Ruleset Reference¶
This section contains generated reference copies of the FedRAMP Consolidated Rules for 2026. These pages show the rules together as complete rulesets instead of carving them into stakeholder-specific sections for providers, agencies, independent assessors, advisors, or FedRAMP.
-
FedRAMP 20x
Review the 20x rulesets by certification class, including the rules and Key Security Indicators that apply to each class.
-
FedRAMP Rev5
Review the Rev5 rulesets by certification class for services that still need the Rev5 certification approach.
-
Complete Rulesets
Review each complete consolidated ruleset without filtering by certification type, class, stakeholder, or site section.
Focus on FedRAMP 20x Class A¶
FedRAMP 20x Class A is the simplest and fastest way to see the new outcome-focused approach in action. It keeps the reference small, emphasizes the most essential expectations, and makes it easier to understand how 20x uses measurable security outcomes instead of large documentation packages.
-
Start with Class A
Class A is a great place to start because it shows the core 20x structure with the least extra noise.
-
See the Class A Indicators
Review the Key Security Indicators that make Class A concrete, measurable, and easier to reason about.