The Schellman Blog

FedRAMP’s Consolidated Rules 2026 (CR26) arrived at the end of June, and cloud providers are already feeling the pressure. In a recent discussion, three industry experts (Christian Baer of Schellman, Corey Clements of SecureIT, and Roi Amior of Anecdotes) unpacked what the rules mean, where the deadlines fall, and how providers can respond and prepare now.

FedRAMP has just released its consolidated rules, which is widely described as the most significant update to the framework in about ten years. The controls themselves remain the same. What’s changed is a new layer of guidelines and rules layered on top of Rev 5, and the timelines matter.

Matt Hungate, Managing Principal at Shellman, discusses the FedRAMP Consolidated Rules for 2026 (CR26), the most significant FedRAMP overhaul since the program’s inception. Even organizations currently holding FedRAMP Rev5 certifications will have their credentials reviewed against CR26’s new rules, making this transition critical regardless of immediate upgrade timelines.

On July 13, 2026, the Department of War (DoW) initiated a pause on CMMC Phase 2, Level 2 certification requirements that were set to take effect on November 10, 2026. While the timing caught many in the defense contractor ecosystem off guard, the move reflects a broader, more pragmatic approach to cybersecurity compliance that prioritizes flexibility and real-world impact.

In June, FedRAMP released its Consolidated Rules 2026 (CR26), the biggest overhaul to the program since it launched in 2011. Schellman’s Christian Baer and Bhanu Jagasia from bladestack.io broke down what's changing and why it matters, whether you're pursuing a new certification or maintaining an existing one.

When the Department of War (DoW) suddenly paused CMMC Phase 2.0 on July 13, 2026, it caught the defense industry off guard. With the third-party assessment requirements halted just months before their go-live date in November 2026, there’s much speculation that compliance activities will also be held up. However, a few things haven’t changed because of the pause: Phase 1 self-assessment requirements are still due, the False Claims Act exposure for inaccurate attestations hasn’t gone anywhere, and the obligation to protect Controlled Unclassified Information (CUI) under NIST 800-171 remains fully in effect. For the defense industrial base, treating this pause as a reason to slow down is the wrong takeaway.

FedRAMP is undergoing its biggest structural shift in over a decade. In this conversation, Schellman's Nick Rundhaug, Managing Director and Federal Practice Leader, unpacks what FedRAMP 20x actually changes for cloud service providers (CSPs) and what to prioritize before walking into an assessment.

FedRAMP's consolidated 2026 rules landed at the end of June, and the shift they represent is significant, featuring new Key Security Indicators (KSIs) for automated, continuous compliance reporting, a leaner but more technical documentation model built around machine-readable CPO and SDR files, and a compressed timeline that's already cutting review periods from years down to about a month.

CMMC certification is mandatory if you want federal contracts, but the journey doesn't end there.

The FedRAMP landscape is shifting. With the introduction of FedRAMP 20x, cloud service providers now face a critical decision: pursue the newer 20x authorization pathway, stay the course with Rev 5, or chart a hybrid strategy that positions them for both short-term and long-term success.