BaselineWatch
73 changes
Desk

FedRAMP Consolidated Rules (2026) 2026.10.08.01 → 2026.10.13.01

Published 2026-10-13
Snapshot taken 2026-10-15 15:31 · rules source
73 with discussion, related-control or assessment updates 73 of 73 changed requirements carry the publisher's note
Why this release, in the publisher's words

FedRAMP's change notes dated 2026-10-13 (version 2026.10.13.01): Updated control mappings: added si-5. Updated control mappings: added cm-10, cm-5, cm-6, ia-11. Updated control mappings: added ca-7. Updated control mappings: added au-9.3, cm-3.6, ia-7, sc-28.1, sc-8.1. Updated control mappings: added ac-18, au-9.3, ia-7, sc-28.1, sc-8.1. Updated control mappings: added ca-2, ca-2.1, ca-2.2, ca-7.1. Updated control mappings: added au-5.2, ir-4.11. Updated control mappings: added au-5.2, ir-5. Updated control mappings: added ir-5. Updated control mappings: added ca-2, ca-2.1, ca-2.2, ca-7.1, ca-7.4. Updated control mappings: added cm-8.4, ra-3, si-4.19. Updated control mappings: added ac-4, cm-12, cm-12.1, ra-3, si-4.19. Updated control mappings: added ra-3. Updated control mappings: added cm-7. Updated control mappings: added cm-4. Updated control mappings: added ir-4.2. Updated control mappings: added au-5.2, au-6, ca-8, ca-8.1, ca-8.2, ra-5, ra-5.2, ra-5.3, ra-5.4, si-2, si-3, si-4.1, si-4.12, si-4.18, si-4.22, si-5.1. Updated control mappings: added au-5.2, ir-4.11, ir-9.3, ra-7, si-2, si-3. Updated control mappings: added au-5.2, si-4, si-4.1, si-7.7. Updated control mappings: added ra-5, si-2.2, si-3, si-4.2, si-4.5. Updated control mappings: added ra-5. Updated control mappings: added ra-5.5, si-2. Updated control mappings: added ra-5, si-5. Updated control mappings: added ra-5.3, ra-5.5. Updated control mappings: added si-4.22, si-7, si-7.1. Updated control mappings: added si-2.3. Updated control mappings: added ra-9. Updated control mappings: added si-7.2. Updated control mappings: added cm-11, cp-3.1, ir-2.1, ir-2.2, ir-9.2, ir-9.4, pl-4, pl-4.1. Updated control mappings: added ca-7.4, cm-3.1, cm-3.6; removed ma-2. Updated control mappings: added cm-6.2, ir-9.4. Updated control mappings: added cm-8.4, cp-10.4, ir-9.4. Updated control mappings: added cm-11, cm-6.2, cp-10.4, ir-9.4, sc-24, sc-7.18, si-4.22, si-7, si-7.1, si-7.5, si-7.7; removed ca-7.1. Updated control mappings: added sc-7.18. Updated control mappings: added cp-2.5, sc-12.1. Updated control mappings: added sc-7.10, sc-7.18, sc-7.20, sc-7.21, si-10, si-4.11, si-4.18, si-4.4. Updated control mappings: added ir-4.2, sc-7.18. Updated control mappings: added ac-4.21, cm-11, sc-7.20, sc-7.21. Updated control mappings: added ia-8.4. Updated control mappings: added ia-2.6, ia-5.8, ia-8.2, ia-8.4. Updated control mappings: added ac-18.4, ac-2.11, ac-2.7, ac-2.9, ac-21, ac-6.3, ac-6.8, au-12.3, au-6.7, cm-5.1, cm-5.5, cm-7.2, ir-4.6, ir-9.4, ra-5.5, sc-2, sc-3, si-4.19. Updated control mappings: added ac-17.4, ac-2.11, ac-2.7, ac-21, ac-6.3, ac-6.8, au-10, au-12.3, ca-3.6, cm-5.1, cm-5.5, ir-4.6, sc-3. Updated control mappings: added ac-2.9, au-10, ia-2.5. Updated control mappings: added ac-2.11, ac-2.12, au-6.5, cm-5.1, cm-6.2, ir-4.2, ir-4.6, si-4, si-4.1, si-4.19, si-4.20, si-4.22, si-4.4. Updated control mappings: added ir-5.1, ir-9.3. Updated control mappings: added ir-4.11, ir-9.3. Updated control mappings: added ir-4.11, ir-4.4, ir-5.1, ra-5.8. Updated control mappings: added au-12.3, au-6.7. Updated control mappings: added ac-19, cm-6.1, ra-3. Updated control mappings: added au-10, au-7, cm-5.1, ir-9.4, si-4.19, si-4.20. Updated control mappings: added au-12.1, au-5.1, au-6.4, au-6.5, si-4.16; removed si-7.7. Updated control mappings: added au-7, ra-5.8, si-4.19. Updated control mappings: added cm-8.2, cm-8.4. Updated control mappings: added ca-2.2, ir-4.11. Updated control mappings: added ia-5.7, ra-9. Updated control mappings: removed si-12. Updated control mappings: added ir-9.3, sc-12.1. Updated control mappings: added ac-19, ra-3, sa-11.1, sa-11.2, sa-15, sa-16, sa-17, sa-21, sa-4, sa-4.1, sa-4.2, sa-4.5, sa-4.9, sa-9.1, sa-9.2, sa-9.5, si-7.15, sr-2, sr-3. Updated control mappings: added ac-19, ca-2.3, ra-3, sr-3. Updated control mappings: added ac-6.8, sc-45, sc-45.1, sc-7.18. Updated control mappings: added sc-12.1. Updated control mappings: added ca-7.4, cm-5.5, ir-9.4, ra-3; removed ma-2. Updated control mappings: added ac-19, ir-9.4, sc-12.1, sc-7.18. Updated control mappings: added ir-9, si-8, si-8.2. Updated control mappings: added ac-11, ac-11.1, ac-19.5, ac-21, ir-9.4, sc-4, sc-7.18, si-4.18; removed ac-1. Updated control mappings: added ac-10, ac-17.4, ac-18, ac-19, si-4.22. Updated control mappings: added ac-17.4, ac-18, ac-19, au-9.3, cm-14, si-7.15, sr-11.

