FedRAMP CR26 Customer Guide¶
At a glance¶
FedRAMP's Consolidated Rules for 2026 (CR26) took effect July 4, 2026, and apply to Game Warden's Class D (High) certification. Most of the new work is Second Front's (2F). What you need to do depends on whether your application runs inside the Game Warden boundary or under your own FedRAMP certification.
- Inside the Game Warden boundary: You're projected to fully inherit 182 of 205 CR26 requirements (89%). Your actions are mostly inputs we ask you for, such as logs, root cause details, and recovery objectives.
- Your own boundary, built on Game Warden: You inherit the platform's technical controls, including most of the vulnerability rules: 24 of the 35 VDR and VER rules are fully inherited and 2 are shared. The certification rules are yours. VDR and VER take effect December 7, 2026. Your part is mainly reporting under your own certification and fixing vulnerabilities in your own code.
Game Warden's certification, and yours if you hold one, stays valid. FedRAMP keeps Rev5 certifications active until at least December 31, 2028.
Which model are you in?¶
The CI/CD pipeline, SOC, and platform controls are identical in both models. The difference is who holds the FedRAMP certification.
| 2F boundary | Your own boundary | |
|---|---|---|
| Who holds the FedRAMP certification | Second Front, for Game Warden | You, for your cloud service offering |
| Who meets the CR26 certification rules | Second Front | You, using Game Warden's inherited controls |
| Who reports incidents to FedRAMP and agencies | Second Front | You, unless your contract makes 2F your reporting agent |
| Identity | Your app uses the 2F IdP or federates through it | Your choice of IdP |
Not sure which model you're in? Check your Game Warden onboarding agreement or email us (see Getting help).
Key dates¶
The next deadline is December 7, 2026, for Vulnerability Detection and Response (VDR) and Vulnerability Evaluation and Reporting (VER). Most other rulesets follow during 2027. These are FedRAMP's Rev5 dates.
"Follow by" is when a certified service must be following the ruleset. After the grace period ends, a service that isn't following it loses its FedRAMP Certification. The last two columns show who meets each ruleset's rules, by number of rules.
| Ruleset | Follow by | Grace ends | 2F boundary | Your own boundary |
|---|---|---|---|---|
| Addressing FedRAMP Communication (AFC) | Jan 5, 2026 | Jul 1, 2026 | 2F: 8 | You: 8 |
| Secure Configuration Guide (SCG) | Mar 1, 2026 | Jul 1, 2026 | 2F: 9 | 2F: 9 |
| Marketplace Listing (MKT) | Jul 4, 2026 | Jul 4, 2026 | 2F: 5 | You: 5 |
| Vulnerability Detection and Response (VDR) | Dec 7, 2026 | Mar 7, 2027 | 2F: 12 · Shared: 5 | 2F: 11 · Shared: 2 · You: 4 |
| Vulnerability Evaluation and Reporting (VER) | Dec 7, 2026 | Mar 7, 2027 | 2F: 18 | 2F: 13 · You: 5 |
| Cryptographic Module Use (CMU) | Jan 1, 2027 | Jun 1, 2027 | 2F: 1 · Shared: 2 | You: 3 |
| FedRAMP Certification (FRC) | Jan 1, 2027 | First assessment started after Jan 1, 2027 | 2F: 14 · Shared: 1 · N/A: 5 | 2F: 4 · Shared: 1 · You: 15 |
| Incident Evaluation and Communication (IEC) | Jan 1, 2027 | Jun 1, 2027 | 2F: 6 | You: 6 |
| Independent Verification and Validation (IVV) | Jan 1, 2027 | First assessment started after Jan 1, 2027 | 2F: 9 | You: 9 |
| Minimum Assessment Scope (MAS) | Jan 1, 2027 | First assessment started after Jan 1, 2027 | 2F: 2 · Shared: 1 | You: 3 |
| Significant Change Notification (SCN) | Jan 1, 2027 | Jun 1, 2027 | 2F: 15 · Shared: 1 | 2F: 14 · You: 2 |
| Collaborative Continuous Monitoring (CCM) | Apr 2, 2027 | Oct 1, 2027 | 2F: 17 | 2F: 3 · You: 14 |
| Certification Package Overview (CPO) | Jul 1, 2027 | First assessment started after Jul 1, 2027 | 2F: 4 | Shared: 3 · You: 1 |
| Security Decision Record (SDR) | Aug 1, 2027 | First assessment started after Aug 1, 2027 | 2F: 4 | Shared: 4 |
| Certification Data Sharing (CDS) | Aug 1, 2027 | Feb 1, 2028 | 2F: 20 | You: 20 |
FedRAMP's overall dates: new Rev5 applications must follow CR26 from January 1, 2027. FedRAMP stops accepting new Rev5 applications on June 11, 2027, and all grace periods end February 1, 2028. See FedRAMP's Important Deadlines.
