FedRAMP Consolidated Rules (2026) 2026.07.14.01 → 2026.09.13.02
Published 2026-09-13
Snapshot taken 2026-10-15 15:31 · rules source
Snapshot taken 2026-10-15 15:31 · rules source
+ 5 added: FRD-MAY, FRD-MNT, FRD-MST, FRD-SHD, FRD-SNT
~ 1 revised: CCM-OCR-AVL
220 with discussion, related-control or assessment updates
226 of 226 changed requirements carry the publisher's note
Why this release, in the publisher's words
FedRAMP's change notes dated 2026-09-13 (version 2026.09.13.02): Fixed broken reference URL for the Agency Liaison Program. Added (if applicable) to clarify that some of these items are not always required depending on the FedRAMP Certification Type or Class. Removed the extra the in all statements. Added force to FedRAMP Definitions for clarity.
https://github.com/FedRAMP/rules/commits/main/fedramp-consolidated-rules.jsonAll · 226AFC: Addressing FedRAMP Communication · 12AGU: Agency Use of FedRAMP Certified Cloud Services · 20CCM: Collaborative Continuous Monitoring · 19CDS: Certification Data Sharing · 15CMU: Cryptographic Module Use · 3CPO: Certification Package Overview · 3FRC: FedRAMP Certification · 21FRD: Definitions · 5IEC: Incident Evaluation and Communication · 8IVV: Independent Verification and Validation · 15KSI-CNA: Cloud Native Architecture · 1KSI-PIY: Policy and Inventory · 3KSI-RPL: Recovery Planning · 1KSI-SVC: Service Configuration · 1MAS: Minimum Assessment Scope · 5MKT: Marketplace Listing · 11REC: FedRAMP Recognition of Independent Assessment Services · 16SCG: Secure Configuration Guide · 9SCN: Significant Change Notification · 17SDR: Security Decision Record · 2VDR: Vulnerability Detection and Response · 16VER: Vulnerability Evaluation and Reporting · 23
Controls added, removed or revised 6
Discussion, related-control and assessment updates 220
| Control | Title | What moved |
|---|---|---|
| AFC-CSO-ACK | Acknowledge Receipt | Assessment and other text |
| AFC-CSO-CRA | Complete Required Actions | Assessment and other text |
| AFC-CSO-EMR | Emergency Message Routing | Assessment and other text |
| AFC-CSO-IMA | Important Message Actions | Assessment and other text |
| AFC-CSO-INB | Maintain a FedRAMP Security Inbox | Assessment and other text |
| AFC-CSO-NOC | Notification of Changes | Assessment and other text |
| AFC-CSO-RCV | Receive Email Without Disruption | Assessment and other text |
| AFC-CSO-TFG | Trust @fedramp.gov and @gsa.gov | Assessment and other text |
| AFC-FRP-CDS | Criticality Designators | Assessment and other text |
| AFC-FRP-ERT | Elevated Reaction Timeframes | Assessment and other text |
| AFC-FRP-RPM | Reaction Metrics | Assessment and other text |
| AFC-FRP-VRE | Verified Emails | Assessment and other text |
| AGU-AGC-AIP | Agency Internal Policies | Assessment and other text |
| AGU-AGC-GRC | Governance, Risk, and Compliance Tools | Assessment and other text |
| AGU-AGC-LIA | Agency Liaison Program | Assessment and other text |
| AGU-AGC-NAA | Notify FedRAMP After Authorization | Assessment and other text |
| AGU-AGC-NAI | Notify Additional Information Requests | Assessment and other text |
| AGU-AGC-NAR | No Additional Security Requirements | Assessment and other text |
| AGU-AGC-SIN | Shared FedRAMP Inbox | Assessment and other text |
| AGU-AGC-TPP | No Certification Type or Path Preferences | Assessment and other text |
| AGU-AGC-WKG | FedRAMP Working Groups | Assessment and other text |
| AGU-SPN-MRC | Most Recent Consolidated Rules | Assessment and other text |
| AGU-USE-ABU | Authorization Before Use | Assessment and other text |
| AGU-USE-AFR | Accept FedRAMP Rules | Assessment and other text |
