The Schellman Blog

FedRAMP has just released its consolidated rules, which is widely described as the most significant update to the framework in about ten years. The controls themselves remain the same. What’s changed is a new layer of guidelines and rules layered on top of Rev 5, and the timelines matter.

Schellman CEO, Avani Desai, and Kristen Wilbur, Schellman Managing Principal, discuss sovereign compliance and the growing demand from countries that each want their own version of security and compliance requirements.

Matt Hungate, Managing Principal at Shellman, discusses the FedRAMP Consolidated Rules for 2026 (CR26), the most significant FedRAMP overhaul since the program’s inception. Even organizations currently holding FedRAMP Rev5 certifications will have their credentials reviewed against CR26’s new rules, making this transition critical regardless of immediate upgrade timelines.

Organizations are confident about AI governance, but the data tells a different story: 70% of organizations say they could pass an AI compliance audit today, while only 27% say their governance program is actually mature.

Soon after Dario Amodei, cofounder of Anthropic, recently warned that the technology industry has drastically understated the real dangers of AI, Sam Altman and Elon Musk agreed with him.

On July 13, 2026, the Department of War (DoW) initiated a pause on CMMC Phase 2, Level 2 certification requirements that were set to take effect on November 10, 2026. While the timing caught many in the defense contractor ecosystem off guard, the move reflects a broader, more pragmatic approach to cybersecurity compliance that prioritizes flexibility and real-world impact.

In June, FedRAMP released its Consolidated Rules 2026 (CR26), the biggest overhaul to the program since it launched in 2011. Schellman’s Christian Baer and Bhanu Jagasia from bladestack.io broke down what's changing and why it matters, whether you're pursuing a new certification or maintaining an existing one.

When the Department of War (DoW) suddenly paused CMMC Phase 2.0 on July 13, 2026, it caught the defense industry off guard. With the third-party assessment requirements halted just months before their go-live date in November 2026, there’s much speculation that compliance activities will also be held up. However, a few things haven’t changed because of the pause: Phase 1 self-assessment requirements are still due, the False Claims Act exposure for inaccurate attestations hasn’t gone anywhere, and the obligation to protect Controlled Unclassified Information (CUI) under NIST 800-171 remains fully in effect. For the defense industrial base, treating this pause as a reason to slow down is the wrong takeaway.

FedRAMP is undergoing its biggest structural shift in over a decade. In this conversation, Schellman's Nick Rundhaug, Managing Director and Federal Practice Leader, unpacks what FedRAMP 20x actually changes for cloud service providers (CSPs) and what to prioritize before walking into an assessment.

FedRAMP's consolidated 2026 rules landed at the end of June, and the shift they represent is significant, featuring new Key Security Indicators (KSIs) for automated, continuous compliance reporting, a leaner but more technical documentation model built around machine-readable CPO and SDR files, and a compressed timeline that's already cutting review periods from years down to about a month.