date (NTC-0013). Updated incident rules apply to Rev5 and to pilot 20x maintenance (NTC-0012). The Significant Change Notification ruleset applies to Rev5. | Rev5 providers, and pilot 20x providers maintaining certification. | Planned |
| Mar 7, 2027 | The VDR and VER grace period ends. Offerings that are not following the rules lose certification (NTC-0014). | Offerings on a corrective action plan. | Planned |
| Apr 2, 2027 | Collaborative Continuous Monitoring to maintain certification, Rev5 (grace period to October 1, 2027). | Rev5 providers. | Planned |
| Jun 11, 2027 | FedRAMP stops accepting new Rev5 Certification requests (NTC-0013). Significant Change Notification grace period ends June 1, 2027. | Providers planning a new Rev5 application. | Planned |
| Aug 1, 2027 | Certification Data Sharing to maintain certification, Rev5 (grace period to February 1, 2028). | Rev5 providers. | Planned |
For existing Rev5 certifications, NTC-0013 says no end date is final and that it is likely no later than 2029. NTC-0009 listed anticipated dates before CR26 was final. Where they differ, the CR26 deadlines page governs.
RFC-0024, issued January 13, 2026, proposed machine-readable packages for Rev5 providers with a September 2026 date. FedRAMP published the initial outcome in Notice NTC-0009 on March 25, 2026 and the final rules in CR26 on June 24, 2026. The CR26 schedule replaced the September date. Machine-readable data now sits under Certification Data Sharing, covered on the OSCAL page.
Primary sources CR26 important dates, CR26 Rev5 deadlines, Notice NTC-0014, Notice NTC-0013, Notice NTC-0012, Notice NTC-0009.
FedRAMP posts a proposed rule or standard for public comment, with a comment period.
The RFC moves to the closed list. Closed RFCs show their closing date.
FedRAMP posts a notice that says what changed and often gives the dates, as with NTC-0009, NTC-0012 and NTC-0013.
The final rule and its dates land in CR26, with separate dates for Rev5 and 20x.
Not every RFC ends in a rule. RFC-0019 was not finalized, RFC-0008 was superseded by RFC-0012 and RFC-0003 was entirely rescinded. A date in an RFC is a proposal until a notice or CR26 repeats it, which is how the September 2026 date from RFC-0024 fell away.
35 RFCs, newest first. Outcomes are as fedramp.gov lists them.
Every RFC on fedramp.gov from the January 2026 release to today.
| RFC | Title | Status | Outcome |
|---|---|---|---|
| RFC-0035 | Cryptographic Module Use Rules Updates | Open until Nov 17, 2026 | Opened October 14, 2026. Proposes a CMVP-Validated Module definition and changes to the cryptographic module use rules for CR26. |
| RFC-0034 | Technical Advisory Group Changes | Closed Oct 9, 2026 | No outcome posted yet. |
| RFC-0033 | 20x Phase 4 Development Tracks for 20x Class D | Closed Oct 9, 2026 | No outcome posted yet. Proposes a Class D pilot and tracks for self-hosted services. |
| RFC-0032 | Offerings By Government | Closed Sep 8, 2026 | No outcome posted yet. |
| RFC-0031 | Updated Incident Communications Procedures | Closed May 12, 2026 | Initial outcome in NTC-0012 (June 3, 2026). Effective July 4, 2026 for 20x and January 1, 2027 for Rev5. |
| RFC-0030 | Rev5 Security Controls Baseline Update for RA, SA, SC, SI and SR | Closed Apr 22, 2026 | Initial outcome in NTC-0013 (June 16, 2026). |
| RFC-0029 | Rev5 Security Controls Baseline Update for PE, PL, PM, PS and PT | Closed Apr 22, 2026 | Initial outcome in NTC-0013 (June 16, 2026). |
| RFC-0028 | Rev5 Security Controls Baseline Update for CP, IA, IR, MA and MP | Closed Apr 22, 2026 | Initial outcome in NTC-0013 (June 16, 2026). |
| RFC-0027 | Rev5 Security Controls Baseline Update for AC, AT, AU, CA and CM | Closed Apr 22, 2026 | Initial outcome in NTC-0013 (June 16, 2026). |
