BaselineWatch
Desk
Your fleet and your work Fleetyour releases and the hardware they run onTriagewhat needs a decisionWatchlistthe products and platforms you runSaved searchesthe lists you come back to
This instance Sourceswhat is read, how often, under what termsDigestthe daily or weekly summary, and alerts
How it is drawn Appearancethe look and the colour schemeBrandingthe mark this instance wears
Owner sign-in

IVV-CSO-FIA FedRAMP Independent Assessments

FedRAMP Consolidated Rules (2026) 2026.10.13.01 against 2026.10.08.01
All changes in this version
modified IVV: Independent Verification and Validation
Why it changed, in the publisher's words

2026-10-13: Updated control mappings: added ca-2, ca-2.1, ca-2.2, ca-7.1, ca-7.4.

https://github.com/FedRAMP/rules/commits/main/fedramp-consolidated-rules.json

Title

FedRAMP Independent Assessments

Discussion

The first such completed assessment is typically called an "initial assessment" while following assessments are called "annual assessments."
The specific requirements for independent verification and validation assessments are documented by the FedRAMP Certification Class and Type.
The option for assessment by FedRAMP directly is limited to cloud services that are explicitly prioritized by FedRAMP, in consultation with the FedRAMP Board and the federal Chief Information Officers Council; this is _extremely_ rare.
FedRAMP Recognized independent assessment services are listed on the FedRAMP Marketplace.

Related controls changed

Before · 2026.10.08.01

After · 2026.10.13.01

ca-2, ca-2.1, ca-2.2, ca-7.1, ca-7.4