Regulatory guidance, assessment prep, and compliance analysis for the Defense Industrial Base and public sector.
FedRAMP ProgramOn August 31, 2026, the FedRAMP 20x program launched Class B and Class C pipelines, replacing the traditional Low and Moderate impact levels with a faster, automation-driven certification model. If yo
FedRAMP ProgramYou re building a cloud service for federal customers. Before you write a single policy or implement a control, you need to answer one question: Low, Moderate, or High? Get this wrong and you ll spend
FedRAMP ProgramSchellman has become the first Third-Party Assessment Organization (3PAO) to assess over 200 cloud service offerings on the FedRAMP Marketplace . This milestone isn t just a number; it s a dataset tha
FedRAMP ProgramThe Decision at Hand With FedRAMP Rev. 5 baselines now in play, cloud service providers must decide: invest in OSCAL-native tools or stick with the traditional Word-and-Excel approach that got you aut
Get weekly security insights and compliance updates delivered to your inbox.
FedRAMP ProgramIf you re a cloud service provider with federal contracts, you re facing a critical decision that affects your engineering plans, contract timelines, and authorization strategy. FedRAMP Rev 5 is the c
FedRAMP ProgramWhen FedRAMP withdrew its proposed requirement for cloud service providers to report assessment costs, it didn t just kill RFC-0019. It clarified where the regulatory line stops and where your commerc
FedRAMP ProgramFedRAMP s new mandatory Security Inbox requirements pose a critical question for cloud service providers: should you manage emergency response monitoring internally, or assign it to a third party? The
FedRAMP ProgramWhat Happened On February 25, 2026, FedRAMP sent an urgent directive to every cloud service provider in its marketplace. CISA Emergency Directive 26-03 demanded immediate action to mitigate vulnerabil
FedRAMP ProgramYou re already hearing the pitch: use your SOC 2 Type II, get a Class A FedRAMP Certification, and skip the expensive assessment grind. It sounds efficient, but it s leading compliance teams into plan
FedRAMP ProgramWhen CISA issues an emergency directive, your response time is measured in days, not weeks. FedRAMP s directive regarding CISA V1: ED 25-03 requires cloud service providers to identify and mitigate po
FedRAMP ProgramThe updated FedRAMP Incident Communication Procedures take effect on July 4, 2026, for new certifications and January 1, 2027, for existing ones. If you re still drafting incident notifications manual
FedRAMP ProgramWhy This Matters Now FedRAMP will stop accepting new Rev5 Certification requests on June 11, 2027. If you re operating a FedRAMP Rev5-authorized cloud service, there s a hard deadline: your first inde
FedRAMP ProgramCISA s Binding Operational Directive 26-04 has accelerated FedRAMP s vulnerability management timeline by nine months. If your team is still relying on monthly vulnerability scans as a form of continu
FedRAMP ProgramFedRAMP s move to machine-readable packages under Rev5 has divided cloud providers. Some see it as a necessary modernization to reduce long-term burdens. Others, who ve invested heavily in manual proc
FedRAMP ProgramThe FedRAMP Consolidated Rules for 2026 remove the agency sponsorship requirement, introducing new certification paths that let you use existing assessments. If you ve delayed entering the federal mar
FedRAMP ProgramThe FedRAMP Consolidated Rules published on June 24, 2026, didn t break any systems or leak data. No agency lost access to critical services. However, if your team treats regulatory overhauls as mere
FedRAMP ProgramYour security team might think they re ready for FedRAMP 20x. They ve studied the guidance, mapped the new controls, and budgeted for additional scanning tools. But if compliance is still isolated fro
FedRAMP ProgramScope This guide explains the new FedRAMP Program Certification path introduced through RFC-0023, specifically for Rev5 Class A, B, and C certifications available without agency sponsorship. It detail
FedRAMP ProgramOne percent of FedRAMP Certified offerings failed the FY26 Q4 Quarterly Test. Not due to a control deficiency or a failed assessment, but because they lost contact with the program. Ten providers now
FedRAMP ProgramYour team has questions. Real ones. The kind that pop up in Slack threads at 4 PM on a Friday, or during the stand-up when someone realizes their SSP just became a legacy artifact. Since CR26 dropped
