+FedRAMP Rules
---+AFC Addressing FedRAMP Communication
------+AFC-FRP FedRAMP Responsibilities
---------+AFC-FRP-VRE Verified Emails
---------+AFC-FRP-CDS Criticality Designators
---------+AFC-FRP-UFS Use FedRAMP_Security Email in Emergencies
---------+AFC-FRP-PNT Public Notice of Emergency Tests
---------+AFC-FRP-RQA Required Actions
---------+AFC-FRP-ERT Elevated Reaction Timeframes
---------+AFC-FRP-COR Explain Corrective Actions
---------+AFC-FRP-RPM Reaction Metrics
------+AFC-CSO General Provider Responsibilities
---------+AFC-CSO-INB Maintain a FedRAMP Security Inbox
---------+AFC-CSO-NOC Notification of Changes
---------+AFC-CSO-TFG Trust @fedramp.gov and @gsa.gov
---------+AFC-CSO-RCV Receive Email Without Disruption
---------+AFC-CSO-CRA Complete Required Actions
---------+AFC-CSO-EMR Emergency Message Routing
---------+AFC-CSO-IMA Important Message Actions
---------+AFC-CSO-ACK Acknowledge Receipt
---+AGU Agency Use of FedRAMP Certified Cloud Services
------+AGU-AGC General Agency Responsibilities
---------+AGU-AGC-AIP Agency Internal Policies
---------+AGU-AGC-NAA Notify FedRAMP After Authorization
---------+AGU-AGC-GRC Governance, Risk, and Compliance Tools
---------+AGU-AGC-NAI Notify Additional Information Requests
---------+AGU-AGC-NAR No Additional Security Requirements
---------+AGU-AGC-TPP No Certification Type or Path Preferences
---------+AGU-AGC-WKG FedRAMP Working Groups
---------+AGU-AGC-LIA Agency Liaison Program
---------+AGU-AGC-SIN Shared FedRAMP Inbox
------+AGU-USE Use of FedRAMP Certifications
---------+AGU-USE-ABU Authorization Before Use
---------+AGU-USE-RCF Resolve Certification Package Conflicts
---------+AGU-USE-RSG Review Secure Configuration Guides
---------+AGU-USE-AFR Accept FedRAMP Rules
---------+AGU-USE-NFC Notify FedRAMP of Monitoring Concerns
---------+AGU-USE-ROR Review Ongoing Certification Reports
---------+AGU-USE-DSO Designate Senior Official
---------+AGU-USE-NPC Notify Provider of Concerns
---------+AGU-USE-RIR Review All Information Resources
---------+AGU-USE-CLA Using FedRAMP Class A Certifications
------+AGU-SPN Agency Sponsored Certifications
---------+AGU-SPN-MRC Most Recent Consolidated Rules
---+CCM Collaborative Continuous Monitoring
------+CCM-AGM Agency Guidance
---------+CCM-AGM-ROR Review Ongoing Reports
---------+CCM-AGM-CSC Consider Security Category
------+CCM-OCR Ongoing Certification Reports
---------+CCM-OCR-AVL Report Availability
---------+CCM-OCR-NRD Next Report Date
---------+CCM-OCR-FBM Feedback Mechanism
---------+CCM-OCR-AFS Anonymized Feedback Summary
---------+CCM-OCR-LSI Limit Sensitive Information
---------+CCM-OCR-SOR Spread Out Reports
---------+CCM-OCR-RPS Responsible Public Certification Report Sharing
------+CCM-QTR Quarterly Reviews
---------+CCM-QTR-MTG Quarterly Review Meeting
---------+CCM-QTR-REG Meeting Registration Info
---------+CCM-QTR-NRD Next Review Date
---------+CCM-QTR-NID No Irresponsible Disclosure
---------+CCM-QTR-SAR Schedule Around Reports
---------+CCM-QTR-ACT Additional Content
---------+CCM-QTR-RTR Record/Transcribe Reviews
---------+CCM-QTR-RTP Restrict Third Parties
---------+CCM-QTR-SRR Share Recordings Responsibly