https://github.com/FedRAMP/rules/commits/main/fedramp-consolidated-rules.json
All · 73AFC: Addressing FedRAMP Communication · 1AGU: Agency Use of FedRAMP Certified Cloud Services · 1CCM: Collaborative Continuous Monitoring · 3CMU: Cryptographic Module Use · 2CPO: Certification Package Overview · 1IEC: Incident Evaluation and Communication · 4IVV: Independent Verification and Validation · 1KSI-CED: Cybersecurity Education · 1KSI-CMT: Change Management · 2KSI-CNA: Cloud Native Architecture · 8KSI-IAM: Identity and Access Management · 6KSI-INR: Incident Response · 3KSI-MLA: Monitoring, Logging, and Auditing · 5KSI-PIY: Policy and Inventory · 3KSI-RPL: Recovery Planning · 2KSI-SCR: Supply Chain Risk · 2KSI-SVC: Service Configuration · 8MAS: Minimum Assessment Scope · 3SCG: Secure Configuration Guide · 1SCN: Significant Change Notification · 2VDR: Vulnerability Detection and Response · 10VER: Vulnerability Evaluation and Reporting · 4

Discussion, related-control and assessment updates in KSI-RPL: Recovery Planning 2

Discussion, related-control and assessment updates
ControlTitleWhat moved
KSI-RPL-ABO Aligning Backups with Objectives Related controls
KSI-RPL-TRC Testing Recovery Capabilities Related controls

Read every requirement in this version · All versions of FedRAMP Consolidated Rules (2026)