Skip to content

BaselineWatch

430 requirements

Desk

FedRAMP Consolidated Rules (2026) 2026.10.13.01

430 requirements · published 2026-10-13
Changes in this version

All AFC: Addressing FedRAMP Communication AGU: Agency Use of FedRAMP Certified Cloud Services CCM: Collaborative Continuous Monitoring CDS: Certification Data Sharing CMU: Cryptographic Module Use CPO: Certification Package Overview CTL-AC: FedRAMP parameters and guidance, AC CTL-AU: FedRAMP parameters and guidance, AU CTL-CA: FedRAMP parameters and guidance, CA CTL-CM: FedRAMP parameters and guidance, CM CTL-CP: FedRAMP parameters and guidance, CP CTL-IA: FedRAMP parameters and guidance, IA CTL-IR: FedRAMP parameters and guidance, IR CTL-MA: FedRAMP parameters and guidance, MA CTL-PS: FedRAMP parameters and guidance, PS CTL-RA: FedRAMP parameters and guidance, RA CTL-SA: FedRAMP parameters and guidance, SA CTL-SC: FedRAMP parameters and guidance, SC CTL-SI: FedRAMP parameters and guidance, SI CTL-SR: FedRAMP parameters and guidance, SR FRC: FedRAMP Certification FRD: Definitions IEC: Incident Evaluation and Communication IVV: Independent Verification and Validation KSI-CED: Cybersecurity Education KSI-CMT: Change Management KSI-CNA: Cloud Native Architecture KSI-IAM: Identity and Access Management KSI-INR: Incident Response KSI-MLA: Monitoring, Logging, and Auditing KSI-PIY: Policy and Inventory KSI-RPL: Recovery Planning KSI-SCR: Supply Chain Risk KSI-SVC: Service Configuration MAS: Minimum Assessment Scope MKT: Marketplace Listing REC: FedRAMP Recognition of Independent Assessment Services SCG: Secure Configuration Guide SCN: Significant Change Notification SDR: Security Decision Record VDR: Vulnerability Detection and Response VER: Vulnerability Evaluation and Reporting

Controls in this version
Ref	Title	Text
KSI-IAM-AAM	Automating Account Management	The lifecycle and privileges of all accounts, roles, and groups are securely managed using automation.	changed here
KSI-IAM-APM	Adopting Passwordless Methods	Secure passwordless methods are used for user authentication and authorization when feasible, otherwise strong passwords with phishing-resistant MFA is used.	changed here
KSI-IAM-ELP	Ensuring Least Privilege	Identity and access management measures are used and persistently reviewed to ensure each user or device can only access the resources they need.	changed here
KSI-IAM-JIT	Authorizing Just-in-Time	A least-privileged, role and attribute-based, and just-in-time security authorization model is used and persistently reviewed for all user and non-user accounts and services.	changed here
KSI-IAM-SNU	Securing Non-User Authentication	Appropriately secure authentication methods are used and persistently reviewed for non-user accounts and services.	changed here
KSI-IAM-SUS	Responding to Suspicious Activity	Accounts with privileged access are disabled or otherwise secured in response to suspicious activity.	changed here

6 of 430.