FedRAMP Consolidated Rules (2026) 2026.07.14.01 → 2026.09.13.02
Published 2026-09-13
Snapshot taken 2026-10-15 15:31 · rules source
Snapshot taken 2026-10-15 15:31 · rules source
+ 5 added: FRD-MAY, FRD-MNT, FRD-MST, FRD-SHD, FRD-SNT
~ 1 revised: CCM-OCR-AVL
220 with discussion, related-control or assessment updates
226 of 226 changed requirements carry the publisher's note
Why this release, in the publisher's words
FedRAMP's change notes dated 2026-09-13 (version 2026.09.13.02): Fixed broken reference URL for the Agency Liaison Program. Added (if applicable) to clarify that some of these items are not always required depending on the FedRAMP Certification Type or Class. Removed the extra the in all statements. Added force to FedRAMP Definitions for clarity.
https://github.com/FedRAMP/rules/commits/main/fedramp-consolidated-rules.jsonAll · 226AFC: Addressing FedRAMP Communication · 12AGU: Agency Use of FedRAMP Certified Cloud Services · 20CCM: Collaborative Continuous Monitoring · 19CDS: Certification Data Sharing · 15CMU: Cryptographic Module Use · 3CPO: Certification Package Overview · 3FRC: FedRAMP Certification · 21FRD: Definitions · 5IEC: Incident Evaluation and Communication · 8IVV: Independent Verification and Validation · 15KSI-CNA: Cloud Native Architecture · 1KSI-PIY: Policy and Inventory · 3KSI-RPL: Recovery Planning · 1KSI-SVC: Service Configuration · 1MAS: Minimum Assessment Scope · 5MKT: Marketplace Listing · 11REC: FedRAMP Recognition of Independent Assessment Services · 16SCG: Secure Configuration Guide · 9SCN: Significant Change Notification · 17SDR: Security Decision Record · 2VDR: Vulnerability Detection and Response · 16VER: Vulnerability Evaluation and Reporting · 23
Controls added, removed or revised in FRD: Definitions 5
Read every requirement in this version · All versions of FedRAMP Consolidated Rules (2026)