Primary sources, straight from the FedRAMP PMO. Read these first; everything else here is commentary.
FedRAMP Consolidated Rules for 2026 (CR26)
- CR26 home: the landing page for the whole ruleset, with sections for providers, assessors, advisors and agencies.
- Using the Consolidated Rules: the rules themselves.
- Vulnerability Evaluation and Reporting: the VER rules, including the BOD 26-04 dates.
- Definitions: FedRAMP’s own terms, including Potential Agency Impact.
- Important dates: the timeline for adoption.
- Machine-readable rules and the CR26 repository: the rule text as data, with a changelog.
The Corrective Action Plan deadline
- FedRAMP notice NTC-0014: the VDR and VER effective dates, the Corrective Action Plan grace period, and the response to CISA BOD 26-04.
Related
- CISA Known Exploited Vulnerabilities catalog: the KEV list that the VDR remediation rules key off.
- FedRAMP help site: where to ask the PMO a question.
After the event
Recordings, slides, and links to the webinars our speakers give will be posted here and on the schedule as they become available.