NIST 800-53 and FedRAMP: Rev5 classes and 2027 dates

How does NIST 800-53 and FedRAMP work for a cloud provider today?

When a federal customer or contract requires FedRAMP, the cloud service must be certified against NIST SP 800-53 controls, and the class you seek determines how many controls and enhancements the authorization must cover. New Rev5 certifications end on 11 June 2027, so 20x is the forward path for most providers planning work now. For Rev5, the Consolidated Rules for 2026 require at least 155 controls and enhancements in the Security Decision Record for Class B, 322 for Class C and 409 for Class D. Annual independent assessment scope is set separately: 35 listed controls and enhancements for Class B, 80 for Class C and 101 for Class D. Confirm the current rule text in the FedRAMP rules repository before you commit to a class, because the rules are versioned and changing.

Cost and timing depend on the class you choose, how much usable evidence your existing program already produces, and how much of the service sits inside the authorization boundary. A provider that already holds a SOC 2 Type II attestation and a mature security program may find less new work than one starting from policies. Ask any partner to show, in writing, which controls they will prepare, which evidence they will generate from your systems, and which artifacts you will still write and approve yourself. Your organization owns its controls and the risk decisions behind them. An implementation partner can configure logging, build the System Security Plan support package, and prepare evidence, but it cannot issue the outcome.

Only a FedRAMP Recognized assessor produces the independent assessment, and only the sponsoring agency or FedRAMP grants the authorization. Rev5 Agency Certification also requires a completed ATO with the agency sponsor and a signed ATO letter sent to FedRAMP, and Class B, C and D applicants need a fresh initial assessment completed within the previous 3 months. Build that three-month window into your schedule, since an assessment that goes stale delays the entire application. Before engaging anyone, confirm which Recognized assessors cover your service model and whether your target agency will sponsor a Rev5 path or expect 20x.

Which FedRAMP class and certification type fits the service?

FedRAMP defines two certification types. Rev5 is the legacy approach, based primarily on documented plans that show how SP 800-53 controls are designed and implemented. 20x is the modern approach, based primarily on measured outcomes expressed as Key Security Indicators. The choice is not only a preference: as of October 2026, Rev5 is the only option for services that need Class D, while 20x Program Certification is available for Classes A, B and C.

Rev5 documentation weight: Rev5 certifications rely on a Security Decision Record, a System Security Plan and an independent assessment built on SP 800-53 controls and enhancements.
20x outcome evidence: 20x asks providers to demonstrate measured outcomes against Key Security Indicators, which map back to SP 800-53 controls.
Class D constraint: A Class D service cannot currently use 20x, so Rev5 is the only path for that impact profile.
Transition timing: FedRAMP expects transition paths for moving existing Rev5 services to 20x by the end of FY27, and it will stop accepting applications for new Rev5 certifications on 11 June 2027.

Confirm with your authorizing sponsor or FedRAMP-recognized assessor which type your service can enter now and whether a later move to 20x would require a new assessment. Check the current rules at FedRAMP: Choose a Type before committing.

What dates should a FedRAMP program plan around?

Plan around 11 June 2027, the date FedRAMP stops accepting applications for new Rev5 certifications, and work backward from it. The earlier dates matter because they decide when your provider can move onto the new rules and which pipeline your next application will use. FedRAMP's Important Dates page sets out the sequence: optional early adoption of the Consolidated Rules for 2026 from 4 July 2026, FedRAMP Ready becoming legacy on 28 July 2026, the 20x Class A pipeline opening on 3 August 2026, and the 20x Class B and C pipeline opening on 31 August 2026.

The Consolidated Rules for 2026 take mandatory effect on 1 January 2027, so any application submitted after that date falls under them. If you are a cloud provider planning a new Rev5 application, confirm with your sponsoring agency and assessor whether it can still be completed before 11 June 2027, because an application that stalls near that date may need to move to 20x. If you are an agency, ask your vendors which pipeline they are in and whether their documentation maps to the Key Security Indicators rather than only to Rev5 control evidence.