| RFC-0026 | Clarifying CA-7 Continuous Monitoring Expectations for Rev5 Providers | Closed Apr 22, 2026 | Initial outcome in NTC-0013 (June 16, 2026). |
| RFC-0025 | Retrospective on the Public Comment Process | Closed Apr 21, 2026 | Initial outcome in NTC-0011 (May 27, 2026). |
| RFC-0024 | Rev5 Machine-Readable Packages | Closed Mar 11, 2026 | Initial outcome in NTC-0009 (March 25, 2026), final rules in CR26. The proposed September 2026 date was replaced. |
| RFC-0023 | Rev5 Program Certifications (No Sponsor Required) | Closed Feb 26, 2026 | Initial outcome in NTC-0008 (March 6, 2026). |
| RFC-0022 | Leveraging External Frameworks | Closed Feb 26, 2026 | Initial outcome in NTC-0007 (March 3, 2026). |
| RFC-0021 | Expanding the FedRAMP Marketplace | Closed Feb 19, 2026 | Initial outcome in NTC-0005 (February 25, 2026). |
| RFC-0020 | FedRAMP Authorization Designations | Closed Feb 19, 2026 | Initial outcome in NTC-0004 (February 25, 2026). |
| RFC-0019 | Reporting Assessment Costs | Closed Feb 12, 2026 | Not finalized or implemented. Outcome in NTC-0002 (February 18, 2026). |
The RFCs that shaped 20x, Key Security Indicators and the Balance Improvement Releases.
| RFC | Title | Status | Outcome |
|---|---|---|---|
| RFC-0018 | FedRAMP Security Inbox Requirements | Closed Nov 17, 2025 | Reworked to cover FedRAMP communications. Applies to 20x and Rev5. |
| RFC-0017 | Persistent Validation and Assessment Standard | Closed Nov 17, 2025 | Published as the Persistent Validation and Assessment standard for 20x. |
| RFC-0016 | Collaborative Continuous Monitoring | Closed Nov 17, 2025 | Published as the Collaborative Continuous Monitoring standard for 20x. |
| RFC-0015 | Recommended Secure Configuration Standard | Closed Nov 17, 2025 | Published as Recommended Secure Configuration guidance. |
| RFC-0014 | Phase Two Key Security Indicators | Closed Nov 17, 2025 | Documented in the Phase Two Key Security Indicators standard. |
| RFC-0013 | SC-7 Boundary Protection Balance Improvement Release | Closed Sep 11, 2025 | Wording tweaked. All FedRAMP Rev5 baselines updated. |
| RFC-0012 | Continuous Vulnerability Management Standard | Closed Aug 21, 2025 | Released as the Vulnerability Detection and Response requirements. |
| RFC-0011 | Pilot Standard for Storing and Sharing Authorization Data | Closed Jun 22, 2025 | Released as the Authorization Data Sharing standard. |
| RFC-0010 | Scope Interpretation Technical Assistance | Closed Jun 15, 2025 | Posted publicly as the Scope of FedRAMP. |
| RFC-0009 | Significant Change Notification Technical Assistance | Closed Jun 15, 2025 | Integrated into the Significant Change Notification requirements. |
| RFC-0008 | Continuous Reporting Standard | Closed Jun 9, 2025 | Did not move forward. Superseded by RFC-0012. |
| RFC-0007 | Significant Change Notification Standard | Closed May 25, 2025 | Finalized with considerable changes. Applied to 20x. |
| RFC-0006 | 20x Phase One Key Security Indicators | Closed May 25, 2025 | Finalized and published. |
| RFC-0005 | Minimum Assessment Scope | Closed May 25, 2025 | Formalized as a 20x standard, with partial Rev5 support later. |
| RFC-0004 | Boundary Policy | Closed Apr 2, 2025 | Replaced by the follow-up RFC-0005, Minimum Assessment Scope. |
| RFC-0003 | Review Initiation Checks (RICs) | Closed Apr 2, 2025 | Entirely rescinded. |
| RFC-0002 | Proposed Revisions to FedRAMP 3PAO Requirements | Closed Apr 2, 2025 | Sent to A2LA with modifications. |
| RFC-0001 | A New Comment Process for FedRAMP | Closed Apr 2, 2025 | The RFC process continues, with periodic review. |
Primary sources FedRAMP RFC index.