| AGU-USE-CLA | Using FedRAMP Class A Certifications | Assessment and other text |
| AGU-USE-DSO | Designate Senior Official | Assessment and other text |
| AGU-USE-NFC | Notify FedRAMP of Monitoring Concerns | Assessment and other text |
| AGU-USE-NPC | Notify Provider of Concerns | Assessment and other text |
| AGU-USE-RCF | Resolve Certification Package Conflicts | Assessment and other text |
| AGU-USE-RIR | Review All Information Resources | Assessment and other text |
| AGU-USE-ROR | Review Ongoing Certification Reports | Assessment and other text |
| AGU-USE-RSG | Review Secure Configuration Guides | Assessment and other text |
| CCM-AGM-CSC | Consider Security Category | Assessment and other text |
| CCM-AGM-ROR | Review Ongoing Reports | Assessment and other text |
| CCM-OCR-AFS | Anonymized Feedback Summary | Assessment and other text |
| CCM-OCR-FBM | Feedback Mechanism | Assessment and other text |
| CCM-OCR-LSI | Limit Sensitive Information | Assessment and other text |
| CCM-OCR-NRD | Next Report Date | Assessment and other text |
| CCM-OCR-RPS | Responsible Public Certification Report Sharing | Assessment and other text |
| CCM-OCR-SOR | Spread Out Reports | Assessment and other text |
| CCM-QTR-ACT | Additional Content | Assessment and other text |
| CCM-QTR-MTG | Quarterly Review Meeting | Assessment and other text |
| CCM-QTR-NID | No Irresponsible Disclosure | Assessment and other text |
| CCM-QTR-NRD | Next Review Date | Assessment and other text |
| CCM-QTR-REG | Meeting Registration Info | Assessment and other text |
| CCM-QTR-RTP | Restrict Third Parties | Assessment and other text |
| CCM-QTR-RTR | Record/Transcribe Reviews | Assessment and other text |
| CCM-QTR-SAR | Schedule Around Reports | Assessment and other text |
| CCM-QTR-SCR | Share Content Responsibly | Assessment and other text |
| CCM-QTR-SRR | Share Recordings Responsibly | Assessment and other text |
| CDS-CSO-AVR | Availability Reporting | Assessment and other text |
| CDS-CSO-CBF | Consistency Between Formats | Assessment and other text |
| CDS-CSO-FID | Always Include FedRAMP ID | Assessment and other text |
| CDS-CSO-FRC | FedRAMP Certification Reports | Assessment and other text |
| CDS-CSO-HAD | Historical FedRAMP Certification Data | Assessment and other text |
| CDS-CSO-IRP | Include Relevant Policies | Assessment and other text |
| CDS-CSO-PSM | Per-Service Certification Materials | Assessment and other text |
| CDS-CSO-PUB | Public Information | Assessment and other text |
| CDS-CSO-RIS | Responsible Information Sharing | Assessment and other text |
| CDS-CSO-RPS | Responsible Public Package Sharing | Assessment and other text |
| CDS-CSO-SVC | Public Service List | Assessment and other text |
| CDS-CSO-UTC | Use Trust Centers | Assessment and other text |
| CDS-TRC-AAI | Agency Access Inventory | Assessment and other text |
| CDS-UTC-AAD | Agency Access Denial | Assessment and other text |
| CDS-UTC-AGA | Agency Access | Assessment and other text |
| CMU-CSO-CAT | Configuration of Agency Tenants | Assessment and other text |
| CMU-CSO-CMD | Cryptographic Module Documentation | Assessment and other text |
| CMU-CSO-UVM | Using Validated Cryptographic Modules | Assessment and other text |
| CPO-CSO-MTD | Certification Package Overview Metadata | Assessment and other text |
| CPO-CSO-OSA | Overall Summary of Assessment in Certification Package | Assessment and other text |
| CPO-CSO-OVR | Overview of the Cloud Service Offering | Assessment and other text |
| FRC-APP-AFC | Applying for FedRAMP Certification | Assessment and other text |
| FRC-APP-FCP | Fresh FedRAMP Certification Package | Assessment and other text |
