FedRAMP Consolidated Rules (2026) 2026.10.08.01 → 2026.10.13.01

Published 2026-10-13
Snapshot taken 2026-10-15 15:31 · rules source

73 with discussion, related-control or assessment updates 73 of 73 changed requirements carry the publisher's note

Why this release, in the publisher's words

FedRAMP's change notes dated 2026-10-13 (version 2026.10.13.01): Updated control mappings: added si-5. Updated control mappings: added cm-10, cm-5, cm-6, ia-11. Updated control mappings: added ca-7. Updated control mappings: added au-9.3, cm-3.6, ia-7, sc-28.1, sc-8.1. Updated control mappings: added ac-18, au-9.3, ia-7, sc-28.1, sc-8.1. Updated control mappings: added ca-2, ca-2.1, ca-2.2, ca-7.1. Updated control mappings: added au-5.2, ir-4.11. Updated control mappings: added au-5.2, ir-5. Updated control mappings: added ir-5. Updated control mappings: added ca-2, ca-2.1, ca-2.2, ca-7.1, ca-7.4. Updated control mappings: added cm-8.4, ra-3, si-4.19. Updated control mappings: added ac-4, cm-12, cm-12.1, ra-3, si-4.19. Updated control mappings: added ra-3. Updated control mappings: added cm-7. Updated control mappings: added cm-4. Updated control mappings: added ir-4.2. Updated control mappings: added au-5.2, au-6, ca-8, ca-8.1, ca-8.2, ra-5, ra-5.2, ra-5.3, ra-5.4, si-2, si-3, si-4.1, si-4.12, si-4.18, si-4.22, si-5.1. Updated control mappings: added au-5.2, ir-4.11, ir-9.3, ra-7, si-2, si-3. Updated control mappings: added au-5.2, si-4, si-4.1, si-7.7. Updated control mappings: added ra-5, si-2.2, si-3, si-4.2, si-4.5. Updated control mappings: added ra-5. Updated control mappings: added ra-5.5, si-2. Updated control mappings: added ra-5, si-5. Updated control mappings: added ra-5.3, ra-5.5. Updated control mappings: added si-4.22, si-7, si-7.1. Updated control mappings: added si-2.3. Updated control mappings: added ra-9. Updated control mappings: added si-7.2. Updated control mappings: added cm-11, cp-3.1, ir-2.1, ir-2.2, ir-9.2, ir-9.4, pl-4, pl-4.1. Updated control mappings: added ca-7.4, cm-3.1, cm-3.6; removed ma-2. Updated control mappings: added cm-6.2, ir-9.4. Updated control mappings: added cm-8.4, cp-10.4, ir-9.4. Updated control mappings: added cm-11, cm-6.2, cp-10.4, ir-9.4, sc-24, sc-7.18, si-4.22, si-7, si-7.1, si-7.5, si-7.7; removed ca-7.1. Updated control mappings: added sc-7.18. Updated control mappings: added cp-2.5, sc-12.1. Updated control mappings: added sc-7.10, sc-7.18, sc-7.20, sc-7.21, si-10, si-4.11, si-4.18, si-4.4. Updated control mappings: added ir-4.2, sc-7.18. Updated control mappings: added ac-4.21, cm-11, sc-7.20, sc-7.21. Updated control mappings: added ia-8.4. Updated control mappings: added ia-2.6, ia-5.8, ia-8.2, ia-8.4. Updated control mappings: added ac-18.4, ac-2.11, ac-2.7, ac-2.9, ac-21, ac-6.3, ac-6.8, au-12.3, au-6.7, cm-5.1, cm-5.5, cm-7.2, ir-4.6, ir-9.4, ra-5.5, sc-2, sc-3, si-4.19. Updated control mappings: added ac-17.4, ac-2.11, ac-2.7, ac-21, ac-6.3, ac-6.8, au-10, au-12.3, ca-3.6, cm-5.1, cm-5.5, ir-4.6, sc-3. Updated control mappings: added ac-2.9, au-10, ia-2.5. Updated control mappings: added ac-2.11, ac-2.12, au-6.5, cm-5.1, cm-6.2, ir-4.2, ir-4.6, si-4, si-4.1, si-4.19, si-4.20, si-4.22, si-4.4. Updated control mappings: added ir-5.1, ir-9.3. Updated control mappings: added ir-4.11, ir-9.3. Updated control mappings: added ir-4.11, ir-4.4, ir-5.1, ra-5.8. Updated control mappings: added au-12.3, au-6.7. Updated control mappings: added ac-19, cm-6.1, ra-3. Updated control mappings: added au-10, au-7, cm-5.1, ir-9.4, si-4.19, si-4.20. Updated control mappings: added au-12.1, au-5.1, au-6.4, au-6.5, si-4.16; removed si-7.7. Updated control mappings: added au-7, ra-5.8, si-4.19. Updated control mappings: added cm-8.2, cm-8.4. Updated control mappings: added ca-2.2, ir-4.11. Updated control mappings: added ia-5.7, ra-9. Updated control mappings: removed si-12. Updated control mappings: added ir-9.3, sc-12.1. Updated control mappings: added ac-19, ra-3, sa-11.1, sa-11.2, sa-15, sa-16, sa-17, sa-21, sa-4, sa-4.1, sa-4.2, sa-4.5, sa-4.9, sa-9.1, sa-9.2, sa-9.5, si-7.15, sr-2, sr-3. Updated control mappings: added ac-19, ca-2.3, ra-3, sr-3. Updated control mappings: added ac-6.8, sc-45, sc-45.1, sc-7.18. Updated control mappings: added sc-12.1. Updated control mappings: added ca-7.4, cm-5.5, ir-9.4, ra-3; removed ma-2. Updated control mappings: added ac-19, ir-9.4, sc-12.1, sc-7.18. Updated control mappings: added ir-9, si-8, si-8.2. Updated control mappings: added ac-11, ac-11.1, ac-19.5, ac-21, ir-9.4, sc-4, sc-7.18, si-4.18; removed ac-1. Updated control mappings: added ac-10, ac-17.4, ac-18, ac-19, si-4.22. Updated control mappings: added ac-17.4, ac-18, ac-19, au-9.3, cm-14, si-7.15, sr-11.