For existing Rev5 services, FedRAMP said on 8 October 2026 that transition paths and timelines for moving to 20x are expected by the end of FY27. Do not assume a migration date until FedRAMP publishes it. Ask your provider for a written transition plan, the staff and assessor time it will require, and how your ongoing assessment and continuous monitoring cadence will carry across the change. Confirm every date above against the FedRAMP Important Dates page before committing budget, since FedRAMP may update its schedule.

How many SP 800-53 controls must a Rev5 Security Decision Record include?

FedRAMP sets minimum counts of NIST SP 800-53 Rev. 5 controls and enhancements for each certification class, and a smaller set that must be assessed every year. These cards explain what the floors mean, how they relate to the SP 800-53B baselines, and what remains your decision.

Class B floor of 155

FedRAMP's Consolidated Rules for 2026 require a Rev5 Class B applicant to include at least 155 controls and enhancements in its Security Decision Record. The number is a floor, not a full catalog. Check that every selected control is mapped to its system component, that the record explains any control left out of scope, and that the count is taken from the record itself rather than from a baseline list.

Class C floor of 322

A Class C Rev5 provider must include at least 322 controls and enhancements in its Security Decision Record. Moving from Class B to Class C roughly doubles the set you must justify, so expect more documented implementation statements, parameter values and tailoring rationale. Ask your assessor early which Class C items they will test first, because gaps in those areas usually surface late in the process.

Class D floor of 409

Class D requires at least 409 controls and enhancements in the Security Decision Record. FedRAMP states that Rev5 is currently the only option for services that need Class D, so a provider in this class cannot yet choose the 20x path for that certification. Confirm with FedRAMP which version of the rules applies to your submission, since rule versions change during the year.

Annual assessment of 35 controls

Each year, an independent assessor must test at least 35 listed controls and enhancements for a Class B Rev5 certification. This subset is a yearly testing minimum that sits inside the larger Security Decision Record, not a replacement for it. Plan your continuous monitoring so these 35 items produce current evidence every year, and confirm which controls are on the list in the rule text before you schedule testing.

Annual assessment of 80 and 101

The annual independent assessment covers 80 controls and enhancements for Class C and 101 for Class D. The yearly set grows faster than the initial floor, so the cost of annual testing scales with class. Ask any assessor to quote against the listed set for your class, not against your full record, and confirm that your monitoring tooling can produce evidence for each listed item without manual rebuilding every year.

How the floors relate to baselines

FedRAMP says its classes loosely align with the SP 800-53B low, moderate and high baselines but do not correlate directly. A baseline is a starting point selected by impact level, while the class floor is FedRAMP's minimum for the Security Decision Record. Treat the baseline as the starting list, then tailor it. Do not assume that meeting a baseline automatically satisfies a class floor, and check the count against the rule text.

What do FedRAMP 20x Key Security Indicators ask for?

Under FedRAMP 20x, the requirements are no longer written as a long list of documented control narratives. They are expressed as Key Security Indicators, and the Consolidated Rules for 2026 contain 46 of them grouped into 10 themes. Each indicator lists the related NIST SP 800-53 controls, so the mapping to 800-53 remains, but the test is whether your service produces measured evidence that the outcome holds. The shift is from the Rev5 approach, which relies mainly on documented plans that describe how a control should work, to the 20x approach, which relies mainly on measured outcomes that show it does work. For a provider, that means a policy page that says logs are reviewed is no longer enough on its own. You need to show the logs, the review cadence, the alerts raised and the actions taken, with timestamps an independent assessor can sample.

The practical work starts with inventory. For each indicator in scope for your class, identify the systems, data sources and people that generate the evidence, and decide who collects it, where it is stored and how it is refreshed. Many indicators will draw on the same underlying tooling, such as identity logs, vulnerability scan results or configuration baselines, so one well-designed evidence pipeline can serve several indicators. Confirm each indicator's applicability and mapping against the machine-readable rules repository at FedRAMP's rules repository rather than relying on a secondary summary, because indicators and their control mappings are updated over time. Record the version you assessed against, since the current mappings were last updated on 13 October 2026, and the version your assessor tests may differ from the one you read last quarter.

