One Program, Three Package Shapes: Architecting for FedRAMP 20x, Rev5 under CR26, and Legacy Buyers
FedRAMP retired the SSP and POA&M. Agencies and the DoD equivalency process still require them. A blueprint for building one evidence layer that emits every package shape a buyer asks for.
FedRAMP has rebuilt itself. The JAB is gone, 20x has been granting authorizations since the 2025 pilots, and the Consolidated Rules for 2026 took effect on July 4, 2026, becoming mandatory for all stakeholders on January 1, 2027. Under CR26 the System Security Plan and the POA&M are retired artifacts: the Security Decision Record replaces them, evidence is machine-readable, and validation is persistent. FedRAMP stops accepting new Rev5 applications on June 11, 2027 and plans to sunset existing Rev5 authorizations by December 31, 2028.
The buyers have not moved at the same speed. Agency authorizing officials still ask for the SSP and the POA&M, and are expected to keep asking after providers stop producing them. Procurement language still cites Rev5 artifacts by name. And for cloud services sold to defense contractors handling CUI, the DoD’s FedRAMP Moderate equivalency memo defines the required body of evidence as exactly the legacy package: SSP, SAP, SAR, and POA&M, covering 100% of the Moderate baseline, assessed by a 3PAO, with every POA&M item closed.
That is the split: the modern rules retire the exact documents the legacy buyers still require. Build only for the new world and you cannot sell into the old one. Build only the old package and you are building on a foundation with a published sunset date. Most providers will spend 2026 through 2028 needing both, and the answer is not parallel compliance programs. It is one security program, one evidence layer, and package emitters that produce whatever shape the buyer requires.
The three package shapes
SDR with KSI summaries, human-readable + JSON
SDR with control summaries; SSP and POA&M retired; VDR/VER; configuration guides
SSP, SAP, SAR, POA&M, monthly ConMon deliverables
Machine-readable measures, persistent validation, class-scaled metric history
Continuous monitoring broadened, availability reporting added
Narrative documents; equivalency demands 100% of Moderate, all POA&Ms closed
Independent assessor at least yearly (Classes B–D)
3PAO annual assessment under updated rules
3PAO assessment; DCMA DIBCAC validates the contractor side
Open now; Phase 3 formalizes wide-scale adoption
Mandatory Jan 1, 2027; no new Rev5 applications after Jun 11, 2027
Persists until buyers and the DoD memo move; Rev5 riders end with the Dec 31, 2028 sunset
The three shapes a single set of security facts must take, depending on who is buying.
What the blueprint covers
The whitepaper is written for teams that have to architect and build these packages, not just read about them. Inside:
- The problem, stated plainly: two clocks running, with the rules retiring documents on one schedule and buyers still requesting them on another
- The three tracks in one view: 20x, Rev5 under CR26, and legacy/equivalency compared on core record, evidence style, assessment, and deadlines
- A buyer-driven decision flow: which shape you owe when your reliance comes from a civilian agency, an existing Rev5 ATO, or defense contractors under DFARS 7012
- The blueprint: one evidence layer built from FedRAMP’s machine-readable rules, with a measurement pipeline, the Security Decision Record as the single source of truth, and emitters that render the 20x package, the CR26 package, and the legacy SSP/POA&M/equivalency body of evidence from the same records
- The way ahead: a phased build sequence and the failure modes that sink these projects, starting with writing the SSP first and reverse-engineering the evidence
Build the packages once
Architecting for 20x, operating a Rev5 authorization under the 2026 rules, or facing an equivalency ask from a defense prime? This is the problem we build for at Optimal: evidence that runs on its own, a Security Decision Record your assessor can verify, and the legacy documents rendered from it rather than authored in parallel. Schedule a 30-minute conversation.
Sources
- FedRAMP Consolidated Rules for 2026
- What’s changing for Rev5 providers
- FedRAMP machine-readable rules
- 20x Key Security Indicators
- DoD FedRAMP Moderate Equivalency memo (December 2023); DFARS 252.204-7012