End of FedRAMP Rev5: What you really need for your 20x migration

Anecdote by Subject CISO, Maril Vernon

I spent years on the attacker facet of safety, performing crimson and purple group assessments and bypassing controls that GRC groups and even auditors believed had been working.

Spoiler: It was hardly ever as tough as I believed it might be. Not as a result of these groups had been careless, however as a result of they had been measured in opposition to a system that rewards proving a management exists at a time limit, not whether or not it may be operationally maintained on any given Tuesday six months after the audit.

FedRAMP Rev5 was constructed on that mannequin. The group described how controls are applied, mapped these descriptions to NIST 800-53, and supported them with fastidiously curated proof.

Evaluators then sampled that proof yearly to find out whether or not the implementation was per the documentation. However in case you’ve ever participated in an audit, you understand how a lot management you could have over scope and clarification. And in case you’ve ever been a pen tester, you recognize that is precisely the place you must begin trying.

With FedRAMP 20X, the questions change utterly. Reasonably than asking organizations to elucidate their safety posture, we ask them to repeatedly show it. This alteration could sound delicate, however it basically adjustments the best way warranties are delivered.

The most important change is not the framework. That is the proof.

FedRAMP 20X replaces narrative-centric controls with key safety indicators (KSIs), that are measurable outcomes backed by machine-readable proof.

The low baseline has 56 KSIs and the medium degree has 61 KSIs, organized throughout 12 safety domains together with cloud-native structure, identification and entry administration, monitoring, incident response, and alter administration.

This framework strikes from asking if in case you have documented your processes to demonstrating that your processes really work.

Let me clarify the distinction with a easy instance. In Rev5, controls could ask you to elucidate your multi-factor authentication coverage. The corresponding KSI requires proof utilizing machine-readable proof that phishing-resistant MFA is at the moment utilized to all privileged accounts in manufacturing environments.

One is a declare supported by chosen proof. The opposite is an goal truth. It’s way more tough to argue the details within the audit room.

For organizations which have spent years optimizing their annual opinions, that is greater than only a documentation replace. You must create a system that permits you to frequently submit dependable proof, not simply put it collectively when an audit approaches.

Fashionable threats are steady, so steady beats attain a sure level.

The most important operational change in FedRAMP 20X just isn’t the controls themselves. It is the rhythm.

In Rev5, proof was collected to help the point-in-time evaluation. From 20X onwards, proof turns into a part of a residing system.

Machine-based KSIs are revalidated on a brief, common schedule, each few days for average techniques, whereas process-based KSIs nonetheless require validation a minimum of quarterly.

There is no such thing as a longer any expectation that one thing could be confirmed to be true inside a hard and fast time period. It implies that we will proceed to show this to be true in a continually altering atmosphere.

That is sensible, given how fashionable infrastructure really works. Cloud environments are continually altering. Builders deploy a number of instances a day.

Identities are frequently created, modified, and deleted. Attackers found a number of years in the past that environments do not stay static after an audit.

Compliance has historically been the one a part of the equation that also pretends to be compliant.

FedRAMP 20X was one of many first main assurance frameworks to acknowledge that actuality. If the system operates repeatedly, the guarantee mannequin should additionally function repeatedly.

Persevering with assurance requires persevering with proof

You may’t and needn’t create an proof package deal each three days. At 20X, proof should circulation straight from the techniques you are engaged on.

This implies offering OSCAL-compliant machine-readable knowledge the place relevant, in addition to a human-readable abstract that gives context, timestamps, and sufficient data for evaluators to grasp what they’re taking a look at.

The Section 2 Completeness Steering makes these expectations clear. Automation should cowl a minimum of 70% of the KSIs, all KSIs have to be addressed, and proof should exist in each machine-readable and human-readable codecs.

It is not busy work. It’s a recognition that fashionable assurance requires each automation and clarification. Machines can validate at scale, however people want sufficient context to grasp what the info is definitely telling us.

For organizations transitioning from Rev5, that is usually the second when the transition feels extra like engineering than compliance.

The actual job is engineering, not writing.

That is as a result of the largest distinction between Rev5 and 20X just isn’t the documentation, however the system design.

