BaselineWatch
227 changes
Desk
Your fleet and your work Fleetyour releases and the hardware they run onTriagewhat needs a decisionWatchlistthe products and platforms you runSaved searchesthe lists you come back to
This instance Sourceswhat is read, how often, under what termsDigestthe daily or weekly summary, and alerts
How it is drawn Appearancethe look and the colour schemeBrandingthe mark this instance wears
Owner sign-in

FedRAMP Consolidated Rules (2026) 2026.07.14.01 → 2026.09.13.02

Published 2026-09-13
Snapshot taken 2026-10-15 15:31 · rules source
+ 5 added: FRD-MAY, FRD-MNT, FRD-MST, FRD-SHD, FRD-SNT ~ 1 revised: CCM-OCR-AVL 220 with discussion, related-control or assessment updates 226 of 226 changed requirements carry the publisher's note
Why this release, in the publisher's words

FedRAMP's change notes dated 2026-09-13 (version 2026.09.13.02): Fixed broken reference URL for the Agency Liaison Program. Added (if applicable) to clarify that some of these items are not always required depending on the FedRAMP Certification Type or Class. Removed the extra the in all statements. Added force to FedRAMP Definitions for clarity.

https://github.com/FedRAMP/rules/commits/main/fedramp-consolidated-rules.json
All · 226AFC: Addressing FedRAMP Communication · 12AGU: Agency Use of FedRAMP Certified Cloud Services · 20CCM: Collaborative Continuous Monitoring · 19CDS: Certification Data Sharing · 15CMU: Cryptographic Module Use · 3CPO: Certification Package Overview · 3FRC: FedRAMP Certification · 21FRD: Definitions · 5IEC: Incident Evaluation and Communication · 8IVV: Independent Verification and Validation · 15KSI-CNA: Cloud Native Architecture · 1KSI-PIY: Policy and Inventory · 3KSI-RPL: Recovery Planning · 1KSI-SVC: Service Configuration · 1MAS: Minimum Assessment Scope · 5MKT: Marketplace Listing · 11REC: FedRAMP Recognition of Independent Assessment Services · 16SCG: Secure Configuration Guide · 9SCN: Significant Change Notification · 17SDR: Security Decision Record · 2VDR: Vulnerability Detection and Response · 16VER: Vulnerability Evaluation and Reporting · 23

Discussion, related-control and assessment updates in CMU: Cryptographic Module Use 3

ControlTitleWhat moved
CMU-CSO-CAT Configuration of Agency Tenants Assessment and other text
CMU-CSO-CMD Cryptographic Module Documentation Assessment and other text
CMU-CSO-UVM Using Validated Cryptographic Modules Assessment and other text

Read every requirement in this version · All versions of FedRAMP Consolidated Rules (2026)