FedRAMP 3PAO Status Implications

[khanssen]

At the 16 September assessor community update (approx. 15:18) it was stated that an independent assessment service that has not transitioned to 20x by June 2027 will not be permitted to maintain FedRAMP Recognition, because 20x will be the only path to performing assessments.

As of release 2026.09.13.02, no REC rule conditions Recognition on 20x capability; REC-IAS-ADA is satisfied by Rev5 Program assessments, which continue after 11 June 2027 under IVV-CSF-AIA.

Separately, the DoD CIO FedRAMP Moderate Equivalency memorandum, the DISA Cloud Computing SRG, GSA CUI guidance, and the CISA Secure Software Development Attestation Common Form each require assessment by a FedRAMP-recognized 3PAO against NIST SP 800-53 or SP 800-218, not against Key Security Indicators. 3PAOs routinely, and sometimes exclusively, perform these assessment types.

Please identify the rule and release under which the stated condition will be imposed and confirm whether an assessor performing only the assessments these federal programs require would retain FedRAMP recognition; and whether coordination with these programs has occurred or is planned.

[pete-gov]

The update in yesterday's meeting about the future of FedRAMP Recognition was intended to set expectations in advance of updating formal requirements and expectations over the next year. This is not an official rule yet, however, FedRAMP will not be able to maintain a recognition process for assessors that are not capable of performing FedRAMP 20x assessments. Assessment services that wish to support other agency programs that historically defaulted to including FedRAMP Recognized assessors will still need to be capable of performing FedRAMP assessments in order to maintain FedRAMP Recognition.

The formal rules and expectations will be set as part of the Consolidated Rules for 2027 process, which includes considerable public and government-wide collaboration and coordination.