Step one is to grasp the place you at the moment stand. Carry out a KSI hole evaluation and rating all necessities as totally lined, partially lined, or not lined. Decide whether or not every KSI could be automated, requires a guide course of, or finally requires each.

Comply with FedRAMP’s beneficial precedence order. First FedRAMP authorization, then cloud native structure, identification and entry administration, then service configuration, monitoring, and the remainder of the area.

Construct your proof pipeline from there. Most automatable KSIs exist already on the info that organizations generate on daily basis by means of cloud platforms, identification suppliers, SIEMs, vulnerability scanners, and configuration administration instruments. The problem is to not create new knowledge.

Constantly gather data, normalize it, map it to KSIs, generate structured proof, and do all of it at scale and on the tempo you want.

Satirically, probably the most arduous job is commonly not the technical telemetry. It is coverage approvals, governance workflows, coaching information, and different guide processes that are not designed to function repeatedly. These are normally probably the most time-consuming hack gadgets, in order that’s precisely why they’re value tackling first.

The position of the evaluator may also change. In Rev5, 3PAO spent loads of time evaluating documentation and explanations. Beneath 20X, proof pipelines shall be examined to make sure they precisely mirror actuality.

Auditing is much less about studying coverage and extra about trusting the integrity of the techniques that generate the proof.

As somebody who has spent years in search of gaps between what organizations doc and what’s really occurring of their environments, I can let you know that this eliminates many hiding locations for risk actors.

Automation just isn’t the objective, sustainability is the objective

This doesn’t imply that each one organizations have to buy the platform. You may construct these pipelines your self, and lots of organizations will. However doing the entire issues we have talked about to date (gathering proof, normalizing knowledge, mapping it to KSIs, producing machine-readable output, creating human-readable summaries, and sustaining their integrity) rapidly turns into a steady engineering effort.

That is the place automation comes into play. Not as a result of people cannot do the work, however as a result of there are higher methods to spend extremely expert engineering time than rebuilding proof packages time and again.

Persistent validation ought to turn out to be an operational characteristic, not a everlasting guide challenge.

We skilled it firsthand at Anecdotes after we grew to become the primary agent GRC platform to realize FedRAMP 20X Reasonable (or Class C) certification utilizing our proprietary platform.

Preliminary score didn’t attain medium. At first we reached “low”, then used the outcomes to enhance the atmosphere and verified it once more, and eventually achieved “medium”.

To me, that is the strongest proof that the framework is working as meant. FedRAMP 20X acknowledges organizations that deal with analysis as a suggestions loop and repeatedly enhance, not simply those who inform the cleanest story.

Begin earlier than you want it

The most important mistake Rev5 organizations could make is treating 20X like a paper transition.

In case you simply remap your SSP with out constructing a system to repeatedly generate dependable proof, you may find yourself rebuilding every thing manually underneath deadline strain. That is precisely what 20X was designed to eradicate.

As an alternative of beginning with probably the most complicated controls, begin with the boring ones. Select a KSI the place most of your knowledge already exists. Measure end-to-end. Carry out ongoing validation. Let’s examine what breaks. Please repair it. repeat. Construct muscle earlier than you construct scale.

As a result of FedRAMP 20X just isn’t asking if it might probably face up to a single audit. It is a query of whether or not your guarantee program will survive the subsequent random Tuesday. The organizations that can succeed on this transition won’t be those with the most effective documentation. They would be the ones who begin constructing ongoing safety earlier than the deadline hits.

Go deeper. Anecdote CISO Jake Bernardes will element the transition from Rev5 to steady machine-readable assurance at GRC Knowledge and AI Summit 2026, an Aug. 12 digital occasion for safety, danger, and compliance leaders to arrange their brokers.

In case you’re gazing a Rev5 clock, you are in the best room. Register free of charge.

In regards to the writer

Marilu Vernon is a Subject CISO at Anekdotes and a former Pink and Purple Workforce Operator. She writes and speaks on GRC engineering, steady management monitoring, offensive safety, and the evolution of recent assurance applications. Her work focuses on serving to organizations transfer past compliance as a documentation follow towards safety decision-making primarily based on trusted, real-time knowledge. Anecdotes is the primary agent GRC platform to leverage its distinctive platform to realize FedRAMP 20X certification.

Sponsored and written by Anecdotes.