FedRAMP CR26: Cryptography and PQC Readiness

FedRAMP is evolving—and the implications go well beyond changes to the authorization and certification process.

In a new podcast hosted by Carahsoft and SCOOP Cyber, SafeLogic CEO Evgeny Gervis joins experts from StackArmor and Qanapi to discuss FedRAMP CR26, the growing role of automation in federal cybersecurity compliance, and what these changes mean for cloud service providers.

One theme stands out: as FedRAMP moves toward more continuous and automated security evidence, organizations need better visibility into the cryptography protecting their systems.

What the Panel Covers

In the discussion, Evgeny and the panel explore:

• Why CR26's shift toward automated evidence could reveal cryptography gaps that point-in-time assessments miss
• Why FIPS 140-3 validated cryptography remains critical as FedRAMP evolves
• How cryptographic visibility supports both federal compliance and post-quantum migration
• Why organizations cannot effectively migrate cryptography they cannot see
• How crypto-agility can help organizations respond to changing algorithms, standards, and threats
• Why compliance should become a byproduct of effective risk management rather than a point-in-time exercise

Watch the Full FedRAMP CR26 Discussion

From Point-in-Time Evidence to Continuous Visibility

CR26 represents a broader shift in FedRAMP toward automation. Rather than relying as heavily on lengthy narratives, manual screenshots, and point-in-time evidence, the new direction emphasizes more dynamic and machine-readable ways of demonstrating that security requirements are being met.

Cryptography is especially well suited to this model.

When implemented and managed properly, organizations can use telemetry to demonstrate which cryptographic modules are deployed, where encryption is enabled, and whether sensitive data is being protected as required. That can provide a more complete view than manually validating a representative system during a point-in-time assessment.

For cloud service providers, this makes cryptographic posture management increasingly important: knowing where cryptography exists, how it is being used, whether it aligns with policy, and whether the implementations protecting sensitive data meet applicable FIPS requirements.

FIPS-Validated Cryptography Still Matters

While FedRAMP processes are changing, the importance of properly implemented cryptography has not.

Organizations protecting sensitive federal data still need to determine whether the cryptography in their environments meets applicable federal requirements, including the use of FIPS 140-3 validated cryptographic modules.

This distinction matters. Using encryption is not the same as using validated cryptography, and organizations need sufficient visibility into their environments to demonstrate that the appropriate cryptographic protections are actually in place.

For technology providers pursuing FedRAMP, that means cryptography should not be treated as a final compliance checkbox. It should be integrated into the architecture, security program, and evidence-generation process from the beginning.

Where PQC Readiness Fits In

Post-quantum cryptography is a related—but distinct—priority.

CR26 itself does not create the broader federal transition toward PQC. However, the same capabilities organizations need to support more continuous FedRAMP evidence also help prepare them for post-quantum migration.

Before an organization can replace a vulnerable or outdated cryptographic algorithm, it needs to know where that algorithm is being used in the first place.

That visibility can expose a larger challenge: cryptographic debt. Many environments still contain older cryptographic implementations that may already be weak or inappropriate, even before accounting for the threat from cryptographically relevant quantum computers.

PQC readiness, therefore, starts with more than just deploying new algorithms. Organizations need to understand their current cryptographic posture, identify what protects their most sensitive data, establish clear cryptographic policies, and build the ability to change cryptography as requirements and threats evolve.

Crypto-Agility Becomes a Long-Term Requirement

The era in which organizations could deploy the same cryptographic algorithms and leave them largely unchanged for decades is ending.

New standards, new vulnerabilities, advances in quantum computing, and an increasingly automated threat landscape all reinforce the need for crypto-agility: the ability to update algorithms and cryptographic implementations without redesigning entire applications or infrastructures.

That means organizations should be able to answer questions such as:

• Where is cryptography deployed across our environment?
• What cryptography is protecting sensitive data?
• Are those implementations FIPS validated where required?
• Does our use of cryptography align with organizational policy?
• Can we replace an algorithm or module efficiently when requirements change?
• Can we continuously verify that those changes have actually propagated across the environment?

Those capabilities support FedRAMP compliance today while creating a stronger foundation for PQC migration tomorrow.

Make Compliance a Byproduct of Good Risk Management

For Evgeny, one of the most important opportunities presented by CR26 is to move away from treating compliance as a test organizations study for.

Instead, evidence of compliance should emerge naturally from a strong risk management and security program. If organizations continuously understand their security posture, collect meaningful telemetry, and govern cryptography effectively, many of the artifacts required for compliance can become outputs of the work they are already doing to manage risk.

That is particularly relevant for cryptography, which underpins digital privacy and trust across federal systems.

The goal is not simply to demonstrate compliance at a moment in time. It is to build an environment in which organizations can continuously understand, govern, and adapt the cryptography protecting their most important data.

Watch the Full Discussion

Watch the full conversation to hear Evgeny and the panel discuss FedRAMP CR26, automated evidence, FIPS 140-3, cryptographic posture management, post-quantum readiness, and why crypto-agility is becoming an essential security capability.

FedRAMP CR26 Explained: FIPS 140-3, PQC & Crypto-Agility