---------+CCM-QTR-SCR Share Content Responsibly
---+CDS Certification Data Sharing
------+CDS-CSO General Provider Responsibilities
---------+CDS-CSO-PUB Public Information
---------+CDS-CSO-SVC Public Service List
---------+CDS-CSO-FID Always Include FedRAMP ID
---------+CDS-CSO-FRC FedRAMP Certification Reports
---------+CDS-CSO-AVR Availability Reporting
---------+CDS-CSO-UTC Use Trust Centers
---------+CDS-CSO-CBF Consistency Between Formats
---------+CDS-CSO-RIS Responsible Information Sharing
---------+CDS-CSO-IRP Include Relevant Policies
---------+CDS-CSO-HAD Historical FedRAMP Certification Data
---------+CDS-CSO-PSM Per-Service Certification Materials
---------+CDS-CSO-RPS Responsible Public Package Sharing
------+CDS-TRC FedRAMP-Compatible Trust Centers
---------+CDS-TRC-USH Uninterrupted Sharing
---------+CDS-TRC-PAC Programmatic Access
---------+CDS-TRC-AAI Agency Access Inventory
---------+CDS-TRC-ACL Access Logging
---------+CDS-TRC-HMR Human and Machine-Readable Certification Data
---------+CDS-TRC-SSM Self-Service Access Management
------+CDS-UTC Using a Trust Center
---------+CDS-UTC-AAD Agency Access Denial
---------+CDS-UTC-AGA Agency Access
------+CDS-CSF Rev5-Specific Provider Responsibilities
---------+CDS-CSF-TCM Trust Center Migration
---+CMU Cryptographic Module Use
------+CMU-CSO Cloud Service Provider Responsibilities
---------+CMU-CSO-CMD Cryptographic Module Documentation
---------+CMU-CSO-UVM Using Validated Cryptographic Modules
---------+CMU-CSO-CAT Configuration of Agency Tenants
---+CPO Certification Package Overview
------+CPO-CSO General Provider Responsibilities
---------+CPO-CSO-OVR Overview of the Cloud Service Offering
---------+CPO-CSO-MTD Certification Package Overview Metadata
---------+CPO-CSO-OSA Overall Summary of Assessment in Certification Package
------+CPO-CSX 20x-Specific Provider Responsibilities
---------+CPO-CSX-CPM Certification Package Maintenance for 20x
------+CPO-CSF Rev5-Specific Provider Responsibilities
---------+CPO-CSF-CPM Certification Package Maintenance for Rev5
---+FRC FedRAMP Certification
------+FRC-CSO General Provider Responsibilities
---------+FRC-CSO-FCP FedRAMP Certification Profile
---------+FRC-CSO-PKG FedRAMP Certification Package
---------+FRC-CSO-JSN FedRAMP JSON Schemas
---------+FRC-CSO-MRA Maintain Responsibility and Accountability
---------+FRC-CSO-POP Pick One Program Certification Type
------+FRC-CLA FedRAMP Class A Certification Rules
---------+FRC-CLA-ASF Approved Alternative Security Frameworks
---------+FRC-CLA-EAM External Assessment Materials
---------+FRC-CLA-MFR Mandatory FedRAMP Rules for Class A
---------+FRC-CLA-RFR Recommended FedRAMP Rules for Class A
---------+FRC-CLA-OFR Address Optional FedRAMP Rules for Class A
---------+FRC-CLA-IVV Optional Independent Verification and Validation
------+FRC-APP Applying for FedRAMP Certification
---------+FRC-APP-MLF Marketplace Listing First
---------+FRC-APP-AFC Applying for FedRAMP Certification
---------+FRC-APP-FCP Fresh FedRAMP Certification Package
---------+FRC-APP-FIA Fresh Independent Assessment
---------+FRC-APP-NTP No Third-Party Applicants
---------+FRC-APP-USA Updating Stale Assessments
