BaselineWatch
Desk
Your fleet and your work Fleetyour releases and the hardware they run onTriagewhat needs a decisionWatchlistthe products and platforms you runSaved searchesthe lists you come back to
This instance Sourceswhat is read, how often, under what termsDigestthe daily or weekly summary, and alerts
How it is drawn Appearancethe look and the colour schemeBrandingthe mark this instance wears
Owner sign-in

FRC-CLA-MFR Mandatory FedRAMP Rules for Class A

FedRAMP Consolidated Rules (2026) 2026.10.05.01 against 2026.09.13.02
All changes in this version
unchanged FRC: FedRAMP Certification

Title

Mandatory FedRAMP Rules for Class A

Control

Providers seeking a Class A FedRAMP Certification MUST address all rules in this FedRAMP Class A Certification subset (FRC-CLA) AND the following additional FedRAMP Class A rules; the appropriate artifacts or information mapping for all rules MUST be supplied in the FedRAMP Certification Package.
- FedRAMP Certification: FRC-CSO-PKG (FedRAMP Certification Package)
- FedRAMP Certification: FRC-CSO-JSN (FedRAMP JSON Schemas)
- FedRAMP Certification: FRC-CSO-POP (Pick One Program Certification Type)
- Minimum Assessment Scope: MAS-CSO-IIR (Identify Information Resources)
- Certification Data Sharing: CDS-CSO-PUB (Public Information)
- Certification Data Sharing: CDS-CSO-UTC (Use Trust Centers)
- Certification Data Sharing: CDS-UTC-AAD (Agency Access Denial)
- Addressing FedRAMP Communication: AFC-CSO-INB (Maintain a FedRAMP Security Inbox)
- Addressing FedRAMP Communication: AFC-CSO-RCV (Receive Email Without Disruption)
- Addressing FedRAMP Communication: AFC-CSO-CRA (Complete Required Actions)
- Incident Evaluation and Communication: IEC-CSO-EFR (Evaluate FedRAMP Reportability)
- Incident Evaluation and Communication: IEC-CSO-FIR (Final Incident Report)
- Vulnerability Detection and Response: VDR-CSO-DET (Vulnerability Detection)
- Collaborative Continuous Monitoring: CCM-OCR-AVL (Report Availability)
- Collaborative Continuous Monitoring: CCM-OCR-NRD (Next Report Date)
- Independent Verification and Validation: IVV-CSX-AIA (Annual Independent Assessments for 20x)
- Key Security Indicators: KSI-CMT-LMC (Logging Changes)
- Key Security Indicators: KSI-CNA-RNT (Restricting Network Traffic)
- Key Security Indicators: KSI-CED-RAT (Reviewing All Training)
- Key Security Indicators: KSI-IAM-AAM (Automating Account Management)
- Key Security Indicators: KSI-IAM-APM (Adopting Passwordless Methods)
- Key Security Indicators: KSI-INR-RIR (Reviewing Incident Response Procedures)
- Key Security Indicators: KSI-SVC-SIN (Securing Information)

Discussion

Some of these specific FedRAMP rules may not have similar counterparts in external frameworks and providers will need to implement new processes to follow these rules.
In general, for each of these FedRAMP requirements, providers should include a sufficiently detailed summary that reviewers will not need to dig into the related security framework materials to understand the related decisions - just saying "see SOC 2 report" is not particularly helpful.
Information about how the provider addresses the included Key Security Indicators are required to receive a class A certification even if the provider intends to pursue a Rev 5 Program Certification path in the future.

Related controls

afc-cso-cra, afc-cso-inb, afc-cso-rcv, ccm-ocr-avl, ccm-ocr-nrd, cds-cso-pub, cds-cso-utc, cds-utc-aad, frc-cso-jsn, frc-cso-pkg, frc-cso-pop, iec-cso-efr, iec-cso-fir, ivv-csx-aia, ksi-ced-rat, ksi-cmt-lmc, ksi-cna-rnt, ksi-iam-aam, ksi-iam-apm, ksi-inr-rir, ksi-svc-sin, mas-cso-iir, vdr-cso-det