BaselineWatch
8 changes
Desk
Your fleet and your work Fleetyour releases and the hardware they run onTriagewhat needs a decisionWatchlistthe products and platforms you runSaved searchesthe lists you come back to
This instance Sourceswhat is read, how often, under what termsDigestthe daily or weekly summary, and alerts
How it is drawn Appearancethe look and the colour schemeBrandingthe mark this instance wears
Owner sign-in

FedRAMP Consolidated Rules (2026) 2026.09.13.02 → 2026.10.05.01

Published 2026-10-05
Snapshot taken 2026-10-15 15:31 · rules source
~ 3 revised: CDS-CSO-PUB, FRC-CSO-JSN, VER-EVA-EPA 1 with discussion, related-control or assessment updates 4 of 4 changed requirements carry the publisher's note
Why this release, in the publisher's words

FedRAMP's change notes dated 2026-10-05 (version 2026.10.05.01): Clarified that logo link must be a viewable web image. Added note recommending the involvement of web-based application engineers. Clarified expectations for public JSON data to be compatible with standard web frameworks. Updated form name. Clarified that likely potential agency impact should be calculated; added PAIN0 to clarify that likely potential agency impact can be entirely mitigated/remediated.

https://github.com/FedRAMP/rules/commits/main/fedramp-consolidated-rules.json
All · 4CDS: Certification Data Sharing · 1CMU: Cryptographic Module Use · 1FRC: FedRAMP Certification · 1VER: Vulnerability Evaluation and Reporting · 1

Controls added, removed or revised 3

ControlTitleChange
CDS-CSO-PUB Public Information Discussion, Control text
FRC-CSO-JSN FedRAMP JSON Schemas Assessment and other text, Discussion, Control text
VER-EVA-EPA Estimate Potential Agency Impact Assessment and other text, Control text

Discussion, related-control and assessment updates 1

ControlTitleWhat moved
CMU-CSO-UVM Using Validated Cryptographic Modules Discussion

Read every requirement in this version · All versions of FedRAMP Consolidated Rules (2026)