FedRAMP 20x checklist tool

The get-certified journey stages as a printable checklist. Stages are educational. They are not an official FedRAMP form.

Educational resource only. scm.cc is not a FedRAMP Recognized Independent Assessor (3PAO) and is not FedRAMP-authorized; it grants no authorization, certification, or assessment outcome. FedRAMP.gov is the authoritative source. This is not legal advice.

Technical detail

Rendered from the same journey records as /get-certified. No extra requirements are added here.

How to implement

Use it as a reading list. Confirm each stage against FedRAMP.gov before you put it in a customer plan.

Related

Primary sources

Last verified 2026-09-27. FedRAMP.gov is authoritative.

Explore the knowledge hub

Learn

Assessor training

Get Certified

Stay Certified

Implementation

Marketplace

Intelligence

Free Tools

Journey stages

  1. Determine applicability

    Confirm the offering is a cloud service seeking federal use and which FedRAMP path (20x vs Rev5) applies. FedRAMP.gov is the rule.

  2. Determine certification class

    Classes A–D are defined on FedRAMP.gov. Class D stays proposal-stage here until a registered definition exists.

  3. Choose a path

    20x vs Rev5 during transition. Dual cadence is common; do not drop monthly ConMon because an OCR exists.

  4. Define the offering boundary

    The authorization boundary belongs in the SDR, not in a slide. Confirm inheritance vs customer responsibility.

  5. Implement requirements

    Map CR26 practices and KSIs onto the offering. Quote official KSI statements; do not paraphrase them as weaker text.

  6. Implement KSIs

    Ten families, 46 indicators in the pinned CR26 catalog. Class C markers live on the indicator pages.

  7. Establish the Security Decision Record

    On the 20x path the SDR replaces a classical SSP. Use the pinned 2026-06-24 schema fields.

  8. Persistent validation

    CCM quarterly OCR plus, where still required, Rev5 monthly ConMon. Cadences are sourced, not estimated.

  9. Gather evidence

    Strong vs weak evidence is described on the evidence page. Missing stays missing — never a fabricated green.

  10. Find a Recognized Independent Assessor (where required)

    Use official FedRAMP registries. scm.cc is not an assessor and does not rank or endorse 3PAOs.

  11. Independent assessment

    An independent assessment is performed by a Recognized Independent Assessor, not by this site.

  12. Resolve findings

    VDR/VER and POA&M handle unevaluated vs dated findings. An unevaluated finding has no invented deadline.

  13. Submit the package

    Follow FedRAMP.gov submission instructions. scm.cc can help assemble working artifacts; it does not submit or sponsor a package.

  14. Certification decision

    FedRAMP Certification is a government decision. It does not replace an agency ATO. scm.cc grants neither.

  15. Marketplace listing

    Official listings live at marketplace.fedramp.gov. This hub is not the Marketplace.

  16. Ongoing certification

    Stay on published CCM/Rev5 cadences and CR26 dates. See deadlines and stay-certified.

This is a reading list, not a readiness score and not a certification forecast.