Skip to content

BaselineWatch

430 requirements

Desk

FedRAMP Consolidated Rules (2026) 2026.10.13.01

430 requirements · published 2026-10-13
Changes in this version

All AFC: Addressing FedRAMP Communication AGU: Agency Use of FedRAMP Certified Cloud Services CCM: Collaborative Continuous Monitoring CDS: Certification Data Sharing CMU: Cryptographic Module Use CPO: Certification Package Overview CTL-AC: FedRAMP parameters and guidance, AC CTL-AU: FedRAMP parameters and guidance, AU CTL-CA: FedRAMP parameters and guidance, CA CTL-CM: FedRAMP parameters and guidance, CM CTL-CP: FedRAMP parameters and guidance, CP CTL-IA: FedRAMP parameters and guidance, IA CTL-IR: FedRAMP parameters and guidance, IR CTL-MA: FedRAMP parameters and guidance, MA CTL-PS: FedRAMP parameters and guidance, PS CTL-RA: FedRAMP parameters and guidance, RA CTL-SA: FedRAMP parameters and guidance, SA CTL-SC: FedRAMP parameters and guidance, SC CTL-SI: FedRAMP parameters and guidance, SI CTL-SR: FedRAMP parameters and guidance, SR FRC: FedRAMP Certification FRD: Definitions IEC: Incident Evaluation and Communication IVV: Independent Verification and Validation KSI-CED: Cybersecurity Education KSI-CMT: Change Management KSI-CNA: Cloud Native Architecture KSI-IAM: Identity and Access Management KSI-INR: Incident Response KSI-MLA: Monitoring, Logging, and Auditing KSI-PIY: Policy and Inventory KSI-RPL: Recovery Planning KSI-SCR: Supply Chain Risk KSI-SVC: Service Configuration MAS: Minimum Assessment Scope MKT: Marketplace Listing REC: FedRAMP Recognition of Independent Assessment Services SCG: Secure Configuration Guide SCN: Significant Change Notification SDR: Security Decision Record VDR: Vulnerability Detection and Response VER: Vulnerability Evaluation and Reporting

Controls in this version
Ref	Title	Text
KSI-INR-AAR	Generating After Action Reports	Incident after action reports are generated and lessons learned are persistently incorporated.	changed here
KSI-INR-RIR	Reviewing Incident Response Procedures	The effectiveness of documented incident response procedures is persistently reviewed.	changed here
KSI-INR-RPI	Reviewing Past Incidents	Past incidents are persistently reviewed for patterns or vulnerabilities that were not previously apparent or identified.	changed here

3 of 430.