------+FRC-APS Applying for FedRAMP Certification with an Agency Sponsor
---------+FRC-APS-ATO Agency Authorization to Operate
------+FRC-CCL Changing Certification Class
---------+FRC-CCL-UCC Upgrading Certification Class
---------+FRC-CCL-DCC Downgrading Certification Class
---------+FRC-CCL-DNP Downgrade Notification Period
------+FRC-CSX 20x-Specific Provider Responsibilities
---------+FRC-CSX-VVK Automated Verification and Validation of Key Security Indicators
---------+FRC-CSX-VVR Automated Verification and Validation of FedRAMP Rules
---------+FRC-CSX-MAS Application within MAS
------+FRC-CSF Rev5-Specific Provider Responsibilities
---------+FRC-CSF-BSL FedRAMP Rev5 Baselines
------------+FRC-CSF-BSL FedRAMP Rev5 Baselines – Class B
------------+FRC-CSF-BSL FedRAMP Rev5 Baselines – Class C
------------+FRC-CSF-BSL FedRAMP Rev5 Baselines – Class D
---------+FRC-CSF-ACP Assign Control Parameters
---------+FRC-CSF-FFG Follow FedRAMP Rev5 Controls Guidance
---------+FRC-CSF-RDY FedRAMP Ready Conversion
---+IEC Incident Evaluation and Communication
------+IEC-FRP FedRAMP Responsibilities
---------+IEC-FRP-ORV Ongoing Review
------+IEC-CSO General Provider Responsibilities
---------+IEC-CSO-EFR Evaluate FedRAMP Reportability
---------+IEC-CSO-DPR Default PAIN Rating
---------+IEC-CSO-IIR Initial Incident Report
---------+IEC-CSO-OIR Ongoing Incident Reports
---------+IEC-CSO-FIR Final Incident Report
---------+IEC-CSO-EFI Estimate Federal Impact
---------+IEC-CSO-AIR Automated Incident Reporting
---+IVV Independent Verification and Validation
------+IVV-CSO General Provider Responsibilities
---------+IVV-CSO-FIA FedRAMP Independent Assessments
---------+IVV-CSO-SEI Supply Evidence of Implementation
---------+IVV-CSO-SEE Supply Evidence of Effectiveness
---------+IVV-CSO-ICP Inclusion in Certification Package
---------+IVV-CSO-DUS Document Use of Representative Samples
---------+IVV-CSO-STE Supply Technical Explanations
---------+IVV-CSO-USR Use Representative Samples
---------+IVV-CSO-RAA Receiving Assessor Advice
------+IVV-IAS General Independent Assessor Responsibilities
---------+IVV-IAS-VIM Verify Implementation
---------+IVV-IAS-VEF Validate Effectiveness
---------+IVV-IAS-SUM Assessment Summary
---------+IVV-IAS-OSA Overall Summary of Assessment
---------+IVV-IAS-VIP Verify Inclusion in Certification Package
---------+IVV-IAS-EPX Engage Provider Experts
---------+IVV-IAS-SHA Sharing Advice
------+IVV-CSX 20x-Specific Provider Responsibilities
---------+IVV-CSX-AIA Annual Independent Assessments for 20x
------+IVV-CSF Rev5-Specific Provider Responsibilities
---------+IVV-CSF-AIA Annual Independent Assessments for Rev5
------------+IVV-CSF-AIA Annual Independent Assessments for Rev5 – Class B
------------+IVV-CSF-AIA Annual Independent Assessments for Rev5 – Class C
------------+IVV-CSF-AIA Annual Independent Assessments for Rev5 – Class D
---------+IVV-CSF-MCA Mandatory Control Assessment
---------+IVV-CSF-ACF Assessment of Rev5 Controls with Findings
---------+IVV-CSF-PCA Preferred Control Assessment
---+MAS Minimum Assessment Scope
------+MAS-CSO General Provider Responsibilities
---------+MAS-CSO-IIR Identify Information Resources
