FedRAMP Consolidated Rules (2026) 2026.10.13.01

430 requirements · published 2026-10-13
Changes in this version

Controls in this version
Ref	Title	Text
FRD-AAP	All Affected Parties	All federal entities whose interests are affected directly or are likely to be affected directly in the event of a vulnerability or incident related to federal customer data. This always includes FedRAMP and directly impacted federal custom
FRD-ACV	Accepted Vulnerability	A vulnerability that the provider does not intend to fully mitigate or remediate, OR that has not or will not be fully mitigated or remediated within the maximum overdue period in FedRAMP Vulnerability Detection and Response rules.
FRD-ADP	Adaptive Change	A type of significant change that does not routinely recur and does not introduce substantive potential security risks that need to be assessed in depth.
FRD-ADV	Advisor	An entity that helps a provider understand, prepare for, or maintain FedRAMP Certification without replacing the provider's responsibility or the assessor's independence.
FRD-AGY	Agency	Has the meaning given in 44 U.S. Code § 3502 (1), which is "any executive department, military department, Government corporation, Government controlled corporation, or other establishment in the executive branch of the Government (includin
FRD-ANA	All Necessary Assessors	All entities who participate in the FedRAMP assessment of a cloud service offering in the context of a FedRAMP Certification. This always includes FedRAMP and any FedRAMP Recognized independent assessor contracted by a provider to perform a
FRD-ANP	All Necessary Parties	All entities whose interests are affected directly by activity related to a specific cloud service offering in the context of FedRAMP Certifications. This always includes FedRAMP and any agency customer who is using the cloud service offeri
FRD-ART	Artifacts	Security-related materials that supply information regarding or evidence of functions, policies, decisions, procedures, operations, or other such activities, for the purposes of obtaining and maintaining a FedRAMP Certification. All such ar
FRD-ASR	Assessor	An assessor that performs assessment, verification, or validation activities for a cloud service offering seeking to obtain or maintain FedRAMP Certification; FedRAMP is the final assessor for FedRAMP Certification, but FedRAMP Recognized i
FRD-CCC	Certification Class Change	A type of significant change that is likely to change the FedRAMP Certification class for the entire cloud service offering (e.g. from Class B to Class C or from Class D to Class C).
FRD-CCL	Certification Class	The category of assurance that a cloud service offering supplies to federal government customers following FedRAMP Practices, increasing from minimal assurance at Class A to significant assurance at Class D; currently available categories a
FRD-CPF	Certification Profile	The combination of a FedRAMP Certification Type (Rev5 or 20x), FedRAMP Certification Path (Program or Agency), and FedRAMP Certification Class (A, B, C, or D) for a cloud service offering.
FRD-CPH	Certification Path	The underlying source of the FedRAMP Certification, either from a federal agency sponsored authorization to operate or directly from FedRAMP itself. The agency path is a legacy path that is only available for FedRAMP Rev5 and still requires
FRD-CRD	Certification Data	The collective information required by FedRAMP for initial and ongoing FedRAMP Certification of a cloud service offering, including the FedRAMP Certification Package.
FRD-CRP	Certification Package	Has meaning from 44 USC § 3607 (b)(8) given to "authorization package", which is "the essential information that can be used by an agency to determine whether to authorize the operation of an information system or the use of a designated se
FRD-CSO	Cloud Service Offering	A specific, packaged cloud computing product or service supplied by a cloud service provider for use by customers, that is the subject of a FedRAMP Certification.
FRD-CTY	Certification Type	The form of assurance that a cloud service offering supplies to federal government customers following FedRAMP Practices, either Rev5 or 20x. Rev5 follows a legacy approach based primarily on documented plans while 20x follows a modern appr
FRD-DCE	Debilitating Customer Effect	An unwanted customer effect that interrupts use of the cloud service for most users or compromises the integrity or confidentiality of most federal customer data. If the adverse customer effect is unknown then it should be treated as if it
FRD-DCF	Disruptive Customer Effect	An unwanted customer effect that interrupts use of the cloud service for many users for less than 24 hours, or that compromises the integrity or confidentiality of large amounts or many types of federal customer data.
