+FRC-CSF Rev5-Specific Provider Responsibilities
---+FRC-CSF-BSL FedRAMP Rev5 Baselines
------+FRC-CSF-BSL FedRAMP Rev5 Baselines – Class B
------+FRC-CSF-BSL FedRAMP Rev5 Baselines – Class C
------+FRC-CSF-BSL FedRAMP Rev5 Baselines – Class D
---+FRC-CSF-ACP Assign Control Parameters
---+FRC-CSF-FFG Follow FedRAMP Rev5 Controls Guidance
---+FRC-CSF-RDY FedRAMP Ready Conversion

FRC-CSF Rev5-Specific Provider Responsibilities

These rules apply to providers for FedRAMP Rev5 Certifications.

  • Types: Rev5
  • Paths: Program, Agency
  • Classes: B, C, D
  • Affects: Providers

1. Resumen

FRC-CSF-BSL FedRAMP Rev5 Baselines

Class B

Providers seeking FedRAMP Rev5 Class B Certification MUST include at least the following NIST SP 800-53 Rev. 5 controls in their Security Decision Record:

Class C

Providers seeking FedRAMP Rev5 Class C Certification MUST include at least the following NIST SP 800-53 Rev. 5 controls in their Security Decision Record:

Class D

Providers seeking FedRAMP Rev5 Class D Certification MUST include at least the following NIST SP 800-53 Rev. 5 controls in their Security Decision Record:

Reference: NIST SP 800-53 Rev. 5, Security and Privacy Controls for Information Systems and Organizations

Defined terms: Security Decision Record (SDR)
FRC-CSF-ACP Assign Control Parameters

Providers MUST assign all organization-defined control parameters, following FedRAMP Rev5 Controls Guidance, and ensure that all control parameter assignments are documented in the Security Decision Record (SDR).

Defined terms: Security Decision Record (SDR)
FRC-CSF-FFG Follow FedRAMP Rev5 Controls Guidance

Providers MUST follow FedRAMP Rev5 Controls Guidance for the implementation and documentation of all applicable controls.
FRC-CSF-RDY FedRAMP Ready Conversion

Providers with FedRAMP Rev5 Ready status MUST convert to a FedRAMP Certification by whichever of the following dates is later: the expiration of their annual assessment or November 17, 2026 (the legacy FedRAMP Ready status will be entirely removed on December 31, 2027).

Notes

The simplest conversion in most cases would be to a FedRAMP 20x Class A Certification.

Cloud services that do not wish to convert or do not meet conversion criteria will be renamed Legacy FedRAMP Ready and otherwise retired from FedRAMP Ready.

1.1 Referencias

1.2 Requisitos identificados

1.3 Regulaciones relacionadas

2. Requisitos identificados

Requisitos

3. Regulaciones relacionadas

Regulaciones
  • FedRAMP Consolidated Rules -

    EN: FedRAMP® Consolidated Rules of the Federal Risk and Authorization Management Program, U.S. General Services Administration (GSA), https://www.fedramp.gov/, from their machine-readable version (FedRAMP/rules). Works of the U.S. Government are not subject to copyright protection in the United States (17 U.S.C. § 105; GSA website policies); GSA dedicated its machine-readable FedRAMP content to the public domain worldwide (CC0 1.0). FedRAMP® is a registered trademark of GSA; GRCA is not affiliated with, nor endorsed by, GSA or FedRAMP. Divided into sections and converted into the GRCA format, the wording unchanged, linked to the NIST SP 800-53 controls they name. Only the version published by FedRAMP is authoritative.

    DE: FedRAMP® Consolidated Rules des Federal Risk and Authorization Management Program, U.S. General Services Administration (GSA), https://www.fedramp.gov/, aus ihrer maschinenlesbaren Fassung (FedRAMP/rules). Werke der US-Regierung sind in den USA urheberrechtlich nicht geschützt (17 U.S.C. § 105; Website-Richtlinien der GSA); die GSA hat ihre maschinenlesbaren FedRAMP-Inhalte weltweit gemeinfrei gestellt (CC0 1.0). FedRAMP® ist eine eingetragene Marke der GSA; GRCA steht in keiner Verbindung zur GSA oder zu FedRAMP und wird von ihnen nicht unterstützt. In Abschnitte aufgeteilt und in das GRCA-Format umgewandelt, der Wortlaut unverändert, mit den genannten Controls aus NIST SP 800-53 verknüpft. Maßgeblich ist allein die von FedRAMP veröffentlichte Fassung.