FedRAMP news from Infosec Standards https://infosecstandards.org/standards/fedramp News about FedRAMP, including major updates to our page on it. en-us FedRAMP puts 10 cloud offerings in remediation after Security Inbox test https://infosecstandards.org/news/fedramp-inbox-remediation https://infosecstandards.org/news/fedramp-inbox-remediation Wed, 09 Sep 2026 00:00:00 GMT After the July 1, 2026 grace period ended, FedRAMP's quarterly Security Inbox test left 10 certified cloud offerings in remediation pending possible revocation. FedRAMP opens temporary Rev5 Ready Conversion and Lost Sponsor pipelines https://infosecstandards.org/news/fedramp-rev5-pipelines https://infosecstandards.org/news/fedramp-rev5-pipelines Wed, 09 Sep 2026 00:00:00 GMT On August 10, 2026, FedRAMP opened limited sponsorless Rev5 Class B and Class C Program Certification paths for eligible Ready Conversion and Lost Sponsor providers. FedRAMP 20x Class A pipeline opens under Consolidated Rules https://infosecstandards.org/news/fedramp-20x-rules https://infosecstandards.org/news/fedramp-20x-rules Tue, 04 Aug 2026 00:00:00 GMT FedRAMP opened the 20x Class A submission pipeline on August 3, 2026. Class B and C follow August 31, and Rev5 is on a fixed sunset path. FedRAMP makes VDR and VER rules mandatory by December 7, 2026 https://infosecstandards.org/news/fedramp-vdr-mandate https://infosecstandards.org/news/fedramp-vdr-mandate Tue, 04 Aug 2026 00:00:00 GMT To align with CISA BOD 26-04, FedRAMP requires all certified cloud services to adopt Vulnerability Detection and Response and Vulnerability Evaluation and Reporting rules by December 7, 2026.