FedRAMP for a startup: what to do in the first 90 days

In the first 90 days, a startup should not write a security plan. It should confirm that a federal buyer wants the service, draw a tight system boundary, choose a starting class and path, and set up automated evidence. FedRAMP changed its rules in 2026, so read the current official text before you commit.

What changed in 2026?

Secondary sources, including a law firm alert, a consultancy summary and a Cloud Security Alliance research note, report that FedRAMP published its Consolidated Rules for 2026 on 25 June 2026. They describe certification Classes A to D replacing the Low, Moderate and High framing, with Class A as the entry point. FedRAMP is reported to recommend that providers start at Class A and consider higher classes once agencies show interest.

Reported dates: vulnerability detection and response rulesets due by 7 December 2026, rules mandatory for all stakeholders on 1 January 2027, new Rev5 applications closed on 11 June 2027, and existing Rev5 authorizations ending on 31 December 2028. They also report that System Security Plans and Plans of Action and Milestones are retired in favor of concise, machine-readable evidence.

The CSA note states it was AI assisted and not through official CSA review. Sources also differ on some labels. Treat every date here as a lead to confirm on fedramp.gov, not as settled fact.

Also note that a certification issued by the program is separate from an agency's own authorization to operate decision, which each agency makes. A tool or consultant cannot grant either.

Days 1 to 30: decide and scope

1. Find the buyer. Ask which agency, civilian or defense, would use the service and when. Without demand, a class is a cost with no return.
2. Choose the market. Civilian and defense requirements differ. Defense work adds more.
3. Draw the boundary. List every component, data store, vendor and person that touches federal data. A smaller boundary is cheaper to secure and evidence.
4. Take stock of what you have. If you already hold a SOC 2 report, A-LIGN's summary notes that existing program work can often be reused. Map what overlaps.
5. Read the official rules. Use the FedRAMP site, not a blog, for classes and paths.

Days 31 to 60: build the evidence engine

FedRAMP's direction favors continuously produced, machine-readable evidence. That is an engineering problem more than a writing one.

1. Inventory. Keep a live list of assets and software components, including open source. A software bill of materials per release helps.
2. Vulnerability handling. Set scan frequency, triage rules and fix timelines, and record them. The reported December 2026 rulesets make this the early gate.
3. Configuration baselines. Define and monitor the intended state of your cloud accounts.
4. Incident process. Reported incident reporting triggers are more complex, so write yours down and test it.
5. Evidence storage. Pull records on a schedule, with timestamps and integrity checks.

Days 61 to 90: test and decide

1. Run an internal gap review against the class you chose.
2. Pick a path and ask early how assessment will work for your class.
3. Price the work: engineering time, assessor fees, and the cost of staying in scope.
4. Present a go or no go decision with the demand evidence from week one.
5. If go, schedule the first assessment steps. If no go, keep the evidence engine, since SOC 2 and other buyers also value it.

Where does Safeguard fit?

Safeguard produces software inventories and scan results, and offers compliance automation for collecting evidence. These help with the inventory and vulnerability parts of the plan. Safeguard does not grant or hold your authorization, and no tool replaces the assessment process.

Quick check

Sources

• A-LIGN: The FedRAMP 2026 Consolidated Rules
• Crowell: FedRAMP revamps the program with Consolidated Rules for 2026
• Cloud Security Alliance: FedRAMP's Consolidated Rules for 2026 (PDF)
• FedRAMP

Last reviewed: 18 October 2026.