---
tags:
  - FedRAMP
  - Guidance
icon: material/gavel
hide:
  - toc
picto:
  source: person
---

<span class="picto">:lucide-person-standing:{ .person title="This content was written by a human just for this page." }</span>

# The Federal Risk and Authorization Management Program

The FedRAMP of 2026 was formally [established in law at the end of 2022](../authority/law/index.md){ data-preview }, with [government-wide guidance
released in mid-2024](../authority/m-24-15/index.md){ data-preview } that mandated a comprehensive overhaul of the program with a new vision.

The Consolidated Rules for 2026 reflect that vision, establishing a full new set of rules for modern FedRAMP.

!!! bug "Historical FedRAMP information is now often wrong!"

    A previous iteration of FedRAMP existed since 2011 with processes that were established and discussed over many years. Nearly all
    of that historical information no longer applies after FedRAMP was rescinded and replaced in 2024. Stakeholders should be extremely
    careful to avoid outdated information, especially that provided by Large Language Models and AI services.

!!! tip "Point AI services at the source material for FedRAMP rules"

    The [Source Data](../sources.md) page in the Overview contains links to the raw source data used to
    generate the FedRAMP Consolidated Rules for 2026. Each of the repositories that contain source data
    also contain instructions for AI Agents to help them process this information.

    Whenever possible, the original [Source Data](../sources.md) should be explicitly specified with
    any AI service to ensure it is primary source of truth.

---

<!--

## What FedRAMP Does in 2026

FedRAMP has an extensive and detailed set of responsibilities and mandates set in law and policy. In general, FedRAMP does the following:

1. **Creates the rules and processes** for cloud service providers to receive FedRAMP Certification and for agencies to use cloud services that
   are FedRAMP Certified or otherwise within the scope of FedRAMP.

2. **Assesses the information supplied by cloud service providers** who are seeking or maintaining FedRAMP Certification to ensure they meet
   FedRAMP requirements.

3. **Supports agency adoption** of FedRAMP Certified cloud services through technical assistance, interagency working groups, clarifying rules,
   and ensuring agencies have effective information to securely configure and deploy these services.

4. **Recognizes third-party independent assessment services** to reduce the cost of the program for taxpayers by requiring private companies
   seeking FedRAMP Certification to bear the majority of the costs for their assessment instead of the federal government.



---

## Learn More About FedRAMP

This section of the Consolidated Rules for 2026 is designed to help stakeholders understand how FedRAMP operates. Our
[official website](https://fedramp.gov) contains much more information that is updated regularly, while this content is
intended to be a snapshot that will apply throughout the effective period for the Consolidated Rules for 2026.

-->

<div class="grid cards" markdown>

-   :lucide-layers:{ .xl .middle .machine } **What is the Marketplace?**

    ---

    Learn why the official FedRAMP Marketplace is the source of truth for the status of cloud service offerings and independent assessment services.

    [FedRAMP Marketplace](../marketplace.md){ data-preview }

-   :lucide-scan:{ .xl .middle .placeholder } **When does FedRAMP apply?**

    ---

    Learn why not all cloud services are eligible for a FedRAMP Certification and when FedRAMP doesn't apply for agency information systems.

    [The Scope of FedRAMP](../scope.md){ data-preview }

-   :lucide-ruler-dimension-line:{ .xl .middle .stable } **Learn the rules.**

    ---

    Review the specific rules that FedRAMP has created for our involvement in certain processes to understand our commitment to consistency.

    [FedRAMP's Responsibilities](rules.md){ data-preview }

-   :lucide-gavel:{ .xl .middle .empty } **Who put FedRAMP in charge?**

    ---

    Review the exact laws and policies that established FedRAMP and granted it authority and responsibility, along with many expectations.

    [FedRAMP's Authority](../authority/law/index.md){ data-preview }

</div>