| FRC-APP-FIA | Fresh Independent Assessment | Assessment and other text |
| FRC-APP-MLF | Marketplace Listing First | Assessment and other text |
| FRC-APP-NTP | No Third-Party Applicants | Assessment and other text |
| FRC-APP-USA | Updating Stale Assessments | Assessment and other text |
| FRC-APS-ATO | Agency Authorization to Operate | Assessment and other text |
| FRC-CCL-DCC | Downgrading Certification Class | Assessment and other text |
| FRC-CCL-DNP | Downgrade Notification Period | Assessment and other text |
| FRC-CCL-UCC | Upgrading Certification Class | Assessment and other text |
| FRC-CLA-ASF | Approved Alternative Security Frameworks | Assessment and other text |
| FRC-CLA-EAM | External Assessment Materials | Assessment and other text |
| FRC-CLA-IVV | Optional Independent Verification and Validation | Assessment and other text |
| FRC-CLA-MFR | Mandatory FedRAMP Rules for Class A | Assessment and other text |
| FRC-CLA-OFR | Address Optional FedRAMP Rules for Class A | Assessment and other text |
| FRC-CLA-RFR | Recommended FedRAMP Rules for Class A | Assessment and other text |
| FRC-CSO-FCP | FedRAMP Certification Profile | Assessment and other text |
| FRC-CSO-JSN | FedRAMP JSON Schemas | Assessment and other text |
| FRC-CSO-MRA | Maintain Responsibility and Accountability | Assessment and other text |
| FRC-CSO-PKG | FedRAMP Certification Package | Assessment and other text |
| FRC-CSO-POP | Pick One Program Certification Type | Assessment and other text |
| IEC-CSO-AIR | Automated Incident Reporting | Assessment and other text |
| IEC-CSO-DPR | Default PAIN Rating | Assessment and other text |
| IEC-CSO-EFI | Estimate Federal Impact | Assessment and other text |
| IEC-CSO-EFR | Evaluate FedRAMP Reportability | Assessment and other text |
| IEC-CSO-FIR | Final Incident Report | Assessment and other text |
| IEC-CSO-IIR | Initial Incident Report | Assessment and other text |
| IEC-CSO-OIR | Ongoing Incident Reports | Assessment and other text |
| IEC-FRP-ORV | Ongoing Review | Assessment and other text |
| IVV-CSO-DUS | Document Use of Representative Samples | Assessment and other text |
| IVV-CSO-FIA | FedRAMP Independent Assessments | Assessment and other text |
| IVV-CSO-ICP | Inclusion in Certification Package | Assessment and other text |
| IVV-CSO-RAA | Receiving Assessor Advice | Assessment and other text |
| IVV-CSO-SEE | Supply Evidence of Effectiveness | Assessment and other text |
| IVV-CSO-SEI | Supply Evidence of Implementation | Assessment and other text |
| IVV-CSO-STE | Supply Technical Explanations | Assessment and other text |
| IVV-CSO-USR | Use Representative Samples | Assessment and other text |
| IVV-IAS-EPX | Engage Provider Experts | Assessment and other text |
| IVV-IAS-OSA | Overall Summary of Assessment | Assessment and other text |
| IVV-IAS-SHA | Sharing Advice | Assessment and other text |
| IVV-IAS-SUM | Assessment Summary | Assessment and other text |
| IVV-IAS-VEF | Validate Effectiveness | Assessment and other text |
| IVV-IAS-VIM | Verify Implementation | Assessment and other text |
| IVV-IAS-VIP | Verify Inclusion in Certification Package | Assessment and other text |
| KSI-CNA-IBP | Implementing Best Practices | Assessment and other text |
| KSI-PIY-RES | Reviewing Executive Support | Assessment and other text |
| KSI-PIY-RIS | Reviewing Investments in Security | Assessment and other text |
| KSI-PIY-RVD | Reviewing Vulnerability Disclosures | Assessment and other text |
| KSI-RPL-RRO | Reviewing Recovery Objectives | Assessment and other text |
| KSI-SVC-RUD | Removing Unwanted Data | Assessment and other text |
