+CDS Certification Data Sharing
---+CDS-CSO General Provider Responsibilities
------+CDS-CSO-PUB Public Information
------+CDS-CSO-SVC Public Service List
------+CDS-CSO-FID Always Include FedRAMP ID
------+CDS-CSO-FRC FedRAMP Certification Reports
------+CDS-CSO-AVR Availability Reporting
------+CDS-CSO-UTC Use Trust Centers
------+CDS-CSO-CBF Consistency Between Formats
------+CDS-CSO-RIS Responsible Information Sharing
------+CDS-CSO-IRP Include Relevant Policies
------+CDS-CSO-HAD Historical FedRAMP Certification Data
------+CDS-CSO-PSM Per-Service Certification Materials
------+CDS-CSO-RPS Responsible Public Package Sharing
---+CDS-TRC FedRAMP-Compatible Trust Centers
------+CDS-TRC-USH Uninterrupted Sharing
------+CDS-TRC-PAC Programmatic Access
------+CDS-TRC-AAI Agency Access Inventory
------+CDS-TRC-ACL Access Logging
------+CDS-TRC-HMR Human and Machine-Readable Certification Data
------+CDS-TRC-SSM Self-Service Access Management
---+CDS-UTC Using a Trust Center
------+CDS-UTC-AAD Agency Access Denial
------+CDS-UTC-AGA Agency Access
---+CDS-CSF Rev5-Specific Provider Responsibilities
------+CDS-CSF-TCM Trust Center Migration

CDS Certification Data Sharing

The Certification Data Sharing rules allow providers to store and share FedRAMP Certification Data through the platform they choose as long as it follows FedRAMP rules for access, accuracy, and transparency. This helps customers and the public review consistent, current security and compliance information while recognizing that the information usually remains the provider's intellectual property and is not federal information.

Effective for 20x

  • Status: required
  • Current status: Consolidated Rules for 2026
  • Optional adoption from: 2026-07-04
  • Required for initial certification from: 2026-07-04
  • Required for ongoing certification from: 2027-01-01
  • Grace period ends: 2027-01-01 or at the next assessment

Effective for Rev5

  • Status: required
  • Current status: Consolidated Rules for 2026
  • Optional adoption from: 2026-07-04
  • Required for initial certification from: 2027-01-01
  • Required for ongoing certification from: 2027-08-01
  • Grace period ends: 2028-02-01

1. Vue d’ensemble

CDS-CSO General Provider Responsibilities

These rules apply to providers for FedRAMP Certifications of any type.

  • Types: 20x, Rev5
  • Paths: Program, Agency
  • Classes: B, C, D
  • Affects: Providers
CDS-TRC FedRAMP-Compatible Trust Centers

These rules apply to trust centers that are FedRAMP-compatible.

  • Types: 20x, Rev5
  • Paths: Program, Agency
  • Classes: B, C, D
  • Affects: Providers
CDS-UTC Using a Trust Center

These rules apply to providers that are using a FedRAMP-compatible trust center instead of USDA Connect; they DO NOT apply to providers using USDA Connect.

  • Types: 20x, Rev5
  • Paths: Program, Agency
  • Classes: B, C, D
  • Affects: Providers
CDS-CSF Rev5-Specific Provider Responsibilities

These rules apply to providers for FedRAMP Rev5 Certifications.

  • Types: Rev5
  • Paths: Program, Agency
  • Classes: B, C, D
  • Affects: Providers

1.1 Références

1.2 Exigences identifiées

1.3 Réglementations associées

2. Exigences identifiées

Exigences

3. Réglementations associées

Réglementations
  • FedRAMP Consolidated Rules -

    EN: FedRAMP® Consolidated Rules of the Federal Risk and Authorization Management Program, U.S. General Services Administration (GSA), https://www.fedramp.gov/, from their machine-readable version (FedRAMP/rules). Works of the U.S. Government are not subject to copyright protection in the United States (17 U.S.C. § 105; GSA website policies); GSA dedicated its machine-readable FedRAMP content to the public domain worldwide (CC0 1.0). FedRAMP® is a registered trademark of GSA; GRCA is not affiliated with, nor endorsed by, GSA or FedRAMP. Divided into sections and converted into the GRCA format, the wording unchanged, linked to the NIST SP 800-53 controls they name. Only the version published by FedRAMP is authoritative.

    DE: FedRAMP® Consolidated Rules des Federal Risk and Authorization Management Program, U.S. General Services Administration (GSA), https://www.fedramp.gov/, aus ihrer maschinenlesbaren Fassung (FedRAMP/rules). Werke der US-Regierung sind in den USA urheberrechtlich nicht geschützt (17 U.S.C. § 105; Website-Richtlinien der GSA); die GSA hat ihre maschinenlesbaren FedRAMP-Inhalte weltweit gemeinfrei gestellt (CC0 1.0). FedRAMP® ist eine eingetragene Marke der GSA; GRCA steht in keiner Verbindung zur GSA oder zu FedRAMP und wird von ihnen nicht unterstützt. In Abschnitte aufgeteilt und in das GRCA-Format umgewandelt, der Wortlaut unverändert, mit den genannten Controls aus NIST SP 800-53 verknüpft. Maßgeblich ist allein die von FedRAMP veröffentlichte Fassung.