If you have been handed a FedRAMP obligation, the problem is rarely that the rules are secret. They are published. The problem is that nothing connects a control you owe to the thing that would actually prove you meet it.
So teams get told to go collect evidence on AWS with no map attached, and spend the first month building the map by hand.
We built FedRAMP Rules Hub because we needed that map and it did not exist in a usable form.
The shape of the 2026 rules
The consolidated 2026 rules cover Rev5 baselines across three certification classes, and the control count scales sharply with each:
| Class | Baseline | Approximate controls |
|---|---|---|
| B | Low | ~155 |
| C | Moderate | ~322 |
| D | High | ~409 |
The jump from Low to Moderate roughly doubles the obligation. That single fact should inform scoping conversations much earlier than it usually does — teams commit to Moderate because a customer asked, without anyone having costed the difference.
Controls are the easy half
A control tells you what must be true. It does not tell you how to demonstrate it, and demonstration is where the months go.
The Hub carries 209 Rev5 authored AWS recipes linking specific controls to executable commands. The distribution inside those recipes turned out to be the most useful finding: 25 of the 35 authored recipes reference AWS Config.
That ratio has a practical consequence. The collector is, in effect, a Config-rule evaluator with CLI fallbacks. If you are planning FedRAMP evidence collection on AWS, getting Config right early covers most of the automatable surface — and treating Config as one integration among many is a sequencing mistake that costs you twice.
The residue is the honest part
Here is where compliance tooling usually starts lying.
A meaningful share of FedRAMP obligations cannot be proven by any API call. They are procedural, documentary, or about human processes: training completed, agreements signed, a review that actually happened. No AWS command produces that evidence, because the evidence is not in AWS.
The tempting move is to quietly count those toward coverage, or to accept a weak proxy and call it proof. It produces a better-looking dashboard and an audit failure later.
We kept the residue visible instead — the obligations no API can produce stay listed as exactly that, unresolved and yours to document manually. Reported coverage is lower. It is also true, and the number a team plans against is the one that has to be true.
This is the general principle for compliance automation, and it survives outside FedRAMP: a tool's job is to shrink the manual set and name what remains, not to make the manual set invisible. A system that hides the gap has moved the failure from your planning to your audit.
What this means if you are scoping this work
Three things worth knowing before you commit:
Baseline choice is a cost decision, not just a sales one. Moderate is roughly double Low. Establish which one you actually need before promising it.
Config-first, not Config-eventually. Most of what can be automated on AWS runs through it.
Budget for the residue explicitly. The obligations no API can prove will not shrink because you bought tooling. They need owners and calendar time, and finding them in month one is considerably cheaper than finding them in the audit.
The catalogue is queryable and public at ramprules.com — scoped plans by class, permalinks for individual controls, and JSON exports if you want to drive it from your own pipeline.
Common questions
- How many controls does FedRAMP Rev5 require?
- It depends on the baseline. Roughly 155 controls at Low, 322 at Moderate and 409 at High. The count matters less than how many of them you can evidence automatically.
- Can FedRAMP evidence collection be fully automated?
- No, and any tool claiming otherwise is inflating coverage. A meaningful share of obligations are procedural or documentary and no API can produce them. The useful thing is knowing exactly which ones those are.
- What is FedRAMP Rules Hub?
- A queryable catalogue of the FedRAMP 2026 consolidated rules that maps controls to executable AWS commands, scoped by certification class, with the unautomatable residue kept visible rather than hidden.
- Compliance
- AWS
- Security