https://github.com/FedRAMP/rules/commits/main/fedramp-consolidated-rules.json

All · 73 AFC: Addressing FedRAMP Communication · 1 AGU: Agency Use of FedRAMP Certified Cloud Services · 1 CCM: Collaborative Continuous Monitoring · 3 CMU: Cryptographic Module Use · 2 CPO: Certification Package Overview · 1 IEC: Incident Evaluation and Communication · 4 IVV: Independent Verification and Validation · 1 KSI-CED: Cybersecurity Education · 1 KSI-CMT: Change Management · 2 KSI-CNA: Cloud Native Architecture · 8 KSI-IAM: Identity and Access Management · 6 KSI-INR: Incident Response · 3 KSI-MLA: Monitoring, Logging, and Auditing · 5 KSI-PIY: Policy and Inventory · 3 KSI-RPL: Recovery Planning · 2 KSI-SCR: Supply Chain Risk · 2 KSI-SVC: Service Configuration · 8 MAS: Minimum Assessment Scope · 3 SCG: Secure Configuration Guide · 1 SCN: Significant Change Notification · 2 VDR: Vulnerability Detection and Response · 10 VER: Vulnerability Evaluation and Reporting · 4

Discussion, related-control and assessment updates 73

Discussion, related-control and assessment updates
Control	Title	What moved
AFC-CSO-INB	Maintain a FedRAMP Security Inbox	Related controls
AGU-USE-RSG	Review Secure Configuration Guides	Related controls
CCM-OCR-AVL	Report Availability	Related controls
CCM-QTR-ACT	Additional Content	Related controls
CCM-QTR-MTG	Quarterly Review Meeting	Related controls
CMU-CSO-CMD	Cryptographic Module Documentation	Related controls
CMU-CSO-UVM	Using Validated Cryptographic Modules	Related controls
CPO-CSO-OSA	Overall Summary of Assessment in Certification Package	Related controls
IEC-CSO-EFR	Evaluate FedRAMP Reportability	Related controls
IEC-CSO-FIR	Final Incident Report	Related controls
IEC-CSO-IIR	Initial Incident Report	Related controls
IEC-CSO-OIR	Ongoing Incident Reports	Related controls
IVV-CSO-FIA	FedRAMP Independent Assessments	Related controls
KSI-CED-RAT	Reviewing All Training	Related controls
KSI-CMT-LMC	Logging Changes	Related controls
KSI-CMT-VTD	Validating Throughout Deployment	Related controls
KSI-CNA-DFP	Defining Functionality and Privileges	Related controls
KSI-CNA-EIS	Enforcing Intended State	Related controls
KSI-CNA-IBP	Implementing Best Practices	Related controls
KSI-CNA-MAT	Minimizing Attack Surface	Related controls
KSI-CNA-OFA	Optimizing for Availability	Related controls
KSI-CNA-RNT	Restricting Network Traffic	Related controls
KSI-CNA-RVP	Reviewing Protections	Related controls
KSI-CNA-ULN	Using Logical Networking	Related controls
KSI-IAM-AAM	Automating Account Management	Related controls
KSI-IAM-APM	Adopting Passwordless Methods	Related controls
KSI-IAM-ELP	Ensuring Least Privilege	Related controls
