Know which requirements
govern your decision.

A reusable federal process for assessing cloud services. It matters when a cloud offering creates, collects, processes, stores, or maintains federal information for an in-scope agency use.

Who it matters to: Cloud service providers, federal agencies, independent assessors, authorizing officials, and delivery partners—not every private company or ordinary software user.

The security and privacy control baseline used by the traditional FedRAMP authorization path. Rev. 5 remains available during the transition, while CR26 governs updated FedRAMP operating rules.

Who it matters to: Security, privacy, GRC, engineering, assessment, and authorization teams responsible for an in-scope federal cloud service.

FedRAMP formally released the Consolidated Rules for 2026 on June 24, 2026. Optional early adoption began July 4, 2026; general mandatory adoption is January 1, 2027, subject to individual rule dates.

Who it matters to: FedRAMP cloud providers and federal authorization stakeholders. Individual rules can have different deadlines, so teams must use the live rule and class that applies to them.

A persistent operating process to find, prioritize, mitigate, remediate, and manage vulnerabilities. The definition is broader than scanner CVEs and can include inaccurate or stale security documentation or failure of the VDR process itself.

Who it matters to: Cloud-provider security, SecOps, engineering, GRC, control-owner, and reviewer teams operating an in-scope service.

The evaluation and reporting layer for exploitability, internet reachability, potential agency impact, status, and decision context. VER means evaluation and reporting—not verification.

Who it matters to: The people evaluating vulnerability context, producing structured reports, reviewing risk, and making or supporting authorization decisions.

A closed proposal that helped shape discussion of machine-readable Rev. 5 packages. FedRAMP said every proposed requirement would be modified, then published the controlling requirements and timelines through CR26 and rule-specific notices.

Who it matters to: Useful historical context for providers and tool builders; it is not the current authority or the source of current transition dates.

A NIST-led family of XML, JSON, and YAML formats for machine-readable controls, implementation, assessment, and POA&M data. Valid structure does not prove that the evidence is true, current, or authentic.

Who it matters to: GRC tool teams, control and assessment teams, cloud providers, agencies, and integrators exchanging structured assurance information.

The Office of Management and Budget policy directing a more automated, reusable, machine-readable federal cloud authorization program, including API-based exchange where feasible.

Who it matters to: Executive agencies and the FedRAMP cloud ecosystem. Commercial vendors are affected when they sell or support an in-scope cloud service under federal acquisition terms.

An August 2026 initial public draft describing a flexible four-stage approach to Test, Evaluation, Verification, and Validation: articulate and organize; define and construct; apply and measure; synthesize and interrogate. It does not prescribe a universal evidence schema or create a certification.

Who it matters to: AI system owners, evaluators, technical teams, risk leaders, procurement specialists, and decision-makers using evaluation results. The draft is design guidance, not a NIST-required evidence artifact, certification, or product endorsement.

The Technical Manual Contract Requirement, Contract Data Requirements List, and Data Item Description establish the required content, format, delivery state, schedule, review or approval code, and acceptance path. The live contract and modifications control.

Validation checks the candidate against source data, equipment or an approved equivalent, intended users, safety, completeness, configuration, and expected results. A tool preflight is not validation, and the required method varies by contract and program.

The acquiring activity or authorized representative confirms that the technical product meets the governing requirements and works for its intended users. Contractor validation can support the event but does not replace it.

Authentication is an Army formal-publication issuance step where applicable. NAVSEA, Air Force, S1000D, and other programs use their own contractual approval, formalization, or acceptance paths. It is not a universal synonym for validation, verification, or public release.

An Army-oriented parts-information product that connects figures and items to supply, applicability, Source, Maintenance and Recoverability coding, maintenance level, quantity, and related work packages. Other Services can require IPBs or different contract-selected structures.

An In-Process Review captures findings and corrective action while the publication is being developed. When invoked, a Final Reproducible Copy is the final reproducible publication deliverable or state defined by the applicable contract, Service, or program. The live TMCR, CDRL/DID, contract, and governing publication profile determine its contents, approval path, and release authority. Neither term creates a universal DoD gate.

A real S1000D project uses the contract-selected issue, schemas, Business Rules Exchange, project business rules, applicability model, Data Module Requirements List, output, and acceptance tests. The latest general issue is not automatically the program requirement.