BaselineWatch
430 requirements
Desk
Your fleet and your work Fleetyour releases and the hardware they run onTriagewhat needs a decisionWatchlistthe products and platforms you runSaved searchesthe lists you come back to
This instance Sourceswhat is read, how often, under what termsDigestthe daily or weekly summary, and alerts
How it is drawn Appearancethe look and the colour schemeBrandingthe mark this instance wears
Owner sign-in

FedRAMP Consolidated Rules (2026) 2026.10.13.01

430 requirements · published 2026-10-13
Changes in this version
AllAFC: Addressing FedRAMP CommunicationAGU: Agency Use of FedRAMP Certified Cloud ServicesCCM: Collaborative Continuous MonitoringCDS: Certification Data SharingCMU: Cryptographic Module UseCPO: Certification Package OverviewCTL-AC: FedRAMP parameters and guidance, ACCTL-AU: FedRAMP parameters and guidance, AUCTL-CA: FedRAMP parameters and guidance, CACTL-CM: FedRAMP parameters and guidance, CMCTL-CP: FedRAMP parameters and guidance, CPCTL-IA: FedRAMP parameters and guidance, IACTL-IR: FedRAMP parameters and guidance, IRCTL-MA: FedRAMP parameters and guidance, MACTL-PS: FedRAMP parameters and guidance, PSCTL-RA: FedRAMP parameters and guidance, RACTL-SA: FedRAMP parameters and guidance, SACTL-SC: FedRAMP parameters and guidance, SCCTL-SI: FedRAMP parameters and guidance, SICTL-SR: FedRAMP parameters and guidance, SRFRC: FedRAMP CertificationFRD: DefinitionsIEC: Incident Evaluation and CommunicationIVV: Independent Verification and ValidationKSI-CED: Cybersecurity EducationKSI-CMT: Change ManagementKSI-CNA: Cloud Native ArchitectureKSI-IAM: Identity and Access ManagementKSI-INR: Incident ResponseKSI-MLA: Monitoring, Logging, and AuditingKSI-PIY: Policy and InventoryKSI-RPL: Recovery PlanningKSI-SCR: Supply Chain RiskKSI-SVC: Service ConfigurationMAS: Minimum Assessment ScopeMKT: Marketplace ListingREC: FedRAMP Recognition of Independent Assessment ServicesSCG: Secure Configuration GuideSCN: Significant Change NotificationSDR: Security Decision RecordVDR: Vulnerability Detection and ResponseVER: Vulnerability Evaluation and Reporting
RefTitleText
KSI-CMT-LMC Logging Changes Modifications to the cloud service offering are logged and monitored. changed here
KSI-CMT-RMV Redeploying vs Modifying Changes to machine-based information resources are executed through the redeployment of version controlled resources rather than direct modification wherever reasonable.
KSI-CMT-RVP Reviewing Change Procedures The effectiveness of documented change management procedures is persistently reviewed.
KSI-CMT-VTD Validating Throughout Deployment Persistent testing and validation of changes throughout deployment is automated. changed here

4 of 430.