---------+MAS-CSO-FLO Information Flows and Security Categories
---------+MAS-CSO-TPR Third-Party Information Resources
---------+MAS-CSO-MDI Metadata Inclusion
---------+MAS-CSO-SUP Supplemental Information
---+MKT Marketplace Listing
------+MKT-FRP FedRAMP Responsibilities
---------+MKT-FRP-SOF Scope of FedRAMP
------+MKT-CSO General Provider Responsibilities
---------+MKT-CSO-MLR Marketplace Listing Requirements
---------+MKT-CSO-PML Provider Marketplace Listing Requests
------+MKT-IAS General Assessor Responsibilities
---------+MKT-IAS-OFR Only FedRAMP Recognized Assessors
---------+MKT-IAS-WEB Website Requirements for Assessors
---------+MKT-IAS-LRQ Listing Requests for Assessors
------+MKT-CAS General Advisor Responsibilities
---------+MKT-CAS-WEB Website Requirements for Advisors
---------+MKT-CAS-LRQ Listing Requests for Advisors
---------+MKT-CAS-RFR Advisor Responses to FedRAMP
------+MKT-IIP Provider Responsibilities for Initial Implementation Phase Listings
---------+MKT-IIP-AGU Agency Use Cases
---------+MKT-IIP-DCP Demonstrating Continuous Progress
---------+MKT-IIP-DLA Deadline for Assessment
---+REC FedRAMP Recognition of Independent Assessment Services
------+REC-FRP FedRAMP Responsibilities
---------+REC-FRP-FOC Foreign Ownership Collection
---------+REC-FRP-RAO Recognized Assessors Only
---------+REC-FRP-DRD Double Revocation Disqualification
------+REC-IAS General Independent Assessor Responsibilities
---------+REC-IAS-ACC A2LA Accreditation
---------+REC-IAS-ADA Actually Do Assessments
---------+REC-IAS-PSC Policy and Standards Compliance
---------+REC-IAS-ANR Annual Surveillance Assessment
---------+REC-IAS-RAS Full A2LA Reassessment
---------+REC-IAS-RAR Re-entry after Revocation
---------+REC-IAS-RQU Roles and Qualifications
---------+REC-IAS-AFI Annual Foreign Interest Reports
---------+REC-IAS-CFI Changes in Foreign Interest
---------+REC-IAS-PST Performance Standards
---------+REC-IAS-CAP Corrective Action Plan
---------+REC-IAS-INV Invalid Deliverables
---------+REC-IAS-SEP Advisory Separation
---+SCG Secure Configuration Guide
------+SCG-CSO General Provider Responsibilities
---------+SCG-CSO-RSC Recommended Secure Configuration
---------+SCG-CSO-AUP Use Instructions
---------+SCG-CSO-PUB Public Secure Configuration Guidance
---------+SCG-CSO-SDF Secure Defaults
------+SCG-ENH Enhanced Capabilities
---------+SCG-ENH-CMP Comparison Capability
---------+SCG-ENH-EXP Export Capability
---------+SCG-ENH-API API Capability
---------+SCG-ENH-MRG Machine-Readable Guidance
---------+SCG-ENH-VRH Versioning and Release History
---+SCN Significant Change Notification
------+SCN-FRP FedRAMP Responsibilities
---------+SCN-FRP-CAP Corrective Action Plan Conditions
------+SCN-CSO General Provider Responsibilities
---------+SCN-CSO-EVA Evaluate Changes
---------+SCN-CSO-MAR Maintain Audit Records
---------+SCN-CSO-INF Required Information
---------+SCN-CSO-HIS Historical Notifications
---------+SCN-CSO-HRM Human and Machine-Readable Notifications
---------+SCN-CSO-ARI Additional Relevant Information
---------+SCN-CSO-NOM Notification Mechanisms
---------+SCN-CSO-EMG Emergency Changes
------+SCN-ADP Adaptive Changes
