FedRAMP packages and the 2026 dates

FedRAMP's 2026 rules (CR26) replace the System Security Plan and its appendices with three machine-readable documents: the Certification Package Overview (CPO), the Security Decision Record (SDR) and the Ongoing Certification Report (OCR). Axis Assure writes all three from your records, checks them against FedRAMP's own published schemas, and keeps each as a stored revision like any other package (see OSCAL packages for when a revision is signed).

TL;DR — The three documents are built from the system's FedRAMP offering profile (track, class, the programs it follows, contacts, the CPO's public address) and your records. Assure → Packages → Export a package offers the CPO, SDR and OCR on Enterprise; for a system with no profile yet, it links you to the page where you set one. That page's lint lists every gap FedRAMP's rules would find — a missing control statement, a parameter you have not set — before you build anything.

Setting the offering profile

Each system keeps its own offering profile: a FedRAMP package describes one system's authorization boundary. There is no separate menu entry for it — the export wizard takes you there.

1. 1

   Start an export

   In Assure → Packages → Export a package, choose a FedRAMP document and the system. If the system has no offering profile, the step says so, does not go on, and offers Set the offering profile, which opens the FedRAMP offering profile page for that system.

2. 2

   Choose the track and class

   Pick the program that follows FedRAMP's rules, then the track and the certification class. Both lists come from that program's own rules pack, never from a list kept in Axis Assure; if no program follows FedRAMP's rules, the page asks you to adopt the FedRAMP rules framework first. A track whose package lists every control of the class baseline asks for the program that follows that baseline; one whose package lists Key Security Indicators asks for the program that follows them.

3. 3

   Describe the offering

   Fill in the service (left blank, its name and description are the system's), where the CPO is published (a full https: address — the other documents name it), the team that maintains the package (a team, never a person's account), the service properties (FedRAMP's own choices, from its pinned schema), contacts, assessor and advisors, repositories, certified services, third parties, ports and protocols, and what the OCR needs that only people can state. Save the profile. If someone else changed the system since you opened the page, the save is refused: reload to see their change, then make yours again.

4. 4

   Read the lint

   The package today shows the lint of the package the profile would build now, against the rules your program follows — or why no package can be built yet. It is computed each time and nothing is stored; Check again after you change your records.

Anyone who can see the workspace's GRC data can read the profile, on a plan that includes FedRAMP packages (on another plan the page shows what unlocks it). Changing it needs the permission to manage systems. Each change is recorded in the workspace's audit trail with the track, class and programs; the contact details are not copied into the audit trail.

What Axis Assure writes

Each document is written as JSON and validated against the version of FedRAMP's schema it was built for; the package records that version. FedRAMP publishes its schemas as drafts and revises them in place, so Axis Assure pins each one by its exact contents; a change FedRAMP makes is reviewed before a new version is used.

Vulnerability reports. The Vulnerability Detail Report (VDR) and the Accepted Vulnerability Info (AVI) are written from Vulnerability Response's findings, and are offered once it holds findings. A system's report counts only the findings of a vulnerability scanner connected to a component inside the system's boundary; with no such scanner, nothing is built, because an empty report would say "no vulnerabilities" where nobody looked. Each report covers the period since your previous submitted report (the first one, since the first finding was detected). Both name the CPO's address from the offering profile, so the profile must be set first.

What is not offered yet. Significant change notifications and incident reports are not written.

Rev5 OSCAL. Providers still on Rev5 can export OSCAL 1.1.3 documents (System Security Plan, assessment plan and results, POA&M). Whether FedRAMP accepts them, and in which version, is FedRAMP's decision; Axis Assure never claims a package is "FedRAMP-accepted".

FedRAMP's dates, as published

These are FedRAMP's dates as its notices and rules stated them when this page was written (checked October 2026). FedRAMP changes them; check fedramp.gov before you plan a submission.

Under CR26, POA&Ms are eliminated: accepted vulnerabilities replace them. DOCX and XLSX submissions are retired, and human-readable material is generated from the machine-readable documents.