Fedramp
Expert guidance for FedRAMP certification and compliance under CR26 (FedRAMP...
Install
npx skills add Sushegaad/Claude-Skills-Governance-Risk-and-Compliance --skill fedramp -g -a claude-code -y- Category
- Security
- Updated
- 26d ago
- License
- MIT
- Context cost
- Mediumabout 3,000 tokens
- Runs scripts
- No, instructions only
What it does
Expert guidance for FedRAMP certification and compliance under CR26 (FedRAMP Consolidated Rules for 2026). Use this skill whenever a user asks about FedRAMP authorization, ATO (Authority to Operate), cloud security for federal government, NIST SP 800-53 controls, CSP compliance, or any of the core FedRAMP document types: SSP, SAP, SAR, POA&M, CIS/CRM workbooks. Also trigger for questions about FedRAMP Certification Classes (A, B, C, D, new baseline labels: A = pilot/transitional, B = LI-SaaS/Low, C = Moderate, D = High, per NTC-0004), FedRAMP 20x (now the primary authorization pathway), OSCAL mandate (September 2026), 3PAO assessments, continuous monitoring (ConMon), gap assessments, system boundary definition, or architecture reviews for federal cloud. FedRAMP Ready retired July 28, 2026 (Legacy FedRAMP Ready). When in doubt, use this skill, it covers the full FedRAMP lifecycle from readiness through continuous monitoring.
FedRAMP Certification Skill
Last verified: 2026-10-03
A comprehensive guide for helping users navigate FedRAMP authorization, from initial readiness through ATO and ongoing continuous monitoring.
Quick Reference: What Does the User Need?
Identify the user's goal and jump to the appropriate section:
| User Goal | Go To |
|---|---|
| "Are we ready for FedRAMP?" / gap assessment | → Readiness & Gap Assessment |
| Writing SSP, POA&M, SAR, SAP, or other docs | → ATO Documentation |
| "Which controls apply to us?" / control mapping | → NIST 800-53 Control Mapping |
| Cloud architecture / AWS/Azure/GCP config | → Architecture Guidance |
| Already authorized, ongoing compliance | → Continuous Monitoring |
Current FedRAMP State (as of August 2026, CR26)
⚠️ CR26 (FedRAMP Consolidated Rules for 2026): FedRAMP has restructured its authorization framework. FIPS 199-based baseline labels (Low/Moderate/High/LI-SaaS) are replaced with Certification Classes A, D (per notice NTC-0004; CR26 rules valid through December 31, 2028). Class labels change the names of the baselines, not their requirements. CSPs already authorized under the old labels retain their authorization through a transition period in which old and new labels are linked.
