The Schellman Blog

GovRAMP (formerly StateRAMP) continues to provide useful avenues for Cloud Service Providers (CSPs) to build secure products for use by State agencies. Earlier this year, GovRAMP released a modified high baseline for CSPs to leverage in protecting the most sensitive SLED data processed by agencies.

Insights from a conversation with Nick Rundhaug, Managing Director and Federal Practice Leader at Schellman. See his full interview here.

FedRAMP's modernization effort, known as FedRAMP 20x, is continuing to advance. On August 31, 2026, the FedRAMP 20x program opened Class B and Class C as the next phase of its rollout. Under the program's official Consolidated Rules for 2026 (CR26), Class B pipeline replaces the old Low impact level for small-scale cloud services, and the Class C pipeline replaces the old Moderate impact level for common enterprise services.

This article was drafted based on a LinkedIn Live discussion between Schellman’s Nick Rundhaug and SecureIT's Tim Sandage and Corey Clements. View their full conversation here.

Insight from Schellman's federal team on the FedRAMP 2026 Consolidated Rule update, featuring the program's biggest overhaul in years.

Highlights from our GovFORWARD 8th Annual Carahsoft Summit on FedRAMP breakout session, featuring Schellman's Matt Hungate.

If you’ve heard “FedRAMP” and immediately thought “that’s a year-long, million-dollar project we’re not ready for” — this post is for you. A lot has changed. The program's new Class A certification tier was built specifically for companies that have already done the hard work of achieving SOC 2 Type II. Here’s what your SOC 2 actually gets you, and why the path to the federal marketplace may be shorter than you think.

Schellman, the nation's No. 1 FedRAMP Independent Assessor, breaks down the most significant restructuring of the federal cloud security program since its 2011 inception.