FRD-DFT	Drift	Changes to information resources that cause deviations from the intended and assessed state; common forms of drift include changes to configurations, deployed software, privileges, running processes, and availability.
FRD-DTM	Deterministic Telemetry	Verifiable data collected directly from an authoritative source that represents a factual and reproducible observation of the attributes of a system such as the system's state, configuration, or behavior.
FRD-FCD	Federal Customer Data	All electronic information, content, and materials that an agency or its authorized users upload, store, or otherwise supply to a cloud service for processing or storage. This does NOT include account information, service metadata, analytic
FRD-FCR	FedRAMP Certification Report	A report that is produced by FedRAMP documenting the results of a FedRAMP Certification assessment. This report is typically produced after the initial FedRAMP Certification assessment on the Program Certification Path and updated as necess
FRD-FCT	FedRAMP Certified	The status of a cloud service offering that has received FedRAMP Certification and meets the legal requirement to be FedRAMP authorized.
FRD-FIN	FedRAMP Independent Assessment	An independent verification and validation assessment, performed by a FedRAMP Recognized independent assessment service or FedRAMP following FedRAMP rules. These assessments are typically first performed to obtain an initial FedRAMP Certifi
FRD-FIR	Final Incident Report (FIR)	A final report after recovery from an incident that is supplied by FedRAMP Certified cloud service providers to FedRAMP and agency customers, following FedRAMP Incident Evaluation and Communication rules.
FRD-FMV	Fully Mitigated Vulnerability	A vulnerability where the likelihood of exploitation or Potential Agency Impact N-rating has been reduced from the original evaluation until either are negligible, but the vulnerability is still detected.
FRD-FPR	FedRAMP Practices	The security measures, safeguards, precautions, procedures, activities, policies, capabilities, mechanisms, etc. that are expected to be in place by FedRAMP to demonstrate that information resources are properly protected, expressed in FedR
FRD-FPV	False Positive Vulnerability	A detected vulnerability that is not actually present in an exploitable state in the information resource
FRD-FRA	FedRAMP Recognized	The status of independent assessment services that are recognized by FedRAMP to perform assessment activities on behalf of FedRAMP for cloud service offerings seeking to obtain or maintain FedRAMP Certification.
FRD-FRI	FedRAMP Reportable Incident	An incident that affects the confidentiality or integrity of federal customer data or is likely to affect the confidentiality or integrity of federal customer data.
FRD-FSI	FedRAMP Security Inbox	An email address that follows the FedRAMP Security Inbox rules.
FRD-HAN	Handle	Has the plain language meaning inclusive of any possible action taken with information, such as access, collect, control, create, display, disclose, disseminate, dispose, maintain, manipulate, process, receive, review, store, transmit, use.
FRD-IFA	Initial FedRAMP Assessment	The first full assessment of a cloud service offering obtaining FedRAMP Certification, coordinated by the provider with all necessary assessors, that results in a FedRAMP Certification.
FRD-IIR	Initial Incident Report (IIR)	An initial report about an incident that is supplied by FedRAMP Certified cloud service providers to FedRAMP and agency customers, following FedRAMP FedRAMP Incident Evaluation and Communication rules.
FRD-INC	Initial Certification	The first FedRAMP Certification of a cloud service offering based on the applicable FedRAMP Practices.
FRD-INT	Incident	Has the meaning given in 44 USC § 3552 (b)(2) which is "an occurrence that (A) actually or imminently jeopardizes, without lawful authority, the integrity, confidentiality, or availability of information or an information system; or (B) con
FRD-IRS	Information Resource	Has the meaning from 44 USC § 3502 (6): "information and related resources, such as personnel, equipment, funds, and information technology." This includes any aspect of the cloud service offering, both technical and managerial, including e
FRD-IRV	Internet-Reachable Vulnerability (IRV)	A vulnerability in a machine-based information resource that might be exploited or otherwise triggered by a payload originating from a source on the public internet.