---------+SCN-ADP-NTF Notification Requirements
------+SCN-RTR Routine Recurring Changes
---------+SCN-RTR-NNR No Notification Requirements
------+SCN-TRF Transformative Changes
---------+SCN-TRF-NIP Notification of Initial Plans
---------+SCN-TRF-NFP Notification of Final Plans
---------+SCN-TRF-NAF Notification After Finishing
---------+SCN-TRF-NAV Notification After Verification
---------+SCN-TRF-UPD Update Documentation
---------+SCN-TRF-TPR Third-Party Review
---+SDR Security Decision Record
------+SDR-CSO General Provider Responsibilities
---------+SDR-CSO-FRR FedRAMP Rules
---------+SDR-CSO-MTD Security Decision Record Metadata
------+SDR-CSX 20x-Specific Provider Responsibilities
---------+SDR-CSX-KSI Key Security Indicators
---------+SDR-CSX-KMT Key Security Indicator Metrics
------+SDR-CSF Rev5-Specific Provider Responsibilities
---------+SDR-CSF-CTF Rev5 Controls
---+VDR Vulnerability Detection and Response
------+VDR-CSO General Provider Responsibilities
---------+VDR-CSO-DET Vulnerability Detection
---------+VDR-CSO-RES Vulnerability Response
---------+VDR-CSO-FAV Failures Are Vulnerabilities
---------+VDR-CSO-DFR Design For Resilience
---------+VDR-CSO-ADT Automate Detection
---------+VDR-CSO-DAC Detect After Changes
---------+VDR-CSO-MSP Maintain Security
---------+VDR-CSO-AKE Avoid KEVs
---------+VDR-CSO-SIR Sampling
------+VDR-TFR Timeframes
---------+VDR-TFR-NMV Non-Machine Verification and Validation
---------+VDR-TFR-PDD Persistent Drift Detection
---------+VDR-TFR-PCD Persistently Complete Detection
---------+VDR-TFR-PVR Mitigation and Remediation Expectations
---------+VDR-TFR-RMN Remaining Vulnerabilities
---------+VDR-TFR-KEV Remediate KEVs
---------+VDR-TFR-PSD Persistent Sample Detection
---------+VDR-TFR-MVX Persistent Machine Verification and Validation for 20x
---------+VDR-TFR-MVF Persistent Machine Verification and Validation for Rev5
---+VER Vulnerability Evaluation and Reporting
------+VER-FRP FedRAMP Responsibilities
---------+VER-FRP-ARP Additional Requirements
---------+VER-FRP-ADV Sensitive Details
------+VER-AGM Agency Guidance
---------+VER-AGM-RVR Review Vulnerability Reports
---------+VER-AGM-MAP Maintain Agency Plans of Action and Milestones
------+VER-EVA Evaluation
---------+VER-EVA-ELX Evaluate Exploitability
---------+VER-EVA-EIR Evaluate Internet-Reachability
---------+VER-EVA-EPA Estimate Potential Agency Impact
---------+VER-EVA-AIA Assume It's Automatable
---------+VER-EVA-GRV Group Vulnerabilities
---------+VER-EVA-EFP Evaluate False Positives
---------+VER-EVA-EFA Evaluation Factors
------+VER-RPT Reporting
---------+VER-RPT-PER Persistent Reporting
---------+VER-RPT-VDT Vulnerability Details
---------+VER-RPT-AVI Accepted Vulnerability Info
---------+VER-RPT-NID Responsible Disclosure
---------+VER-RPT-HLO High-Level Overviews
---------+VER-RPT-RPD Responsible Public Disclosure
------+VER-TFR Timeframes
---------+VER-TFR-MHR Monthly Activity Report
---------+VER-TFR-MAV Mark Accepted Vulnerabilities
---------+VER-TFR-MRH Historical Activity
---------+VER-TFR-EVU Evaluate Vulnerabilities Quickly
---------+VER-TFR-IRI Internet-Reachable Incidents
---------+VER-TFR-NRI Non-Internet-Reachable Incidents

