BaselineWatch
227 changes
Desk
Your fleet and your work Fleetyour releases and the hardware they run onTriagewhat needs a decisionWatchlistthe products and platforms you runSaved searchesthe lists you come back to
This instance Sourceswhat is read, how often, under what termsDigestthe daily or weekly summary, and alerts
How it is drawn Appearancethe look and the colour schemeBrandingthe mark this instance wears
Owner sign-in

FedRAMP Consolidated Rules (2026) 2026.07.14.01 → 2026.09.13.02

Published 2026-09-13
Snapshot taken 2026-10-15 15:31 · rules source
+ 5 added: FRD-MAY, FRD-MNT, FRD-MST, FRD-SHD, FRD-SNT ~ 1 revised: CCM-OCR-AVL 220 with discussion, related-control or assessment updates 226 of 226 changed requirements carry the publisher's note
Why this release, in the publisher's words

FedRAMP's change notes dated 2026-09-13 (version 2026.09.13.02): Fixed broken reference URL for the Agency Liaison Program. Added (if applicable) to clarify that some of these items are not always required depending on the FedRAMP Certification Type or Class. Removed the extra the in all statements. Added force to FedRAMP Definitions for clarity.

https://github.com/FedRAMP/rules/commits/main/fedramp-consolidated-rules.json
All · 226AFC: Addressing FedRAMP Communication · 12AGU: Agency Use of FedRAMP Certified Cloud Services · 20CCM: Collaborative Continuous Monitoring · 19CDS: Certification Data Sharing · 15CMU: Cryptographic Module Use · 3CPO: Certification Package Overview · 3FRC: FedRAMP Certification · 21FRD: Definitions · 5IEC: Incident Evaluation and Communication · 8IVV: Independent Verification and Validation · 15KSI-CNA: Cloud Native Architecture · 1KSI-PIY: Policy and Inventory · 3KSI-RPL: Recovery Planning · 1KSI-SVC: Service Configuration · 1MAS: Minimum Assessment Scope · 5MKT: Marketplace Listing · 11REC: FedRAMP Recognition of Independent Assessment Services · 16SCG: Secure Configuration Guide · 9SCN: Significant Change Notification · 17SDR: Security Decision Record · 2VDR: Vulnerability Detection and Response · 16VER: Vulnerability Evaluation and Reporting · 23

Controls added, removed or revised in CCM: Collaborative Continuous Monitoring 1

ControlTitleChange
CCM-OCR-AVL Report Availability Assessment and other text, Control text

Discussion, related-control and assessment updates in CCM: Collaborative Continuous Monitoring 18

ControlTitleWhat moved
CCM-AGM-CSC Consider Security Category Assessment and other text
CCM-AGM-ROR Review Ongoing Reports Assessment and other text
CCM-OCR-AFS Anonymized Feedback Summary Assessment and other text
CCM-OCR-FBM Feedback Mechanism Assessment and other text
CCM-OCR-LSI Limit Sensitive Information Assessment and other text
CCM-OCR-NRD Next Report Date Assessment and other text
CCM-OCR-RPS Responsible Public Certification Report Sharing Assessment and other text
CCM-OCR-SOR Spread Out Reports Assessment and other text
CCM-QTR-ACT Additional Content Assessment and other text
CCM-QTR-MTG Quarterly Review Meeting Assessment and other text
CCM-QTR-NID No Irresponsible Disclosure Assessment and other text
CCM-QTR-NRD Next Review Date Assessment and other text
CCM-QTR-REG Meeting Registration Info Assessment and other text
CCM-QTR-RTP Restrict Third Parties Assessment and other text
CCM-QTR-RTR Record/Transcribe Reviews Assessment and other text
CCM-QTR-SAR Schedule Around Reports Assessment and other text
CCM-QTR-SCR Share Content Responsibly Assessment and other text
CCM-QTR-SRR Share Recordings Responsibly Assessment and other text

Read every requirement in this version · All versions of FedRAMP Consolidated Rules (2026)