FRD-KEV	Known Exploited Vulnerability (KEV)	Has the meaning given in CISA Binding Operational Directive 26-04, which is any vulnerability identified in CISA's Known Exploited Vulnerabilities catalog.
FRD-LEV	Likely Exploitable Vulnerability (LEV)	A vulnerability that is not fully mitigated AND is reachable by a likely threat actor; AND a likely threat actor with knowledge of the vulnerability would likely gain unauthorized access, cause harm, disrupt operations, or otherwise have an
FRD-LKY	Likely	A reasonable degree of probability based on context.
FRD-MAY	MAY	The rule is truly optional. Parties SHOULD address such rules in their security documentation by explaining their decisions about how they handle such rules.
FRD-MBI	Machine-Based (Information Resources)	Any information technology information resource—including systems, processes, software, hardware, services, cloud-native capabilities, and any other such capability, component, or resource—that relies primarily on mechanical or electronic d
FRD-MCE	Minimal Customer Effect	An unwanted customer effect that is only noticeable by some users. This includes minor inconveniences such as reduced performance.
FRD-MGN	Machine-Generated	Automatically produced by a computer process, application, or other mechanism without the intervention or manipulation of a human during production.
FRD-MNT	MUST NOT	The rule is an absolute prohibition. Parties MUST meet such rules and address them in their security documentation. Failure to follow the rule is a vulnerability likely requiring corrective action and/or the denial of initial or ongoing Fed
FRD-MRD	Machine-Readable	Has the meaning from 44 U.S. Code § 3502 (18) which is "the term "machine-readable", when used with respect to data, means data in a format that can be easily processed by a computer without human intervention while ensuring no semantic mea
FRD-MST	MUST	The rule is an absolute requirement. Parties MUST meet such rules and address them in their security documentation. Failure to follow the rule is a vulnerability likely requiring corrective action and/or the denial of initial or ongoing Fed
FRD-NCE	Narrow Customer Effect	An unwanted customer effect that interrupts use of the cloud service for some users for less than 12 hours, or that compromises the integrity or confidentiality of an extremely limited amount and type of federal customer data.
FRD-OCR	Ongoing Certification Report (OCR)	A regular report that is supplied by FedRAMP Certified cloud service providers to agency customers, following FedRAMP Collaborative Continuous Monitoring rules.
FRD-ODV	Overdue Vulnerability	A vulnerability that the provider intends to fully mitigate or remediate but has not or will not do so within the time frames recommended or required by FedRAMP.
FRD-OIR	Ongoing Incident Report (OIR)	A recurring report about an ongoing incident that is supplied by FedRAMP Certified cloud service providers to FedRAMP and agency customers, following the FedRAMP Incident Evaluation and Communication rules.
FRD-ONC	Ongoing Certification	The continued FedRAMP Certification of a cloud service offering based on the applicable FedRAMP Practices.
FRD-PAC	Privileged Account	An account with elevated privileges that enables administrative functions over some aspect of the cloud service offering that may affect the confidentiality, integrity, or availability of information beyond those given to normal users; leve
FRD-PAI	Potential Agency Impact	The estimated cumulative effect of unauthorized access, disruption, harm, or other adverse impacts to all agencies using the cloud service that are likely to result from security incidents or the exploitation of vulnerabilities in the cloud
FRD-PER	Persistently	Occurring in a firm, steady way that is repeated over a long period of time in spite of obstacles or difficulties. Persistent activities may vary between actors, may occur irregularly, and may include interruptions or waiting periods betwee
FRD-PFA	Persistent FedRAMP Assessment	Follow-on assessments of a cloud service offering focused on Key Security Indicators, coordinated by the provider with all necessary assessors, to maintain FedRAMP Certification or change its FedRAMP Certification class.
