FedRAMP Certification Timeline
Official calendar dates come from FedRAMP.gov Important Deadlines (also on the Deadline Center). scm.cc does not publish how many months an offering will take to certify — that duration is an estimate we do not have a sourced methodology for, so it is omitted.
Educational resource only. scm.cc is not a FedRAMP Recognized Independent Assessor (3PAO) and is not FedRAMP-authorized; it grants no authorization, certification, or assessment outcome. FedRAMP.gov is the authoritative source. This is not legal advice.
Technical detail
This page lists DEADLINE_FACTS (official) and explicitly omits a duration estimate. Certification-timeline (guide) and /deadlines are related, not duplicates of a guessed Gantt.
How to implement
Plan against official CR26 overall dates. Walk the get-certified journey in parallel; duration depends on class, evidence, and assessor availability — none of which this page invents.
Official dates (not duration estimates)
| Date | Milestone | Kind |
|---|---|---|
| 2026-07-04 | Consolidated Rules for 2026 in effect for widespread adoption | official |
| 2026-07-04 | New FedRAMP 20x applications must follow CR26 | official |
| 2027-01-01 | New FedRAMP Rev5 applications must follow CR26 | official |
| 2027-01-01 | Active 20x offerings must follow CR26 (or corrective action) | official |
| 2027-06-11 | No new applications for FedRAMP Rev5 Certification | official |
| 2028-02-01 | Default CR26 grace periods expire | official |
| 2028-12-31 | CR26 practices expire no later than this date | official |
Questions teams ask
- How long does certification take?
- scm.cc does not publish a month count. Official CR26 dates are on the Deadline Center. Duration is omitted, not guessed.
Related
Primary sources
- FedRAMP path & transition deadlines (retrieved 2026-10-11)
- FedRAMP 20x overview & Core Principles (retrieved 2026-09-27)
- FedRAMP Certification reference (classes, KSI metrics window) (retrieved 2026-09-27)
Last verified 2026-10-11. FedRAMP.gov is authoritative.
Explore the knowledge hub
Learn
- What is 20x?
- Fundamentals
- 20x vs Rev5
- Classes A–D
- Class A
- Class B
- Class C
- Class D
- KSIs
- SDR
- Evidence
- Continuous Monitoring
- Vulnerability Mgmt
- Identity & Access
- Logging
- Config Management
- Encryption
- Incident Response
- Compliance as Code
- OSCAL
- Glossary
- Controls
- AC-17
- AC-2
- AC-6
- AU-12
- AU-2
- AU-6
- CA-7
- CM-2
- CM-6
- CP-9
- IA-2
- IA-4
- IA-5
- IR-4
- IR-8
- RA-3
- RA-5
- SC-13
- SC-7
- SI-2
- SI-4