FedRAMP Ready Is Retiring July 28, 2026
What CR26 Changes and What to Do Now
If selling cloud software to the federal government is part of your plan, mark July 28, 2026 on the calendar. That is the day FedRAMP Ready retires, and it is one piece of the largest FedRAMP overhaul since the program launched in 2011. Here is what is changing, what is not, and the moves that actually matter before the deadline.
What is actually changing on July 28
FedRAMP confirmed the retirement of FedRAMP Ready as an outcome of RFC-0023. (FedRAMP, notice 0008.) The mechanics are straightforward, even if the implications are not:
- No new submissions after July 28, 2026. FedRAMP will not accept new FedRAMP Ready packages past that date.
- Existing Ready designations are renamed. They become “Legacy FedRAMP Ready” rather than disappearing overnight.
- A new certification model takes its place. Ready was an on-ramp that signaled a cloud service was a reasonable bet for an agency. The new model moves toward a sponsorless certification path, so a provider can earn standing without first landing an agency sponsor.
This sits inside the broader 2026 changes often referred to as CR26. CR26 is set to finalize by June 30, 2026, with optional early adoption opening July 1. (FedRAMP, RFC outcomes, 2026.)
Why FedRAMP is doing this
For years, the hardest part of FedRAMP was not the security work. It was the chicken-and-egg problem: you needed an agency sponsor to get authorized, but agencies preferred to buy things that were already authorized.
FedRAMP Ready was a partial fix. It gave providers a way to signal readiness while they hunted for a sponsor. The new direction removes more of that friction:
- Sponsorless certification lets capable providers earn standing on the strength of their security program, not their rolodex.
- A cleaner taxonomy is coming. The familiar impact levels are giving way to lettered certification classes: Class A is the new entry-level baseline that succeeds FedRAMP Ready, while Class B covers Li-SaaS and Low, Class C covers Moderate, and Class D covers High. (FedRAMP RFC-0020, notice 0004, 2026.)
- More automation runs underneath all of it, with machine-readable evidence and continuous validation replacing point-in-time document reviews.
The throughline is simple: fewer manual gates, more continuous proof.
What this means if you already have FedRAMP Ready
Do not panic, but do not coast either.
- Your designation does not vanish on July 28. It is reclassified as Legacy FedRAMP Ready.
- It stops being a growth path. Legacy status is a holding pattern, not a launchpad. Buyers and agencies will increasingly look for the new certification.
- Plan your transition now. Map where your current package sits against the new model, so you are not rebuilding under deadline pressure later this year.
What this means if you were about to start
This is the group with the most to gain from moving quickly.
- Skip the sunsetting status. Aiming for FedRAMP Ready this summer means chasing a designation that retires in weeks. Point at the new certification path instead.
- Draw your boundary first. Lock your authorization boundary before anyone writes a System Security Plan. Every week the boundary stays fuzzy is a week of rework.
- Automate evidence from day one. The new model rewards structured, continuously validated evidence. Building that habit now means CR26 works for you instead of against you.
- Run a gap assessment before documentation. We always start with a quick gap assessment, because writing toward the wrong scope, or a retiring status, is how projects lose a quarter.
What this means for your sales and marketing language
- “FedRAMP Ready” is becoming a legacy term. If your website and decks lead with it, you will start to look behind.
- As certifications come online under the new model, update your language to match. Sharp federal buyers track who is current and who is coasting on an old badge.
- If you are mid-transition, say so plainly. “Moving to the new FedRAMP certification model” is a stronger story than a status that is about to sunset.
What this means for you
The headline is a deadline, but the real message is a direction. FedRAMP is moving from a slow, sponsor-gated, document-heavy process toward a faster, sponsorless, continuously validated one. July 28 is just the first clearly dated step.
If you do nothing else this month, do these three things: confirm where your current FedRAMP status stands, decide whether you are transitioning an existing package or starting fresh under the new model, and get your evidence into a structured format you can keep current. The providers who treat CR26 as an operating-model change, not a rebrand, will be the ones quoting shorter timelines a year from now.
Start before you feel ready. The deadline will not move for you, but the work you do now will make it a non-event.
Not sure whether to transition your FedRAMP Ready package or aim straight at the new certification model? Book a 30-minute scoping call with AARC-360 and we will map your path!