FRD-PMV	Partially Mitigated Vulnerability	A vulnerability where the likelihood or Potential Agency Impact N-rating has been reduced from the original evaluation but the risk of exploitation still exists and the vulnerability is still detected.
FRD-PRO	Promptly	Without unnecessary delay.
FRD-PRV	Provider	The cloud service provider responsible for a cloud service offering in the context of FedRAMP Certification.
FRD-QTR	Quarterly Review	A regular synchronous meeting hosted by a FedRAMP Certified cloud service provider for agency customers, following FedRAMP Collaborative Continuous Monitoring rules.
FRD-RGL	Regularly	Performing the activity on a consistent, predictable, and repeated basis, at set intervals, automatically if possible, following a documented plan. These intervals may vary as appropriate between different activities.
FRD-RMV	Remediated Vulnerability	A vulnerability that has been neutralized or eliminated and is no longer detected.
FRD-RSP	Responsibly	In a way that shows that you have good judgment and the ability to act correctly and make decisions on your own.
FRD-RTR	Routine Recurring Change	The type of significant change that regularly and routinely recurs as part of ongoing operations, vulnerability mitigation, or vulnerability remediation.
FRD-SCT	Security Category	Has the meaning from NIST FIPS 199, which is "The characterization of information or an information system based on an assessment of the potential impact that a loss of confidentiality, integrity, or availability of such information or info
FRD-SDR	Security Decision Record (SDR)	A persistently maintained, verified, and validated record of the security decisions made by a provider over the lifecycle of a cloud service offering. The Security Decision Record replaces the traditional System Security Plan and documents
FRD-SGC	Significant Change	Has the meaning given in NIST SP 800-37 Rev. 2 which is "a change that is likely to substantively affect the security or privacy posture of a system."
FRD-SHD	SHOULD	There may exist valid reasons in particular circumstances to ignore this rule, but the full implications must be understood and carefully weighed. Parties MUST address such rules in their security documentation by explaining their decisions
FRD-SNT	SHOULD NOT	There may exist valid reasons in particular circumstances when the particular action is acceptable or even useful, but the full implications must be understood and carefully weighed. Parties MUST address such rules in their security documen
FRD-TLA	Top-Level Administrative Account	The most privileged account with the highest level of access within a cloud service offering for a customer organization, typically with complete control over all aspects of the cloud service offering, including managing resources, users, a
FRD-TPR	Third-Party Information Resource	Any information resource that is not entirely included in the Minimum Assessment Scope for the cloud service offering obtaining FedRAMP Certification.
FRD-TRC	Trust Center	A secure repository or service used by cloud service providers to store and share FedRAMP Certification Data. Trust centers are the complete and definitive source for FedRAMP Certification Data and must follow the FedRAMP Certification Data
FRD-TRF	Transformative Change	The type of significant change that introduces substantive potential security risks that are likely to affect existing risk determinations and must be assessed in depth.
FRD-VLD	Vulnerability Detection	The systematic process of discovering and identifying security vulnerabilities in information resources through assessment, scanning, threat intelligence, vulnerability disclosure mechanisms, bug bounties, supply chain monitoring, and other
FRD-VLN	Validation	Confirmation through objective evidence that implemented security capabilities and related certification data are suitable for their intended FedRAMP Certification use and support the expected security outcomes for a cloud service offering.
FRD-VLR	Vulnerability Response	The systematic process of tracking, evaluating, mitigating, monitoring, remediating, assessing exploitation, reporting, and otherwise managing detected vulnerabilities.
FRD-VRF	Verification	Confirmation through objective evidence that specified FedRAMP Practices have been fulfilled for a cloud service offering.
FRD-VUL	Vulnerability	Has the meaning given to "security vulnerability" in 6 USC § 650 (25), which is "any attribute of hardware, software, process, or procedure that could enable or facilitate the defeat of [...] management, operational, and technical controls

80 of 430.