FedRAMP Rev 5 T.1: Rev 5 baseline transition plan

What does T.1 require?

The Rev 5 transition strategy took effect on 30 May 2023 and set the timeline by the provider's phase: providers in planning (applying, in readiness review, without an agency In Process request or a 3PAO contract before that date) implement the Rev 5 baseline on the updated templates and have all new controls tested before submitting a package; providers in initiation (under 3PAO contract or assessment, or with a package under review before that date) complete their authorization on Rev 4, identify the delta to Rev 5 by 1 September 2023 or before the ATO, document plans with implementation and testing schedules in the SSP and POA&M in the repository, update them for leveraged providers' shared controls, and complete Rev 5 implementation by the next annual assessment; providers in continuous monitoring identify the delta by 1 September 2023, update for leveraged information by 2 October 2023, and complete implementation and testing within one year of a last assessment dated between 2 January and 3 July 2023 or by the next scheduled annual assessment for one due between 3 July and 15 December 2023. Every provider produces an entirely new package on the Rev 5 templates, scopes the transition assessment with the Rev 4 to Rev 5 controls selection template (core, new, conditional, provider-specific and inherited controls worksheets), tests all new or modified Rev 5 requirements, identifies the risks of leveraging IaaS or PaaS not yet transitioned, and an offering last assessed against Rev 4 undergoes a full new Rev 5 assessment.