Plan for the gap between a paper-based program and a measured one. Teams often discover that a control is operating but leaves no retrievable record, or that evidence exists in a ticketing system without a consistent link to the affected asset. Walk through two or three indicators with your assessor or implementation partner early, and ask them to confirm which artifacts they will sample and how far back they will look. Your self-hosted platforms should be able to export that evidence on demand within your own environment. Confirm with the FedRAMP documentation and your assessor which evidence formats are acceptable before you build the pipeline, since the requirements for what counts as sufficient evidence are set by the rules and the assessment, not by your tooling.

How to prepare a FedRAMP submission before the assessor arrives

This sequence takes a cloud service from an undefined scope to a fresh initial independent assessment that FedRAMP can accept, with each step producing a document the next step depends on. The provider owns every decision and the assessor issues the findings.

Confirm the certification type and class
Start by choosing between Rev5 and 20x and selecting the impact class (B, C or D) that matches the service. FedRAMP says its classes loosely align with the SP 800-53B low, moderate and high baselines but do not correlate directly, so confirm the class against FedRAMP's current guidance rather than assuming a baseline. Note that Rev5 is currently the only option for Class D, and that Rev5 applications stop being accepted on 11 June 2027. The output is a one-page decision record signed by the service owner, naming the type, class and the reasons for them.
Map the service boundary
Document every component that stores, processes or transmits federal data, including hosting accounts, management planes, identity providers, logging pipelines, backup systems and third-party services. Mark which components are inherited from an underlying provider and which the provider operates itself. Self-hosted and hybrid services need this step to be especially exact, because the boundary decides which controls the provider must implement. The output is a boundary diagram plus an inventory that ties each component to an owner and a data flow.
Select controls for the security decision record
Using the boundary, select the SP 800-53 Rev. 5 controls and enhancements that the Consolidated Rules for 2026 require in the Security Decision Record for the chosen class. Check the counts in the rules against your selection, and record for each control whether it is implemented by the provider, inherited, or shared. Where a control is tailored, record the rationale. The output is a draft Security Decision Record with a control-by-control status. Confirm the current counts directly in the FedRAMP rules before you finalize the list.
Collect evidence for each selected control
For each selected control, gather the artifact an assessor would examine: configuration exports, policy documents, access review records, scan results, change tickets, training logs and incident test records. Store the artifacts in a single evidence index that links each file to the control ID, the owner and the collection date. If the service is assessed against 20x Key Security Indicators, build the index around the indicators and their mapped SP 800-53 controls instead. The output is a control evidence index that an assessor can navigate without asking where a file lives.
Run a pre-assessment gap review
Compare the evidence index with the Security Decision Record and the SP 800-53A assessment procedures for each control. For each control, check that the determination statement can be answered from the evidence, and that the evidence is current and covers the whole boundary, not a sample of it. Record every gap as an item with a control ID, a missing or weak artifact, an owner and a remediation or documented risk decision. The output is a gap list, reviewed and accepted by the authorizing decision-maker. Independent consultants may run this review, but the provider decides what to fix.
Close gaps and freeze the assessed configuration
Remediate the items on the gap list, update the system security plan and evidence index to match, and record any control that the provider chooses to accept as a documented risk rather than fix. Freeze the configuration that will be assessed, so that the evidence reflects one version of the system. Changes made after the freeze must be tracked, because they can invalidate evidence the assessor has already seen. The output is a version-controlled plan and evidence set with a change log and a signed statement of the assessed baseline.
Book the fresh initial independent assessment
Engage a FedRAMP Recognized assessment service and schedule the initial independent assessment. FedRAMP requires the assessment for Class B, C and D applicants to be completed within the previous 3 months, so time the booking so the assessment window covers the submission date, and confirm that the evidence is still current when the assessor starts. Ask the assessor to confirm independence and the scope they will test. The output is a signed engagement letter, an agreed assessment scope and a dated assessment plan.
Prepare the submission package for the assessor
Assemble the artifacts the assessor will request into a package that includes the boundary diagram, the Security Decision Record, the system security plan, the evidence index and the closed gap list. Name a single contact who answers evidence questions during the assessment. Ask the assessor to confirm in writing which artifacts they need and in what format. The output is a submission-ready package that the assessor can review without rebuilding the documentation from scratch.

