BaselineWatch
Desk
Your fleet and your work Fleetyour releases and the hardware they run onTriagewhat needs a decisionWatchlistthe products and platforms you runSaved searchesthe lists you come back to
This instance Sourceswhat is read, how often, under what termsDigestthe daily or weekly summary, and alerts
How it is drawn Appearancethe look and the colour schemeBrandingthe mark this instance wears
Owner sign-in

SCG-CSO-RSC Recommended Secure Configuration

FedRAMP Consolidated Rules (2026) 2026.10.13.01 against 2026.10.08.01
All changes in this version
modified SCG: Secure Configuration Guide
Why it changed, in the publisher's words

2026-10-13: Updated control mappings: added cm-7.

https://github.com/FedRAMP/rules/commits/main/fedramp-consolidated-rules.json

Title

Recommended Secure Configuration

Control

Providers MUST create, maintain, and make available recommendations for securely configuring their cloud services (the Secure Configuration Guide) that includes at least the following information:
- Required: Instructions on how to securely access, configure, operate, and decommission top-level administrative accounts that control enterprise access to the entire cloud service offering.
- Required: Explanations of security-related settings that can be operated only by top-level administrative accounts and their security implications.
- Recommended: Explanations of security-related settings that can be operated only by privileged accounts and their security implications.

Discussion

These rules refer to this guidance as a Secure Configuration Guide but cloud service providers may make this guidance available in various appropriate forms that provide the best customer experience.
This guidance should explain how top-level administrative accounts and privileged accounts are named and referred to in the cloud service offering.

Related controls changed

Before · 2026.10.08.01

After · 2026.10.13.01

cm-7