FedRAMP Rules

The process rules of FedRAMP: requirements and recommendations.

1. Prehľad

AFC Addressing FedRAMP Communication

The Addressing FedRAMP Communication rules (formerly FedRAMP Security Inbox) ensure FedRAMP can reliably contact the security and compliance staff responsible for every FedRAMP-authorized cloud service offering. These rules also set expectations for urgent communications, response time testing, and routing important messages separately from general support or customer service channels.

Effective

  • Status: required
  • Current status: Consolidated Rules for 2026
  • Required for initial certification from: 2026-01-05
  • Required for ongoing certification from: 2026-01-05
  • Grace period ends: 2026-07-01
AGU Agency Use of FedRAMP Certified Cloud Services

The Agency Use rules summarize the many demands made on agencies by the FedRAMP Authorization Act and OMB Memorandum M-24-15 in a simple, clear, easy-to-follow set of FedRAMP-style rules. These rules align agency policies, authorization letters, machine-readable tools, secure configuration review, continuous monitoring, and communication with FedRAMP so certifications can be reused consistently across government.

Effective

  • Status: required
  • Current status: Consolidated Rules for 2026
  • Optional adoption from: 2026-07-04
  • Required for initial certification from: 2026-07-04
  • Required for ongoing certification from: 2026-07-04
  • Grace period ends: 2026-07-04
CCM Collaborative Continuous Monitoring

The Collaborative Continuous Monitoring rules help agencies use shared, current authorization information from providers as part of each agency's own Information Security Continuous Monitoring strategy. These rules reduce unnecessary manual burden by encouraging automated monitoring and review while allowing each agency to make its own risk-based decisions about ongoing authorization.

Effective for 20x

  • Status: required
  • Current status: Consolidated Rules for 2026
  • Optional adoption from: 2026-07-04
  • Required for initial certification from: 2026-07-04
  • Required for ongoing certification from: 2027-01-01
  • Grace period ends: 2027-01-01 or at the next assessment

Effective for Rev5

  • Status: required
  • Current status: Consolidated Rules for 2026
  • Optional adoption from: 2026-07-04
  • Required for initial certification from: 2027-01-01
  • Required for ongoing certification from: 2027-04-02
  • Grace period ends: 2027-10-01
CDS Certification Data Sharing

The Certification Data Sharing rules allow providers to store and share FedRAMP Certification Data through the platform they choose as long as it follows FedRAMP rules for access, accuracy, and transparency. This helps customers and the public review consistent, current security and compliance information while recognizing that the information usually remains the provider's intellectual property and is not federal information.

Effective for 20x

  • Status: required
  • Current status: Consolidated Rules for 2026
  • Optional adoption from: 2026-07-04
  • Required for initial certification from: 2026-07-04
  • Required for ongoing certification from: 2027-01-01
  • Grace period ends: 2027-01-01 or at the next assessment

Effective for Rev5

  • Status: required
  • Current status: Consolidated Rules for 2026
  • Optional adoption from: 2026-07-04
  • Required for initial certification from: 2027-01-01
  • Required for ongoing certification from: 2027-08-01
  • Grace period ends: 2028-02-01
CMU Cryptographic Module Use

The Cryptographic Module Use rules clarify how providers should select and use cryptographic modules. These rules allow risk-based decisions for some services while still encouraging validated cryptographic modules whenever they are technically feasible and reasonable.

Effective for 20x

  • Status: required
  • Current status: Consolidated Rules for 2026
  • Optional adoption from: 2026-07-04
  • Required for initial certification from: 2026-07-04
  • Required for ongoing certification from: 2027-01-01
  • Grace period ends: 2027-01-01 or at the next assessment

Effective for Rev5

  • Status: required
  • Current status: Consolidated Rules for 2026
  • Optional adoption from: 2026-07-04
  • Required for initial certification from: 2027-01-01
  • Required for ongoing certification from: 2027-01-01
  • Grace period ends: 2027-06-01
CPO Certification Package Overview

The Certification Package Overview rules outline the expectations for a simple overview of the cloud service offering that must be included within a FedRAMP Certification Package. This overview replaces the historically required base System Security Plan for FedRAMP Rev5 and is intended to provide a clear, concise, and consistent summary of the offering and the information included in the package to help customers understand the offering at a high level.

Effective for 20x

  • Status: required
  • Current status: Consolidated Rules for 2026
  • Optional adoption from: 2026-07-04
  • Required for initial certification from: 2026-07-04
  • Required for ongoing certification from: 2027-01-01
  • Grace period ends: 2027-01-01 or at the next assessment

Effective for Rev5

  • Status: required
  • Current status: Consolidated Rules for 2026
  • Optional adoption from: 2026-07-04
  • Required for initial certification from: 2027-01-01
  • Required for ongoing certification from: 2027-07-01
  • Grace period ends: 2027-07-01 or at the next assessment
FRC FedRAMP Certification

This ruleset explains how cloud service offerings obtain and maintain FedRAMP Certification across certification classes and paths.

Effective for 20x

  • Status: required
  • Current status: Consolidated Rules for 2026
  • Optional adoption from: 2026-07-04
  • Required for initial certification from: 2026-07-04
  • Required for ongoing certification from: 2027-01-01
  • Grace period ends: 2027-01-01 or at the next assessment

Effective for Rev5

  • Status: required
  • Current status: Consolidated Rules for 2026
  • Optional adoption from: 2026-07-04
  • Required for initial certification from: 2027-01-01
  • Required for ongoing certification from: 2027-01-01
  • Grace period ends: 2027-01-01 or at the next assessment
IEC Incident Evaluation and Communication

The Incident Evaluation and Communication rules explain how providers must communicate incident information to FedRAMP and government customers when they are affected by an incident or likely to be affected by an incident.