FedRAMP began publishing numbered public notices on February 18, 2026.
| Notice | Posted | Title |
|---|---|---|
| NTC-0016 | Jul 22, 2026 | Outcome from the FY26 Q4 FedRAMP Security Inbox Test |
| NTC-0015 | Jul 7, 2026 | Emergency Test: FY26 Q4 FedRAMP Security Inbox Test |
| NTC-0014 | Jun 16, 2026 | FedRAMP Response to CISA BOD 26-04 (Prioritizing Security Updates Based on Risk). VDR and VER mandatory December 7, 2026. |
| NTC-0013 | Jun 16, 2026 | Initial Outcome of Rev5 Baseline RFCs (RFC-0026 through RFC-0030) |
| NTC-0012 | Jun 3, 2026 | Initial Outcome of RFC-0031, Updated Incident Communications Procedures |
| NTC-0011 | May 27, 2026 | Initial Outcome of RFC-0025, Retrospective on the Public Comment Process |
| NTC-0010 | Apr 23, 2026 | FedRAMP Response to CISA ED 25-03 |
| NTC-0009 | Mar 25, 2026 | Initial Outcome of RFC-0024, Rev5 Machine-Readable Packages |
| NTC-0008 | Mar 6, 2026 | Initial Outcome of RFC-0023, Rev5 Program Certifications |
| NTC-0007 | Mar 3, 2026 | Initial Outcome of RFC-0022, Leveraging External Frameworks |
| NTC-0006 | Feb 25, 2026 | Emergency Directive 26-03, Mitigate Vulnerabilities in SD-WAN Systems |
| NTC-0005 | Feb 25, 2026 | Initial Outcome of RFC-0021, Expanding the FedRAMP Marketplace |
| NTC-0004 | Feb 25, 2026 | Initial Outcome of RFC-0020, FedRAMP Authorization Designations |
| NTC-0003 | Feb 18, 2026 | Notification of Planned FY26 Q2 FedRAMP Security Inbox Test |
| NTC-0002 | Feb 18, 2026 | Outcome from RFC-0019, Reporting Assessment Costs |
| NTC-0001 | Feb 18, 2026 | Introducing FedRAMP Public Notices |
fedramp.gov numbers its notices 0001 through 0016, and its RFC pages refer to them as NTC. Notices announce RFC outcomes, respond to federal directives such as CISA BOD 26-04, and report operational events such as the quarterly security inbox test.
Primary sources FedRAMP notice index.
Quzara does not promise authorization timelines. These are the dates FedRAMP has published.
Move vulnerability management to the VDR and VER rules. Plan for evaluating internet reachability, exploitability and KEV status, not monthly scans alone. The grace period to March 7, 2027 runs under a corrective action plan.
If you run cryptographic modules, read RFC-0035 and comment. FedRAMP states that currently operating services do not need to change anything.
Plan the move to CR26 for your next independent assessment after January 1, 2027, and decide before June 11, 2027 whether a new Rev5 application is still your path.
Watch the RFC-0033 outcome. It proposed a Class D pilot and requires a CR26-compliant 20x Class C Certification first. Treat it as a proposal until FedRAMP posts the outcome.
Cybertorch produces the operating evidence. NISTcompliance.ai structures it into the package the rules require.
Cybertorch is a 24/7 U.S. citizen SOC on Azure Government, FedRAMP Certified Class D (High), with vulnerability management that supplies evidence for the rules effective December 7, 2026.
NISTcompliance.ai generates SSP and POA&M drafts and OSCAL from control evidence, so a rule change becomes an update to the record instead of a rewrite.
Control mapping across NIST SP 800-53 Rev 5, FedRAMP, FISMA and CMMC Level 2, so each change is checked against every framework you carry.
FedRAMP advisory, ISSO support and continuous monitoring from Quzara, available through our GSA HACS vehicle.
NISTcompliance.ai operates inside the Cybertorch FedRAMP boundary on Azure Government. AI drafts and compares, and ISSOs, assessors and authorizing officials make every determination.
Quzara advisory, Cybertorch monitoring and NISTcompliance.ai automation help you meet each date with evidence. Engage Quzara through our GSA HACS vehicle or directly.
