BaselineWatch
430 requirements
Desk
Your fleet and your work Fleetyour releases and the hardware they run onTriagewhat needs a decisionWatchlistthe products and platforms you runSaved searchesthe lists you come back to
This instance Sourceswhat is read, how often, under what termsDigestthe daily or weekly summary, and alerts
How it is drawn Appearancethe look and the colour schemeBrandingthe mark this instance wears
Owner sign-in

FedRAMP Consolidated Rules (2026) 2026.10.13.01

430 requirements · published 2026-10-13
Changes in this version
AllAFC: Addressing FedRAMP CommunicationAGU: Agency Use of FedRAMP Certified Cloud ServicesCCM: Collaborative Continuous MonitoringCDS: Certification Data SharingCMU: Cryptographic Module UseCPO: Certification Package OverviewCTL-AC: FedRAMP parameters and guidance, ACCTL-AU: FedRAMP parameters and guidance, AUCTL-CA: FedRAMP parameters and guidance, CACTL-CM: FedRAMP parameters and guidance, CMCTL-CP: FedRAMP parameters and guidance, CPCTL-IA: FedRAMP parameters and guidance, IACTL-IR: FedRAMP parameters and guidance, IRCTL-MA: FedRAMP parameters and guidance, MACTL-PS: FedRAMP parameters and guidance, PSCTL-RA: FedRAMP parameters and guidance, RACTL-SA: FedRAMP parameters and guidance, SACTL-SC: FedRAMP parameters and guidance, SCCTL-SI: FedRAMP parameters and guidance, SICTL-SR: FedRAMP parameters and guidance, SRFRC: FedRAMP CertificationFRD: DefinitionsIEC: Incident Evaluation and CommunicationIVV: Independent Verification and ValidationKSI-CED: Cybersecurity EducationKSI-CMT: Change ManagementKSI-CNA: Cloud Native ArchitectureKSI-IAM: Identity and Access ManagementKSI-INR: Incident ResponseKSI-MLA: Monitoring, Logging, and AuditingKSI-PIY: Policy and InventoryKSI-RPL: Recovery PlanningKSI-SCR: Supply Chain RiskKSI-SVC: Service ConfigurationMAS: Minimum Assessment ScopeMKT: Marketplace ListingREC: FedRAMP Recognition of Independent Assessment ServicesSCG: Secure Configuration GuideSCN: Significant Change NotificationSDR: Security Decision RecordVDR: Vulnerability Detection and ResponseVER: Vulnerability Evaluation and Reporting
RefTitleText
MAS-CSO-FLO Information Flows and Security Categories Providers MUST clearly identify, document, and explain information flows and security categories for ALL information resources or sets of information resources in the cloud service offering. changed here
MAS-CSO-IIR Identify Information Resources Providers MUST identify a set of information resources to assess for FedRAMP Certification that includes all information resources that are likely to handle federal customer data or likely to impact the confidentiality, integrity, or availa changed here
MAS-CSO-MDI Metadata Inclusion Providers MUST include metadata (including metadata about federal customer data) in the Minimum Assessment Scope ONLY IF MAS-CSO-IIR (Identify Information Resources) APPLIES.
MAS-CSO-SUP Supplemental Information Providers MAY include additional materials about other information resources that are not part of the cloud service offering in a FedRAMP Certification Package supplement; these resources will not be FedRAMP Certified and MUST be clearly ma
MAS-CSO-TPR Third-Party Information Resources Providers MUST address the potential impact to federal customer data from third-party information resources used by the cloud service offering, ONLY IF MAS-CSO-IIR (Identify Information Resources) APPLIES, by documenting the following infor changed here

5 of 430.