Who owns the controls and who issues the outcome?

A FedRAMP authorization for a NIST SP 800-53 system depends on four roles that never collapse into one. The cloud provider owns the controls and the risk decisions, a partner prepares the system and its evidence, an independent assessor tests the controls, and FedRAMP or an agency sponsor makes the grant. Read each card to see where your responsibility ends and the next party's begins.

The cloud provider owns the controls

The provider remains accountable for every control in its authorization boundary, including the implementation statements in its System Security Plan and the plan of action and milestones for open findings. It decides how risk is accepted, which controls are inherited from a common control provider, and how it runs its relationship with the sponsoring agency or FedRAMP. Check that named internal owners sign off on each control narrative, because an outside partner cannot make those decisions for you.

The partner prepares systems and evidence

An implementation partner such as DeployOpen can configure, harden, document and collect evidence for a self-hosted platform, inside the client's own infrastructure and within a written scope. This covers configuration baselines, logging, access settings and the artifacts an assessor will request. The partner does not own the control decisions, does not sign the authorization package as the provider, and cannot guarantee that an assessment will pass or that a certification will follow.

The assessor tests and reports

A FedRAMP Recognized assessor performs the independent assessment against the SP 800-53A procedures and issues the assessment report with its findings. Independence matters: the assessor must not have designed or implemented the controls it tests, so it should not be the same firm that prepared the evidence. Confirm the assessor's recognition status and the applicable assessment rules for your class before engaging anyone, and ask how findings from the preparation phase will be handled.

FedRAMP or the sponsor grants the outcome

Only FedRAMP, for a FedRAMP certification, or the agency sponsor, through an authorization to operate, can grant the outcome. Under Rev5 Agency Certification, the sponsor's signed ATO letter must reach FedRAMP. Neither a consultant's readiness review nor an assessor's report is an authorization. Ask the provider in writing which body will decide, what package it must submit, and what happens to the outcome if the system changes materially after the decision.

What do FedRAMP buyers ask about NIST 800-53 before hiring help?

Can a Rev5 FedRAMP certification still be started after June 2027?

Under the supplied FedRAMP dates, FedRAMP will stop accepting applications for new Rev5 certifications on 11 June 2027, and the Consolidated Rules for 2026 take mandatory effect on 1 January 2027. Any Rev5 plan should be checked against the current timeline before scope is agreed, because the dates decide whether a Rev5 path is still open for your service. Ask your FedRAMP sponsor or assessor to confirm which certification type and class apply to your offering. The full schedule, including optional early adoption and pipeline openings, is on the FedRAMP Important Dates page.

What actually drives the cost of a NIST 800-53 FedRAMP effort?

The main drivers are the certification class, the authorization boundary, how much control evidence already exists, how much depends on third-party services, and the scope of independent assessment. FedRAMP's rules set minimum control counts in the Security Decision Record for each class, and the annual assessment scope also rises from Class B to Class D. NIST publishes no compliance or certification cost estimates, so no reliable figure can be quoted from NIST itself. Ask any provider to break a quote into your own work, the independent assessor's fees, tooling you buy, and recurring annual testing, and to show which assumptions about boundary and inherited controls it depends on.

Which parts of a FedRAMP 800-53 effort can our own team do?

Your team owns the system, the risk decisions and the controls, and it can prepare most of the documentation and evidence in house if it has the staff and time. Work that usually needs outside help includes building evidence pipelines, writing or reviewing the System Security Plan, configuring logging and scanning, and preparing for assessment. Some work must stay with you or with independent parties: the authorizing official's risk decision and the independent assessor's testing. Assessors must be independent, so the partner that helped build the system generally cannot also assess it. Confirm this boundary in writing before work starts.

How long does a FedRAMP NIST 800-53 effort take?