| MAS-CSO-FLO | Information Flows and Security Categories | Assessment and other text |
| MAS-CSO-IIR | Identify Information Resources | Assessment and other text |
| MAS-CSO-MDI | Metadata Inclusion | Assessment and other text |
| MAS-CSO-SUP | Supplemental Information | Assessment and other text |
| MAS-CSO-TPR | Third-Party Information Resources | Assessment and other text |
| MKT-CAS-LRQ | Listing Requests for Advisors | Assessment and other text |
| MKT-CAS-RFR | Advisor Responses to FedRAMP | Assessment and other text |
| MKT-CAS-WEB | Website Requirements for Advisors | Assessment and other text |
| MKT-CSO-MLR | Marketplace Listing Requirements | Assessment and other text |
| MKT-CSO-PML | Provider Marketplace Listing Requests | Assessment and other text |
| MKT-IAS-LRQ | Listing Requests for Assessors | Assessment and other text |
| MKT-IAS-OFR | Only FedRAMP Recognized Assessors | Assessment and other text |
| MKT-IAS-WEB | Website Requirements for Assessors | Assessment and other text |
| MKT-IIP-AGU | Agency Use Cases | Assessment and other text |
| MKT-IIP-DCP | Demonstrating Continuous Progress | Assessment and other text |
| MKT-IIP-DLA | Deadline for Assessment | Assessment and other text |
| REC-FRP-DRD | Double Revocation Disqualification | Assessment and other text |
| REC-FRP-FOC | Foreign Ownership Collection | Assessment and other text |
| REC-FRP-RAO | Recognized Assessors Only | Assessment and other text |
| REC-IAS-ACC | A2LA Accreditation | Assessment and other text |
| REC-IAS-ADA | Actually Do Assessments | Assessment and other text |
| REC-IAS-AFI | Annual Foreign Interest Reports | Assessment and other text |
| REC-IAS-ANR | Annual Surveillance Assessment | Assessment and other text |
| REC-IAS-CAP | Corrective Action Plan | Assessment and other text |
| REC-IAS-CFI | Changes in Foreign Interest | Assessment and other text |
| REC-IAS-INV | Invalid Deliverables | Assessment and other text |
| REC-IAS-PSC | Policy and Standards Compliance | Assessment and other text |
| REC-IAS-PST | Performance Standards | Assessment and other text |
| REC-IAS-RAR | Re-entry after Revocation | Assessment and other text |
| REC-IAS-RAS | Full A2LA Reassessment | Assessment and other text |
| REC-IAS-RQU | Roles and Qualifications | Assessment and other text |
| REC-IAS-SEP | Advisory Separation | Assessment and other text |
| SCG-CSO-AUP | Use Instructions | Assessment and other text |
| SCG-CSO-PUB | Public Secure Configuration Guidance | Assessment and other text |
| SCG-CSO-RSC | Recommended Secure Configuration | Assessment and other text |
| SCG-CSO-SDF | Secure Defaults | Assessment and other text |
| SCG-ENH-API | API Capability | Assessment and other text |
| SCG-ENH-CMP | Comparison Capability | Assessment and other text |
| SCG-ENH-EXP | Export Capability | Assessment and other text |
| SCG-ENH-MRG | Machine-Readable Guidance | Assessment and other text |
| SCG-ENH-VRH | Versioning and Release History | Assessment and other text |
| SCN-ADP-NTF | Notification Requirements | Assessment and other text |
| SCN-CSO-ARI | Additional Relevant Information | Assessment and other text |
| SCN-CSO-EMG | Emergency Changes | Assessment and other text |
| SCN-CSO-EVA | Evaluate Changes | Assessment and other text |
| SCN-CSO-HIS | Historical Notifications | Assessment and other text |
| SCN-CSO-HRM | Human and Machine-Readable Notifications | Assessment and other text |
| SCN-CSO-INF | Required Information | Assessment and other text |
| SCN-CSO-MAR | Maintain Audit Records | Assessment and other text |
| SCN-CSO-NOM | Notification Mechanisms | Assessment and other text |