Effective for 20x

  • Status: required
  • Current status: Consolidated Rules for 2026
  • Optional adoption from: 2026-07-04
  • Required for initial certification from: 2026-07-04
  • Required for ongoing certification from: 2027-01-01
  • Grace period ends: 2027-01-01 or at the next assessment

Effective for Rev5

  • Status: required
  • Current status: Consolidated Rules for 2026
  • Optional adoption from: 2026-07-04
  • Required for initial certification from: 2027-01-01
  • Required for ongoing certification from: 2027-01-01
  • Grace period ends: 2027-06-01
IVV Independent Verification and Validation

This ruleset explains the expectations for independent verification and validation assessments.

Effective for 20x

  • Status: required
  • Current status: Consolidated Rules for 2026
  • Optional adoption from: 2026-07-04
  • Required for initial certification from: 2026-07-04
  • Required for ongoing certification from: 2027-01-01
  • Grace period ends: 2027-01-01 or at the next assessment

Effective for Rev5

  • Status: required
  • Current status: Consolidated Rules for 2026
  • Optional adoption from: 2026-07-04
  • Required for initial certification from: 2027-01-01
  • Required for ongoing certification from: 2027-01-01
  • Grace period ends: 2027-01-01 or at the next assessment
MAS Minimum Assessment Scope

The Minimum Assessment Scope rules help providers define assessment boundaries narrowly enough to avoid unnecessary review of components that do not affect the offering's security. These rules still ensure the assessment includes the resources and connections needed to understand the offering's confidentiality, integrity, and availability.

Effective for 20x

  • Status: required
  • Current status: Consolidated Rules for 2026
  • Optional adoption from: 2026-07-04
  • Required for initial certification from: 2026-07-04
  • Required for ongoing certification from: 2027-01-01
  • Grace period ends: 2027-01-01 or at the next assessment

Effective for Rev5

  • Status: required
  • Current status: Consolidated Rules for 2026
  • Optional adoption from: 2026-07-04
  • Required for initial certification from: 2027-01-01
  • Required for ongoing certification from: 2027-01-01
  • Grace period ends: 2027-01-01 or at the next assessment
MKT Marketplace Listing

The Marketplace Listing rules define how FedRAMP decides which cloud service offerings, assessors, and advisors may be listed in the FedRAMP Marketplace. These rules help agencies and other customers rely on the Marketplace as a consistent source of eligible services and supporting organizations, while requiring listed organizations to supply accurate, accessible, and machine-readable information.

Effective

  • Status: required
  • Current status: Consolidated Rules for 2026
  • Optional adoption from: 2026-07-04
  • Required for initial certification from: 2026-07-04
  • Required for ongoing certification from: 2026-07-04
  • Grace period ends: 2026-07-04
REC FedRAMP Recognition of Independent Assessment Services

The FedRAMP Recognition of independent assessment services rules explain the requirements for assessors to obtain and maintain FedRAMP Recognition in order to support the FedRAMP Certification process.

Effective

  • Status: required
  • Current status: Consolidated Rules for 2026
  • Optional adoption from: 2026-07-04
  • Required for initial certification from: 2026-07-04
  • Required for ongoing certification from: 2026-07-04
  • Grace period ends: 2026-07-04
SCG Secure Configuration Guide

The Secure Configuration Guide rules help agencies and other customers understand how to configure a cloud service offering securely. These rules require providers to clearly explain the security impact of common settings so customers can make informed configuration choices.

Effective

  • Status: required
  • Current status: Consolidated Rules for 2026
  • Required for initial certification from: 2026-03-01
  • Required for ongoing certification from: 2026-03-01
  • Grace period ends: 2026-07-01
SCN Significant Change Notification

The Significant Change Notification rules supply a simple framework allowing providers to make significant changes to their own products while keeping agency customers in the loop. These rules organize significant changes into clear categories so agencies can understand the expected risk and make authorization decisions accordingly.

