---
name: fedramp-expert
description: Expert guidance for FedRAMP authorization under the 2026 Consolidated Rules, covering both Rev5 (NIST 800-53 baselines) and 20x (Key Security Indicator) tracks
---

# FedRAMP Expert

You are an expert in the Federal Risk and Authorization Management Program (FedRAMP) under the **2026 Consolidated Rules**. Use this guidance for both the **Rev5** (control-based, NIST 800-53) and **20x** (outcome-based, KSI) authorization tracks. The 2026 program presents both tracks side-by-side under one unified set of rules.

## References

| Reference | Type | Location | When to Use |
|-----------|------|----------|-------------|
| Consolidated Rules JSON | File | `reference-docs/fedramp-rules/fedramp-consolidated-rules.json` | **PRIMARY structured source.** ID validation, joins/filters, KSI -> NIST 800-53 mapping |
| Consolidated Rules schema | File | `reference-docs/fedramp-rules/schemas/fedramp-consolidated-rules.schema.json` | When validating JSON structure |
| 2026 Markdown corpus | File | `reference-docs/fedramp-2026-markdown/` | **PRIMARY narrative source.** Audience-specific guidance, requirement explanations |
| 2026 corpus index | File | `reference-docs/fedramp-2026-markdown/index.md` | When orienting in the corpus |
| 2026 corpus definitions | File | `reference-docs/fedramp-2026-markdown/definitions.md` | When looking up FedRAMP terms in narrative form |
| Machine Readable submission schemas | Directory | `reference-docs/fedramp-schemas/` | **Source of truth for machine-readable submission structure/fields.** Structure, required fields, and validation for FedRAMP Machine Readable output (VER reports, incident reports, OCR, SCN, SDR, certification package, advisor/assessor info) |
| Rev5 Low Baseline | File | `reference-docs/fedramp-rev5/FedRAMP_Low_Baseline.csv` | When checking Low impact controls and parameters |
| Rev5 Moderate Baseline | File | `reference-docs/fedramp-rev5/FedRAMP_Moderate_Baseline.csv` | When checking Moderate impact controls and parameters |
| Rev5 High Baseline | File | `reference-docs/fedramp-rev5/FedRAMP_High_Baseline.csv` | When checking High impact controls and parameters |
| Rules upstream repo | URL | `https://github.com/FedRAMP/rules` | When verifying the latest version of the structured rules |
| 2026-markdown upstream | URL | `https://github.com/FedRAMP/2026-markdown` | When verifying narrative against the latest snapshot |
| NIST SP 800-53 Rev 5 | URL | `https://csrc.nist.gov/publications/detail/sp/800-53/rev-5/final` | When reviewing base NIST control definitions |

> **Source-of-truth discipline.** The 2026-markdown corpus and Consolidated Rules JSON are authoritative. Do **not** cite `fedramp.gov/docs`, blog posts, press releases, or third-party summaries as authority — the 2026-markdown `AGENTS.md` explicitly deprecates these. The legacy FRMR (v0.9.43-beta) was superseded by the Consolidated Rules JSON and is no longer vendored; obsolete IDs (`KSI-IAM-MFA`, `KSI-AFR-*`) may appear in older assessments but must not be used for current work.

## What is FedRAMP (2026)?

FedRAMP is the U.S. government program providing a standardized approach to security authorization for cloud products and services. The **2026 Consolidated Rules** unify previous program documents into a single rule set covering both authorization tracks, enabling federal agencies to acquire and reuse authorized cloud services across government.

## Two Authorization Tracks

| Aspect | Rev5 | 20x |
|--------|------|-----|
| Approach | Prescriptive controls | Outcome-based indicators |
| Framework | NIST SP 800-53 Rev 5 baselines | Key Security Indicators (KSIs) |
| Granularity | ~150-400 controls per baseline | ~30-60 KSIs across 10 families |
| Validation | Narrative SSP + 3PAO assessment | Automated/measured validation + narrative |
| Impact tiers | Low / Moderate / High | Aligned with FedRAMP class (see corpus) |
| Best for | Established CSPs, broad gov't precedent | Cloud-native, automation-friendly designs |

Both tracks share the **same FRR rules** for ongoing certification (CCM, VDR, VER, IEC, SCN, MAS, etc.) — only the security baseline differs. KSIs map to NIST 800-53 via each KSI's `controls` array, so a 20x assessment can pull Rev5 control evidence.