| SCN-FRP-CAP | Corrective Action Plan Conditions | Assessment and other text |
| SCN-RTR-NNR | No Notification Requirements | Assessment and other text |
| SCN-TRF-NAF | Notification After Finishing | Assessment and other text |
| SCN-TRF-NAV | Notification After Verification | Assessment and other text |
| SCN-TRF-NFP | Notification of Final Plans | Assessment and other text |
| SCN-TRF-NIP | Notification of Initial Plans | Assessment and other text |
| SCN-TRF-TPR | Third-Party Review | Assessment and other text |
| SCN-TRF-UPD | Update Documentation | Assessment and other text |
| SDR-CSO-FRR | FedRAMP Rules | Assessment and other text |
| SDR-CSO-MTD | Security Decision Record Metadata | Assessment and other text |
| VDR-CSO-ADT | Automate Detection | Assessment and other text |
| VDR-CSO-AKE | Avoid KEVs | Assessment and other text |
| VDR-CSO-DAC | Detect After Changes | Assessment and other text |
| VDR-CSO-DET | Vulnerability Detection | Assessment and other text |
| VDR-CSO-DFR | Design For Resilience | Assessment and other text |
| VDR-CSO-FAV | Failures Are Vulnerabilities | Assessment and other text |
| VDR-CSO-MSP | Maintain Security | Assessment and other text |
| VDR-CSO-RES | Vulnerability Response | Assessment and other text |
| VDR-CSO-SIR | Sampling | Assessment and other text |
| VDR-TFR-KEV | Remediate KEVs | Assessment and other text |
| VDR-TFR-NMV | Non-Machine Verification and Validation | Assessment and other text |
| VDR-TFR-PCD | Persistently Complete Detection | Assessment and other text |
| VDR-TFR-PDD | Persistent Drift Detection | Assessment and other text |
| VDR-TFR-PSD | Persistent Sample Detection | Assessment and other text |
| VDR-TFR-PVR | Mitigation and Remediation Expectations | Assessment and other text |
| VDR-TFR-RMN | Remaining Vulnerabilities | Assessment and other text |
| VER-AGM-MAP | Maintain Agency Plans of Action and Milestones | Assessment and other text |
| VER-AGM-RVR | Review Vulnerability Reports | Assessment and other text |
| VER-EVA-AIA | Assume It's Automatable | Assessment and other text |
| VER-EVA-EFA | Evaluation Factors | Assessment and other text |
| VER-EVA-EFP | Evaluate False Positives | Assessment and other text |
| VER-EVA-EIR | Evaluate Internet-Reachability | Assessment and other text |
| VER-EVA-ELX | Evaluate Exploitability | Assessment and other text |
| VER-EVA-EPA | Estimate Potential Agency Impact | Assessment and other text |
| VER-EVA-GRV | Group Vulnerabilities | Assessment and other text |
| VER-FRP-ADV | Sensitive Details | Assessment and other text |
| VER-FRP-ARP | Additional Requirements | Assessment and other text |
| VER-RPT-AVI | Accepted Vulnerability Info | Assessment and other text |
| VER-RPT-HLO | High-Level Overviews | Assessment and other text |
| VER-RPT-NID | Responsible Disclosure | Assessment and other text |
| VER-RPT-PER | Persistent Reporting | Assessment and other text |
| VER-RPT-RPD | Responsible Public Disclosure | Assessment and other text |
| VER-RPT-VDT | Vulnerability Details | Assessment and other text |
| VER-TFR-EVU | Evaluate Vulnerabilities Quickly | Assessment and other text |
| VER-TFR-IRI | Internet-Reachable Incidents | Assessment and other text |
| VER-TFR-MAV | Mark Accepted Vulnerabilities | Assessment and other text |
| VER-TFR-MHR | Monthly Activity Report | Assessment and other text |
| VER-TFR-MRH | Historical Activity | Assessment and other text |
| VER-TFR-NRI | Non-Internet-Reachable Incidents | Assessment and other text |
Read every requirement in this version · All versions of FedRAMP Consolidated Rules (2026)