KSI-IAM-JIT	Authorizing Just-in-Time	Related controls
KSI-IAM-SNU	Securing Non-User Authentication	Related controls
KSI-IAM-SUS	Responding to Suspicious Activity	Related controls
KSI-INR-AAR	Generating After Action Reports	Related controls
KSI-INR-RIR	Reviewing Incident Response Procedures	Related controls
KSI-INR-RPI	Reviewing Past Incidents	Related controls
KSI-MLA-ALA	Authorizing Log Access	Related controls
KSI-MLA-EVC	Evaluating Configurations	Related controls
KSI-MLA-LET	Logging Event Types	Related controls
KSI-MLA-OSM	Operating SIEM Capability	Related controls
KSI-MLA-RVL	Reviewing Logs	Related controls
KSI-PIY-GIV	Generating Inventories	Related controls
KSI-PIY-RIS	Reviewing Investments in Security	Related controls
KSI-PIY-RSD	Reviewing Security in the SDLC	Related controls
KSI-RPL-ABO	Aligning Backups with Objectives	Related controls
KSI-RPL-TRC	Testing Recovery Capabilities	Related controls
KSI-SCR-MIT	Mitigating Supply Chain Risk	Related controls
KSI-SCR-MON	Monitoring Supply Chain Risk	Related controls
KSI-SVC-ACM	Automating Configuration Management	Related controls
KSI-SVC-ASM	Automating Secret Management	Related controls
KSI-SVC-EIS	Evaluating and Improving Security	Related controls
KSI-SVC-PRR	Preventing Residual Risk	Related controls
KSI-SVC-RUD	Removing Unwanted Data	Related controls
KSI-SVC-SIN	Securing Information	Related controls
KSI-SVC-VCM	Validating Communications	Related controls
KSI-SVC-VRI	Validating Resource Integrity	Related controls
MAS-CSO-FLO	Information Flows and Security Categories	Related controls
MAS-CSO-IIR	Identify Information Resources	Related controls
MAS-CSO-TPR	Third-Party Information Resources	Related controls
SCG-CSO-RSC	Recommended Secure Configuration	Related controls
SCN-CSO-EMG	Emergency Changes	Related controls
SCN-CSO-EVA	Evaluate Changes	Related controls
VDR-CSO-ADT	Automate Detection	Related controls
VDR-CSO-AKE	Avoid KEVs	Related controls
VDR-CSO-DAC	Detect After Changes	Related controls
VDR-CSO-DET	Vulnerability Detection	Related controls
VDR-CSO-FAV	Failures Are Vulnerabilities	Related controls
VDR-CSO-MSP	Maintain Security	Related controls
VDR-CSO-RES	Vulnerability Response	Related controls
VDR-CSO-SIR	Sampling	Related controls
VDR-TFR-PDD	Persistent Drift Detection	Related controls
VDR-TFR-PVR	Mitigation and Remediation Expectations	Related controls
VER-EVA-EFA	Evaluation Factors	Related controls
VER-EVA-EPA	Estimate Potential Agency Impact	Related controls
VER-RPT-PER	Persistent Reporting	Related controls
VER-RPT-VDT	Vulnerability Details	Related controls

Read every requirement in this version · All versions of FedRAMP Consolidated Rules (2026)