CR26 Final Rules: Class A-D Transition Underway

CR26 final rules released June 25, 2026, replacing Low/Mod/High with Classes A-D. Key timelines: July 6 marketplace open, August pipeline start, January 2027 mandatory transition, June 2027 Rev5 new certs end. Class A live for SOC 2 holders. Terminology changes and new requirements (SCN, IV&V, risk-based VM) are reshaping the compliance landscape. FIPS 140-2 to 140-3 transition also affects authorization timelines. Abnormal AI pursuing Class D upgrade signals growing demand for highest baseline. Asato achieved FedRAMP Ready under the old program, highlighting the retirement of Ready status.