+AFC Addressing FedRAMP Communication
---+AFC-FRP FedRAMP Responsibilities
------+AFC-FRP-VRE Verified Emails
------+AFC-FRP-CDS Criticality Designators
------+AFC-FRP-UFS Use FedRAMP_Security Email in Emergencies
------+AFC-FRP-PNT Public Notice of Emergency Tests
------+AFC-FRP-RQA Required Actions
------+AFC-FRP-ERT Elevated Reaction Timeframes
------+AFC-FRP-COR Explain Corrective Actions
------+AFC-FRP-RPM Reaction Metrics
---+AFC-CSO General Provider Responsibilities
------+AFC-CSO-INB Maintain a FedRAMP Security Inbox
------+AFC-CSO-NOC Notification of Changes
------+AFC-CSO-TFG Trust @fedramp.gov and @gsa.gov
------+AFC-CSO-RCV Receive Email Without Disruption
------+AFC-CSO-CRA Complete Required Actions
------+AFC-CSO-EMR Emergency Message Routing
------+AFC-CSO-IMA Important Message Actions
------+AFC-CSO-ACK Acknowledge Receipt

AFC Addressing FedRAMP Communication

The Addressing FedRAMP Communication rules (formerly FedRAMP Security Inbox) ensure FedRAMP can reliably contact the security and compliance staff responsible for every FedRAMP-authorized cloud service offering. These rules also set expectations for urgent communications, response time testing, and routing important messages separately from general support or customer service channels.

Effective

  • Status: required
  • Current status: Consolidated Rules for 2026
  • Required for initial certification from: 2026-01-05
  • Required for ongoing certification from: 2026-01-05
  • Grace period ends: 2026-07-01

1. Visão geral

AFC-FRP FedRAMP Responsibilities

These rules apply to FedRAMP when communicating with cloud service providers.

  • Types: 20x, Rev5
  • Paths: Program, Agency
  • Classes: B, C, D
  • Affects: FedRAMP
AFC-CSO General Provider Responsibilities

These rules apply to providers with any type of FedRAMP Certification.

  • Types: 20x, Rev5
  • Paths: Program, Agency
  • Classes: B, C, D
  • Affects: Providers

1.1 Referências

1.2 Requisitos identificados

1.3 Regulamentos relacionados

2. Requisitos identificados

Requisitos

3. Regulamentos relacionados

Regulamentos
  • FedRAMP Consolidated Rules -

    EN: FedRAMP® Consolidated Rules of the Federal Risk and Authorization Management Program, U.S. General Services Administration (GSA), https://www.fedramp.gov/, from their machine-readable version (FedRAMP/rules). Works of the U.S. Government are not subject to copyright protection in the United States (17 U.S.C. § 105; GSA website policies); GSA dedicated its machine-readable FedRAMP content to the public domain worldwide (CC0 1.0). FedRAMP® is a registered trademark of GSA; GRCA is not affiliated with, nor endorsed by, GSA or FedRAMP. Divided into sections and converted into the GRCA format, the wording unchanged, linked to the NIST SP 800-53 controls they name. Only the version published by FedRAMP is authoritative.

    DE: FedRAMP® Consolidated Rules des Federal Risk and Authorization Management Program, U.S. General Services Administration (GSA), https://www.fedramp.gov/, aus ihrer maschinenlesbaren Fassung (FedRAMP/rules). Werke der US-Regierung sind in den USA urheberrechtlich nicht geschützt (17 U.S.C. § 105; Website-Richtlinien der GSA); die GSA hat ihre maschinenlesbaren FedRAMP-Inhalte weltweit gemeinfrei gestellt (CC0 1.0). FedRAMP® ist eine eingetragene Marke der GSA; GRCA steht in keiner Verbindung zur GSA oder zu FedRAMP und wird von ihnen nicht unterstützt. In Abschnitte aufgeteilt und in das GRCA-Format umgewandelt, der Wortlaut unverändert, mit den genannten Controls aus NIST SP 800-53 verknüpft. Maßgeblich ist allein die von FedRAMP veröffentlichte Fassung.