+AGU Agency Use of FedRAMP Certified Cloud Services
---+AGU-AGC General Agency Responsibilities
------+AGU-AGC-AIP Agency Internal Policies
------+AGU-AGC-NAA Notify FedRAMP After Authorization
------+AGU-AGC-GRC Governance, Risk, and Compliance Tools
------+AGU-AGC-NAI Notify Additional Information Requests
------+AGU-AGC-NAR No Additional Security Requirements
------+AGU-AGC-TPP No Certification Type or Path Preferences
------+AGU-AGC-WKG FedRAMP Working Groups
------+AGU-AGC-LIA Agency Liaison Program
------+AGU-AGC-SIN Shared FedRAMP Inbox
---+AGU-USE Use of FedRAMP Certifications
------+AGU-USE-ABU Authorization Before Use
------+AGU-USE-RCF Resolve Certification Package Conflicts
------+AGU-USE-RSG Review Secure Configuration Guides
------+AGU-USE-AFR Accept FedRAMP Rules
------+AGU-USE-NFC Notify FedRAMP of Monitoring Concerns
------+AGU-USE-ROR Review Ongoing Certification Reports
------+AGU-USE-DSO Designate Senior Official
------+AGU-USE-NPC Notify Provider of Concerns
------+AGU-USE-RIR Review All Information Resources
------+AGU-USE-CLA Using FedRAMP Class A Certifications
---+AGU-SPN Agency Sponsored Certifications
------+AGU-SPN-MRC Most Recent Consolidated Rules

AGU Agency Use of FedRAMP Certified Cloud Services

The Agency Use rules summarize the many demands made on agencies by the FedRAMP Authorization Act and OMB Memorandum M-24-15 in a simple, clear, easy-to-follow set of FedRAMP-style rules. These rules align agency policies, authorization letters, machine-readable tools, secure configuration review, continuous monitoring, and communication with FedRAMP so certifications can be reused consistently across government.

Effective

  • Status: required
  • Current status: Consolidated Rules for 2026
  • Optional adoption from: 2026-07-04
  • Required for initial certification from: 2026-07-04
  • Required for ongoing certification from: 2026-07-04
  • Grace period ends: 2026-07-04

1. Prezentare generală

AGU-AGC General Agency Responsibilities

These rules apply to agencies based on the FedRAMP Authorization Act, OMB M-24-15, and related FedRAMP policies.

  • Types: 20x, Rev5
  • Paths: Program, Agency
  • Classes: A, B, C, D
  • Affects: Agencies
AGU-USE Use of FedRAMP Certifications

These rules apply when agencies use FedRAMP Certifications to make agency authorization decisions.

  • Types: 20x, Rev5
  • Paths: Program, Agency
  • Classes: A, B, C, D
  • Affects: Agencies
AGU-SPN Agency Sponsored Certifications

These rules apply when an agency sponsors a FedRAMP Rev5 Certification after completing an agency authorization.

  • Types: Rev5
  • Paths: Agency
  • Classes: B, C, D
  • Affects: Agencies

1.1 Referințe

1.2 Cerințe identificate

1.3 Reglementări asociate

2. Cerințe identificate

Cerințe

3. Reglementări asociate

Reglementări
  • FedRAMP Consolidated Rules -

    EN: FedRAMP® Consolidated Rules of the Federal Risk and Authorization Management Program, U.S. General Services Administration (GSA), https://www.fedramp.gov/, from their machine-readable version (FedRAMP/rules). Works of the U.S. Government are not subject to copyright protection in the United States (17 U.S.C. § 105; GSA website policies); GSA dedicated its machine-readable FedRAMP content to the public domain worldwide (CC0 1.0). FedRAMP® is a registered trademark of GSA; GRCA is not affiliated with, nor endorsed by, GSA or FedRAMP. Divided into sections and converted into the GRCA format, the wording unchanged, linked to the NIST SP 800-53 controls they name. Only the version published by FedRAMP is authoritative.

    DE: FedRAMP® Consolidated Rules des Federal Risk and Authorization Management Program, U.S. General Services Administration (GSA), https://www.fedramp.gov/, aus ihrer maschinenlesbaren Fassung (FedRAMP/rules). Werke der US-Regierung sind in den USA urheberrechtlich nicht geschützt (17 U.S.C. § 105; Website-Richtlinien der GSA); die GSA hat ihre maschinenlesbaren FedRAMP-Inhalte weltweit gemeinfrei gestellt (CC0 1.0). FedRAMP® ist eine eingetragene Marke der GSA; GRCA steht in keiner Verbindung zur GSA oder zu FedRAMP und wird von ihnen nicht unterstützt. In Abschnitte aufgeteilt und in das GRCA-Format umgewandelt, der Wortlaut unverändert, mit den genannten Controls aus NIST SP 800-53 verknüpft. Maßgeblich ist allein die von FedRAMP veröffentlichte Fassung.