Skip to content

BaselineWatch

430 requirements

Desk

FedRAMP Consolidated Rules (2026) 2026.10.13.01

430 requirements · published 2026-10-13
Changes in this version

All AFC: Addressing FedRAMP Communication AGU: Agency Use of FedRAMP Certified Cloud Services CCM: Collaborative Continuous Monitoring CDS: Certification Data Sharing CMU: Cryptographic Module Use CPO: Certification Package Overview CTL-AC: FedRAMP parameters and guidance, AC CTL-AU: FedRAMP parameters and guidance, AU CTL-CA: FedRAMP parameters and guidance, CA CTL-CM: FedRAMP parameters and guidance, CM CTL-CP: FedRAMP parameters and guidance, CP CTL-IA: FedRAMP parameters and guidance, IA CTL-IR: FedRAMP parameters and guidance, IR CTL-MA: FedRAMP parameters and guidance, MA CTL-PS: FedRAMP parameters and guidance, PS CTL-RA: FedRAMP parameters and guidance, RA CTL-SA: FedRAMP parameters and guidance, SA CTL-SC: FedRAMP parameters and guidance, SC CTL-SI: FedRAMP parameters and guidance, SI CTL-SR: FedRAMP parameters and guidance, SR FRC: FedRAMP Certification FRD: Definitions IEC: Incident Evaluation and Communication IVV: Independent Verification and Validation KSI-CED: Cybersecurity Education KSI-CMT: Change Management KSI-CNA: Cloud Native Architecture KSI-IAM: Identity and Access Management KSI-INR: Incident Response KSI-MLA: Monitoring, Logging, and Auditing KSI-PIY: Policy and Inventory KSI-RPL: Recovery Planning KSI-SCR: Supply Chain Risk KSI-SVC: Service Configuration MAS: Minimum Assessment Scope MKT: Marketplace Listing REC: FedRAMP Recognition of Independent Assessment Services SCG: Secure Configuration Guide SCN: Significant Change Notification SDR: Security Decision Record VDR: Vulnerability Detection and Response VER: Vulnerability Evaluation and Reporting

Controls in this version
Ref	Title	Text
KSI-SVC-ACM	Automating Configuration Management	The configuration of machine-based information resources is managed using automation and persistently reviewed for drift.	changed here
KSI-SVC-ASM	Automating Secret Management	Management, protection, and regular rotation of digital keys, certificates, and other secrets is automated and persistently reviewed.	changed here
KSI-SVC-EIS	Evaluating and Improving Security	Information resources are persistently evaluated for opportunities to improve security and those improvements are persistently made.	changed here
KSI-SVC-PRR	Preventing Residual Risk		changed here
KSI-SVC-RUD	Removing Unwanted Data		changed here
KSI-SVC-SIN	Securing Information	Information is encrypted or otherwise secured from unwanted access or modification.	changed here
KSI-SVC-VCM	Validating Communications		changed here
KSI-SVC-VRI	Validating Resource Integrity	Use cryptographic methods to validate the integrity of machine-based information resources.	changed here

8 of 430.