CR26 final rules drive the transition to Classes A-D and continuous certification

CR26 replaces impact-level terminology with Classes A-D, mandates classification narratives and machine-readable evidence, changes sponsorship and IV&V requirements, and moves CSPs toward continuous authorization. Phased intake is underway, with Rev5/20x dual-running, OSCAL-ready packages, explicit boundary mapping, FIPS 140-3 planning, and January 2027 mandatory transition remaining the main CSP priorities.