No duration can be promised from general principles, because the time depends on the class, boundary complexity, existing controls and how quickly the independent assessment can be scheduled. The most reliable timing sources are FedRAMP's published dates for each certification path and the prerequisites it sets, such as a fresh initial independent assessment completed within the previous 3 months for Class B, C and D applicants. Ask any partner for a milestone plan tied to those prerequisites, the dependencies it assumes, and the points where your organization must provide decisions or access.

What does the work require from our engineering and security teams?

It requires named owners for the system boundary, identity and access, logging, vulnerability management, change management, and incident response, plus people who can answer questions during assessment. Engineers must be able to show configurations, logs and scan results on demand, not only describe them. Compliance staff must keep the plans of action and milestones, the system security plan and the change records current. Plan for these people to spend recurring time after certification, because annual assessment and continuous monitoring continue for the life of the authorization.

Does 20x replace Rev5 for every service now?

No. As of October 2026, FedRAMP says Rev5 is still the only option for services that need Class D, while 20x Program Certification is available for Classes A, B and C. FedRAMP expects a 20x Class D pilot in late 2026 and formal availability in early 2027, and its FY27 goals include rulesets for self-hosted and hybrid-hosted services and transition paths for existing Rev5 services by the end of FY27. Services that need Class D, or that are self-hosted or hybrid, should confirm the current option with FedRAMP before choosing a path, since the answer may change during FY27.

Where an implementation partner fits in a FedRAMP program

An implementation partner's job in a FedRAMP program is to prepare the system, its controls and its evidence, and that boundary should be written down before any work starts. For a self-hosted open-source platform running inside your own cloud accounts, data center or air-gapped network, a partner can plan and build the platform, harden and document its configuration, map implemented controls to the SP 800-53 requirements in your Security Decision Record, collect evidence and run readiness checks against the assessment procedures in SP 800-53A. The scope should name each system component, each control family in play, the evidence formats expected by your assessor and the review points where you accept or reject the output. A fixed-scope statement of work is the natural place to record those items, along with what the partner will not do.

The partner does not decide your risk posture. Choosing which controls to tailor, which parameter values to set, which risks to accept and which to remediate first belongs to your organization, and the Security Decision Record is your document to sign. A partner can present options and the reasoning behind each one, but it should not sign the record, act as the authorizing official or accept residual risk on your behalf. Ask your partner to confirm in writing that its role is limited to preparation and evidence, and ask your own leadership to name who owns each decision. Assessor independence also limits what the partner may do: the independent assessor who issues the assessment work must not have designed or operated the controls it tests, so a partner that also performs the independent assessment would create a conflict you should avoid.

How DeployOpen prepares FedRAMP evidence for assessment

DeployOpen plans, implements, hardens, documents and supports self-hosted open-source platforms inside your own infrastructure, and prepares the systems, controls and evidence that a FedRAMP assessment will examine. DeployOpen does not issue audit reports or certifications; independent assessors and the FedRAMP process make those decisions.

How we scope

Engagements are fixed-scope, with scope, deliverables and timelines agreed in writing before work starts.
We map the agreed system boundary to the SP 800-53 controls and the FedRAMP class you are pursuing, and confirm the count with your assessor.
We confirm which controls your organization owns, which are inherited, and which sit with your cloud or hosting provider.

How we build

We deploy and configure self-hosted open-source platforms in your cloud accounts, data centers or air-gapped networks.
We implement control settings such as logging, access, encryption and patching, and record each setting as configuration evidence.
We run security testing on applications, APIs and infrastructure so findings can be tracked in your plan of action and milestones.

How we hand over

We produce system documentation, procedures and evidence packages organized by control so your assessor can trace each control.
We document known gaps and remediation steps so your team can decide accepted risk and owners before assessment begins.
We train your staff to operate, monitor and update the platforms, so evidence collection continues after the engagement ends.

How we support

Ongoing support, upgrades and continuous testing are available as retainers after the fixed-scope work is complete.
Retainers can cover recurring evidence refresh, vulnerability remediation tracking and changes that affect the authorization boundary.
Confirm with your assessor and FedRAMP's current rules which evidence and cadence your class requires before agreeing a retainer.

NIST 800-53 and FedRAMP