Skip to content

BaselineWatch

430 requirements

Desk

FedRAMP Consolidated Rules (2026) 2026.10.13.01

430 requirements · published 2026-10-13
Changes in this version

All AFC: Addressing FedRAMP Communication AGU: Agency Use of FedRAMP Certified Cloud Services CCM: Collaborative Continuous Monitoring CDS: Certification Data Sharing CMU: Cryptographic Module Use CPO: Certification Package Overview CTL-AC: FedRAMP parameters and guidance, AC CTL-AU: FedRAMP parameters and guidance, AU CTL-CA: FedRAMP parameters and guidance, CA CTL-CM: FedRAMP parameters and guidance, CM CTL-CP: FedRAMP parameters and guidance, CP CTL-IA: FedRAMP parameters and guidance, IA CTL-IR: FedRAMP parameters and guidance, IR CTL-MA: FedRAMP parameters and guidance, MA CTL-PS: FedRAMP parameters and guidance, PS CTL-RA: FedRAMP parameters and guidance, RA CTL-SA: FedRAMP parameters and guidance, SA CTL-SC: FedRAMP parameters and guidance, SC CTL-SI: FedRAMP parameters and guidance, SI CTL-SR: FedRAMP parameters and guidance, SR FRC: FedRAMP Certification FRD: Definitions IEC: Incident Evaluation and Communication IVV: Independent Verification and Validation KSI-CED: Cybersecurity Education KSI-CMT: Change Management KSI-CNA: Cloud Native Architecture KSI-IAM: Identity and Access Management KSI-INR: Incident Response KSI-MLA: Monitoring, Logging, and Auditing KSI-PIY: Policy and Inventory KSI-RPL: Recovery Planning KSI-SCR: Supply Chain Risk KSI-SVC: Service Configuration MAS: Minimum Assessment Scope MKT: Marketplace Listing REC: FedRAMP Recognition of Independent Assessment Services SCG: Secure Configuration Guide SCN: Significant Change Notification SDR: Security Decision Record VDR: Vulnerability Detection and Response VER: Vulnerability Evaluation and Reporting

Controls in this version
Ref	Title	Text
KSI-PIY-GIV	Generating Inventories	Authoritative sources are used to automatically generate real-time inventories of all information resources when needed.	changed here
KSI-PIY-RES	Reviewing Executive Support	Executive support for achieving the provider's security goals is persistently reviewed and demonstrated.
KSI-PIY-RIS	Reviewing Investments in Security	The effectiveness of the provider's investments in achieving security goals is persistently reviewed.	changed here
KSI-PIY-RSD	Reviewing Security in the SDLC	The effectiveness of building security and privacy considerations into the Software Development Lifecycle and aligning with CISA Secure By Design principles is persistently reviewed.	changed here
KSI-PIY-RVD	Reviewing Vulnerability Disclosures	The effectiveness of the provider's vulnerability disclosure program is persistently reviewed.

5 of 430.