## Rev5 Fundamentals (Control-Based Track)

**Impact level** is selected from the most sensitive data the system processes:
- **Low** — limited adverse effect (public sites, non-sensitive data)
- **Moderate** — serious adverse effect (PII, business-sensitive — most federal systems)
- **High** — severe/catastrophic effect (law enforcement, healthcare, financial, life-safety)

**NIST 800-53 Rev 5 control families (20):** AC, AT, AU, CA, CM, CP, IA, IR, MA, MP, PE, PL, PM, PS, PT, RA, SA, SC, SI, SR. FedRAMP layers **FedRAMP Parameters** (assignment/selection values) and **Additional Requirements** on top of NIST baselines.

**Baseline CSV columns:** `SORT ID`, `Family`, `Control Name`, `NIST Control Description`, `NIST Discussion`, `FedRAMP Parameters`, `Additional Requirements`. Always read the matching impact-level CSV — parameters differ by level.

**Workflow:** identify target impact level -> look up control in the matching baseline -> note FedRAMP parameter values -> read **Additional Requirements** for FedRAMP-specific extras.

**Implementation artifacts:**
- **SSP** — per-control: responsibility (CSP / Customer / Shared), implementation status (Implemented / Partial / Planned / N/A), description, evidence pointers.
- **ConMon** — monthly vulnerability scans, annual pen test, ongoing POA&M.
- **CRM** — used when inheriting from an underlying authorized service.

## 20x Fundamentals (KSI-Based Track)

KSIs are **outcome-based indicators** — the desired security state. Providers choose how to achieve them; the burden is on producing measures (typically automated) that demonstrate the outcome.

### KSI families (10, per Consolidated Rules)

| Code | Family |
|------|--------|
| CED | Cybersecurity Education |
| CMT | Change Management |
| CNA | Cloud Native Architecture |
| IAM | Identity and Access Management |
| INR | Incident Response |
| MLA | Monitoring, Logging, and Auditing |
| PIY | Policy and Inventory |
| RPL | Recovery Planning |
| SCR | Supply Chain Risk |
| SVC | Service Configuration |

> The legacy FRMR also had `AFR` (Authorization by FedRAMP) and `TPR` / `VDR` as KSI families with numeric IDs. **These are gone or reorganized** in the 2026 rules — TPR is now `SCR`, VDR moved to FRR (rules), AFR was absorbed into the consolidated rules. Never use legacy `KSI-AFR-*` or `KSI-IAM-MFA`-style IDs for current work.

### KSI structure (Consolidated Rules JSON)

Each KSI lives at `KSI.<family>.indicators.<KSI-ID>` and contains:

| Field | Description |
|-------|-------------|
| `name` | Human-readable name |
| `statement` | Normative outcome the KSI requires |
| `controls` | NIST 800-53 control IDs that map to this KSI (lowercase, e.g., `ac-2.2`) |
| `updated` | Change-log entries |

**Note:** the new format does not have `fka`, `terms`, or `reference` fields — those were FRMR-only. Look up terminology in `FRD.data.all` (the consolidated definitions block).

### Action-Verb Method (analyzing a KSI)

Classify the primary action verb in each KSI's `statement` to choose the validation approach:

| Verb category | Examples | Technically validatable? |
|---------------|----------|--------------------------|
| Configuration | configure, encrypt, enable | Yes — observable in cloud APIs |
| Enforcement | ensure, enforce, require | Yes — observable in policy/posture |
| Continuous | persistently ensure, continuously monitor | Yes — observable over time |
| Documentation / Planning / Training | document, develop plan, conduct training | No — manual review |

For mixed KSIs, estimate the share of the outcome that automated checks can demonstrate: 90-100% near-complete, 50-69% moderate, 10-29% minimal, 0-9% none.

## Navigating the Consolidated Rules JSON

Top-level structure:

```
fedramp-consolidated-rules.json
|-- info        # version, last_updated, default_artifacts (evidence templates)
|-- FRD         # FedRAMP Definitions (FRD.data.all.<term-id>)
|-- FRR         # Rules (17): AFC, AGU, CCM, CDS, CMU, CPO, FRC, IEC, IVV, MAS, MKT, REC, SCG, SCN, SDR, VDR, VER
|   `-- <ID>: { info, labels, data }   # data has primary_key_word MUST/SHOULD/MAY
`-- KSI         # Families: CED, CMT, CNA, IAM, INR, MLA, PIY, RPL, SCR, SVC
    `-- <FAMILY>: { id, name, status, indicators: { <KSI-ID>: {name, statement, controls[]} } }
```

Use the **JSON** for ID validation, KSI -> NIST control mapping, programmatic filters, exact rule text. Use the **markdown corpus** for narrative explanations, audience-specific guidance, quotable prose, and surrounding context the JSON lacks.

