Framework module · fedramp-rev5
FedRAMP (Rev. 5 baselines)
The authorization a cloud service needs before a federal agency can buy it, assessed against NIST 800-53 Rev. 5 Low, Moderate, or High baselines.
Rev. 5 · FedRAMP · published 2023-05-30
Standing today
Acquisition required
01Standing
Acquisition required
Named, with the authority's acquisition path recorded; onboarding is refused until a control set is registered.
FedRAMP (Rev. 5 baselines) cannot be onboarded yet: Freely published; baselines not ingested as a control catalog. Onboarding is enabled once a control set is registered, so a new project never opens into an empty workspace.
FedRAMP (Rev. 5 baselines) cannot be onboarded yet: Freely published; baselines not ingested as a control catalog. Onboarding is enabled once a control set is registered, so a new project never opens into an empty workspace.
02Registry record
checked 2026-08-06
- Registry status
- Roadmap · modelledWe model the regime — control families and at least one crosswalk map on disk — but no control catalog is ingested.
- Control units
- Not on record — no catalog ingested and no authority-published count cited.
- Control families
- Low baseline · Moderate baseline · High baseline · Continuous monitoring
- Applies to
- federal cloud · US
- Verification
- Secondary — corroborated across independent sources; the authority blocks automated fetch or does not state it plainly. checked 2026-08-06
- Pending change
- FedRAMP 20x is now the forward path (see framework `fedramp-20x`). Rev. 5 authorizations stay valid — existing ones through at least 2028-12-31 — but RFC-0024 requires machine-readable packages from Rev. 5 holders by 2026-09-30, and new authorizations after 2027 are expected to go through 20x.Expected: 2026-09-30 (machine-readable packages)
03Version ledger
2 editions
| Rev. 4 | Superseded | date not published |
| Rev. 5 | Current edition · supersedes Rev. 4 | 2023-05-30 |