BaselineWatch
430 requirements
Desk
Your fleet and your work Fleetyour releases and the hardware they run onTriagewhat needs a decisionWatchlistthe products and platforms you runSaved searchesthe lists you come back to
This instance Sourceswhat is read, how often, under what termsDigestthe daily or weekly summary, and alerts
How it is drawn Appearancethe look and the colour schemeBrandingthe mark this instance wears
Owner sign-in

FedRAMP Consolidated Rules (2026) 2026.10.13.01

430 requirements · published 2026-10-13
Changes in this version
AllAFC: Addressing FedRAMP CommunicationAGU: Agency Use of FedRAMP Certified Cloud ServicesCCM: Collaborative Continuous MonitoringCDS: Certification Data SharingCMU: Cryptographic Module UseCPO: Certification Package OverviewCTL-AC: FedRAMP parameters and guidance, ACCTL-AU: FedRAMP parameters and guidance, AUCTL-CA: FedRAMP parameters and guidance, CACTL-CM: FedRAMP parameters and guidance, CMCTL-CP: FedRAMP parameters and guidance, CPCTL-IA: FedRAMP parameters and guidance, IACTL-IR: FedRAMP parameters and guidance, IRCTL-MA: FedRAMP parameters and guidance, MACTL-PS: FedRAMP parameters and guidance, PSCTL-RA: FedRAMP parameters and guidance, RACTL-SA: FedRAMP parameters and guidance, SACTL-SC: FedRAMP parameters and guidance, SCCTL-SI: FedRAMP parameters and guidance, SICTL-SR: FedRAMP parameters and guidance, SRFRC: FedRAMP CertificationFRD: DefinitionsIEC: Incident Evaluation and CommunicationIVV: Independent Verification and ValidationKSI-CED: Cybersecurity EducationKSI-CMT: Change ManagementKSI-CNA: Cloud Native ArchitectureKSI-IAM: Identity and Access ManagementKSI-INR: Incident ResponseKSI-MLA: Monitoring, Logging, and AuditingKSI-PIY: Policy and InventoryKSI-RPL: Recovery PlanningKSI-SCR: Supply Chain RiskKSI-SVC: Service ConfigurationMAS: Minimum Assessment ScopeMKT: Marketplace ListingREC: FedRAMP Recognition of Independent Assessment ServicesSCG: Secure Configuration GuideSCN: Significant Change NotificationSDR: Security Decision RecordVDR: Vulnerability Detection and ResponseVER: Vulnerability Evaluation and Reporting
RefTitleText
CCM-AGM-CSC Consider Security Category Agencies SHOULD consider the Security Category noted in their Authorization to Operate of the federal information system that includes the cloud service offering in its boundary and assign appropriate information security resources for revi
CCM-AGM-ROR Review Ongoing Reports Agencies MUST review each Ongoing Certification Report to understand how changes to the cloud service offering may impact the previously agreed-upon risk tolerance documented in the agency's Authorization to Operate of a federal information
CCM-OCR-AFS Anonymized Feedback Summary Providers MUST supply an anonymized and desensitized summary of the feedback, questions, and answers about each Ongoing Certification Report as an addendum to the Ongoing Certification Report OR in the next Ongoing Certification Report.
CCM-OCR-AVL Report Availability Providers MUST supply an Ongoing Certification Report to all necessary parties every 3 months, covering the entire period since the previous summary, in a consistent format that is human readable; this report MUST include high-level summari changed here
CCM-OCR-FBM Feedback Mechanism Providers MUST supply an asynchronous mechanism for all necessary parties to provide feedback or ask questions about each Ongoing Certification Report.
CCM-OCR-LSI Limit Sensitive Information Providers MUST NOT irresponsibly disclose sensitive information in an Ongoing Certification Report that would likely have an adverse effect on the cloud service offering.
CCM-OCR-NRD Next Report Date Providers MUST supply the target date for their next Ongoing Certification Report with other public FedRAMP Certification Data.
CCM-OCR-RPS Responsible Public Certification Report Sharing Providers MAY responsibly supply some or all of the information an Ongoing Certification Report to the public or other parties if the provider determines doing so will NOT likely have an adverse effect on the cloud service offering.
CCM-OCR-SOR Spread Out Reports Providers SHOULD establish a regular 3 month cycle for Ongoing Certification Reports that is spread out from the beginning, middle, or end of each quarter.
CCM-QTR-ACT Additional Content Providers SHOULD supply additional information in Quarterly Reviews that the provider determines is of interest, use, or otherwise relevant to agencies. changed here
CCM-QTR-MTG Quarterly Review Meeting changed here
CCM-QTR-NID No Irresponsible Disclosure Providers MUST NOT irresponsibly disclose sensitive information in a Quarterly Review that would likely have an adverse effect on the cloud service offering.
CCM-QTR-NRD Next Review Date Providers MUST publicly supply the target date for their next Quarterly Review with other public FedRAMP Certification Data.
CCM-QTR-REG Meeting Registration Info Providers MUST supply either a registration link or a downloadable calendar file with meeting information for Quarterly Reviews to all necessary parties.
CCM-QTR-RTP Restrict Third Parties Providers SHOULD NOT invite third parties to attend Quarterly Reviews intended for agencies unless they have specific relevance.
CCM-QTR-RTR Record/Transcribe Reviews Providers SHOULD record or transcribe Quarterly Reviews and supply them to all necessary parties.
CCM-QTR-SAR Schedule Around Reports Providers SHOULD regularly schedule Quarterly Reviews to occur at least 3 business days after releasing an Ongoing Certification Report AND within 10 business days of such release.
CCM-QTR-SCR Share Content Responsibly Providers MAY responsibly supply content prepared for a Quarterly Review to the public or other parties if the provider determines doing so will NOT likely have an adverse effect on the cloud service offering.
CCM-QTR-SRR Share Recordings Responsibly Providers MAY responsibly supply recordings or transcriptions of Quarterly Reviews to the public or other parties ONLY if the provider removes all agency information (comments, questions, names, etc.) AND determines doing so will NOT likely

19 of 430.