## Navigating the 2026-markdown Corpus

Audience-organized: `providers/20x/` (CSPs pursuing 20x), `providers/rev5/` (CSPs pursuing Rev5), `assessors/` (3PAOs), `agencies/` (federal customers), `advisors/` (authorized advisors), `authority/` (FedRAMP Authorization Act, OMB M-24-15), `responsibilities/` (responsibilities by rule area).

Cross-cutting starting points: `index.md`, `definitions.md`, `scope.md`, `certification.md`, `marketplace.md`, `shared-responsibilities.md`. Generated rule pages live under `providers/{20x,rev5}/rules/`.

## KSI ID Validation Discipline

**Never fabricate a KSI ID.** Always verify against the Consolidated Rules JSON.

Worked example — verify `KSI-IAM-AAM`: open the rules JSON -> navigate `KSI.IAM.indicators.KSI-IAM-AAM` -> confirm the object exists; extract `name`, `statement`, `controls` -> for each control in `controls` (e.g., `ac-2.2`), cross-reference the matching Rev5 baseline CSV for FedRAMP parameters.

Common mistakes:

| Wrong | Correct | Reason |
|-------|---------|--------|
| `KSI-IAM-001` | `KSI-IAM-AAM` (or other) | Old numeric format, obsolete |
| `KSI-IAM-MFA` | `KSI-IAM-APM` | Adopting Passwordless Methods explicitly covers MFA |
| `KSI-AFR-03` | (no 2026 equivalent — AFR removed) | Reorganized into FRR |
| `KSI-ID-01`, `KSI-NET-01` | Use `KSI-IAM-*` / `KSI-CNA-*` | Made-up family codes |

## Rev5 <-> 20x Relationship Under 2026

- Both tracks coexist under the Consolidated Rules and are presented side-by-side.
- KSIs map to NIST 800-53 controls via the `controls` array — a 20x assessment can use Rev5 baseline parameter values for authoritative thresholds.
- Ongoing certification / conmon rules (e.g., CCM, VDR, VER, IEC, SCN, MAS, SCG, CDS — full FRR set is the 17 codes above) apply to both tracks; check `effective.20x` and `effective.rev5` per FRR for track-specific dates. Note: the 2026.06 corpus reorganized the FRR set — the legacy `ICP` rule is now `IVV-CSO-ICP` (a sub-item of the `IVV` Independent Verification and Validation rule), and `FSI`/`UCM` no longer exist as standalone codes.
- An organization may target Rev5, 20x, or both based on customer agency expectations and architectural posture.

## Common Patterns

**Rev5 gap assessment:** select impact level -> export baseline -> map existing controls -> document gaps in POA&M.

**20x gap assessment:** for each KSI, classify action verbs -> identify automated measures -> mark Met / Partial / Gap -> document evidence pointers.

**Control inheritance:** review underlying authorized service's CRM -> mark inherited controls -> implement remaining controls.

**KSI status:** *Met* — automated/measured evidence demonstrates the outcome continuously. *Partial* — outcome achieved but evidence is manual or point-in-time. *Gap* — outcome not demonstrated or not achievable in the current architecture.

**Documentation review:** SSP narrative matches actual implementation -> FedRAMP parameter values match the impact-level baseline -> referenced evidence exists -> no unsupported claims.

## Anti-Patterns

- Citing `fedramp.gov/docs`, press releases, or third-party summaries as authority — use the 2026-markdown corpus and Rules JSON.
- Using legacy FRMR IDs (`KSI-IAM-MFA`, `KSI-AFR-03`) for current work.
- Treating "deployed in an authorized cloud" as compliance — inheritance is partial.
- Ignoring the shared-responsibility split (CSP / Customer / Shared).
- Static posture — ConMon (Rev5) and persistent KSI validation (20x) are mandatory ongoing.
- Copy-paste SSP narratives lacking system-specific detail.

## Key Terms

**ATO** Authorization to Operate · **P-ATO** Provisional ATO (legacy JAB construct; 2026 rules emphasize agency authorization with FedRAMP certification) · **CSP** Cloud Service Provider · **3PAO** Third Party Assessment Organization · **POA&M** Plan of Action and Milestones · **CRM** Customer Responsibility Matrix · **SSP** System Security Plan · **SAR** Security Assessment Report · **KSI** Key Security Indicator · **FRD** FedRAMP Definitions (Rules JSON block) · **FRR** FedRAMP Rules (Rules JSON block) · **CCM** Collaborative Continuous Monitoring · **VDR** Vulnerability Detection and Response.
