+AGU Agency Use of FedRAMP Certified Cloud Services
---+AGU-AGC General Agency Responsibilities
------+AGU-AGC-AIP Agency Internal Policies
------+AGU-AGC-NAA Notify FedRAMP After Authorization
------+AGU-AGC-GRC Governance, Risk, and Compliance Tools
------+AGU-AGC-NAI Notify Additional Information Requests
------+AGU-AGC-NAR No Additional Security Requirements
------+AGU-AGC-TPP No Certification Type or Path Preferences
------+AGU-AGC-WKG FedRAMP Working Groups
------+AGU-AGC-LIA Agency Liaison Program
------+AGU-AGC-SIN Shared FedRAMP Inbox
---+AGU-USE Use of FedRAMP Certifications
------+AGU-USE-ABU Authorization Before Use
------+AGU-USE-RCF Resolve Certification Package Conflicts
------+AGU-USE-RSG Review Secure Configuration Guides
------+AGU-USE-AFR Accept FedRAMP Rules
------+AGU-USE-NFC Notify FedRAMP of Monitoring Concerns
------+AGU-USE-ROR Review Ongoing Certification Reports
------+AGU-USE-DSO Designate Senior Official
------+AGU-USE-NPC Notify Provider of Concerns
------+AGU-USE-RIR Review All Information Resources
------+AGU-USE-CLA Using FedRAMP Class A Certifications
---+AGU-SPN Agency Sponsored Certifications
------+AGU-SPN-MRC Most Recent Consolidated Rules
|
AGU Agency Use of FedRAMP Certified Cloud Services
The Agency Use rules summarize the many demands made on agencies by the FedRAMP Authorization Act and OMB Memorandum M-24-15 in a simple, clear, easy-to-follow set of FedRAMP-style rules. These rules align agency policies, authorization letters, machine-readable tools, secure configuration review, continuous monitoring, and communication with FedRAMP so certifications can be reused consistently across government. Effective- Status: required
- Current status: Consolidated Rules for 2026
- Optional adoption from: 2026-07-04
- Required for initial certification from: 2026-07-04
- Required for ongoing certification from: 2026-07-04
- Grace period ends: 2026-07-04
1. Overview
| Summary |
Standard |
|
AGU-AGC General Agency Responsibilities
|
These rules apply to agencies based on the FedRAMP Authorization Act, OMB M-24-15, and related FedRAMP policies. - Types: 20x, Rev5
- Paths: Program, Agency
- Classes: A, B, C, D
- Affects: Agencies
|
|
AGU-USE Use of FedRAMP Certifications
|
These rules apply when agencies use FedRAMP Certifications to make agency authorization decisions. - Types: 20x, Rev5
- Paths: Program, Agency
- Classes: A, B, C, D
- Affects: Agencies
|
|
AGU-SPN Agency Sponsored Certifications
|
These rules apply when an agency sponsors a FedRAMP Rev5 Certification after completing an agency authorization. - Types: Rev5
- Paths: Agency
- Classes: B, C, D
- Affects: Agencies
|
1.1 References
1.2 Identified Requirements
1.3 Related Regulations
2. Identified Requirements
Requirements
| Source |
Requirement |
3. Related Regulations
Regulations
| Source |
Regulation |
- FedRAMP Consolidated Rules -
EN: FedRAMP® Consolidated Rules of the Federal Risk and Authorization Management Program, U.S. General Services Administration (GSA), https://www.fedramp.gov/, from their machine-readable version (FedRAMP/rules). Works of the U.S. Government are not subject to copyright protection in the United States (17 U.S.C. § 105; GSA website policies); GSA dedicated its machine-readable FedRAMP content to the public domain worldwide (CC0 1.0). FedRAMP® is a registered trademark of GSA; GRCA is not affiliated with, nor endorsed by, GSA or FedRAMP. Divided into sections and converted into the GRCA format, the wording unchanged, linked to the NIST SP 800-53 controls they name. Only the version published by FedRAMP is authoritative.
DE: FedRAMP® Consolidated Rules des Federal Risk and Authorization Management Program, U.S. General Services Administration (GSA), https://www.fedramp.gov/, aus ihrer maschinenlesbaren Fassung (FedRAMP/rules). Werke der US-Regierung sind in den USA urheberrechtlich nicht geschützt (17 U.S.C. § 105; Website-Richtlinien der GSA); die GSA hat ihre maschinenlesbaren FedRAMP-Inhalte weltweit gemeinfrei gestellt (CC0 1.0). FedRAMP® ist eine eingetragene Marke der GSA; GRCA steht in keiner Verbindung zur GSA oder zu FedRAMP und wird von ihnen nicht unterstützt. In Abschnitte aufgeteilt und in das GRCA-Format umgewandelt, der Wortlaut unverändert, mit den genannten Controls aus NIST SP 800-53 verknüpft. Maßgeblich ist allein die von FedRAMP veröffentlichte Fassung.
|