FedRAMP Consolidated Rules (2026) 2026.10.13.01
AllAFC: Addressing FedRAMP CommunicationAGU: Agency Use of FedRAMP Certified Cloud ServicesCCM: Collaborative Continuous MonitoringCDS: Certification Data SharingCMU: Cryptographic Module UseCPO: Certification Package OverviewCTL-AC: FedRAMP parameters and guidance, ACCTL-AU: FedRAMP parameters and guidance, AUCTL-CA: FedRAMP parameters and guidance, CACTL-CM: FedRAMP parameters and guidance, CMCTL-CP: FedRAMP parameters and guidance, CPCTL-IA: FedRAMP parameters and guidance, IACTL-IR: FedRAMP parameters and guidance, IRCTL-MA: FedRAMP parameters and guidance, MACTL-PS: FedRAMP parameters and guidance, PSCTL-RA: FedRAMP parameters and guidance, RACTL-SA: FedRAMP parameters and guidance, SACTL-SC: FedRAMP parameters and guidance, SCCTL-SI: FedRAMP parameters and guidance, SICTL-SR: FedRAMP parameters and guidance, SRFRC: FedRAMP CertificationFRD: DefinitionsIEC: Incident Evaluation and CommunicationIVV: Independent Verification and ValidationKSI-CED: Cybersecurity EducationKSI-CMT: Change ManagementKSI-CNA: Cloud Native ArchitectureKSI-IAM: Identity and Access ManagementKSI-INR: Incident ResponseKSI-MLA: Monitoring, Logging, and AuditingKSI-PIY: Policy and InventoryKSI-RPL: Recovery PlanningKSI-SCR: Supply Chain RiskKSI-SVC: Service ConfigurationMAS: Minimum Assessment ScopeMKT: Marketplace ListingREC: FedRAMP Recognition of Independent Assessment ServicesSCG: Secure Configuration GuideSCN: Significant Change NotificationSDR: Security Decision RecordVDR: Vulnerability Detection and ResponseVER: Vulnerability Evaluation and Reporting
| Ref | Title | Text | |
|---|---|---|---|
| FRC-APP-AFC | Applying for FedRAMP Certification | Providers MUST complete the FedRAMP Certification Application Form in full to request an initial assessment by FedRAMP. | |
| FRC-APP-FCP | Fresh FedRAMP Certification Package | Providers MUST supply a fresh initial FedRAMP Certification Package that shows the current status of the cloud service offering as verified and validated by the provider within the previous 7 days. | |
| FRC-APP-FIA | Fresh Independent Assessment | ||
| FRC-APP-MLF | Marketplace Listing First | Providers MUST be listed in the FedRAMP Marketplace before applying for FedRAMP Certification, including: - FedRAMP Marketplace: MKT-CSO-MLR (Marketplace Listing Requirements), - FedRAMP Marketplace: MKT-CSO-PML (Provider Marketplace Listin | |
| FRC-APP-NTP | No Third-Party Applicants | Providers MUST NOT use a third party to apply for a FedRAMP Certification on their behalf; this includes independent assessment services. | |
| FRC-APP-USA | Updating Stale Assessments | Providers MAY freshen a stale initial independent verification and validation assessment by having a FedRAMP Recognized independent assessment service review any changes between the original assessment and the current status of the cloud se | |
| FRC-APS-ATO | Agency Authorization to Operate | Providers seeking a FedRAMP Rev5 Agency Certification MUST have completed the Authorization to Operate (ATO) process with their agency sponsor for the cloud service offering, concluding with a formal signed ATO letter that the agency has se | |
| FRC-CCL-DCC | Downgrading Certification Class | Providers MUST apply for a new FedRAMP Certification to downgrade their Certification Class. | |
| FRC-CCL-DNP | Downgrade Notification Period | Providers SHOULD notify all necessary parties at least 120 days in advance of an intended downgrade or cancellation of FedRAMP Certification. | |
| FRC-CCL-UCC | Upgrading Certification Class | Providers MUST apply for a new FedRAMP Certification to upgrade their Certification Class; all applicable requirements MUST be met in advance. | |
| FRC-CLA-ASF | Approved Alternative Security Frameworks | Providers seeking a FedRAMP Class A Certification MUST have completed a certification or equivalent process, including an independent assessment if applicable, from one of the following alternative security frameworks within the past 12 mon | |
| FRC-CLA-EAM | External Assessment Materials | Providers seeking a FedRAMP Class A Certification MUST supply the following materials from their alternative security framework assessment to all necessary parties: - SOC 2 Type II: Complete report, bridge or gap letter (if applicable), ver | |
| FRC-CLA-IVV | Optional Independent Verification and Validation | Providers seeking a FedRAMP Class A Certification MAY have the FedRAMP Certification Package independently verified and validated by a FedRAMP Recognized assessor before submission to FedRAMP. | |
| FRC-CLA-MFR | Mandatory FedRAMP Rules for Class A | Providers seeking a Class A FedRAMP Certification MUST address all rules in this FedRAMP Class A Certification subset (FRC-CLA) AND the following additional FedRAMP Class A rules; the appropriate artifacts or information mapping for all rul | |
| FRC-CLA-OFR | Address Optional FedRAMP Rules for Class A | Providers seeking a Class A FedRAMP Certification MAY address the following additional optional FedRAMP Class A rules (if applicable): - Collaborative Continuous Monitoring: CCM-QTR-MTG (Quarterly Review Meeting) - Certification Data Sharin | |
| FRC-CLA-RFR | Recommended FedRAMP Rules for Class A | Providers seeking a Class A FedRAMP Certification SHOULD address the following additional recommended FedRAMP Class A rules (if applicable): - Certification Data Sharing: CDS-CSO-AVR (Availability Reporting) - Certification Package Overview | |
| FRC-CSO-FCP | FedRAMP Certification Profile | Providers MUST identify a target FedRAMP Certification Profile and apply all relevant FedRAMP Practices to the cloud service offering. | |
| FRC-CSO-JSN | FedRAMP JSON Schemas | Providers MUST supply machine-readable information in JSON documents that are valid against the corresponding JSON schema when a rule contains a FedRAMP JSON schema, UNLESS otherwise specified in the rule; public JSON data MUST be supplied | |
| FRC-CSO-MRA | Maintain Responsibility and Accountability | Providers MUST maintain responsibility and accountability for the accuracy and completeness of all information in the FedRAMP Certification Package, especially when they engage a third party (such as an independent assessor, advisory servic | |
| FRC-CSO-PKG | FedRAMP Certification Package | Providers seeking a Certification MUST supply a complete FedRAMP Certification Package to FedRAMP for initial certification; the FedRAMP Certification Package MUST include at least the following information: - Information about the Cloud Se | |
| FRC-CSO-POP | Pick One Program Certification Type | Providers MUST NOT seek both FedRAMP Rev5 Program Certification and FedRAMP 20x Program Certification for the same cloud service offering; pick one type. |
21 of 430.