Skip to content

BaselineWatch

430 requirements

Desk

FedRAMP Consolidated Rules (2026) 2026.10.13.01

430 requirements · published 2026-10-13
Changes in this version

All AFC: Addressing FedRAMP Communication AGU: Agency Use of FedRAMP Certified Cloud Services CCM: Collaborative Continuous Monitoring CDS: Certification Data Sharing CMU: Cryptographic Module Use CPO: Certification Package Overview CTL-AC: FedRAMP parameters and guidance, AC CTL-AU: FedRAMP parameters and guidance, AU CTL-CA: FedRAMP parameters and guidance, CA CTL-CM: FedRAMP parameters and guidance, CM CTL-CP: FedRAMP parameters and guidance, CP CTL-IA: FedRAMP parameters and guidance, IA CTL-IR: FedRAMP parameters and guidance, IR CTL-MA: FedRAMP parameters and guidance, MA CTL-PS: FedRAMP parameters and guidance, PS CTL-RA: FedRAMP parameters and guidance, RA CTL-SA: FedRAMP parameters and guidance, SA CTL-SC: FedRAMP parameters and guidance, SC CTL-SI: FedRAMP parameters and guidance, SI CTL-SR: FedRAMP parameters and guidance, SR FRC: FedRAMP Certification FRD: Definitions IEC: Incident Evaluation and Communication IVV: Independent Verification and Validation KSI-CED: Cybersecurity Education KSI-CMT: Change Management KSI-CNA: Cloud Native Architecture KSI-IAM: Identity and Access Management KSI-INR: Incident Response KSI-MLA: Monitoring, Logging, and Auditing KSI-PIY: Policy and Inventory KSI-RPL: Recovery Planning KSI-SCR: Supply Chain Risk KSI-SVC: Service Configuration MAS: Minimum Assessment Scope MKT: Marketplace Listing REC: FedRAMP Recognition of Independent Assessment Services SCG: Secure Configuration Guide SCN: Significant Change Notification SDR: Security Decision Record VDR: Vulnerability Detection and Response VER: Vulnerability Evaluation and Reporting

Controls in this version
Ref	Title	Text
KSI-RPL-ABO	Aligning Backups with Objectives	The alignment of machine-based information resource backups with defined recovery objectives is persistently reviewed.	changed here
KSI-RPL-ARP	Aligning Recovery Plan	The alignment of recovery plans with defined recovery objectives is persistently reviewed.
KSI-RPL-RRO	Reviewing Recovery Objectives	The desired Recovery Time Objectives (RTO) and Recovery Point Objectives (RPO) are defined and persistently reviewed for alignment with the provider's business needs and capabilities.
KSI-RPL-TRC	Testing Recovery Capabilities	The capability to recover from incidents and contingencies aligned with defined recovery objectives is persistently tested.	changed here

4 of 430.