What changes for you¶
CR26 changes how certification works, not the security of the platform you deploy to. These are the changes you'll notice:
| Change | 2F boundary | Your own boundary |
|---|---|---|
| Word and Excel templates are replaced by machine-readable JSON (OSCAL optional), and the SSP becomes a Security Decision Record | Second Front converts the Game Warden package. We'll ask for details about your app if needed. | You convert your own package by the CPO and SDR dates. Second Front will supply Game Warden's inherited data. |
| POA&Ms are replaced by a list of Accepted Weaknesses | Second Front manages the list for Game Warden. | You manage your own list. |
| FedRAMP no longer sets most review frequencies and thresholds; providers set their own | Second Front sets them for Game Warden and will publish them to you. | You set your own. Keep them consistent with the values Game Warden publishes for the controls you inherit. |
| Vulnerability response goes beyond monthly scans, with new remediation and reporting timelines | Second Front detects, evaluates, and reports platform-wide. You fix vulnerabilities in your own code and images within the Game Warden remediation timelines. | You meet VDR and VER by December 7, 2026, inheriting Game Warden's scanning and evaluation. |
| "Continuous monitoring" becomes Ongoing Certification | Second Front handles it. | You handle it for your service. |
How much you inherit¶
Inside the Game Warden boundary, you're projected to fully inherit 182 of 205 requirements (89%), with none left entirely to you.
| Projected requirements (205) | 2F boundary | Your own boundary |
|---|---|---|
| Fully inherited | 182 (88.8%) | 81 (39.5%) |
| Shared | 18 (8.8%) | 24 (11.7%) |
| Your responsibility | 0 | 100 (48.8%) |
| Not applicable | 5 (2.4%) | 0 |
The 205 are the 159 CR26 rules plus the 46 Key Security Indicators (KSIs) FedRAMP requires for 20x Class C. FedRAMP hasn't published KSI requirements for Class D yet, so we track the Class C set.
Note
These figures are projections from our current CR26 responsibility mapping. Fully inherited means Second Front performs the activity, and you only supply inputs when asked. Shared means you perform part of it. Your customer responsibility matrix will show each requirement.
Key Security Indicators¶
Inside the Game Warden boundary, 38 of the 46 KSIs are projected to be fully inherited. The other 8 are shared, and most of them cover access and data inside your application, which only you control.
| Shared KSI (2F boundary) | Second Front handles | You handle |
|---|---|---|
| KSI-IAM-AAM Automating Account Management | Account lifecycle through the 2F IdP, including provisioning, inactivity disablement, and revocation | Roles, groups, and privileges inside your app |
| KSI-IAM-ELP Ensuring Least Privilege | Least privilege for platform, infrastructure, and pipeline access | Least-privilege roles and permissions inside your app |
| KSI-IAM-JIT Authorizing Just-in-Time | Just-in-time authorization for privileged platform access | Just-in-time and role-based access inside your app |
| KSI-RPL-ARP Aligning Recovery Plan | The platform recovery plan | Your app's recovery plan |
| KSI-SCR-MIT Mitigating Supply Chain Risk | Pipeline scanning, SBOMs, and policy gates on images and dependencies | Choosing your dependencies and vendors |
| KSI-PIY-RSD Reviewing Security in the SDLC | Secure-by-design checks enforced in the pipeline | Security in your development practices before code reaches the pipeline |
| KSI-SVC-RUD Removing Unwanted Data | Removing data from platform storage and backups on agency request | Removing data held inside your app |
| KSI-CED-RAT Reviewing All Training | Training for Second Front personnel | Training for your developers and staff |
If you run your own boundary, the technical KSIs are inherited the same way, because the pipeline and SOC are identical. KSIs about your own security program, such as executive support, security investments, your vulnerability disclosure program, and staff training, are yours. So are most identity KSIs, unless your app uses the 2F IdP.
FedRAMP's full list is in its Key Security Indicators reference.
Your action checklist¶
- Make sure your app authenticates through the 2F IdP or federates through it with phishing-resistant MFA.
- Forward your application security and access logs to the 2F SOC.
- Provide your app's RTO and RPO, and review them when the platform prompts you.
- Provide application-level root cause analysis to the 2F SOC when asked after an incident.
- Fix vulnerabilities in your own code and images within the Game Warden remediation timelines.
- Tell us about significant changes to your app before you deploy them.
- Keep roles, least privilege, and just-in-time access inside your app current.
- Maintain your app's recovery plan, and train your developers and staff.
- Meet VDR and VER by Dec 7, 2026, inheriting Game Warden's scanning and evaluation.
- Follow CMU, FRC, IEC, IVV, MAS, and SCN by Jan 1, 2027.
- Set your own review frequencies and thresholds, consistent with the values Game Warden publishes.
- Follow CCM by Apr 2, 2027.
- Convert your package to the Certification Package Overview by Jul 1, 2027.
- Publish your Security Decision Record and follow CDS by Aug 1, 2027.
- Request Game Warden's inherited data for your package from your 2F contact.
FAQ¶
Do I need to change my plans, policies, or other documentation?
In the 2F boundary, Second Front handles the package changes and will tell you if we need anything from you. If you run your own boundary, you'll move your package from the legacy templates to FedRAMP's machine-readable formats by the CPO and SDR dates.
Will my responsibilities change?
In the 2F boundary, you're projected to fully inherit 89% of requirements and none fall entirely on you. Your main new inputs are recovery objectives, root cause details after incidents, and using the 2F IdP.
What happens with FedRAMP 20x?
FedRAMP 20x has no Class D (High) path yet. FedRAMP expects to pilot it in late 2026 and offer it formally in early 2027. We'll publish our transition plan once Class D requirements are released.
Can I keep using my own identity provider?
Yes, by federating it through the 2F IdP, which enforces phishing-resistant MFA for all apps in the 2F boundary.
When will I get the updated responsibility matrix?
We'll publish the final CR26 customer responsibility matrix here when it's ready.
Getting help¶
Questions about CR26 or your responsibilities? Email fedramp@secondfront.com or contact your 2F customer success manager.
Reviewed by Melanie Huffman, Director, FedRAMP Program. Dates reflect FedRAMP's Consolidated Rules for 2026 as published in October 2026 and may change.