Effective for 20x

  • Status: required
  • Current status: Consolidated Rules for 2026
  • Optional adoption from: 2026-07-04
  • Required for initial certification from: 2026-07-04
  • Required for ongoing certification from: 2027-01-01
  • Grace period ends: 2027-01-01 or at the next assessment

Effective for Rev5

  • Status: required
  • Current status: Consolidated Rules for 2026
  • Optional adoption from: 2026-07-04
  • Required for initial certification from: 2027-01-01
  • Required for ongoing certification from: 2027-01-01
  • Grace period ends: 2027-06-01
SDR Security Decision Record

The Security Decision Record replaced a traditional System Security Plan with a persistently maintained, verified, and validated record of the security decisions made by the cloud service provider over the lifecycle of their cloud service offering.

Effective for 20x

  • Status: required
  • Current status: Consolidated Rules for 2026
  • Optional adoption from: 2026-07-04
  • Required for initial certification from: 2026-07-04
  • Required for ongoing certification from: 2027-01-01
  • Grace period ends: 2027-01-01 or at the next assessment

Effective for Rev5

  • Status: required
  • Current status: Consolidated Rules for 2026
  • Optional adoption from: 2026-07-04
  • Required for initial certification from: 2027-01-01
  • Required for ongoing certification from: 2027-08-01
  • Grace period ends: 2027-08-01 or at the next assessment
VDR Vulnerability Detection and Response

The Vulnerability Detection and Response rules require providers to continuously identify, analyze, prioritize, mitigate, and remediate vulnerabilities and related exposures through automated systems. These rules give providers flexibility in implementation while ensuring agencies receive the information needed to support ongoing authorization decisions.

Effective

  • Status: required
  • Current status: Mandated by CISA BOD 26-04
  • Optional adoption from: 2026-07-04
  • Required for initial certification from: 2026-12-07
  • Required for ongoing certification from: 2026-12-07
  • Grace period ends: 2027-03-07
VER Vulnerability Evaluation and Reporting

The Vulnerability Evaluation and Reporting rules require cloud service providers to determine when vulnerabilities are likely to impact federal customers and report the status of such vulnerabilities to all necessary parties.

Effective

  • Status: required
  • Current status: Mandated by CISA BOD 26-04
  • Optional adoption from: 2026-07-04
  • Required for initial certification from: 2026-12-07
  • Required for ongoing certification from: 2026-12-07
  • Grace period ends: 2027-03-07

1.1 Odkazy

1.2 Identifikované požiadavky

1.3 Súvisiace predpisy

2. Identifikované požiadavky

Požiadavky

3. Súvisiace predpisy

Predpisy
  • FedRAMP Consolidated Rules -

    EN: FedRAMP® Consolidated Rules of the Federal Risk and Authorization Management Program, U.S. General Services Administration (GSA), https://www.fedramp.gov/, from their machine-readable version (FedRAMP/rules). Works of the U.S. Government are not subject to copyright protection in the United States (17 U.S.C. § 105; GSA website policies); GSA dedicated its machine-readable FedRAMP content to the public domain worldwide (CC0 1.0). FedRAMP® is a registered trademark of GSA; GRCA is not affiliated with, nor endorsed by, GSA or FedRAMP. Divided into sections and converted into the GRCA format, the wording unchanged, linked to the NIST SP 800-53 controls they name. Only the version published by FedRAMP is authoritative.

    DE: FedRAMP® Consolidated Rules des Federal Risk and Authorization Management Program, U.S. General Services Administration (GSA), https://www.fedramp.gov/, aus ihrer maschinenlesbaren Fassung (FedRAMP/rules). Werke der US-Regierung sind in den USA urheberrechtlich nicht geschützt (17 U.S.C. § 105; Website-Richtlinien der GSA); die GSA hat ihre maschinenlesbaren FedRAMP-Inhalte weltweit gemeinfrei gestellt (CC0 1.0). FedRAMP® ist eine eingetragene Marke der GSA; GRCA steht in keiner Verbindung zur GSA oder zu FedRAMP und wird von ihnen nicht unterstützt. In Abschnitte aufgeteilt und in das GRCA-Format umgewandelt, der Wortlaut unverändert, mit den genannten Controls aus NIST SP 800-53 verknüpft. Maßgeblich ist allein die von FedRAMP veröffentlichte Fassung.