Insights

The Department of War (DoW) is immediately suspending Cybersecurity Maturity Model Certification (CMMC) Phase II requirements, which had been scheduled to take effect on November 10, 2026.

On June 25, 2026, the Federal Risk & Authorization Management Program (FedRAMP) launched its Consolidated Rules for 2026, marking a significant turning point in how the U.S. government administers security authorizations of private sector cloud offerings. The Consolidated Rules apply to all variants of the FedRAMP ecosystem, including legacy "Rev5" authorization holders, as well as future certifications under the new 20x program. Importantly, the Rules are intended in part to transition Rev5 authorizations over to 20x, with the Rev5 authorization status expected to terminate by the end of 2028. 

The Federal Risk and Authorization Management Program (FedRAMP) continues to advance its modernization agenda. On April 8, 2026, FedRAMP released RFC-0031, Updated Incident Communications Procedures for public comment. This RFC proposes replacing the current FedRAMP Incident Communications Procedures (ICP) with what FedRAMP calls “a clear set of reporting requirements … established using a modern rules-based format.” 

Crowell & Moring’s “All Things Protest” podcast keeps you up to date on major trends in bid protest litigation, key developments in high-profile cases, and best practices in state and federal procurement. In this episode, Crowell's Christian Curran, Zachary Schroeder, and Bryan Dewan discuss a recent Federal Circuit appeal on the Blue & Gold waiver rule, and a Court of Federal Claims protest about the "late is late" rule in the world of electronic proposal submissions.

Materials discussed in this episode:

Click below to listen or access from one of these links: