@sagentix-inc/evidence-collector 0.3.0 → 0.3.2

package/apps/sos-app/src/data/fedramp_rules.json

@@ -1 +1 @@
-{"info":{"title":"FedRAMP Consolidated Rules for 2026","version":"2026.10.13.01","last_updated":"2026-10-13"},"defaultArtifacts":{"FRR":["Explanation of how the rule is followed, or an explanation of the reason and resulting risk to customers for not following the rule.","Verification that the implementation is appropriate for the rule, or that the reason for not implementing is accepted by a senior official.","Validation that the implementation is in place and working as intended, or that the reason for not implementing is accepted by a senior official.","Independent verification.","Independent validation."],"KSI":["Explanation of measures (and their objectives) that demonstrate the Key Security Indicator, or an explanation of the reason and resulting risk to customers for not having measures available for that Key Security Indicator.","Explanation of the cycle for any measures that are implemented persistently (if applicable).","Verification that the measures demonstrate the Key Security Indicator, or that the reason for not having them is accepted.","Verification that the automation in place is accurate and sufficient to demonstrate appropriate measures for the Key Security Indicator, or that automation is not necessary for each measure.","Validation that the measures are accurately produced and are in place and working as intended, or that the reason for not having them is valid."]},"themes":{"CED":{"id":"KSI-CED","name":"Cybersecurity Education","status":"stable"},"CMT":{"id":"KSI-CMT","name":"Change Management","status":"stable"},"CNA":{"id":"KSI-CNA","name":"Cloud Native Architecture","status":"stable"},"IAM":{"id":"KSI-IAM","name":"Identity and Access Management","status":"stable"},"INR":{"id":"KSI-INR","name":"Incident Response","status":"stable"},"MLA":{"id":"KSI-MLA","name":"Monitoring, Logging, and Auditing","status":"stable"},"PIY":{"id":"KSI-PIY","name":"Policy and Inventory","status":"stable"},"RPL":{"id":"KSI-RPL","name":"Recovery Planning","status":"stable"},"SCR":{"id":"KSI-SCR","name":"Supply Chain Risk","status":"stable"},"SVC":{"id":"KSI-SVC","name":"Service Configuration","status":"stable"}},"ksis":[{"id":"KSI-CED-RAT","theme":"CED","name":"Reviewing All Training","controls":["at-2","at-2.2","at-2.3","at-3","at-3.5","at-4","cm-11","cp-3","cp-3.1","ir-2","ir-2.1","ir-2.2","ir-2.3","ir-9.2","ir-9.4","pl-4","pl-4.1","ps-6","sr-11.1"],"updated":"2026-10-13","statement":"The effectiveness of relevant cybersecurity education and training is persistently reviewed, including at least general training for all employees, role-specific training for employees in high risk roles, training for development and engineering staff on secure software delivery, and training for staff involved with incident response or disaster recovery."},{"id":"KSI-CMT-LMC","theme":"CMT","name":"Logging Changes","controls":["au-2","ca-7.4","cm-3","cm-3.1","cm-3.2","cm-3.6","cm-4.2","cm-6","cm-8.3"],"updated":"2026-10-13","statement":"Modifications to the cloud service offering are logged and monitored."},{"id":"KSI-CMT-RMV","theme":"CMT","name":"Redeploying vs Modifying","controls":["cm-2","cm-3","cm-5","cm-6","cm-7","cm-8.1","si-3"],"updated":"2026-06-24","statement":"Changes to machine-based information resources are executed through the redeployment of version controlled resources rather than direct modification wherever reasonable."},{"id":"KSI-CMT-RVP","theme":"CMT","name":"Reviewing Change Procedures","controls":["cm-3","cm-3.2","cm-3.4","cm-5","cm-7.1","cm-9"],"updated":"2026-06-24","statement":"The effectiveness of documented change management procedures is persistently reviewed."},{"id":"KSI-CMT-VTD","theme":"CMT","name":"Validating Throughout Deployment","controls":["cm-3","cm-3.2","cm-4.2","cm-6.2","ir-9.4","si-2"],"updated":"2026-10-13","statement":"Persistent testing and validation of changes throughout deployment is automated."},{"id":"KSI-CNA-DFP","theme":"CNA","name":"Defining Functionality and Privileges","controls":["cm-2","cm-8.4","cp-10.4","ir-9.4","si-3"],"updated":"2026-10-13","statement":"The functionality and privileges for infrastructure and services are strictly defined."},{"id":"KSI-CNA-EIS","theme":"CNA","name":"Enforcing Intended State","controls":["ca-2.1","cm-11","cm-6.2","cp-10.4","ir-9.4","sc-24","sc-7.18","si-4.22","si-7","si-7.1","si-7.5","si-7.7"],"updated":"2026-10-13","byClass":{"b":"**Optional:** Automated services are used to persistently assess the security of all machine-based information resources and automatically enforce their intended operational state.","c":"Automated services are used to persistently assess the security of all machine-based information resources and automatically enforce their intended operational state."}},{"id":"KSI-CNA-IBP","theme":"CNA","name":"Implementing Best Practices","controls":["ac-17.3","cm-2","pl-10","sc-7.18"],"updated":"2026-10-13","statement":"The use and configuration of third-party machine-based information resources is persistently compared against the original provider's best practices and guidance."},{"id":"KSI-CNA-MAT","theme":"CNA","name":"Minimizing Attack Surface","controls":["ac-17.3","ac-18.1","ac-18.3","ac-20.1","ca-9","sc-10","sc-7.18","sc-7.3","sc-7.4","sc-7.5","sc-7.8","sc-8","si-10","si-11","si-16"],"updated":"2026-10-13","statement":"Machine-based information resources are persistently reviewed to ensure they have a minimal attack surface and that lateral movement is minimized if compromised."},{"id":"KSI-CNA-OFA","theme":"CNA","name":"Optimizing for Availability","controls":["cp-2.5","sc-12.1"],"updated":"2026-10-13","statement":"Machine-based information resources are persistently reviewed to ensure they are appropriately optimized for high availability and rapid recovery."},{"id":"KSI-CNA-RNT","theme":"CNA","name":"Restricting Network Traffic","controls":["ac-17.3","ca-9","cm-7.1","sc-7.10","sc-7.18","sc-7.20","sc-7.21","sc-7.5","si-10","si-4.11","si-4.18","si-4.4","si-8"],"updated":"2026-10-13","statement":"Machine-based information resources are persistently reviewed to ensure they are appropriately configured to limit inbound and outbound network traffic."},{"id":"KSI-CNA-RVP","theme":"CNA","name":"Reviewing Protections","controls":["ir-4.2","sc-5","sc-7.18","si-8","si-8.2"],"updated":"2026-10-13","statement":"The effectiveness of protection against denial of service attacks and other unwanted activity for machine-based information resources is persistently reviewed."},{"id":"KSI-CNA-ULN","theme":"CNA","name":"Using Logical Networking","controls":["ac-12","ac-17.3","ac-4.21","ca-9","cm-11","sc-10","sc-4","sc-7","sc-7.20","sc-7.21","sc-7.7","sc-8"],"updated":"2026-10-13","statement":"Logical networking and related capabilities are used and persistently reviewed to enforce traffic flow controls."},{"id":"KSI-IAM-AAM","theme":"IAM","name":"Automating Account Management","controls":["ac-2.13","ac-2.2","ac-2.3","ac-6.7","ia-12","ia-12.2","ia-12.3","ia-12.5","ia-4.4","ia-8.4"],"updated":"2026-10-13","statement":"The lifecycle and privileges of all accounts, roles, and groups are securely managed using automation."},{"id":"KSI-IAM-APM","theme":"IAM","name":"Adopting Passwordless Methods","controls":["ac-2","ac-3","ia-2","ia-2.1","ia-2.2","ia-2.6","ia-2.8","ia-5","ia-5.1","ia-5.2","ia-5.6","ia-5.8","ia-6","ia-8","ia-8.2","ia-8.4","sc-23"],"updated":"2026-10-13","statement":"Secure passwordless methods are used for user authentication and authorization when feasible, otherwise strong passwords with phishing-resistant MFA is used."},{"id":"KSI-IAM-ELP","theme":"IAM","name":"Ensuring Least Privilege","controls":["ac-12","ac-14","ac-17","ac-17.1","ac-17.2","ac-17.3","ac-18.4","ac-2.11","ac-2.5","ac-2.6","ac-2.7","ac-2.9","ac-20","ac-20.1","ac-21","ac-3","ac-4","ac-6","ac-6.3","ac-6.8","au-12.3","au-6.7","cm-2.7","cm-5.1","cm-5.5","cm-7.2","cm-9","ia-11","ia-2","ia-3","ia-4","ia-4.4","ia-5.2","ia-5.6","ir-4.6","ir-9.4","ps-2","ps-3","ps-4","ps-5","ps-6","ra-5.5","sc-2","sc-20","sc-21","sc-22","sc-23","sc-3","sc-39","sc-4","si-3","si-4.19"],"updated":"2026-10-13","statement":"Identity and access management measures are used and persistently reviewed to ensure each user or device can only access the resources they need."},{"id":"KSI-IAM-JIT","theme":"IAM","name":"Authorizing Just-in-Time","controls":["ac-17","ac-17.4","ac-2","ac-2.1","ac-2.11","ac-2.2","ac-2.3","ac-2.4","ac-2.6","ac-2.7","ac-20.1","ac-21","ac-3","ac-4","ac-5","ac-6","ac-6.1","ac-6.10","ac-6.2","ac-6.3","ac-6.5","ac-6.7","ac-6.8","ac-6.9","ac-7","au-10","au-12.3","au-9.4","ca-3.6","cm-5","cm-5.1","cm-5.5","cm-7","cm-7.2","cm-7.5","cm-9","ia-4","ia-4.4","ia-7","ir-4.6","ps-2","ps-3","ps-4","ps-5","ps-6","ps-9","ra-5.5","sc-2","sc-23","sc-3","sc-39"],"updated":"2026-10-13","statement":"A least-privileged, role and attribute-based, and just-in-time security authorization model is used and persistently reviewed for all user and non-user accounts and services."},{"id":"KSI-IAM-SNU","theme":"IAM","name":"Securing Non-User Authentication","controls":["ac-2","ac-2.2","ac-2.9","ac-4","ac-6.5","au-10","ia-2.5","ia-3","ia-5.2","ra-5.5"],"updated":"2026-10-13","statement":"Appropriately secure authentication methods are used and persistently reviewed for non-user accounts and services."},{"id":"KSI-IAM-SUS","theme":"IAM","name":"Responding to Suspicious Activity","controls":["ac-2","ac-2.1","ac-2.11","ac-2.12","ac-2.13","ac-2.3","ac-7","au-6.5","cm-5.1","cm-6.2","ir-4.2","ir-4.6","ps-4","ps-8","si-4","si-4.1","si-4.19","si-4.20","si-4.22","si-4.4"],"updated":"2026-10-13","statement":"Accounts with privileged access are disabled or otherwise secured in response to suspicious activity."},{"id":"KSI-INR-AAR","theme":"INR","name":"Generating After Action Reports","controls":["ir-3","ir-4","ir-4.1","ir-5.1","ir-8","ir-9.3"],"updated":"2026-10-13","statement":"Incident after action reports are generated and lessons learned are persistently incorporated."},{"id":"KSI-INR-RIR","theme":"INR","name":"Reviewing Incident Response Procedures","controls":["ir-4","ir-4.1","ir-4.11","ir-6","ir-6.1","ir-6.3","ir-7","ir-7.1","ir-8","ir-8.1","ir-9.3","si-4.5"],"updated":"2026-10-13","statement":"The effectiveness of documented incident response procedures is persistently reviewed."},{"id":"KSI-INR-RPI","theme":"INR","name":"Reviewing Past Incidents","controls":["ir-3","ir-4","ir-4.1","ir-4.11","ir-4.4","ir-5","ir-5.1","ir-8","ra-5.8"],"updated":"2026-10-13","statement":"Past incidents are persistently reviewed for patterns or vulnerabilities that were not previously apparent or identified."},{"id":"KSI-MLA-ALA","theme":"MLA","name":"Authorizing Log Access","controls":["au-12.3","au-6.7","si-11"],"updated":"2026-10-13","byClass":{"b":"**Optional:** A least-privileged, role and attribute-based, and just-in-time access authorization model is used and persistently reviewed for access to log data based on organizationally defined data sensitivity.","c":"A least-privileged, role and attribute-based, and just-in-time access authorization model is used and persistently reviewed for access to log data based on organizationally defined data sensitivity."}},{"id":"KSI-MLA-EVC","theme":"MLA","name":"Evaluating Configurations","controls":["ac-19","ca-7","cm-2","cm-6","cm-6.1","ra-3","si-7.7"],"updated":"2026-10-13","statement":"The configuration of machine-based information resources, especially infrastructure as code, is persistently evaluated and tested."},{"id":"KSI-MLA-LET","theme":"MLA","name":"Logging Event Types","controls":["ac-17.1","ac-2.4","ac-20.1","ac-6.9","au-10","au-12","au-2","au-7","au-7.1","cm-5.1","ir-9.4","si-4.19","si-4.20","si-4.4","si-4.5","si-7.7"],"updated":"2026-10-13","statement":"A list of information resources and event types that will be logged, monitored, and audited is maintained and persistently reviewed to ensure these activities occur."},{"id":"KSI-MLA-OSM","theme":"MLA","name":"Operating SIEM Capability","controls":["ac-17.1","ac-20.1","au-11","au-12.1","au-2","au-3","au-3.1","au-4","au-5","au-5.1","au-6.1","au-6.3","au-6.4","au-6.5","au-7","au-7.1","au-8","au-9","ir-4.1","si-4.16","si-4.2","si-4.4"],"updated":"2026-10-13","statement":"A Security Information and Event Management (SIEM) or similar system(s) is used and persistently reviewed for centralized, tamper-resistant logging of events, activities, and changes."},{"id":"KSI-MLA-RVL","theme":"MLA","name":"Reviewing Logs","controls":["ac-2.4","ac-6.9","au-2","au-6","au-6.1","au-7","ra-5.8","si-4","si-4.19","si-4.4"],"updated":"2026-10-13","statement":"Logs are persistently reviewed and audited."},{"id":"KSI-PIY-GIV","theme":"PIY","name":"Generating Inventories","controls":["cm-12","cm-12.1","cm-2.2","cm-7.5","cm-8","cm-8.1","cm-8.2","cm-8.4","cp-2.8"],"updated":"2026-10-13","statement":"Authoritative sources are used to automatically generate real-time inventories of all information resources when needed."},{"id":"KSI-PIY-RES","theme":"PIY","name":"Reviewing Executive Support","controls":[],"updated":"2026-06-24","statement":"Executive support for achieving the provider's security goals is persistently reviewed and demonstrated."},{"id":"KSI-PIY-RIS","theme":"PIY","name":"Reviewing Investments in Security","controls":["ac-5","ca-2","ca-2.2","cp-2.1","cp-4.1","ir-3.2","ir-4.11","pm-3","sa-2","sa-3","sr-2.1"],"updated":"2026-10-13","statement":"The effectiveness of the provider's investments in achieving security goals is persistently reviewed."},{"id":"KSI-PIY-RSD","theme":"PIY","name":"Reviewing Security in the SDLC","controls":["ac-5","au-3.3","cm-3.4","ia-5.7","pl-8","pm-7","ra-9","sa-3","sa-8","sc-18","sc-4","si-10","si-11","si-16"],"updated":"2026-10-13","statement":"The effectiveness of building security and privacy considerations into the Software Development Lifecycle and aligning with CISA Secure By Design principles is persistently reviewed."},{"id":"KSI-PIY-RVD","theme":"PIY","name":"Reviewing Vulnerability Disclosures","controls":["ra-5.11"],"updated":"2026-06-24","statement":"The effectiveness of the provider's vulnerability disclosure program is persistently reviewed."},{"id":"KSI-RPL-ABO","theme":"RPL","name":"Aligning Backups with Objectives","controls":["cm-2.3","cp-10","cp-10.2","cp-6","cp-9"],"updated":"2026-10-13","statement":"The alignment of machine-based information resource backups with defined recovery objectives is persistently reviewed."},{"id":"KSI-RPL-ARP","theme":"RPL","name":"Aligning Recovery Plan","controls":["cp-10","cp-10.2","cp-2","cp-2.1","cp-2.3","cp-4.1","cp-6","cp-6.1","cp-6.3","cp-7","cp-7.1","cp-7.2","cp-7.3","cp-8","cp-8.1","cp-8.2"],"updated":"2026-06-24","statement":"The alignment of recovery plans with defined recovery objectives is persistently reviewed."},{"id":"KSI-RPL-RRO","theme":"RPL","name":"Reviewing Recovery Objectives","controls":["cp-10","cp-2.3"],"updated":"2026-06-24","statement":"The desired Recovery Time Objectives (RTO) and Recovery Point Objectives (RPO) are defined and persistently reviewed for alignment with the provider's business needs and capabilities."},{"id":"KSI-RPL-TRC","theme":"RPL","name":"Testing Recovery Capabilities","controls":["cp-10","cp-2.1","cp-2.3","cp-4","cp-4.1","cp-6","cp-6.1","cp-9.1","ir-3","ir-3.2","ir-9.3","sc-12.1"],"updated":"2026-10-13","statement":"The capability to recover from incidents and contingencies aligned with defined recovery objectives is persistently tested."},{"id":"KSI-SCR-MIT","theme":"SCR","name":"Mitigating Supply Chain Risk","controls":["ac-19","ac-20","ca-7.4","ra-3","ra-3.1","sa-10","sa-11","sa-11.1","sa-11.2","sa-15","sa-15.3","sa-16","sa-17","sa-21","sa-22","sa-4","sa-4.1","sa-4.2","sa-4.5","sa-4.9","sa-9","sa-9.1","sa-9.2","sa-9.5","sc-18","si-7.1","si-7.15","sr-2","sr-3","sr-5","sr-6"],"updated":"2026-10-13","statement":"Persistently identify, review, and mitigate potential supply chain risks."},{"id":"KSI-SCR-MON","theme":"SCR","name":"Monitoring Supply Chain Risk","controls":["ac-19","ac-20","ca-2.3","ca-3","ir-6.3","ps-7","ra-3","ra-5","sa-9","si-5","sr-3","sr-5","sr-6","sr-8"],"updated":"2026-10-13","statement":"Third party software information resources are automatically monitored for upstream vulnerabilities using mechanisms that may include contractual notification requirements or active monitoring services."},{"id":"KSI-SVC-ACM","theme":"SVC","name":"Automating Configuration Management","controls":["ac-2.4","ac-6.8","cm-2","cm-2.2","cm-2.3","cm-6","cm-7.1","pl-10","pl-9","sa-5","sc-45","sc-45.1","sc-7.18","si-5","sr-10"],"updated":"2026-10-13","statement":"The configuration of machine-based information resources is managed using automation and persistently reviewed for drift."},{"id":"KSI-SVC-ASM","theme":"SVC","name":"Automating Secret Management","controls":["ac-17.2","ia-5.2","ia-5.6","sc-12","sc-12.1","sc-17"],"updated":"2026-10-13","statement":"Management, protection, and regular rotation of digital keys, certificates, and other secrets is automated and persistently reviewed."},{"id":"KSI-SVC-EIS","theme":"SVC","name":"Evaluating and Improving Security","controls":["ca-7.4","cm-12.1","cm-5.5","cm-7.1","ir-9.4","pl-8","ra-3","sc-39","sc-7","si-2.2","si-4","sr-10"],"updated":"2026-10-13","statement":"Information resources are persistently evaluated for opportunities to improve security and those improvements are persistently made."},{"id":"KSI-SVC-PRR","theme":"SVC","name":"Preventing Residual Risk","controls":["ac-19","ir-9.4","sc-12.1","sc-4","sc-7.18"],"updated":"2026-10-13","byClass":{"b":"**Optional:** Plans, procedures, and the state of information resources are persistently reviewed after making changes to limit and remove unwanted residual elements that would likely negatively affect the confidentiality, integrity, or availability of federal customer data.","c":"Plans, procedures, and the state of information resources are persistently reviewed after making changes to limit and remove unwanted residual elements that would likely negatively affect the confidentiality, integrity, or availability of federal customer data."}},{"id":"KSI-SVC-RUD","theme":"SVC","name":"Removing Unwanted Data","controls":["ir-9","si-12.3","si-18.4","si-8","si-8.2"],"updated":"2026-10-13","byClass":{"b":"**Optional:** Unwanted federal customer data is removed promptly when requested by an agency in alignment with customer agreements, including from backups if appropriate; this typically applies when a customer spills information or when a customer seeks to remove information from a service due to a change in usage.","c":"Unwanted federal customer data is removed promptly when requested by an agency in alignment with customer agreements, including from backups if appropriate; this typically applies when a customer spills information or when a customer seeks to remove information from a service due to a change in usage."}},{"id":"KSI-SVC-SIN","theme":"SVC","name":"Securing Information","controls":["ac-11","ac-11.1","ac-17.2","ac-19.5","ac-21","cp-9.8","ir-9.4","sc-13","sc-20","sc-21","sc-22","sc-23","sc-28","sc-28.1","sc-4","sc-7.18","sc-8","sc-8.1","si-4.18"],"updated":"2026-10-13","statement":"Information is encrypted or otherwise secured from unwanted access or modification."},{"id":"KSI-SVC-VCM","theme":"SVC","name":"Validating Communications","controls":["ac-10","ac-17.4","ac-18","ac-19","sc-23","si-4.22","si-7.1"],"updated":"2026-10-13","byClass":{"b":"**Optional:** The authenticity and integrity of communications between machine-based information resources is persistently validated using automation.","c":"The authenticity and integrity of communications between machine-based information resources is persistently validated using automation."}},{"id":"KSI-SVC-VRI","theme":"SVC","name":"Validating Resource Integrity","controls":["ac-17.4","ac-18","ac-19","au-9.3","cm-14","cm-2.2","cm-8.3","sc-13","sc-23","si-7","si-7.1","si-7.15","sr-10","sr-11"],"updated":"2026-10-13","statement":"Use cryptographic methods to validate the integrity of machine-based information resources."}],"families":{"AFC":{"name":"Addressing FedRAMP Communication","status":"stable","effective":{"all":{"is":"required","current_status":"Consolidated Rules for 2026","date":{"obtain":"2026-01-05","maintain":"2026-01-05","grace":{"default":"2026-07-01","until_next_assessment":false}}}}},"AGU":{"name":"Agency Use of FedRAMP Certified Cloud Services","status":"placeholder","effective":{"all":{"is":"required","current_status":"Consolidated Rules for 2026","date":{"obtain":"2026-07-04","maintain":"2026-07-04","optional_adoption":"2026-07-04","grace":{"default":"2026-07-04","until_next_assessment":false}}}}},"CCM":{"name":"Collaborative Continuous Monitoring","status":"stable","effective":{"20x":{"is":"required","current_status":"Consolidated Rules for 2026","date":{"obtain":"2026-07-04","maintain":"2027-01-01","optional_adoption":"2026-07-04","grace":{"default":"2027-01-01","until_next_assessment":true}}},"rev5":{"is":"required","current_status":"Consolidated Rules for 2026","date":{"obtain":"2027-01-01","maintain":"2027-04-02","optional_adoption":"2026-07-04","grace":{"default":"2027-10-01","until_next_assessment":false}}}}},"CDS":{"name":"Certification Data Sharing","status":"stable","effective":{"20x":{"is":"required","current_status":"Consolidated Rules for 2026","date":{"obtain":"2026-07-04","maintain":"2027-01-01","optional_adoption":"2026-07-04","grace":{"default":"2027-01-01","until_next_assessment":true}}},"rev5":{"is":"required","current_status":"Consolidated Rules for 2026","date":{"obtain":"2027-01-01","maintain":"2027-08-01","optional_adoption":"2026-07-04","grace":{"default":"2028-02-01","until_next_assessment":false}}}}},"CMU":{"name":"Cryptographic Module Use","status":"stable","effective":{"20x":{"is":"required","current_status":"Consolidated Rules for 2026","date":{"obtain":"2026-07-04","maintain":"2027-01-01","optional_adoption":"2026-07-04","grace":{"default":"2027-01-01","until_next_assessment":true}}},"rev5":{"is":"required","current_status":"Consolidated Rules for 2026","date":{"obtain":"2027-01-01","maintain":"2027-01-01","optional_adoption":"2026-07-04","grace":{"default":"2027-06-01","until_next_assessment":false}}}}},"CPO":{"name":"Certification Package Overview","status":"stable","effective":{"20x":{"is":"required","current_status":"Consolidated Rules for 2026","date":{"obtain":"2026-07-04","maintain":"2027-01-01","optional_adoption":"2026-07-04","grace":{"default":"2027-01-01","until_next_assessment":true}}},"rev5":{"is":"required","current_status":"Consolidated Rules for 2026","date":{"obtain":"2027-01-01","maintain":"2027-07-01","optional_adoption":"2026-07-04","grace":{"default":"2027-07-01","until_next_assessment":true}}}}},"FRC":{"name":"FedRAMP Certification","status":"stable","effective":{"20x":{"is":"required","current_status":"Consolidated Rules for 2026","date":{"obtain":"2026-07-04","maintain":"2027-01-01","optional_adoption":"2026-07-04","grace":{"default":"2027-01-01","until_next_assessment":true}}},"rev5":{"is":"required","current_status":"Consolidated Rules for 2026","date":{"obtain":"2027-01-01","maintain":"2027-01-01","optional_adoption":"2026-07-04","grace":{"default":"2027-01-01","until_next_assessment":true}}}}},"IEC":{"name":"Incident Evaluation and Communication","status":"stable","effective":{"20x":{"is":"required","current_status":"Consolidated Rules for 2026","date":{"obtain":"2026-07-04","maintain":"2027-01-01","optional_adoption":"2026-07-04","grace":{"default":"2027-01-01","until_next_assessment":true}}},"rev5":{"is":"required","current_status":"Consolidated Rules for 2026","date":{"obtain":"2027-01-01","maintain":"2027-01-01","optional_adoption":"2026-07-04","grace":{"default":"2027-06-01","until_next_assessment":false}}}}},"IVV":{"name":"Independent Verification and Validation","status":"stable","effective":{"20x":{"is":"required","current_status":"Consolidated Rules for 2026","date":{"obtain":"2026-07-04","maintain":"2027-01-01","optional_adoption":"2026-07-04","grace":{"default":"2027-01-01","until_next_assessment":true}}},"rev5":{"is":"required","current_status":"Consolidated Rules for 2026","date":{"obtain":"2027-01-01","maintain":"2027-01-01","optional_adoption":"2026-07-04","grace":{"default":"2027-01-01","until_next_assessment":true}}}}},"MAS":{"name":"Minimum Assessment Scope","status":"stable","effective":{"20x":{"is":"required","current_status":"Consolidated Rules for 2026","date":{"obtain":"2026-07-04","maintain":"2027-01-01","optional_adoption":"2026-07-04","grace":{"default":"2027-01-01","until_next_assessment":true}}},"rev5":{"is":"required","current_status":"Consolidated Rules for 2026","date":{"obtain":"2027-01-01","maintain":"2027-01-01","optional_adoption":"2026-07-04","grace":{"default":"2027-01-01","until_next_assessment":true}}}}},"MKT":{"name":"Marketplace Listing","status":"stable","effective":{"all":{"is":"required","current_status":"Consolidated Rules for 2026","date":{"obtain":"2026-07-04","maintain":"2026-07-04","optional_adoption":"2026-07-04","grace":{"default":"2026-07-04","until_next_assessment":false}}}}},"REC":{"name":"FedRAMP Recognition of Independent Assessment Services","status":"stable","effective":{"all":{"is":"required","current_status":"Consolidated Rules for 2026","date":{"obtain":"2026-07-04","maintain":"2026-07-04","optional_adoption":"2026-07-04","grace":{"default":"2026-07-04","until_next_assessment":false}}}}},"SCG":{"name":"Secure Configuration Guide","status":"stable","effective":{"all":{"is":"required","current_status":"Consolidated Rules for 2026","date":{"obtain":"2026-03-01","maintain":"2026-03-01","grace":{"default":"2026-07-01","until_next_assessment":false}}}}},"SCN":{"name":"Significant Change Notification","status":"stable","effective":{"20x":{"is":"required","current_status":"Consolidated Rules for 2026","date":{"obtain":"2026-07-04","maintain":"2027-01-01","optional_adoption":"2026-07-04","grace":{"default":"2027-01-01","until_next_assessment":true}}},"rev5":{"is":"required","current_status":"Consolidated Rules for 2026","date":{"obtain":"2027-01-01","maintain":"2027-01-01","optional_adoption":"2026-07-04","grace":{"default":"2027-06-01","until_next_assessment":false}}}}},"SDR":{"name":"Security Decision Record","status":"stable","effective":{"20x":{"is":"required","current_status":"Consolidated Rules for 2026","date":{"obtain":"2026-07-04","maintain":"2027-01-01","optional_adoption":"2026-07-04","grace":{"default":"2027-01-01","until_next_assessment":true}}},"rev5":{"is":"required","current_status":"Consolidated Rules for 2026","date":{"obtain":"2027-01-01","maintain":"2027-08-01","optional_adoption":"2026-07-04","grace":{"default":"2027-08-01","until_next_assessment":true}}}}},"VDR":{"name":"Vulnerability Detection and Response","status":"stable","effective":{"all":{"is":"required","current_status":"Mandated by CISA BOD 26-04","date":{"obtain":"2026-12-07","maintain":"2026-12-07","optional_adoption":"2026-07-04","grace":{"default":"2027-03-07","until_next_assessment":false}}}}},"VER":{"name":"Vulnerability Evaluation and Reporting","status":"stable","effective":{"all":{"is":"required","current_status":"Mandated by CISA BOD 26-04","date":{"obtain":"2026-12-07","maintain":"2026-12-07","optional_adoption":"2026-07-04","grace":{"default":"2027-03-07","until_next_assessment":false}}}}}},"rules":{"AFC-CSO-INB":{"id":"AFC-CSO-INB","family":"AFC","scope":"all","subset":"CSO","name":"Maintain a FedRAMP Security Inbox","statement":"Providers MUST establish and maintain an email address to receive messages from FedRAMP; this inbox is a FedRAMP Security Inbox (FSI).","force":"MUST","notes":["Unless otherwise notified, FedRAMP will use the listed Security Email on the Marketplace for these notifications.","If a provider establishes a new inbox in reaction to this guidance that is different from the Security Email then they must follow the AFC-CSO-NOC (Notification of Changes) rules to notify FedRAMP."],"related":["AFC-CSO-NOC"],"controls":["si-5"],"artifacts":{"all":["Email address to receive messages from FedRAMP"]},"updated":"2026-10-13"},"AFC-CSO-NOC":{"id":"AFC-CSO-NOC","family":"AFC","scope":"all","subset":"CSO","name":"Notification of Changes","statement":"Providers MUST immediately notify FedRAMP of any changes to the email address for their FedRAMP Security Inbox.","force":"MUST","artifacts":{"all":["Process, manual or automated, to notify FedRAMP of changes in the FedRAMP Security Inbox"]},"updated":"2026-06-24"},"AFC-CSO-TFG":{"id":"AFC-CSO-TFG","family":"AFC","scope":"all","subset":"CSO","name":"Trust @fedramp.gov and @gsa.gov","statement":"Providers MUST treat any email originating from an @fedramp.gov or @gsa.gov email address as if it was sent from FedRAMP by default; if such a message is confirmed to originate from someone other than FedRAMP then the FedRAMP Security Inbox rules no longer apply.","force":"MUST","artifacts":{"all":["Configuration settings for FSI mailbox","Automated validation to check FSI mailbox configuration"]},"updated":"2026-06-24"},"AFC-CSO-RCV":{"id":"AFC-CSO-RCV","family":"AFC","scope":"all","subset":"CSO","name":"Receive Email Without Disruption","statement":"Providers MUST receive and react to email messages from FedRAMP without disruption and without requiring additional actions from FedRAMP.","force":"MUST","note":"This requirement is intended to prevent cloud service providers from requiring FedRAMP to complete a CAPTCHA, log into a customer portal, or otherwise take service-specific actions that might prevent the security team from receiving the message.","updated":"2026-06-24"},"AFC-CSO-CRA":{"id":"AFC-CSO-CRA","family":"AFC","scope":"all","subset":"CSO","name":"Complete Required Actions","statement":"Providers MUST complete the required actions in Emergency or Emergency Test designated messages sent by FedRAMP within the timeframe included in the message.","force":"MUST","note":"Timeframes may vary by FedRAMP Certification class.","updated":"2026-06-24"},"AFC-CSO-EMR":{"id":"AFC-CSO-EMR","family":"AFC","scope":"all","subset":"CSO","name":"Emergency Message Routing","statement":"Providers MUST route Emergency designated messages sent by FedRAMP to a senior security official for their awareness.","force":"MUST","note":"Senior security officials are determined by the provider.","artifacts":{"all":["Configuration settings for FSI mailbox","Automated validation to check FSI mailbox configuration"]},"updated":"2026-06-24"},"AFC-CSO-IMA":{"id":"AFC-CSO-IMA","family":"AFC","scope":"all","subset":"CSO","name":"Important Message Actions","statement":"Providers SHOULD complete the required actions in Important designated messages sent by FedRAMP within the timeframe specified in the message.","force":"SHOULD","note":"Timeframes may vary by FedRAMP Certification class.","updated":"2026-06-24"},"AFC-CSO-ACK":{"id":"AFC-CSO-ACK","family":"AFC","scope":"all","subset":"CSO","name":"Acknowledge Receipt","statement":"Providers SHOULD promptly and automatically acknowledge the receipt of messages received from FedRAMP in their FedRAMP Security Inbox.","force":"SHOULD","updated":"2026-06-24"},"CCM-OCR-AVL":{"id":"CCM-OCR-AVL","family":"CCM","scope":"all","subset":"OCR","name":"Report Availability","statement":"Providers MUST supply an Ongoing Certification Report to all necessary parties every 3 months, covering the entire period since the previous summary, in a consistent format that is human readable; this report MUST include high-level summaries of at least the following information (if applicable):","force":"MUST","following_information":["Changes to FedRAMP Certification Data","Planned changes to FedRAMP Certification Data during at least the next 3 months","Accepted vulnerabilities","Transformative changes","Updated recommendations or best practices for security, configuration, usage, or similar aspects of the cloud service offering","A list of all agencies that are directly using the product","FedRAMP Reportable Incidents or an attestation that no such incidents occurred","Lessons learned and changes planned or made as a result of FedRAMP Reportable Incidents (if such occurred)"],"controls":["ca-7"],"timeframe_type":"months","timeframe_num":3,"artifacts":{"all":["Most recent Ongoing Certification Report. If the report is not available, the provider MUST provide a sample report that includes all required information.","How the report will be delivered"]},"schema":{"name":"FedRAMP Ongoing Certification Report (CCM-OCR-AVL)","url":"https://fedramp.gov/schemas/fedramp-ongoing-certification-report-schema-2026-06-24.json"},"updated":"2026-10-13"},"CCM-OCR-NRD":{"id":"CCM-OCR-NRD","family":"CCM","scope":"all","subset":"OCR","name":"Next Report Date","statement":"Providers MUST supply the target date for their next Ongoing Certification Report with other public FedRAMP Certification Data.","force":"MUST","updated":"2026-06-24"},"CCM-OCR-FBM":{"id":"CCM-OCR-FBM","family":"CCM","scope":"all","subset":"OCR","name":"Feedback Mechanism","statement":"Providers MUST supply an asynchronous mechanism for all necessary parties to provide feedback or ask questions about each Ongoing Certification Report.","force":"MUST","note":"This could be email by default but providers are encouraged to consider something more interactive as appropriate.","artifacts":{"all":["How to access the feedback mechanism."]},"updated":"2026-06-24"},"CCM-OCR-AFS":{"id":"CCM-OCR-AFS","family":"CCM","scope":"all","subset":"OCR","name":"Anonymized Feedback Summary","statement":"Providers MUST supply an anonymized and desensitized summary of the feedback, questions, and answers about each Ongoing Certification Report as an addendum to the Ongoing Certification Report OR in the next Ongoing Certification Report.","force":"MUST","note":"This is intended to encourage sharing of information and decrease the burden on the cloud service provider - providing this summary will reduce duplicate questions from agencies and ensure FedRAMP has access to this information. It is generally in the provider's interest to update this addendum frequently throughout the quarter.","artifacts":{"all":["How the summary will be delivered"]},"updated":"2026-06-24"},"CCM-OCR-LSI":{"id":"CCM-OCR-LSI","family":"CCM","scope":"all","subset":"OCR","name":"Limit Sensitive Information","statement":"Providers MUST NOT irresponsibly disclose sensitive information in an Ongoing Certification Report that would likely have an adverse effect on the cloud service offering.","force":"MUST NOT","updated":"2026-06-24"},"CCM-OCR-SOR":{"id":"CCM-OCR-SOR","family":"CCM","scope":"all","subset":"OCR","name":"Spread Out Reports","statement":"Providers SHOULD establish a regular 3 month cycle for Ongoing Certification Reports that is spread out from the beginning, middle, or end of each quarter.","force":"SHOULD","note":"This recommendation is intended to discourage hundreds of cloud service providers from releasing their Ongoing Certification Reports during the first or last week of each quarter because that is the easiest way for a single provider to track this deliverable; the result would overwhelm agencies with many cloud services. Widely used cloud service providers are encouraged to work with their customers to identify ideal timeframes for this cycle.","updated":"2026-06-24"},"CCM-OCR-RPS":{"id":"CCM-OCR-RPS","family":"CCM","scope":"all","subset":"OCR","name":"Responsible Public Certification Report Sharing","statement":"Providers MAY responsibly supply some or all of the information an Ongoing Certification Report to the public or other parties if the provider determines doing so will NOT likely have an adverse effect on the cloud service offering.","force":"MAY","updated":"2026-06-24"},"CCM-QTR-MTG":{"id":"CCM-QTR-MTG","family":"CCM","scope":"all","subset":"QTR","name":"Quarterly Review Meeting","controls":["ca-7"],"updated":"2026-10-13","byClass":{"a":{"statement":"Providers with Class A Certifications MAY host a synchronous Quarterly Review every 3 months, open to all necessary parties, to review aspects of the most recent Ongoing Certification Reports that the provider determines are of the most relevance to agencies.","force":"MAY","timeframe_type":"months","timeframe_num":3,"artifacts":{"all":["selected ordinal recurrence for the synchronous Quarterly Review cycle if applicable."]}},"b":{"statement":"Providers with Class B Certifications SHOULD host a synchronous Quarterly Review every 3 months, open to all necessary parties, to review aspects of the most recent Ongoing Certification Reports that the provider determines are of the most relevance to agencies.","force":"SHOULD","timeframe_type":"months","timeframe_num":3,"artifacts":{"all":["selected ordinal recurrence for the Ongoing Certification Report cycle if applicable OR explanation for why Ongoing Certification Reports are not being delivered."]}},"c":{"statement":"Providers with Class C Certifications MUST host a synchronous Quarterly Review every 3 months, open to all necessary parties, to review aspects of the most recent Ongoing Certification Reports that the provider determines are of the most relevance to agencies.","force":"MUST","timeframe_type":"months","timeframe_num":3,"artifacts":{"all":["selected ordinal recurrence for the Ongoing Certification Report cycle."]}},"d":{"statement":"Providers with Class D Certifications MUST host a synchronous Quarterly Review every 3 months, open to all necessary parties, to review aspects of the most recent Ongoing Certification Reports that the provider determines are of the most relevance to agencies.","force":"MUST","timeframe_type":"months","timeframe_num":3,"artifacts":{"all":["selected ordinal recurrence for the Ongoing Certification Report cycle."]}}}},"CCM-QTR-REG":{"id":"CCM-QTR-REG","family":"CCM","scope":"all","subset":"QTR","name":"Meeting Registration Info","statement":"Providers MUST supply either a registration link or a downloadable calendar file with meeting information for Quarterly Reviews to all necessary parties.","force":"MUST","artifacts":{"all":["URL to the registration page or calendar file."]},"updated":"2026-06-24"},"CCM-QTR-NRD":{"id":"CCM-QTR-NRD","family":"CCM","scope":"all","subset":"QTR","name":"Next Review Date","statement":"Providers MUST publicly supply the target date for their next Quarterly Review with other public FedRAMP Certification Data.","force":"MUST","updated":"2026-06-24"},"CCM-QTR-NID":{"id":"CCM-QTR-NID","family":"CCM","scope":"all","subset":"QTR","name":"No Irresponsible Disclosure","statement":"Providers MUST NOT irresponsibly disclose sensitive information in a Quarterly Review that would likely have an adverse effect on the cloud service offering.","force":"MUST NOT","updated":"2026-06-24"},"CCM-QTR-SAR":{"id":"CCM-QTR-SAR","family":"CCM","scope":"all","subset":"QTR","name":"Schedule Around Reports","statement":"Providers SHOULD regularly schedule Quarterly Reviews to occur at least 3 business days after releasing an Ongoing Certification Report AND within 10 business days of such release.","force":"SHOULD","timeframe_type":"bizdays","updated":"2026-06-24"},"CCM-QTR-ACT":{"id":"CCM-QTR-ACT","family":"CCM","scope":"all","subset":"QTR","name":"Additional Content","statement":"Providers SHOULD supply additional information in Quarterly Reviews that the provider determines is of interest, use, or otherwise relevant to agencies.","force":"SHOULD","controls":["ca-7"],"updated":"2026-10-13"},"CCM-QTR-RTR":{"id":"CCM-QTR-RTR","family":"CCM","scope":"all","subset":"QTR","name":"Record/Transcribe Reviews","statement":"Providers SHOULD record or transcribe Quarterly Reviews and supply them to all necessary parties.","force":"SHOULD","updated":"2026-06-24"},"CCM-QTR-RTP":{"id":"CCM-QTR-RTP","family":"CCM","scope":"all","subset":"QTR","name":"Restrict Third Parties","statement":"Providers SHOULD NOT invite third parties to attend Quarterly Reviews intended for agencies unless they have specific relevance.","force":"SHOULD NOT","note":"This is because agencies are less likely to actively participate in meetings with third parties; the cloud service provider's independent assessor should be considered relevant by default.","updated":"2026-06-24"},"CCM-QTR-SRR":{"id":"CCM-QTR-SRR","family":"CCM","scope":"all","subset":"QTR","name":"Share Recordings Responsibly","statement":"Providers MAY responsibly supply recordings or transcriptions of Quarterly Reviews to the public or other parties ONLY if the provider removes all agency information (comments, questions, names, etc.) AND determines doing so will NOT likely have an adverse effect on the cloud service offering.","force":"MAY","updated":"2026-06-24"},"CCM-QTR-SCR":{"id":"CCM-QTR-SCR","family":"CCM","scope":"all","subset":"QTR","name":"Share Content Responsibly","statement":"Providers MAY responsibly supply content prepared for a Quarterly Review to the public or other parties if the provider determines doing so will NOT likely have an adverse effect on the cloud service offering.","force":"MAY","updated":"2026-06-24"},"CDS-CSO-PUB":{"id":"CDS-CSO-PUB","family":"CDS","scope":"all","subset":"CSO","name":"Public Information","statement":"Providers MUST publicly share up-to-date information about the cloud service offering in both human-readable and JSON formats, including at least the following information that is available and applicable:","force":"MUST","notes":["Generally, this information should be available on a public webpage or publicly shared in a FedRAMP-compatible trust center.","The JSON data for this rule will be consumed by FedRAMP and agency GRC tools using automation with web-based tools. Do not expect FedRAMP or your customers to download this data directly, it should be accessible for common web frameworks. FedRAMP strongly recommends that application engineering experts be involved in making public JSON data and the related information available in a way that can work with web-based applications."],"following_information":["FedRAMP ID","Service Model","Deployment Model","Business Category","UEI Number","Sales Contact Information","Security Contact Information","Product Website Link","Link to Product Logo (must be a valid image link, properly named, that will display in a browser without processing - transparent PNG preferred)","Overall Service Description","Detailed list of specific services and their security categories (see CDS-CSO-SVC (Public Service List) (Service List))","Link to Secure Configuration Guidance","Overview of documentation supplied by the provider for the cloud service offering","Link to Trust Center landing page that includes instructions on accessing information in the trust center","Next Ongoing Certification Report date (see CCM-OCR-NRD (Next Report Date))","Current FedRAMP Recognized independent assessment service"],"related":["CDS-CSO-SVC","CCM-OCR-NRD"],"artifacts":{"all":["URL to the human-readable data.","URL to the machine-readable data."]},"schema":{"name":"FedRAMP Certification Package Overview (FRC-CSO-PKG)","url":"https://fedramp.gov/schemas/fedramp-certification-package-overview-schema-2026-06-24.json"},"updated":"2026-10-05"},"CDS-CSO-SVC":{"id":"CDS-CSO-SVC","family":"CDS","scope":"all","subset":"CSO","name":"Public Service List","statement":"Providers MUST publicly share a detailed list of specific services and their security categories that are included in the cloud service offering using clear feature or service names that align with standard public marketing materials; this list MUST be complete enough for a potential customer to determine which services are and are not included in the FedRAMP Minimum Assessment Scope without requesting access to underlying FedRAMP Certification Data.","force":"MUST","artifacts":{"all":["URL to the human-readable data.","URL to the machine-readable data (if applicable)."]},"schema":{"name":"FedRAMP Certification Package Overview (FRC-CSO-PKG)","url":"https://fedramp.gov/schemas/fedramp-certification-package-overview-schema-2026-06-24.json"},"updated":"2026-06-24"},"CDS-CSO-FID":{"id":"CDS-CSO-FID","family":"CDS","scope":"all","subset":"CSO","name":"Always Include FedRAMP ID","statement":"Providers MUST always include the FedRAMP ID of the related cloud service offering in all FedRAMP Certification Data once assigned, including all reports, notifications, and other communication that results from FedRAMP rules.","force":"MUST","notes":["The FedRAMP ID is supplied by FedRAMP after a cloud service offering is registered to be listed on the FedRAMP Marketplace - providers will need to use a placeholder until the FedRAMP ID is assigned.","Many providers have multiple cloud service offerings or use internal names that don't align to public materials; using the FedRAMP ID ensures we can easily align the communication with a specific cloud service offering."],"updated":"2026-06-24"},"CDS-CSO-FRC":{"id":"CDS-CSO-FRC","family":"CDS","scope":"all","subset":"CSO","name":"FedRAMP Certification Reports","statement":"Providers MUST include FedRAMP Certification Reports with their FedRAMP Certification Data without inappropriate modifications, and make such reports available within 2 weeks of receiving the materials from FedRAMP.","force":"MUST","note":"FedRAMP provides Certification Reports for all cloud service offerings following the Program Certification path as part of the initial and ongoing FedRAMP Certification process, and may provide Certification Reports for cloud service offerings following the Agency Certification path.","timeframe_type":"weeks","timeframe_num":2,"updated":"2026-06-24"},"CDS-CSO-AVR":{"id":"CDS-CSO-AVR","family":"CDS","scope":"all","subset":"CSO","name":"Availability Reporting","updated":"2026-06-24","byClass":{"a":{"statement":"Providers with Class A Certifications SHOULD maintain a web service, available to all necessary parties, that indicates current and historical availability of core services within the cloud service offering over at least the past 30 days, including availability incidents, in both human-readable and machine-readable formats; this service SHOULD be available even if the primary cloud service offering is unavailable.","force":"SHOULD"},"b":{"statement":"Providers with Class B Certifications MUST maintain a web service, available to all necessary parties, that indicates current and historical availability of core services within the cloud service offering over at least the past 30 days, including availability incidents, in both human-readable and machine-readable formats; this service MUST be available even if the primary cloud service offering is unavailable.","force":"MUST"},"c":{"statement":"Providers with Class C Certifications MUST maintain a web service, available to all necessary parties, that indicates current and historical availability of core services within the cloud service offering over at least the past 30 days, including availability incidents, in both human-readable and machine-readable formats; this service MUST be available even if the primary cloud service offering is unavailable.","force":"MUST"},"d":{"statement":"Providers with Class D Certifications MUST maintain a web service, available to all necessary parties, that indicates current and historical availability of core services within the cloud service offering over at least the past 30 days, including availability incidents, in both human-readable and machine-readable formats; this service MUST be available even if the primary cloud service offering is unavailable.","force":"MUST"}}},"CDS-CSO-UTC":{"id":"CDS-CSO-UTC","family":"CDS","scope":"all","subset":"CSO","name":"Use Trust Centers","statement":"Providers MUST use a FedRAMP-compatible trust center to store and share FedRAMP Certification Data with all necessary parties.","force":"MUST","note":"Rules for FedRAMP-Compatible Trust Centers are explained in the Certification Data Sharing Rules under the FedRAMP-Compatible Trust Centers section (id: CDS-TRC).","schema":{"name":"FedRAMP Certification Package Overview (FRC-CSO-PKG)","url":"https://fedramp.gov/schemas/fedramp-certification-package-overview-schema-2026-06-24.json"},"updated":"2026-06-24"},"CDS-CSO-CBF":{"id":"CDS-CSO-CBF","family":"CDS","scope":"all","subset":"CSO","name":"Consistency Between Formats","statement":"Providers MUST use automation to ensure information remains consistent between human-readable and machine-readable formats when FedRAMP Certification Data is provided in both formats.","force":"MUST","updated":"2026-06-24"},"CDS-CSO-RIS":{"id":"CDS-CSO-RIS","family":"CDS","scope":"all","subset":"CSO","name":"Responsible Information Sharing","statement":"Providers MUST provide sufficient information in FedRAMP Certification Data to support agency authorization decisions but SHOULD NOT include sensitive information that would likely enable a threat actor to gain unauthorized access, cause harm, disrupt operations, or otherwise have a negative adverse impact on the cloud service offering.","force":"MUST","note":"This is not a license to exclude accurate risk information, but specifics that would likely lead to compromise should be abstracted. A breach of confidentiality with FedRAMP Certification Data should be anticipated by a secure cloud service provider.","updated":"2026-06-24"},"CDS-CSO-IRP":{"id":"CDS-CSO-IRP","family":"CDS","scope":"all","subset":"CSO","name":"Include Relevant Policies","statement":"Providers MUST supply all relevant policies and procedures in the FedRAMP Certification Data, including a human-readable and machine-readable reference that explains at least the following about each included policy and procedure:","force":"MUST","following_information":["Name of policy or procedure","Name of file, document, web page, etc.","Brief summary of policy or procedure","Word count of document","Current version","Date of last update","Related FedRAMP Practices (if applicable)"],"artifacts":{"all":["Explanation of how to access this information."]},"updated":"2026-06-24"},"CDS-CSO-HAD":{"id":"CDS-CSO-HAD","family":"CDS","scope":"all","subset":"CSO","name":"Historical FedRAMP Certification Data","statement":"Providers MUST supply snapshots of FedRAMP Certification Data aligned to Ongoing Certification Reports to all necessary parties; these snapshots MUST be available for the duration of FedRAMP Certification.","force":"MUST","note":"Historical snapshots do not need to be reconstructed for periods before the provider's first Ongoing Certification Report, but should be maintained for all subsequent Ongoing Certification Reports.","artifacts":{"all":["Explanation of how to access this information."]},"updated":"2026-06-24"},"CDS-CSO-PSM":{"id":"CDS-CSO-PSM","family":"CDS","scope":"all","subset":"CSO","name":"Per-Service Certification Materials","notes":["Providers determine what they consider to be separate services, based on maximizing the customer experience for agencies who may only adopt some services and not others.","Providers are encouraged to provide a single comprehensive set of materials for all shared aspects of the service offering and only provide separate materials for unique aspects of each service to minimize the burden on providers and agencies."],"updated":"2026-06-24","byClass":{"a":{"statement":"Providers with Class A Certifications MAY supply per-service FedRAMP Certification materials.","force":"MAY","artifacts":{"all":["Explanation of the supplied materials, including how to access and use them."]}},"b":{"statement":"Providers with Class B Certifications MAY supply per-service FedRAMP Certification materials.","force":"MAY","artifacts":{"all":["Explanation of the supplied materials, including how to access and use them."]}},"c":{"statement":"Providers with Class C Certifications MAY supply per-service FedRAMP Certification materials.","force":"MAY","artifacts":{"all":["Explanation of the supplied materials, including how to access and use them."]}},"d":{"statement":"Providers with Class D Certifications MUST supply per-service FedRAMP Certification materials.","force":"MUST","artifacts":{"all":["Explanation of the supplied materials, including how to access and use them."]}}}},"CDS-CSO-RPS":{"id":"CDS-CSO-RPS","family":"CDS","scope":"all","subset":"CSO","name":"Responsible Public Package Sharing","statement":"Providers MAY responsibly share some or all of the information in a FedRAMP Certification Package publicly or with other parties if the provider determines doing so will NOT likely have an adverse effect on the cloud service offering.","force":"MAY","artifacts":{"all":["Explanation of if and how this information is shared with other parties."]},"updated":"2026-06-24"},"CDS-TRC-USH":{"id":"CDS-TRC-USH","family":"CDS","scope":"all","subset":"TRC","name":"Uninterrupted Sharing","statement":"Trust centers MUST share FedRAMP Certification Data with all necessary parties without interruption.","force":"MUST","note":"\"Without interruption\" means that parties should not have to request manual approval each time they need to access FedRAMP Certification Data or go through a complicated process. The preferred way of ensuring access without interruption is to use on-demand just-in-time access provisioning.","updated":"2026-06-24"},"CDS-TRC-PAC":{"id":"CDS-TRC-PAC","family":"CDS","scope":"all","subset":"TRC","name":"Programmatic Access","statement":"Trust centers MUST provide documented programmatic access to all FedRAMP Certification Data, including programmatic access to human-readable materials.","force":"MUST","artifacts":{"all":["URL to the documentation for programmatic access."]},"updated":"2026-06-24"},"CDS-TRC-AAI":{"id":"CDS-TRC-AAI","family":"CDS","scope":"all","subset":"TRC","name":"Agency Access Inventory","statement":"Trust centers MUST maintain an inventory and history of federal agency users or systems with access to FedRAMP Certification Data and MUST make this information available to FedRAMP upon request.","force":"MUST","artifacts":{"all":["Explanation of how FedRAMP can obtain this information."]},"updated":"2026-06-24"},"CDS-TRC-ACL":{"id":"CDS-TRC-ACL","family":"CDS","scope":"all","subset":"TRC","name":"Access Logging","statement":"Trust centers MUST log access to FedRAMP Certification Data and store summaries of access for at least six months; such information, as it pertains to specific parties, SHOULD be made available upon request by those parties.","force":"MUST","artifacts":{"all":["Explanation of how the appropriate parties can obtain this log information."]},"updated":"2026-06-24"},"CDS-TRC-HMR":{"id":"CDS-TRC-HMR","family":"CDS","scope":"all","subset":"TRC","name":"Human and Machine-Readable Certification Data","statement":"Trust centers SHOULD make FedRAMP Certification Data available to view and download in both human-readable and machine-readable formats.","force":"SHOULD","updated":"2026-06-24"},"CDS-TRC-SSM":{"id":"CDS-TRC-SSM","family":"CDS","scope":"all","subset":"TRC","name":"Self-Service Access Management","statement":"Trust centers SHOULD include features that encourage all necessary parties to provision and manage access to FedRAMP Certification Data for their users and services directly.","force":"SHOULD","artifacts":{"all":["URL or explanation how to access documentation of these features and capabilities."]},"updated":"2026-06-24"},"CDS-UTC-AAD":{"id":"CDS-UTC-AAD","family":"CDS","scope":"all","subset":"UTC","name":"Agency Access Denial","statement":"Providers MUST notify FedRAMP within 5 business days of denying an agency access request for FedRAMP Certification Data.","force":"MUST","timeframe_type":"bizdays","timeframe_num":5,"updated":"2026-06-24"},"CDS-UTC-AGA":{"id":"CDS-UTC-AGA","family":"CDS","scope":"all","subset":"UTC","name":"Agency Access","statement":"Providers SHOULD supply access to the FedRAMP Certification Package with agencies upon request.","force":"SHOULD","artifacts":{"all":["URL or explanation of how to request these materials.","Explanation of how the provider decides whether or not to share these materials or other related policies."]},"updated":"2026-06-24"},"CMU-CSO-CMD":{"id":"CMU-CSO-CMD","family":"CMU","scope":"all","subset":"CSO","name":"Cryptographic Module Documentation","statement":"Providers MUST document the cryptographic modules used in each service (or groups of services that use the same modules) where cryptographic services are used to protect federal customer data, including whether these modules are validated under the NIST Cryptographic Module Validation Program or are update streams of such modules.","force":"MUST","controls":["au-9.3","cm-3.6","ia-7","sc-28.1","sc-8.1"],"artifacts":{"all":["List of cryptographic modules including whether these modules are validated under the NIST Cryptographic Module Validation Program or are update streams of such modules."]},"updated":"2026-10-13"},"CMU-CSO-UVM":{"id":"CMU-CSO-UVM","family":"CMU","scope":"all","subset":"CSO","name":"Using Validated Cryptographic Modules","note":"Cryptographic modules include specific algorithms by definition; if an update stream of a cryptographic module adds new algorithms that were not previously validated then those algorithms can not be considered within the scope of update stream usage under these rules as they are new algorithms within the module that have never been validated.","controls":["ac-18","au-9.3","ia-7","sc-28.1","sc-8.1"],"updated":"2026-10-13","byClass":{"a":{"statement":"Providers with Class A Certifications MAY use cryptographic modules or update streams of cryptographic modules with active validations under the NIST Cryptographic Module Validation Program when using cryptographic services to protect federal customer data.","force":"MAY","artifacts":{"all":["List of cryptographic modules including whether these modules are validated under the NIST Cryptographic Module Validation Program or are update streams of such modules."]}},"b":{"statement":"Providers with Class B Certifications MAY use cryptographic modules or update streams of cryptographic modules with active validations under the NIST Cryptographic Module Validation Program when using cryptographic services to protect federal customer data.","force":"MAY","artifacts":{"all":["List of cryptographic modules including whether these modules are validated under the NIST Cryptographic Module Validation Program or are update streams of such modules."]}},"c":{"statement":"Providers with Class C Certifications SHOULD use cryptographic modules or update streams of cryptographic modules with active validations under the NIST Cryptographic Module Validation Program when using cryptographic services to protect federal customer data.","force":"SHOULD","artifacts":{"all":["List of cryptographic modules including whether these modules are validated under the NIST Cryptographic Module Validation Program or are update streams of such modules."]}},"d":{"statement":"Providers with Class D Certifications MUST use cryptographic modules or update streams of cryptographic modules with active validations under the NIST Cryptographic Module Validation Program when using cryptographic services to protect federal customer data.","force":"MUST","artifacts":{"all":["List of cryptographic modules including whether these modules are validated under the NIST Cryptographic Module Validation Program or are update streams of such modules."]}}}},"CMU-CSO-CAT":{"id":"CMU-CSO-CAT","family":"CMU","scope":"all","subset":"CSO","name":"Configuration of Agency Tenants","statement":"Providers SHOULD configure agency tenants by default to use cryptographic services that use cryptographic modules or update streams of cryptographic modules with active validations under the NIST Cryptographic Module Validation Program when such modules are available.","force":"SHOULD","artifacts":{"all":["List of cryptographic modules used by default including whether these modules are validated under the NIST Cryptographic Module Validation Program or are update streams of such modules."]},"updated":"2026-06-24"},"CPO-CSO-OVR":{"id":"CPO-CSO-OVR","family":"CPO","scope":"all","subset":"CSO","name":"Overview of the Cloud Service Offering","statement":"Providers MUST supply a Certification Package Overview within their FedRAMP Certification Package, in both human-readable and JSON formats, that includes at least all of the information required by the following rules:","force":"MUST","notes":["For FedRAMP Rev5, the Certification Package Overview replaces the historically required System Security Plan (not including appendices).","This list of rules may not apply to all FedRAMP Certification Classes or Types - if a rule does not apply then the information is not required."],"following_information":["Certification Package Overview: CPO-CSO-MTD (Certification Package Overview Metadata)","Certification Data Sharing: CDS-CSO-PUB (Public Information)","Certification Data Sharing: CDS-CSO-SVC (Public Service List)","Certification Data Sharing: CDS-CSO-IRP (Include Relevant Policies)","Minimum Assessment Scope: MAS-CSO-IIR (Identify Information Resources)","Minimum Assessment Scope: MAS-CSO-FLO (Information Flows and Security Categories)","Minimum Assessment Scope: MAS-CSO-TPR (Third-Party Information Resources)","Using Cryptographic Modules: CMU-CSO-CMD (Cryptographic Module Documentation)","Independent Verification and Validation: IVV-CSO-ICP (Inclusion in Certification Package)"],"related":["CPO-CSO-MTD","CDS-CSO-PUB","CDS-CSO-SVC","MAS-CSO-IIR","MAS-CSO-FLO","MAS-CSO-TPR","CMU-CSO-CMD","CDS-CSO-IRP","IVV-CSO-ICP"],"schema":{"name":"FedRAMP Certification Package Overview Schema","url":"https://fedramp.gov/schemas/fedramp-certification-package-overview-schema-2026-06-24.json"},"updated":"2026-06-24"},"CPO-CSO-MTD":{"id":"CPO-CSO-MTD","family":"CPO","scope":"all","subset":"CSO","name":"Certification Package Overview Metadata","statement":"Providers MUST also include the following basic metadata in their Certification Package Overview:","force":"MUST","following_information":["Name, title, and contact information of official that is responsible and accountable for the FedRAMP Certification Package","Version","Date and time of last update","Source of update"],"updated":"2026-06-24"},"CPO-CSO-OSA":{"id":"CPO-CSO-OSA","family":"CPO","scope":"all","subset":"CSO","name":"Overall Summary of Assessment in Certification Package","related":["IVV-IAS-OSA"],"controls":["ca-2","ca-2.1","ca-2.2","ca-7.1"],"updated":"2026-10-13","byClass":{"a":{"statement":"Providers seeking Class A Certification MAY also include an overall summary of their FedRAMP independent assessment in their Certification Package Overview.","force":"MAY"},"b":{"statement":"Providers seeking Class B Certification MUST also include the overall summary of their FedRAMP independent assessment, supplied by the assessor per IVV-IAS-OSA (Overall Summary of Assessment), in their Certification Package Overview.","force":"MUST"},"c":{"statement":"Providers seeking Class C Certification MUST also include the overall summary of their FedRAMP independent assessment, supplied by the assessor per IVV-IAS-OSA (Overall Summary of Assessment), in their Certification Package Overview.","force":"MUST"},"d":{"statement":"Providers seeking Class D Certification MUST also include the overall summary of their FedRAMP independent assessment, supplied by the assessor per IVV-IAS-OSA (Overall Summary of Assessment), in their Certification Package Overview.","force":"MUST"}}},"CPO-CSX-CPM":{"id":"CPO-CSX-CPM","family":"CPO","scope":"20x","subset":"CSX","name":"Certification Package Maintenance for 20x","notes":["Providers are expected to maintain their FedRAMP Certification Package using automation as changes occur to ensure they are never out of date.","This rule does not require or expect persistent human review of all materials in this cadence."],"updated":"2026-06-24","byClass":{"a":{"statement":"Providers with 20x Class A Certifications SHOULD persistently maintain their FedRAMP Certification Package to ensure it is up to date and complete at least once every 3 months.","force":"SHOULD","timeframe_type":"months","timeframe_num":3},"b":{"statement":"Providers with 20x Class B Certifications MUST persistently maintain their FedRAMP Certification Package to ensure it is up to date and complete at least once every month.","force":"MUST","timeframe_type":"months","timeframe_num":1},"c":{"statement":"Providers with 20x Class C Certifications MUST persistently maintain their FedRAMP Certification Package to ensure it is up to date and complete at least once every 2 weeks.","force":"MUST","timeframe_type":"weeks","timeframe_num":2},"d":{"statement":"Providers with 20x Class D Certifications MUST persistently maintain their FedRAMP Certification Package to ensure it is up to date and complete at least once every week.","force":"MUST","timeframe_type":"weeks","timeframe_num":1}}},"FRC-CSO-FCP":{"id":"FRC-CSO-FCP","family":"FRC","scope":"all","subset":"CSO","name":"FedRAMP Certification Profile","statement":"Providers MUST identify a target FedRAMP Certification Profile and apply all relevant FedRAMP Practices to the cloud service offering.","force":"MUST","note":"Information resources (including third-party information resources) MAY vary by security category as appropriate to the type of information handled by or impacted by the information resource.","updated":"2026-06-24"},"FRC-CSO-PKG":{"id":"FRC-CSO-PKG","family":"FRC","scope":"all","subset":"CSO","name":"FedRAMP Certification Package","statement":"Providers seeking a Certification MUST supply a complete FedRAMP Certification Package to FedRAMP for initial certification; the FedRAMP Certification Package MUST include at least the following information:","force":"MUST","following_information":["Information about the Cloud Service Offering following CPO-CSO-OVR (Overview of the Cloud Service Offering)","Implementation, Validation, and Assessment information for each relevant FedRAMP requirement/control/ksi as defined in SDR-CSO-FRR (FedRAMP Rules)","A real or example Ongoing Certification Report following CCM-OCR-AVL (Report Availability)"],"related":["CPO-CSO-OVR","SDR-CSO-FRR","CCM-OCR-AVL"],"schema":{"name":"FedRAMP Certification Package Overview (FRC-CSO-PKG)","url":"https://fedramp.gov/schemas/fedramp-certification-package-overview-schema-2026-06-24.json"},"updated":"2026-06-25"},"FRC-CSO-JSN":{"id":"FRC-CSO-JSN","family":"FRC","scope":"all","subset":"CSO","name":"FedRAMP JSON Schemas","statement":"Providers MUST supply machine-readable information in JSON documents that are valid against the corresponding JSON schema when a rule contains a FedRAMP JSON schema, UNLESS otherwise specified in the rule; public JSON data MUST be supplied in a manner compatible with modern web frameworks, including:","force":"MUST","notes":["FedRAMP JSON schemas are designed to be lightweight and flexible to establish a minimum set of structured information while allowing providers to improve on the format and structure of the information as needed to meet their needs and the needs of their customers.","Public JSON data is intended to be consumed by FedRAMP, agency GRC tools, and more - it should be available in a way that enables standard web-application use following standard web frameworks. Generally, if you can't write a web app to parse this data without configuring a browser to bypass security defaults then there has likely been a problem.","The Schema Validator available at fedramp.gov will not work properly if Cross-Origin Resource Sharing is not properly configured."],"following_information":["Cross-Origin Resource Sharing (CORS) should allow web applications running on a different domain to access the public JSON data directly.","Proper web application headers should be supplied for public JSON data, including at least setting Content-Type to application/json and X-Content-Type-Options: nosniff."],"updated":"2026-10-05"},"FRC-CSO-MRA":{"id":"FRC-CSO-MRA","family":"FRC","scope":"all","subset":"CSO","name":"Maintain Responsibility and Accountability","statement":"Providers MUST maintain responsibility and accountability for the accuracy and completeness of all information in the FedRAMP Certification Package, especially when they engage a third party (such as an independent assessor, advisory service, or external tools) to supply information on their behalf.","force":"MUST","updated":"2026-06-24"},"FRC-CSO-POP":{"id":"FRC-CSO-POP","family":"FRC","scope":"all","subset":"CSO","name":"Pick One Program Certification Type","statement":"Providers MUST NOT seek both FedRAMP Rev5 Program Certification and FedRAMP 20x Program Certification for the same cloud service offering; pick one type.","force":"MUST NOT","note":"This rule does not prevent a provider from seeking and maintaining a FedRAMP Rev5 Agency Certification and a FedRAMP 20x Program Certification for the same cloud service offering, however, doing so is strongly discouraged due to the increased complexity and risk of confusion for all parties.","updated":"2026-06-24"},"FRC-CLA-ASF":{"id":"FRC-CLA-ASF","family":"FRC","scope":"all","subset":"CLA","name":"Approved Alternative Security Frameworks","statement":"Providers seeking a FedRAMP Class A Certification MUST have completed a certification or equivalent process, including an independent assessment if applicable, from one of the following alternative security frameworks within the past 12 months:","force":"MUST","following_information":["FedRAMP Rev5 (including FedRAMP Ready) at any historical Impact Level","SOC 2 Type II","GovRAMP at any Impact Level"],"updated":"2026-06-24"},"FRC-CLA-EAM":{"id":"FRC-CLA-EAM","family":"FRC","scope":"all","subset":"CLA","name":"External Assessment Materials","statement":"Providers seeking a FedRAMP Class A Certification MUST supply the following materials from their alternative security framework assessment to all necessary parties:","force":"MUST","following_information":["SOC 2 Type II: Complete report, bridge or gap letter (if applicable), verified audit engagement documentation, estimated schedule for upcoming report, supplemental compliance evidence (if applicable)","FedRAMP Ready: Readiness Assessment Report, Security Assessment Plan, and any other materials required by FedRAMP.","GovRAMP: Readiness Assessment Report, Security Assessment Plan, and any other materials required by GovRAMP."],"updated":"2026-06-24"},"FRC-CLA-MFR":{"id":"FRC-CLA-MFR","family":"FRC","scope":"all","subset":"CLA","name":"Mandatory FedRAMP Rules for Class A","statement":"Providers seeking a Class A FedRAMP Certification MUST address all rules in this FedRAMP Class A Certification subset (FRC-CLA) AND the following additional FedRAMP Class A rules; the appropriate artifacts or information mapping for all rules MUST be supplied in the FedRAMP Certification Package.","force":"MUST","notes":["Some of these specific FedRAMP rules may not have similar counterparts in external frameworks and providers will need to implement new processes to follow these rules.","In general, for each of these FedRAMP requirements, providers should include a sufficiently detailed summary that reviewers will not need to dig into the related security framework materials to understand the related decisions - just saying \"see SOC 2 report\" is not particularly helpful.","Information about how the provider addresses the included Key Security Indicators are required to receive a class A certification even if the provider intends to pursue a Rev 5 Program Certification path in the future."],"following_information":["FedRAMP Certification: FRC-CSO-PKG (FedRAMP Certification Package)","FedRAMP Certification: FRC-CSO-JSN (FedRAMP JSON Schemas)","FedRAMP Certification: FRC-CSO-POP (Pick One Program Certification Type)","Minimum Assessment Scope: MAS-CSO-IIR (Identify Information Resources)","Certification Data Sharing: CDS-CSO-PUB (Public Information)","Certification Data Sharing: CDS-CSO-UTC (Use Trust Centers)","Certification Data Sharing: CDS-UTC-AAD (Agency Access Denial)","Addressing FedRAMP Communication: AFC-CSO-INB (Maintain a FedRAMP Security Inbox)","Addressing FedRAMP Communication: AFC-CSO-RCV (Receive Email Without Disruption)","Addressing FedRAMP Communication: AFC-CSO-CRA (Complete Required Actions)","Incident Evaluation and Communication: IEC-CSO-EFR (Evaluate FedRAMP Reportability)","Incident Evaluation and Communication: IEC-CSO-FIR (Final Incident Report)","Vulnerability Detection and Response: VDR-CSO-DET (Vulnerability Detection)","Collaborative Continuous Monitoring: CCM-OCR-AVL (Report Availability)","Collaborative Continuous Monitoring: CCM-OCR-NRD (Next Report Date)","Independent Verification and Validation: IVV-CSX-AIA (Annual Independent Assessments for 20x)","Key Security Indicators: KSI-CMT-LMC (Logging Changes)","Key Security Indicators: KSI-CNA-RNT (Restricting Network Traffic)","Key Security Indicators: KSI-CED-RAT (Reviewing All Training)","Key Security Indicators: KSI-IAM-AAM (Automating Account Management)","Key Security Indicators: KSI-IAM-APM (Adopting Passwordless Methods)","Key Security Indicators: KSI-INR-RIR (Reviewing Incident Response Procedures)","Key Security Indicators: KSI-SVC-SIN (Securing Information)"],"related":["FRC-CSO-POP","MAS-CSO-IIR","CDS-CSO-PUB","CDS-CSO-UTC","CDS-UTC-AAD","AFC-CSO-INB","AFC-CSO-RCV","AFC-CSO-CRA","IEC-CSO-EFR","IEC-CSO-FIR","VDR-CSO-DET","CCM-OCR-AVL","CCM-OCR-NRD","IVV-CSX-AIA","FRC-CSO-PKG","FRC-CSO-JSN","KSI-CMT-LMC","KSI-CNA-RNT","KSI-CED-RAT","KSI-IAM-AAM","KSI-INR-RIR","KSI-SVC-SIN","KSI-IAM-APM"],"updated":"2026-07-14"},"FRC-CLA-RFR":{"id":"FRC-CLA-RFR","family":"FRC","scope":"all","subset":"CLA","name":"Recommended FedRAMP Rules for Class A","statement":"Providers seeking a Class A FedRAMP Certification SHOULD address the following additional recommended FedRAMP Class A rules (if applicable):","force":"SHOULD","following_information":["Certification Data Sharing: CDS-CSO-AVR (Availability Reporting)","Certification Package Overview: CPO-CSF-CPM (Certification Package Maintenance for Rev5)","Certification Package Overview: CPO-CSX-CPM (Certification Package Maintenance for 20x)","Incident Evaluation and Communication: IEC-CSO-IIR (Initial Incident Report)","Incident Evaluation and Communication: IEC-CSO-OIR (Ongoing Incident Reports)","Vulnerability Detection and Response: VDR-TFR-MVX (Persistent Machine Verification and Validation for 20x)","Vulnerability Detection and Response: VDR-TFR-PCD (Persistently Complete Detection)","Vulnerability Detection and Response: VDR-TFR-PDD (Persistent Drift Detection)","Vulnerability Detection and Response: VDR-TFR-PSD (Persistent Sample Detection)","Vulnerability Detection and Response: VDR-TFR-PVR (Mitigation and Remediation Expectations)","Vulnerability Evaluation and Reporting: VER-TFR-EVU (Evaluate Vulnerabilities Quickly)"],"related":["CDS-CSO-AVR","CPO-CSF-CPM","CPO-CSX-CPM","IEC-CSO-IIR","IEC-CSO-OIR","VDR-TFR-MVX","VDR-TFR-PCD","VDR-TFR-PDD","VDR-TFR-PSD","VDR-TFR-PVR","VER-TFR-EVU"],"updated":"2026-06-24"},"FRC-CLA-OFR":{"id":"FRC-CLA-OFR","family":"FRC","scope":"all","subset":"CLA","name":"Address Optional FedRAMP Rules for Class A","statement":"Providers seeking a Class A FedRAMP Certification MAY address the following additional optional FedRAMP Class A rules (if applicable):","force":"MAY","following_information":["Collaborative Continuous Monitoring: CCM-QTR-MTG (Quarterly Review Meeting)","Certification Data Sharing: CDS-CSO-PSM (Per-Service Certification Materials)","Cryptographic Module Use: CMU-CSO-UVM (Using Validated Cryptographic Modules)","FedRAMP Certification: FRC-APP-FIA (Fresh Independent Assessment)","Independent Verification and Validation: IVV-CSO-FIA (FedRAMP Independent Assessments)","Security Decision Record: SDR-CSX-KMT (Key Security Indicator Metrics)","Vulnerability Evaluation and Reporting: VER-TFR-IRI (Internet-Reachable Incidents)","Vulnerability Evaluation and Reporting: VER-TFR-MRH (Historical Activity)","Vulnerability Evaluation and Reporting: VER-TFR-NRI (Non-Internet-Reachable Incidents)"],"related":["CCM-QTR-MTG","CDS-CSO-PSM","CMU-CSO-UVM","FRC-APP-FIA","IVV-CSO-FIA","SDR-CSX-KMT","VER-TFR-IRI","VER-TFR-MRH","VER-TFR-NRI"],"updated":"2026-06-24"},"FRC-CLA-IVV":{"id":"FRC-CLA-IVV","family":"FRC","scope":"all","subset":"CLA","name":"Optional Independent Verification and Validation","statement":"Providers seeking a FedRAMP Class A Certification MAY have the FedRAMP Certification Package independently verified and validated by a FedRAMP Recognized assessor before submission to FedRAMP.","force":"MAY","updated":"2026-06-24"},"FRC-APP-MLF":{"id":"FRC-APP-MLF","family":"FRC","scope":"all","subset":"APP","name":"Marketplace Listing First","statement":"Providers MUST be listed in the FedRAMP Marketplace before applying for FedRAMP Certification, including:","force":"MUST","following_information":["FedRAMP Marketplace: MKT-CSO-MLR (Marketplace Listing Requirements),","FedRAMP Marketplace: MKT-CSO-PML (Provider Marketplace Listing Requests)","FedRAMP Marketplace: MKT-IIP-AGU (Agency Use Cases)","FedRAMP Marketplace: MKT-IIP-DCP (Demonstrating Continuous Progress)"],"related":["MKT-CSO-MLR","MKT-CSO-PML","MKT-IIP-AGU","MKT-IIP-DCP"],"updated":"2026-06-24"},"FRC-APP-AFC":{"id":"FRC-APP-AFC","family":"FRC","scope":"all","subset":"APP","name":"Applying for FedRAMP Certification","statement":"Providers MUST complete the FedRAMP Certification Application Form in full to request an initial assessment by FedRAMP.","force":"MUST","updated":"2026-06-24"},"FRC-APP-FCP":{"id":"FRC-APP-FCP","family":"FRC","scope":"all","subset":"APP","name":"Fresh FedRAMP Certification Package","statement":"Providers MUST supply a fresh initial FedRAMP Certification Package that shows the current status of the cloud service offering as verified and validated by the provider within the previous 7 days.","force":"MUST","updated":"2026-06-24"},"FRC-APP-FIA":{"id":"FRC-APP-FIA","family":"FRC","scope":"all","subset":"APP","name":"Fresh Independent Assessment","updated":"2026-06-24","byClass":{"a":{"statement":"Providers seeking Class A Certification MAY supply a fresh initial FedRAMP independent assessment that was completed by a FedRAMP Recognized independent assessment service within the previous 3 months.","force":"MAY","timeframe_type":"months","timeframe_num":3},"b":{"statement":"Providers seeking Class B Certification MUST supply a fresh initial FedRAMP independent assessment that was completed by a FedRAMP Recognized independent assessment service within the previous 3 months.","force":"MUST","timeframe_type":"months","timeframe_num":3},"c":{"statement":"Providers seeking Class C Certification MUST supply a fresh initial FedRAMP independent assessment that was completed by a FedRAMP Recognized independent assessment service within the previous 3 months.","force":"MUST","timeframe_type":"months","timeframe_num":3},"d":{"statement":"Providers seeking Class D Certification MUST supply a fresh initial FedRAMP independent assessment that was completed by a FedRAMP Recognized independent assessment service within the previous 3 months.","force":"MUST","timeframe_type":"months","timeframe_num":3}}},"FRC-APP-NTP":{"id":"FRC-APP-NTP","family":"FRC","scope":"all","subset":"APP","name":"No Third-Party Applicants","statement":"Providers MUST NOT use a third party to apply for a FedRAMP Certification on their behalf; this includes independent assessment services.","force":"MUST NOT","notes":["FedRAMP previously allowed independent assessment services to submit applications on behalf of providers, but this caused confusion about who was responsible for the application and the information in it. Providers should apply directly to ensure clear accountability.","Providers may use third parties to help them prepare their application and assessment materials for submission."],"updated":"2026-06-24"},"FRC-APP-USA":{"id":"FRC-APP-USA","family":"FRC","scope":"all","subset":"APP","name":"Updating Stale Assessments","statement":"Providers MAY freshen a stale initial independent verification and validation assessment by having a FedRAMP Recognized independent assessment service review any changes between the original assessment and the current status of the cloud service offering in place of a full re-assessment, UNLESS the stale assessment is more than 9 months old.","force":"MAY","updated":"2026-06-24"},"FRC-APS-ATO":{"id":"FRC-APS-ATO","family":"FRC","scope":"all","subset":"APS","name":"Agency Authorization to Operate","statement":"Providers seeking a FedRAMP Rev5 Agency Certification MUST have completed the Authorization to Operate (ATO) process with their agency sponsor for the cloud service offering, concluding with a formal signed ATO letter that the agency has sent over official government channels to FedRAMP.","force":"MUST","updated":"2026-06-24"},"FRC-CCL-UCC":{"id":"FRC-CCL-UCC","family":"FRC","scope":"all","subset":"CCL","name":"Upgrading Certification Class","statement":"Providers MUST apply for a new FedRAMP Certification to upgrade their Certification Class; all applicable requirements MUST be met in advance.","force":"MUST","notes":["Upgrade paths include moving from A to B, C, or D; B to C or D; and C to D.","The preferred path is to incrementally update the implementation and assurance commitments within the current Certification Class until the provider has met all requirements for the target Certification Class, then apply for the new Certification Class."],"updated":"2026-06-24"},"FRC-CCL-DCC":{"id":"FRC-CCL-DCC","family":"FRC","scope":"all","subset":"CCL","name":"Downgrading Certification Class","statement":"Providers MUST apply for a new FedRAMP Certification to downgrade their Certification Class.","force":"MUST","notes":["Downgrade paths include moving from D to C, B, or A; C to B or A; or B to A.","FRC-CCL-DNP (Downgrade Notification Period) applies - please DO NOT downgrade Certification Class with providing advance notification to all necessary parties!"],"related":["FRC-CCL-DNP"],"updated":"2026-06-24"},"FRC-CCL-DNP":{"id":"FRC-CCL-DNP","family":"FRC","scope":"all","subset":"CCL","name":"Downgrade Notification Period","statement":"Providers SHOULD notify all necessary parties at least 120 days in advance of an intended downgrade or cancellation of FedRAMP Certification.","force":"SHOULD","note":"Downgrading or canceling FedRAMP Certification will have severe negative consequences for the provider and their agency customers and should only be done after careful consideration and planning... but if it must be done, notify all necessary parties as soon as possible.","updated":"2026-06-24"},"FRC-CSX-VVK":{"id":"FRC-CSX-VVK","family":"FRC","scope":"20x","subset":"CSX","name":"Automated Verification and Validation of Key Security Indicators","controls":["cm-2.2","si-6"],"updated":"2026-10-13","byClass":{"a":{"statement":"Providers seeking 20x Class A Certification MAY implement automated methods to persistently verify and validate the accuracy and completeness of Key Security Indicators.","force":"MAY"},"b":{"statement":"Providers seeking 20x Class B Certification SHOULD implement automated methods to persistently verify and validate the accuracy and completeness of Key Security Indicators with at least 1 automated method for each Key Security Indicator.","force":"SHOULD"},"c":{"statement":"Providers seeking 20x Class C Certification MUST implement automated methods to persistently verify and validate the accuracy and completeness of Key Security Indicators with at least 2 automated methods for each Key Security Indicator.","force":"MUST"},"d":{"statement":"Providers seeking 20x Class D Certification MUST implement automated methods to persistently verify and validate the accuracy and completeness of Key Security Indicators with at least 4 automated methods for each Key Security Indicator.","force":"MUST"}}},"FRC-CSX-VVR":{"id":"FRC-CSX-VVR","family":"FRC","scope":"20x","subset":"CSX","name":"Automated Verification and Validation of FedRAMP Rules","note":"Different rules will be easy to automate for different providers, depending on the implementation, so FedRAMP generally leaves this implementation up to providers based on what makes the most sense for their own business and approach.","controls":["si-6"],"updated":"2026-10-13","byClass":{"a":{"statement":"Providers seeking 20x Class A Certification MAY implement automated methods to persistently verify and validate the accuracy and completeness of the Security Decision Record for FedRAMP rules when applicable.","force":"MAY"},"b":{"statement":"Providers seeking 20x Class B Certification SHOULD implement automated methods to persistently verify and validate the accuracy and completeness of the Security Decision Record for FedRAMP rules when applicable.","force":"SHOULD"},"c":{"statement":"Providers seeking 20x Class C Certification SHOULD implement automated methods to persistently verify and validate the accuracy and completeness of the Security Decision Record for FedRAMP rules when applicable.","force":"SHOULD"},"d":{"statement":"Providers seeking 20x Class D Certification SHOULD implement automated methods to persistently verify and validate the accuracy and completeness of the Security Decision Record for FedRAMP rules when applicable.","force":"SHOULD"}}},"FRC-CSX-MAS":{"id":"FRC-CSX-MAS","family":"FRC","scope":"20x","subset":"CSX","name":"Application within MAS","statement":"Providers SHOULD apply ALL Key Security Indicators to ALL aspects of their cloud service offering that are within the FedRAMP Minimum Assessment Scope.","force":"SHOULD","updated":"2026-06-24"},"IEC-CSO-EFR":{"id":"IEC-CSO-EFR","family":"IEC","scope":"all","subset":"CSO","name":"Evaluate FedRAMP Reportability","statement":"Providers MUST promptly evaluate incidents to determine if they affect confidentiality or integrity of federal customer data or are likely to affect confidentiality or integrity of federal customer data; such incidents are FedRAMP Reportable Incidents and must be reported following the FedRAMP Incident Evaluation and Communication rules.","force":"MUST","controls":["au-5.2","ir-4.11"],"artifacts":{"all":["An incident log showing an example of one or more incidents being evaluated including the reason for the determination. The log can be from real incidents, simulated incidents, or a combination of sources."]},"updated":"2026-10-13"},"IEC-CSO-DPR":{"id":"IEC-CSO-DPR","family":"IEC","scope":"all","subset":"CSO","name":"Default PAIN Rating","statement":"Providers MUST treat FedRAMP Reportable Incidents as if they have a Potential Agency Impact N-rating (PAIN) of 5 UNLESS they promptly estimate the PAIN rating following the rule in IEC-CSO-EFI (Estimate Federal Impact).","force":"MUST","related":["IEC-CSO-EFI"],"updated":"2026-06-24"},"IEC-CSO-IIR":{"id":"IEC-CSO-IIR","family":"IEC","scope":"all","subset":"CSO","name":"Initial Incident Report","related":["IEC-CSO-EFI"],"controls":["au-5.2","ir-5"],"schema":{"name":"FedRAMP Incident Report (IEC-CSO-IIR / IEC-CSO-OIR / IEC-CSO-FIR)","url":"https://fedramp.gov/schemas/fedramp-incident-report-schema-2026-06-24.json"},"updated":"2026-10-13","byClass":{"a":{"statement":"Providers with Class A Certifications SHOULD responsibly notify all affected parties after identifying FedRAMP Reportable Incidents by providing an Initial Incident Report with as much of the following information that is available at the time of reporting and/or the current relevant status for each item:","force":"SHOULD","following_information":["Contact information for the federal incident response coordinator","Provider's internally assigned tracking identifier","Description of the incident","Timeline of the incident, including start time, time and source of detection, time of completed FedRAMP Reportable Incident evaluation, and other major incident milestones determined by the provider","Historically and currently estimated Potential Agency Impact N-rating (PAIN) of the incident, including an explanation of the evaluation following the requirements in IEC-CSO-EFI (Estimate Federal Impact) (if applicable)","Functional impact to federal agency customers (include impact to confidentiality and/or integrity and the impacted federal customer data types)","Estimated recovery plan, milestones, and timelines","List of likely affected customer agencies"],"artifacts":{"all":["An Initial Incident Report for one or more incidents. The report can be from real incidents, simulated incidents, or a combination of sources."]}},"b":{"statement":"Providers with Class B Certifications MUST responsibly notify all affected parties after identifying FedRAMP Reportable Incidents by providing an Initial Incident Report with as much of the following information that is available at the time of reporting and/or the current relevant status for each item:","force":"MUST","following_information":["Contact information for the federal incident response coordinator.","Provider's internally assigned tracking identifier","Description of the incident","Timeline of the incident, including start time, time and source of detection, time of completed FedRAMP Reportable Incident evaluation, and other major incident milestones determined by the provider","Historically and currently estimated Potential Agency Impact N-rating (PAIN) of the incident, including an explanation of the evaluation following the requirements in IEC-CSO-EFI (Estimate Federal Impact) (if applicable)","Functional impact to federal agency customers (include impact to confidentiality and/or integrity and the impacted federal customer data types)","Estimated recovery plan, milestones, and timelines","List of likely affected customer agencies"],"artifacts":{"all":["An Initial Incident Report for one or more incidents. The report can be from real incidents, simulated incidents, or a combination of sources."]}},"c":{"statement":"Providers with Class C Certifications MUST responsibly notify all affected parties after identifying FedRAMP Reportable Incidents by providing an Initial Incident Report with as much of the following information that is available at the time of reporting and/or the current relevant status for each item:","force":"MUST","following_information":["Contact information for the federal incident response coordinator.","Provider's internally assigned tracking identifier","Description of the incident","Timeline of the incident, including start time, time and source of detection, time of completed FedRAMP Reportable Incident evaluation, and other major incident milestones determined by the provider","Historically and currently estimated Potential Agency Impact N-rating (PAIN) of the incident, including an explanation of the evaluation following the requirements in IEC-CSO-EFI (Estimate Federal Impact) (if applicable)","Functional impact to federal agency customers (include impact to confidentiality and/or integrity and the impacted federal customer data types)","Estimated recovery plan, milestones, and timelines","List of likely affected customer agencies"],"artifacts":{"all":["An Initial Incident Report for one or more incidents. The report can be from real incidents, simulated incidents, or a combination of sources."]}},"d":{"statement":"Providers with Class D Certifications MUST responsibly notify all affected parties after identifying FedRAMP Reportable Incidents by providing an Initial Incident Report with as much of the following information that is available at the time of reporting and/or the current relevant status for each item:","force":"MUST","following_information":["Contact information for the federal incident response coordinator.","Provider's internally assigned tracking identifier","Description of the incident","Timeline of the incident, including start time, time and source of detection, time of completed FedRAMP Reportable Incident evaluation, and other major incident milestones determined by the provider","Historically and currently estimated Potential Agency Impact N-rating (PAIN) of the incident, including an explanation of the evaluation following the requirements in IEC-CSO-EFI (Estimate Federal Impact) (if applicable)","Functional impact to federal agency customers (include impact to confidentiality and/or integrity and the impacted federal customer data types)","Estimated recovery plan, milestones, and timelines","List of likely affected customer agencies"],"artifacts":{"all":["An Initial Incident Report for one or more incidents. The report can be from real incidents, simulated incidents, or a combination of sources."]}}}},"IEC-CSO-OIR":{"id":"IEC-CSO-OIR","family":"IEC","scope":"all","subset":"CSO","name":"Ongoing Incident Reports","controls":["ir-5"],"schema":{"name":"FedRAMP Incident Report (IEC-CSO-IIR / IEC-CSO-OIR / IEC-CSO-FIR)","url":"https://fedramp.gov/schemas/fedramp-incident-report-schema-2026-06-24.json"},"updated":"2026-10-13","byClass":{"a":{"statement":"Providers with Class A Certifications SHOULD responsibly notify all affected parties of ongoing activity as new information becomes available during incident response for FedRAMP Reportable Incidents, including updates (or lack of updates) to all previously reported information and as much of the following additional information that is available and/or the current relevant status for each item:","force":"SHOULD","following_information":["Observed incident activity","Indicators of compromise","Related Common Vulnerabilities and Exposures (CVE) identifier (if applicable)","Root cause","Response and recovery activities"],"artifacts":{"all":["An Ongoing Incident Report for one or more incidents. The report can be from real incidents, simulated incidents, or a combination of sources."]}},"b":{"statement":"Providers with Class B Certifications MUST responsibly notify all affected parties of ongoing activity as new information becomes available during incident response for FedRAMP Reportable Incidents, including updates (or lack of updates) to all previously reported information and as much of the following additional information that is available and/or the current relevant status for each item:","force":"MUST","following_information":["Observed incident activity","Indicators of compromise","Related Common Vulnerabilities and Exposures (CVE) identifier, if applicable","Root cause","Response and recovery activities"],"artifacts":{"all":["An Ongoing Incident Report for one or more incidents. The report can be from real incidents, simulated incidents, or a combination of sources."]}},"c":{"statement":"Providers with Class C Certifications MUST responsibly notify all affected parties of ongoing activity as new information becomes available during incident response for FedRAMP Reportable Incidents, including updates (or lack of updates) to all previously reported information and as much of the following additional information that is available and/or the current relevant status for each item:","force":"MUST","following_information":["Observed incident activity","Indicators of compromise","Related Common Vulnerabilities and Exposures (CVE) identifier, if applicable","Root cause","Response and recovery activities"],"artifacts":{"all":["An Ongoing Incident Report for one or more incidents. The report can be from real incidents, simulated incidents, or a combination of sources."]}},"d":{"statement":"Providers with Class D Certifications MUST responsibly notify all affected parties of ongoing activity as new information becomes available during incident response for FedRAMP Reportable Incidents, including updates (or lack of updates) to all previously reported information and as much of the following additional information that is available and/or the current relevant status for each item:","force":"MUST","following_information":["Observed incident activity","Indicators of compromise","Related Common Vulnerabilities and Exposures (CVE) identifier, if applicable","Root cause","Response and recovery activities"],"artifacts":{"all":["An Ongoing Incident Report for one or more incidents. The report can be from real incidents, simulated incidents, or a combination of sources."]}}}},"IEC-CSO-FIR":{"id":"IEC-CSO-FIR","family":"IEC","scope":"all","subset":"CSO","name":"Final Incident Report","controls":["ir-5"],"schema":{"name":"FedRAMP Incident Report (IEC-CSO-IIR / IEC-CSO-OIR / IEC-CSO-FIR)","url":"https://fedramp.gov/schemas/fedramp-incident-report-schema-2026-06-24.json"},"updated":"2026-10-13","byClass":{"a":{"statement":"Providers with Class A Certifications MUST responsibly notify all affected parties by providing a Final Incident Report once the incident has been resolved and recovery is complete, including final updates to all previously reported information.","force":"MUST","artifacts":{"all":["An Final Incident Report for one or more incidents. The report can be from real incidents, simulated incidents, or a combination of sources."]}},"b":{"statement":"Providers with Class B Certifications MUST responsibly notify all affected parties by providing a Final Incident Report once the incident has been resolved and recovery is complete, including final updates to all previously reported information.","force":"MUST","artifacts":{"all":["An Final Incident Report for one or more incidents. The report can be from real incidents, simulated incidents, or a combination of sources."]}},"c":{"statement":"Providers with Class C Certifications MUST responsibly notify all affected parties by providing a Final Incident Report once the incident has been resolved and recovery is complete, including final updates to all previously reported information.","force":"MUST","artifacts":{"all":["An Final Incident Report for one or more incidents. The report can be from real incidents, simulated incidents, or a combination of sources."]}},"d":{"statement":"Providers with Class D Certifications MUST responsibly notify all affected parties by providing a Final Incident Report once the incident has been resolved and recovery is complete, including final updates to all previously reported information.","force":"MUST","artifacts":{"all":["An Final Incident Report for one or more incidents. The report can be from real incidents, simulated incidents, or a combination of sources."]}}}},"IEC-CSO-EFI":{"id":"IEC-CSO-EFI","family":"IEC","scope":"all","subset":"CSO","name":"Estimate Federal Impact","statement":"Providers SHOULD promptly estimate the likely adverse impact of an incident on agency customers to assign a Potential Agency Impact N-rating; this step is called Incident Rating.","force":"SHOULD","note":"All incidents must be assigned a default PAIN-5 as required by IEC-CSO-DPR (Default PAIN Rating) if this step is not completed.","following_information_bullets":["**N1** for a likely minimal customer effect on 1 or more agencies.","**N2** for a likely narrow customer effect on 1 or more agencies.","**N3** for a likely disruptive customer effect on 1 agency.","**N4** for a likely debilitating customer effect on 1 agency or a likely disruptive customer effect on more than 1 agency.","**N5** for a likely debilitating customer effect on more than 1 agency."],"related":["IEC-CSO-DPR"],"artifacts":{"all":["An incident log showing an example of one or more incidents being evaluated including the reason for the determination. The log can be from real incidents, simulated incidents, or a combination of sources."]},"schema":{"name":"FedRAMP Incident Report (IEC-CSO-IIR / IEC-CSO-OIR / IEC-CSO-FIR)","url":"https://fedramp.gov/schemas/fedramp-incident-report-schema-2026-06-24.json"},"updated":"2026-06-24"},"IEC-CSO-AIR":{"id":"IEC-CSO-AIR","family":"IEC","scope":"all","subset":"CSO","name":"Automated Incident Reporting","statement":"Providers SHOULD use automation to minimize human intervention in the process of reporting FedRAMP Reportable Incidents to all affected parties.","force":"SHOULD","updated":"2026-06-24"},"IVV-CSO-FIA":{"id":"IVV-CSO-FIA","family":"IVV","scope":"all","subset":"CSO","name":"FedRAMP Independent Assessments","notes":["The first such completed assessment is typically called an \"initial assessment\" while following assessments are called \"annual assessments.\"","The specific requirements for independent verification and validation assessments are documented by the FedRAMP Certification Class and Type.","The option for assessment by FedRAMP directly is limited to cloud services that are explicitly prioritized by FedRAMP, in consultation with the FedRAMP Board and the federal Chief Information Officers Council; this is _extremely_ rare.","FedRAMP Recognized independent assessment services are listed on the FedRAMP Marketplace."],"controls":["ca-2","ca-2.1","ca-2.2","ca-7.1","ca-7.4"],"updated":"2026-10-13","byClass":{"a":{"statement":"Providers with Class A Certifications MAY persistently complete an independent verification and validation assessment of all applicable FedRAMP rules with a FedRAMP Recognized independent assessment service OR FedRAMP at least once per year; this is a FedRAMP independent assessment.","force":"MAY","timeframe_type":"years","timeframe_num":1},"b":{"statement":"Providers with Class B Certifications MUST persistently complete an independent verification and validation assessment of all applicable FedRAMP rules with a FedRAMP Recognized independent assessment service OR FedRAMP at least once per year; this is a FedRAMP independent assessment.","force":"MUST","timeframe_type":"years","timeframe_num":1},"c":{"statement":"Providers with Class C Certifications MUST persistently complete an independent verification and validation assessment of all applicable FedRAMP rules with a FedRAMP Recognized independent assessment service OR FedRAMP at least once per year; this is a FedRAMP independent assessment.","force":"MUST","timeframe_type":"years","timeframe_num":1},"d":{"statement":"Providers with Class D Certifications MUST persistently complete an independent verification and validation assessment of all applicable FedRAMP rules with a FedRAMP Recognized independent assessment service OR FedRAMP at least once per year; this is a FedRAMP independent assessment.","force":"MUST","timeframe_type":"years","timeframe_num":1}}},"IVV-CSO-SEI":{"id":"IVV-CSO-SEI","family":"IVV","scope":"all","subset":"CSO","name":"Supply Evidence of Implementation","statement":"Providers MUST supply evidence to all necessary assessors of the implementation of the measures that have been documented to meet FedRAMP Practices; this evidence is the result of verification.","force":"MUST","note":"For example, if the documentation says that firewall rules are used to block traffic then the cloud service provider would verify that firewall rules are in place to block traffic and supply that evidence to assessors (preferably by allowing them to see how firewall configurations are deployed from a source of truth).","updated":"2026-06-24"},"IVV-CSO-SEE":{"id":"IVV-CSO-SEE","family":"IVV","scope":"all","subset":"CSO","name":"Supply Evidence of Effectiveness","statement":"Providers MUST supply evidence to all necessary assessors of the effectiveness of the measures that have been implemented to meet FedRAMP Practices; this evidence is the result of validation.","force":"MUST","note":"For example, after verifying that firewalls are configured to block traffic following IVV-CSO-SEI (Supply Evidence of Implementation), the provider would validate that traffic is actually being blocked and supply evidence of that validation to assessors (such as by allowing them to see metrics on the traffic that is blocked vs not).","related":["IVV-CSO-SEI"],"updated":"2026-06-24"},"IVV-CSO-ICP":{"id":"IVV-CSO-ICP","family":"IVV","scope":"all","subset":"CSO","name":"Inclusion in Certification Package","statement":"Providers MUST supply the results of FedRAMP independent assessments in their FedRAMP Certification Package without inappropriate modification.","force":"MUST","notes":["Inappropriate modification in this context means changing the underlying intent/etc. of the content provided by the independent assessment service - the content itself may be modified for presentation, formatting, etc. as needed.","This rule is related to IVV-IAS-VIP (Verify Inclusion in Certification Package)."],"related":["IVV-IAS-VIP"],"updated":"2026-06-24"},"IVV-CSO-DUS":{"id":"IVV-CSO-DUS","family":"IVV","scope":"all","subset":"CSO","name":"Document Use of Representative Samples","statement":"Providers MUST document and explain the use of representative samples during verification and validation when using representative samples as allowed by IVV-CSO-USR (Use Representative Samples).","force":"MUST","related":["IVV-CSO-USR"],"updated":"2026-06-24"},"IVV-CSO-STE":{"id":"IVV-CSO-STE","family":"IVV","scope":"all","subset":"CSO","name":"Supply Technical Explanations","statement":"Providers SHOULD supply all necessary assessors with technical explanations, demonstrations, and other relevant supporting information about the technical capabilities they employ to address FedRAMP rules; this SHOULD be supplied as necessary to ensure the assessor can effectively complete verification and validation.","force":"SHOULD","updated":"2026-06-24"},"IVV-CSO-USR":{"id":"IVV-CSO-USR","family":"IVV","scope":"all","subset":"CSO","name":"Use Representative Samples","statement":"Providers MAY use representative samples as appropriate during verification and validation.","force":"MAY","note":"Many modern cloud services using effective automation do not need to use representative sampling and are capable of persistently verifying and validating the majority of their security measures automatically.","updated":"2026-06-24"},"IVV-CSO-RAA":{"id":"IVV-CSO-RAA","family":"IVV","scope":"all","subset":"CSO","name":"Receiving Assessor Advice","statement":"Providers MAY ask for and accept advice from their assessor during assessment regarding techniques and procedures that will improve their security posture or the effectiveness, clarity, and accuracy of their verification, validation and reporting procedures, UNLESS doing so is likely to compromise the objectivity and integrity of the assessment.","force":"MAY","updated":"2026-06-24"},"IVV-CSX-AIA":{"id":"IVV-CSX-AIA","family":"IVV","scope":"20x","subset":"CSX","name":"Annual Independent Assessments for 20x","updated":"2026-06-24","byClass":{"a":{"statement":"Providers with 20x Class A Certifications MUST meet the expectations of their underlying alternative security framework as part of their persistent independent verification and validation assessment.","force":"MUST"},"b":{"statement":"Providers with 20x Class B Certifications MUST include all Key Security Indicators in a FedRAMP independent assessment at least once per year.","force":"MUST","timeframe_type":"years","timeframe_num":1},"c":{"statement":"Providers with 20x Class C Certifications MUST include all Key Security Indicators in a FedRAMP independent assessment at least once per year.","force":"MUST","timeframe_type":"years","timeframe_num":1},"d":{"statement":"Providers with 20x Class D Certifications MUST include all Key Security Indicators in a FedRAMP independent assessment at least once per year.","force":"MUST","timeframe_type":"years","timeframe_num":1}}},"MAS-CSO-IIR":{"id":"MAS-CSO-IIR","family":"MAS","scope":"all","subset":"CSO","name":"Identify Information Resources","statement":"Providers MUST identify a set of information resources to assess for FedRAMP Certification that includes all information resources that are likely to handle federal customer data or likely to impact the confidentiality, integrity, or availability of federal customer data handled by the cloud service offering; this set of information resources is the cloud service offering.","force":"MUST","notes":["Certain categories of cloud computing products and services are specified as entirely outside the scope of FedRAMP by the Director of the Office of Management and Budget. All such products and services are therefore not included in the cloud service offering for FedRAMP. For more, see https://fedramp.gov/scope.","Software produced by cloud service providers that is delivered separately for installation on agency systems and not operated in a shared responsibility model (typically including agents, application clients, mobile applications, etc. that are not fully managed by the cloud service provider) is not a cloud computing product or service and is entirely outside the scope of FedRAMP under the FedRAMP Certification Act. All such software is therefore not included in the cloud service offering for FedRAMP. For more, see https://fedramp.gov/scope.","All aspects of the cloud service offering are determined and maintained by the cloud service provider in accordance with related FedRAMP Certification rules and documented by the cloud service provider in their FedRAMP Certification Package."],"controls":["cm-8.4","ra-3","si-4.19"],"artifacts":{"all":["A machine readable output containing all required data of the components of the cloud service offering that are likely to handle federal customer data or likely to impact the confidentiality, integrity, or availability of federal customer data handled by the cloud service offering.","A human readable explanation of how the machine readable output is derived.","The code for the automated process used to generate the machine readable output."]},"updated":"2026-10-13"},"MAS-CSO-FLO":{"id":"MAS-CSO-FLO","family":"MAS","scope":"all","subset":"CSO","name":"Information Flows and Security Categories","statement":"Providers MUST clearly identify, document, and explain information flows and security categories for ALL information resources or sets of information resources in the cloud service offering.","force":"MUST","note":"Information resources (including third-party information resources) MAY vary by security category as appropriate to the type of information handled by or impacted by the information resource.","controls":["ac-4","cm-12","cm-12.1","ra-3","si-4.19"],"artifacts":{"all":["A machine readable output containing all required data of the permitted connections between components of the cloud service offering that are likely to handle federal customer data or likely to impact the confidentiality, integrity, or availability of federal customer data handled by the cloud service offering.","A human readable explanation of how the machine readable output is derived.","The code for the automated process used to generate the machine readable output."]},"updated":"2026-10-13"},"MAS-CSO-TPR":{"id":"MAS-CSO-TPR","family":"MAS","scope":"all","subset":"CSO","name":"Third-Party Information Resources","statement":"Providers MUST address the potential impact to federal customer data from third-party information resources used by the cloud service offering, ONLY IF MAS-CSO-IIR (Identify Information Resources) APPLIES, by documenting the following information about each applicable third-party information resource:","force":"MUST","following_information":["General usage and configuration","Explanation or justification for use","Mitigation measures in place to reduce the potential impact to federal customer data","Compensating controls in place to reduce the potential impact to federal customer data"],"related":["MAS-CSO-IIR"],"controls":["ra-3"],"artifacts":{"all":["A machine readable output containing all required data of the third-party information resources of the cloud service offering that are likely to handle federal customer data or likely to impact the confidentiality, integrity, or availability of federal customer data handled by the cloud service offering.","A human readable explanation of how the machine readable output is derived.","The code for the automated process used to generate the machine readable output."]},"schema":{"name":"FedRAMP Certification Package Overview (FRC-CSO-PKG)","url":"https://fedramp.gov/schemas/fedramp-certification-package-overview-schema-2026-06-24.json"},"updated":"2026-10-13"},"MAS-CSO-MDI":{"id":"MAS-CSO-MDI","family":"MAS","scope":"all","subset":"CSO","name":"Metadata Inclusion","statement":"Providers MUST include metadata (including metadata about federal customer data) in the Minimum Assessment Scope ONLY IF MAS-CSO-IIR (Identify Information Resources) APPLIES.","force":"MUST","related":["MAS-CSO-IIR"],"artifacts":{"all":["A machine readable output containing all required data of the metadata collected or maintained by the cloud service offering that are likely to handle federal customer data or likely to impact the confidentiality, integrity, or availability of federal customer data handled by the cloud service offering.","A human readable explanation of how the machine readable output is derived.","The code for the automated process used to generate the machine readable output."]},"updated":"2026-06-24"},"MAS-CSO-SUP":{"id":"MAS-CSO-SUP","family":"MAS","scope":"all","subset":"CSO","name":"Supplemental Information","statement":"Providers MAY include additional materials about other information resources that are not part of the cloud service offering in a FedRAMP Certification Package supplement; these resources will not be FedRAMP Certified and MUST be clearly marked and separated from the cloud service offering.","force":"MAY","note":"This is intended to allow inclusion of things like security materials for apps, supplemental marketing collateral, and other information that is not part of the cloud service offering but may be useful to agencies.","updated":"2026-06-24"},"MKT-CSO-MLR":{"id":"MKT-CSO-MLR","family":"MKT","scope":"all","subset":"CSO","name":"Marketplace Listing Requirements","statement":"Providers MUST address at least these FedRAMP rules to apply for a new FedRAMP Marketplace listing OR to request updates to an existing listing:","force":"MUST","following_information":["Certification Data Sharing: CDS-CSO-PUB (Public Information)"],"related":["CDS-CSO-PUB"],"updated":"2026-06-24"},"MKT-CSO-PML":{"id":"MKT-CSO-PML","family":"MKT","scope":"all","subset":"CSO","name":"Provider Marketplace Listing Requests","statement":"Providers MUST notify FedRAMP using the FedRAMP Marketplace Providing Listing Request Form to request a listing in the FedRAMP Marketplace.","force":"MUST","note":"FedRAMP does not accept applications for a FedRAMP Marketplace Listing via email!","updated":"2026-06-24"},"MKT-IIP-AGU":{"id":"MKT-IIP-AGU","family":"MKT","scope":"all","subset":"IIP","name":"Agency Use Cases","statement":"Providers MUST demonstrate that a cloud service offering is intended for one of the following use cases:","force":"MUST","notes":["FedRAMP will not list products or services that are outside the explicit statutory scope of FedRAMP; See MKT-FRP-SOF (Scope of FedRAMP).","Services used by private companies to meet other compliance requirements (such as CMMC) that do not also meet one of the above use cases are outside the scope of FedRAMP."],"following_information":["Direct Use: The product will be used directly by agency customers for integration into a federal information system that falls within the scope of 44 USC § 3506 and will receive an agency Authorization to Operate.","Indirect Use: The product will be included as a third-party information resource in other cloud service offerings that are directly used by agency customers."],"related":["MKT-FRP-SOF"],"updated":"2026-06-24"},"MKT-IIP-DCP":{"id":"MKT-IIP-DCP","family":"MKT","scope":"all","subset":"IIP","name":"Demonstrating Continuous Progress","statement":"Providers MUST demonstrate continuous progress towards a FedRAMP Certification, documented in their Trust Center or website and updated at least quarterly; progress is measured by the provider against documented goals and milestones.","force":"MUST","note":"This is an opportunity for a business to showcase its goals and progress, and should be seen as a marketing and customer experience challenge instead of a compliance challenge.","updated":"2026-06-24"},"MKT-IIP-DLA":{"id":"MKT-IIP-DLA","family":"MKT","scope":"all","subset":"IIP","name":"Deadline for Assessment","statement":"Providers MUST demonstrate that an assessment for a FedRAMP Certification Class B, C, or D has been scheduled within 2 years of initial listing in the Initial Implementation Phase.","force":"MUST","timeframe_type":"years","timeframe_num":2,"updated":"2026-06-24"},"SCG-CSO-RSC":{"id":"SCG-CSO-RSC","family":"SCG","scope":"all","subset":"CSO","name":"Recommended Secure Configuration","statement":"Providers MUST create, maintain, and make available recommendations for securely configuring their cloud services (the Secure Configuration Guide) that includes at least the following information:","force":"MUST","notes":["These rules refer to this guidance as a Secure Configuration Guide but cloud service providers may make this guidance available in various appropriate forms that provide the best customer experience.","This guidance should explain how top-level administrative accounts and privileged accounts are named and referred to in the cloud service offering."],"following_information":["Required: Instructions on how to securely access, configure, operate, and decommission top-level administrative accounts that control enterprise access to the entire cloud service offering.","Required: Explanations of security-related settings that can be operated only by top-level administrative accounts and their security implications.","Recommended: Explanations of security-related settings that can be operated only by privileged accounts and their security implications."],"controls":["cm-7"],"artifacts":{"all":["URL to the human-readable data.","URL to the machine-readable data."]},"schema":{"name":"FedRAMP Certification Package Overview (FRC-CSO-PKG)","url":"https://fedramp.gov/schemas/fedramp-certification-package-overview-schema-2026-06-24.json"},"updated":"2026-10-13"},"SCG-CSO-AUP":{"id":"SCG-CSO-AUP","family":"SCG","scope":"all","subset":"CSO","name":"Use Instructions","statement":"Providers MUST include instructions in the FedRAMP Certification Package that explain how to obtain and use the Secure Configuration Guide.","force":"MUST","note":"These instructions may appear in a variety of ways; it is up to the provider to do so in the most appropriate and effective ways for their specific customer needs.","artifacts":{"all":["URL or explanation of how to request these materials.","Explanation of how the provider decides whether or not to share these materials or other related policies."]},"updated":"2026-06-24"},"SCG-CSO-PUB":{"id":"SCG-CSO-PUB","family":"SCG","scope":"all","subset":"CSO","name":"Public Secure Configuration Guidance","statement":"Providers SHOULD make the Secure Configuration Guide available publicly.","force":"SHOULD","artifacts":{"all":["Explanation of how to access this information","or explanation why this functionality is not available"]},"updated":"2026-06-24"},"SCG-CSO-SDF":{"id":"SCG-CSO-SDF","family":"SCG","scope":"all","subset":"CSO","name":"Secure Defaults","statement":"Providers SHOULD set all settings to their recommended secure defaults for top-level administrative accounts and privileged accounts when initially provisioned.","force":"SHOULD","artifacts":{"all":["Explanation of how to access this information","or explanation why this functionality is not available"]},"updated":"2026-06-24"},"SCG-ENH-CMP":{"id":"SCG-ENH-CMP","family":"SCG","scope":"all","subset":"ENH","name":"Comparison Capability","statement":"Providers SHOULD offer the capability to compare all current settings for top-level administrative accounts and privileged accounts to the recommended secure defaults.","force":"SHOULD","artifacts":{"all":["Explanation of how to access this information","or explanation why this functionality is not available"]},"updated":"2026-06-24"},"SCG-ENH-EXP":{"id":"SCG-ENH-EXP","family":"SCG","scope":"all","subset":"ENH","name":"Export Capability","statement":"Providers SHOULD offer the capability to export all security settings in a machine-readable format.","force":"SHOULD","artifacts":{"all":["Explanation of how to access this information","or explanation why this functionality is not available"]},"updated":"2026-06-24"},"SCG-ENH-API":{"id":"SCG-ENH-API","family":"SCG","scope":"all","subset":"ENH","name":"API Capability","statement":"Providers SHOULD offer the capability to view and adjust security settings via an API or similar capability.","force":"SHOULD","artifacts":{"all":["Explanation of how to access this information","or explanation why this functionality is not available"]},"updated":"2026-06-24"},"SCG-ENH-MRG":{"id":"SCG-ENH-MRG","family":"SCG","scope":"all","subset":"ENH","name":"Machine-Readable Guidance","statement":"Providers SHOULD also provide the Secure Configuration Guide in a machine-readable format that can be used by customers or third-party tools to compare against current settings.","force":"SHOULD","artifacts":{"all":["Explanation of how to access this information","or explanation why this functionality is not available"]},"updated":"2026-06-24"},"SCG-ENH-VRH":{"id":"SCG-ENH-VRH","family":"SCG","scope":"all","subset":"ENH","name":"Versioning and Release History","statement":"Providers SHOULD provide versioning and a release history for recommended secure default settings for top-level administrative accounts and privileged accounts as they are adjusted over time.","force":"SHOULD","artifacts":{"all":["Explanation of how to access this information","or explanation why this functionality is not available"]},"updated":"2026-06-24"},"SCN-CSO-EVA":{"id":"SCN-CSO-EVA","family":"SCN","scope":"all","subset":"CSO","name":"Evaluate Changes","statement":"Providers MUST evaluate all potential significant changes to determine the type of significant change and follow the appropriate Significant Change Notification rules.","force":"MUST","following_information":["Is it a significant change? --> Continue evaluation and follow the Significant Change Notification rules.","If it is, is it an FedRAMP Certification class change?  --> This requires a new assessment and cannot be done under the Significant Change Notification rules.","If it is not, is it a routine recurring change? --> Follow the Routine Recurring Change rules (SCN-RTR Routine Recurring Changes).","If it is not, is it a transformative change? --> Follow the Transformative Change rules (SCN-TRF Transformative Changes).","If it is not, then it is an adaptive change --> Follow the Adaptive Change rules (SCN-ADP Adaptive Changes)."],"controls":["cm-4"],"artifacts":{"all":["Evidence of significant change evaluation including a description fo the change, the determined type, and an explanation for the decision. At least one example must be provided for each type of change. Real examples are prefered but the provider may use fictitious examples as long as the example provides evidence of the decision making process."]},"schema":{"name":"FedRAMP Significant Change Notification (SCN-CSO-INF)","url":"https://fedramp.gov/schemas/fedramp-significant-change-notifications-schema-2026-06-24.json"},"updated":"2026-10-13"},"SCN-CSO-MAR":{"id":"SCN-CSO-MAR","family":"SCN","scope":"all","subset":"CSO","name":"Maintain Audit Records","statement":"Providers MUST maintain auditable records of the significant change evaluation activities required by SCN-CSO-EVA (Evaluate Changes) and make them available to FedRAMP as requested.","force":"MUST","note":"These audit records must be available to FedRAMP on request; these records do not need to be included in the FedRAMP Certification Package by default and do not need to be emailed to FedRAMP continuously.","related":["SCN-CSO-EVA"],"artifacts":{"all":["Explanation of how FedRAMP can obtain this information."]},"updated":"2026-06-24"},"SCN-CSO-INF":{"id":"SCN-CSO-INF","family":"SCN","scope":"all","subset":"CSO","name":"Required Information","statement":"Providers MUST include at least the following information in Significant Change Notifications:","force":"MUST","note":"Structure of the information may vary depending on how the provider tracks this internally.","following_information":["Service Offering FedRAMP ID","Assessor Name (if applicable)","Related Vulnerability (if applicable)","Significant Change type and explanation of categorization","Short description of change","Reason for change","Summary of customer impact, including changes to services and customer configuration responsibilities","Plan and timeline for the change, including for the verification, assessment, and/or validation of impacted Key Security Indicators or Rev5 Controls","Copy of the business or security impact analysis","Name and title of approver"],"artifacts":{"all":["A recent Significant Change Notification or sample Significant Change Notification"]},"schema":{"name":"FedRAMP Significant Change Notification (SCN-CSO-INF)","url":"https://fedramp.gov/schemas/fedramp-significant-change-notifications-schema-2026-06-24.json"},"updated":"2026-06-24"},"SCN-CSO-HIS":{"id":"SCN-CSO-HIS","family":"SCN","scope":"all","subset":"CSO","name":"Historical Notifications","statement":"Providers MUST keep 12 months of historical Significant Change Notifications available with their FedRAMP Certification Data.","force":"MUST","artifacts":{"all":["Explanation of how FedRAMP can obtain this information."]},"updated":"2026-06-24"},"SCN-CSO-HRM":{"id":"SCN-CSO-HRM","family":"SCN","scope":"all","subset":"CSO","name":"Human and Machine-Readable Notifications","statement":"Providers MUST make ALL Significant Change Notifications and related audit records available in human-readable and JSON formats.","force":"MUST","artifacts":{"all":["URL or explanation of how to request these materials.","Explanation of how the provider decides whether or not to share these materials or other related policies."]},"schema":{"name":"FedRAMP Significant Change Notifications Schema","url":"https://fedramp.gov/schemas/fedramp-significant-change-notifications-schema-2026-06-24.json"},"updated":"2026-06-24"},"SCN-CSO-ARI":{"id":"SCN-CSO-ARI","family":"SCN","scope":"all","subset":"CSO","name":"Additional Relevant Information","statement":"Providers MAY include additional relevant information in Significant Change Notifications.","force":"MAY","note":"This allows providers to convey whatever additional information they think is relevant without worrying about negative consequences from not following an exact template.","updated":"2026-06-24"},"SCN-CSO-NOM":{"id":"SCN-CSO-NOM","family":"SCN","scope":"all","subset":"CSO","name":"Notification Mechanisms","statement":"Providers MAY notify necessary parties in a variety of ways as long as the mechanism for notification is clearly documented in the FedRAMP Certification Package and easily accessible.","force":"MAY","notes":["The sharing mechanism should be designed based on the needs of the provider and their customers and may vary between providers.","The default sharing mechanism for most providers during the SCN beta was to send an email to agency customers and upload a copy of the notification to the provider's secure sharing location."],"artifacts":{"all":["Current list of available notification mechanisms"]},"updated":"2026-06-24"},"SCN-CSO-EMG":{"id":"SCN-CSO-EMG","family":"SCN","scope":"all","subset":"CSO","name":"Emergency Changes","statement":"Providers MAY execute significant changes (including transformative changes) during an emergency or incident without following the Significant Change Notification rules in advance. In such emergencies, providers MUST follow all relevant procedures, notify all necessary parties, retroactively provide all Significant Change Notification materials, and complete appropriate assessment after the incident.","force":"MAY","note":"Procedures for emergency changes should be documented in the FedRAMP Certification Package.","controls":["ir-4.2"],"updated":"2026-10-13"},"SCN-ADP-NTF":{"id":"SCN-ADP-NTF","family":"SCN","scope":"all","subset":"ADP","name":"Notification Requirements","statement":"Providers MUST notify all necessary parties within 10 business days after finishing adaptive changes, also including the following information:","force":"MUST","notes":["Activities that match the adaptive significant change type are a frequent and normal part of iteratively improving a service by deploying new functionality or modifying existing functionality in a way that is typically transparent to customers and does not introduce significant new security risks.","In general, most changes that do not happen regularly will be adaptive changes. This change type deliberately covers a wide range of activities in a way that requires assessment and consideration."],"following_information":["Summary of any new risks identified and/or vulnerabilities resulting from the change (if applicable)"],"timeframe_type":"bizdays","timeframe_num":10,"artifacts":{"all":["At least the most recent SCN notification including the date it was sent and the date the change was applied. Additional examples may be provided. If no SCN notifications have been sent then this artifact is not required."]},"updated":"2026-06-24"},"SCN-RTR-NNR":{"id":"SCN-RTR-NNR","family":"SCN","scope":"all","subset":"RTR","name":"No Notification Requirements","statement":"Providers SHOULD NOT make formal Significant Change Notifications for routine recurring changes; this type of change is exempted from notification requirements.","force":"SHOULD NOT","notes":["Activities that match the routine recurring significant change type are performed regularly and routinely by cloud service providers to address flaws or vulnerabilities, address incidents, and generally perform the typical maintenance and service delivery changes expected during day-to-day operations.","These changes leverage mature processes and capabilities to identify, mitigate, and remediate risks as part of the change. They are often entirely automated and may occur without human intervention, even though they have an impact on security of the service.","If the activity does not occur regularly and routinely then it cannot be a significant change of this type (e.g., replacing all physical firewalls to remediate a vulnerability is obviously not regular or routine)."],"updated":"2026-06-24"},"SCN-TRF-NIP":{"id":"SCN-TRF-NIP","family":"SCN","scope":"all","subset":"TRF","name":"Notification of Initial Plans","statement":"Providers MUST notify all necessary parties of initial plans for transformative changes at least 30 business days before starting transformative changes, including a summary of any likely security impacts or changes in risk.","force":"MUST","timeframe_type":"bizdays","timeframe_num":30,"artifacts":{"all":["At least the most recent initial SCN notification for a transformative change including the date it was sent and the date the change was applied. Additional examples may be provided. If no transformative SCN notifications have been sent then this artifact is not required."]},"updated":"2026-06-24"},"SCN-TRF-NFP":{"id":"SCN-TRF-NFP","family":"SCN","scope":"all","subset":"TRF","name":"Notification of Final Plans","statement":"Providers MUST notify all necessary parties of final plans for transformative changes at least 10 business days before starting transformative changes, including updates to all previously sent information.","force":"MUST","timeframe_type":"bizdays","timeframe_num":10,"artifacts":{"all":["At least the most recent final SCN notification for a transformative change including the date it was sent and the date the change was applied. Additional examples may be provided. If no transformative SCN notifications have been sent then this artifact is not required."]},"updated":"2026-06-24"},"SCN-TRF-NAF":{"id":"SCN-TRF-NAF","family":"SCN","scope":"all","subset":"TRF","name":"Notification After Finishing","statement":"Providers MUST notify all necessary parties within 5 business days after finishing transformative changes, including updates to all previously sent information.","force":"MUST","timeframe_type":"bizdays","timeframe_num":5,"artifacts":{"all":["At least the most recent post deployment SCN notification for a transformative change including the date it was sent and the date the change was applied. Additional examples may be provided. If no transformative SCN notifications have been sent then this artifact is not required."]},"updated":"2026-06-24"},"SCN-TRF-NAV":{"id":"SCN-TRF-NAV","family":"SCN","scope":"all","subset":"TRF","name":"Notification After Verification","statement":"Providers MUST notify all necessary parties within 5 business days after completing the verification, assessment, and/or validation of transformative changes, also including the following information:","force":"MUST","following_information":["Updates to all previously sent information","Summary of any new risks identified and/or vulnerabilities resulting from the change (if applicable)","Copy of the security assessment report (if applicable)"],"timeframe_type":"bizdays","timeframe_num":5,"artifacts":{"all":["At least the most recent after verification SCN notification for a transformative change including the date it was sent and the date the change was applied. Additional examples may be provided. If no transformative SCN notifications have been sent then this artifact is not required."]},"updated":"2026-06-24"},"SCN-TRF-UPD":{"id":"SCN-TRF-UPD","family":"SCN","scope":"all","subset":"TRF","name":"Update Documentation","statement":"Providers MUST publish updated service documentation and other materials to reflect transformative changes within 30 business days after finishing transformative changes.","force":"MUST","note":"This requirement is focused on service documentation like user guides, information listed in the marketplace, and other such materials; it does not require updating the system security plan or FedRAMP Certification Package.","timeframe_type":"bizdays","timeframe_num":30,"artifacts":{"all":["Date of the most recent transformative change and the date of the corresponding documentation update. If no documentation updates were required as the result of this change, explain how this was determined."]},"updated":"2026-06-24"},"SCN-TRF-TPR":{"id":"SCN-TRF-TPR","family":"SCN","scope":"all","subset":"TRF","name":"Third-Party Review","statement":"Providers SHOULD engage a third-party assessor to review the scope and impact of the planned change before starting transformative changes if human validation is necessary; such reviews SHOULD be limited to security decisions that require human validation.","force":"SHOULD","note":"Activities that match the transformative significant change type are rare for a cloud service offering, adjusted for the size, scale, and complexity of the service. Small cloud service offerings may go years without transformative changes, while hyperscale providers may release multiple transformative changes per year.","artifacts":{"all":["Third Party assesment report OR explanation why a third party assessor was not engaged"]},"updated":"2026-06-24"},"SDR-CSO-FRR":{"id":"SDR-CSO-FRR","family":"SDR","scope":"all","subset":"CSO","name":"FedRAMP Rules","statement":"Providers MUST supply a Security Decision Record, in both human-readable and JSON formats, that includes at least all of the following information for each applicable FedRAMP rule:","force":"MUST","following_information":["Explanation of how the rule is followed, or an explanation of the reason and resulting risk to customers for not following the rule.","Verification that the implementation is appropriate for the rule, or that the reason for not implementing is accepted by a senior official.","Validation that the implementation is in place and working as intended, or that the reason for not implementing is accepted by a senior official.","Independent verification.","Independent validation.","Any responses or clarifications to the comments in the independent verification or validation.","Rule-specific artifacts (if applicable)."],"schema":{"name":"FedRAMP Security Decision Record Schema","url":"https://fedramp.gov/schemas/fedramp-security-decision-record-schema-2026-06-24.json"},"updated":"2026-06-24"},"SDR-CSO-MTD":{"id":"SDR-CSO-MTD","family":"SDR","scope":"all","subset":"CSO","name":"Security Decision Record Metadata","statement":"Providers MUST also include the following basic metadata in their Security Decision Record:","force":"MUST","following_information":["Version","Date and time of last update","Source of update"],"updated":"2026-06-24"},"SDR-CSX-KSI":{"id":"SDR-CSX-KSI","family":"SDR","scope":"20x","subset":"CSX","name":"Key Security Indicators","statement":"Providers MUST also include short and simple high-level summaries of at least the following for each applicable Key Security Indicator:","force":"MUST","following_information":["Explanation of measures (and their objectives) that demonstrate the Key Security Indicator, or an explanation of the reason and resulting risk to customers for not having measures available for that Key Security Indicator.","Explanation of the cycle for any measures that are implemented persistently (if applicable).","Verification that the measures demonstrate the Key Security Indicator, or that the reason for not having them is accepted.","Verification that the automation in place is accurate and sufficient to demonstrate appropriate measures for the Key Security Indicator, or that automation is not necessary for each measure.","Validation that the measures are accurately produced and are in place and working as intended, or that the reason for not having them is valid."],"schema":{"name":"FedRAMP Security Decision Record Schema","url":"https://fedramp.gov/schemas/fedramp-security-decision-record-schema-2026-06-24.json"},"updated":"2026-06-24"},"SDR-CSX-KMT":{"id":"SDR-CSX-KMT","family":"SDR","scope":"20x","subset":"CSX","name":"Key Security Indicator Metrics","note":"For initial FedRAMP Certification, providers will need to have mechanisms in place and agree to meet this requirement in the event the cloud service has not been operating with related metrics available for the required period prior to applying for initial certification.","schema":{"name":"FedRAMP Security Decision Record Schema","url":"https://fedramp.gov/schemas/fedramp-security-decision-record-schema-2026-06-24.json"},"updated":"2026-10-08","byClass":{"a":{"statement":"Providers with 20x Class A Certifications MAY also include historical metrics in their Security Decision Record.","force":"MAY"},"b":{"statement":"Providers with 20x Class B Certifications SHOULD also include historical metrics in their Security Decision Record, supplying at least the following information for each applicable Key Security Indicator:","force":"SHOULD","following_information":["Summary of each metric over the past 30 days","Summary of metric up to the past year (where available)"]},"c":{"statement":"Providers with 20x Class C Certifications MUST also include historical metrics in their Security Decision Record, supplying at least the following information for each applicable Key Security Indicator:","force":"MUST","following_information":["Summary of each metric over the past 30 days","Summary of metric up to the past year (where available)","All daily metric data (including status of persistent validation) up to the past year (where available)"]},"d":{"statement":"Providers with 20x Class D Certifications MUST significantly supersede the minimum requirements for lower Classes, with specifics to be set during the 20x Phase 4 Pilot.","force":"MUST"}}},"VDR-CSO-DET":{"id":"VDR-CSO-DET","family":"VDR","scope":"all","subset":"CSO","name":"Vulnerability Detection","statement":"Providers MUST systematically, persistently, and promptly discover and identify vulnerabilities within their cloud service offering using appropriate techniques such as assessment, scanning, threat intelligence, vulnerability disclosure mechanisms, bug bounties, penetration testing, incident response, automated control testing, supply chain monitoring, and other relevant capabilities; this process is called vulnerability detection. Vulnerability detection includes persistently verifying and validating that information resources and processes are operating as intended and documented for FedRAMP Practices.","force":"MUST","notes":["FedRAMP's vulnerability detection (and response) rules are intended to set modern expectations for maintaining the security of a cloud service. Historical FedRAMP guidance on vulnerability scanning or continuous monitoring generally focused only on CVE-type vulnerabilities while leaving other types of vulnerabilities and exposures unaddressed.","Providers are encouraged to leverage their existing holistic security review, architecture review, and similar processes to meet these requirements. FedRAMP strongly discourages providers from implementing separate vulnerability detection and response processes for FedRAMP reporting that are operated by independent compliance branches unless these processes are consuming data directly from the areas of the cloud service that actively maintain it."],"controls":["au-5.2","au-6","ca-8","ca-8.1","ca-8.2","ra-5","ra-5.2","ra-5.3","ra-5.4","si-2","si-3","si-4.1","si-4.12","si-4.18","si-4.22","si-5.1"],"updated":"2026-10-13"},"VDR-CSO-RES":{"id":"VDR-CSO-RES","family":"VDR","scope":"all","subset":"CSO","name":"Vulnerability Response","statement":"Providers MUST systematically, persistently, and promptly track, evaluate, monitor, mitigate, remediate, assess exploitation of, report, and otherwise manage all detected vulnerabilities within their cloud service offering; this process is called vulnerability response.","force":"MUST","notes":["If it is not possible to fully mitigate vulnerabilities or remediate vulnerabilities, providers SHOULD instead partially mitigate vulnerabilities promptly, progressively, and persistently.","FedRAMP does not use the terms \"mitigation\" and \"remediation\" interchangeably. Mitigation is the process of reducing the risk and impact of a vulnerability through partial mitigation and even full mitigation; remediation is the process of entirely eliminating the vulnerability. A fully mitigated vulnerability will still exist (with negligible risk) until it has been remediated. This separation is based on the plain language definitions of these words.","Please refer to FedRAMP Definitions for strict interpretation in the FedRAMP context."],"controls":["au-5.2","ir-4.11","ir-9.3","ra-7","si-2","si-3"],"updated":"2026-10-13"},"VDR-CSO-FAV":{"id":"VDR-CSO-FAV","family":"VDR","scope":"all","subset":"CSO","name":"Failures Are Vulnerabilities","statement":"Providers MUST treat problems or failures with their vulnerability detection and response processes as vulnerabilities.","force":"MUST","controls":["au-5.2","si-4","si-4.1","si-7.7"],"updated":"2026-10-13"},"VDR-CSO-DFR":{"id":"VDR-CSO-DFR","family":"VDR","scope":"all","subset":"CSO","name":"Design For Resilience","statement":"Providers SHOULD make design and architecture decisions for their cloud service offering that mitigate the risk of vulnerabilities by default AND decrease the risk and complexity of vulnerability detection and response.","force":"SHOULD","updated":"2026-06-24"},"VDR-CSO-ADT":{"id":"VDR-CSO-ADT","family":"VDR","scope":"all","subset":"CSO","name":"Automate Detection","statement":"Providers SHOULD use automated services to improve and streamline vulnerability detection and response.","force":"SHOULD","controls":["ra-5","si-2.2","si-3","si-4.2","si-4.5"],"updated":"2026-10-13"},"VDR-CSO-DAC":{"id":"VDR-CSO-DAC","family":"VDR","scope":"all","subset":"CSO","name":"Detect After Changes","statement":"Providers SHOULD automatically perform vulnerability detection on representative samples of new or significantly changed information resources.","force":"SHOULD","controls":["ra-5"],"updated":"2026-10-13"},"VDR-CSO-MSP":{"id":"VDR-CSO-MSP","family":"VDR","scope":"all","subset":"CSO","name":"Maintain Security","statement":"Providers SHOULD NOT weaken the security of information resources to facilitate vulnerability scanning, detection, or assessment activities.","force":"SHOULD NOT","controls":["ra-5.5","si-2"],"updated":"2026-10-13"},"VDR-CSO-AKE":{"id":"VDR-CSO-AKE","family":"VDR","scope":"all","subset":"CSO","name":"Avoid KEVs","statement":"Providers SHOULD NOT deploy or otherwise activate new machine-based information resources with Known Exploited Vulnerabilities.","force":"SHOULD NOT","controls":["ra-5","si-5"],"updated":"2026-10-13"},"VDR-CSO-SIR":{"id":"VDR-CSO-SIR","family":"VDR","scope":"all","subset":"CSO","name":"Sampling","statement":"Providers MAY sample effectively identical information resources, especially machine-based information resources, when performing vulnerability detection UNLESS doing so would decrease the efficiency or effectiveness of vulnerability detection.","force":"MAY","controls":["ra-5.3","ra-5.5"],"updated":"2026-10-13"},"VDR-TFR-NMV":{"id":"VDR-TFR-NMV","family":"VDR","scope":"all","subset":"TFR","name":"Non-Machine Verification and Validation","statement":"Providers MUST verify and validate the status of non-machine-based information resources at least once every 3 months.","force":"MUST","timeframe_type":"months","timeframe_num":3,"updated":"2026-06-24"},"VDR-TFR-PDD":{"id":"VDR-TFR-PDD","family":"VDR","scope":"all","subset":"TFR","name":"Persistent Drift Detection","controls":["si-4.22","si-7","si-7.1"],"updated":"2026-10-13","byClass":{"a":{"statement":"Providers with Class A Certifications SHOULD persistently perform vulnerability detection on all information resources that are likely to drift, at least once every 3 months.","force":"SHOULD","timeframe_type":"months","timeframe_num":3},"b":{"statement":"Providers with Class B Certifications SHOULD persistently perform vulnerability detection on all information resources that are likely to drift, at least once every month.","force":"SHOULD","timeframe_type":"months","timeframe_num":1},"c":{"statement":"Providers with Class C Certifications SHOULD persistently perform vulnerability detection on all information resources that are likely to drift, at least once every 14 days.","force":"SHOULD","timeframe_type":"days","timeframe_num":14},"d":{"statement":"Providers with Class D Certifications SHOULD persistently perform vulnerability detection on all information resources that are likely to drift, at least once every 7 days.","force":"SHOULD","timeframe_type":"days","timeframe_num":7}}},"VDR-TFR-PCD":{"id":"VDR-TFR-PCD","family":"VDR","scope":"all","subset":"TFR","name":"Persistently Complete Detection","updated":"2026-06-24","byClass":{"a":{"statement":"Providers with Class A Certifications SHOULD persistently perform vulnerability detection on all information resources that are NOT likely to drift, at least once every 6 months.","force":"SHOULD","timeframe_type":"months","timeframe_num":6},"b":{"statement":"Providers with Class B Certifications SHOULD persistently perform vulnerability detection on all information resources that are NOT likely to drift, at least once every 6 months.","force":"SHOULD","timeframe_type":"months","timeframe_num":6},"c":{"statement":"Providers with Class C Certifications SHOULD persistently perform vulnerability detection on all information resources that are NOT likely to drift, at least once every month.","force":"SHOULD","timeframe_type":"months","timeframe_num":1},"d":{"statement":"Providers with Class D Certifications SHOULD persistently perform vulnerability detection on all information resources that are NOT likely to drift, at least once every month.","force":"SHOULD","timeframe_type":"months","timeframe_num":1}}},"VDR-TFR-PVR":{"id":"VDR-TFR-PVR","family":"VDR","scope":"all","subset":"TFR","name":"Mitigation and Remediation Expectations","related":["VER-EVA-EPA"],"controls":["si-2.3"],"updated":"2026-10-13","byClass":{"a":{"statement":"Providers with Class A Certifications SHOULD partially mitigate vulnerabilities, fully mitigate vulnerabilities, or remediate vulnerabilities to a lower potential agency impact within the timeframes from evaluation shown below, factoring for the current Potential Agency Impact N-rating as defined in VER-EVA-EPA (Estimate Potential Agency Impact), internet reachability, and likely exploitability.","force":"SHOULD"},"b":{"statement":"Providers with Class B Certifications SHOULD partially mitigate vulnerabilities, fully mitigate vulnerabilities, or remediate vulnerabilities to a lower potential agency impact within the timeframes from evaluation shown below, factoring for the current Potential Agency Impact N-rating as defined in VER-EVA-EPA (Estimate Potential Agency Impact), internet reachability, and likely exploitability:","force":"SHOULD"},"c":{"statement":"Providers with Class C Certifications SHOULD partially mitigate vulnerabilities, fully mitigate vulnerabilities, or remediate vulnerabilities to a lower Potential Agency Impact N-rating within the timeframes from evaluation shown below, factoring for the current Potential Agency Impact N-rating as defined in VER-EVA-EPA (Estimate Potential Agency Impact), internet reachability, and likely exploitability:","force":"SHOULD"},"d":{"statement":"Providers with Class D Certifications SHOULD partially mitigate vulnerabilities, fully mitigate vulnerabilities, or remediate vulnerabilities to a lower Potential Agency Impact N-rating within the maximum timeframes from evaluation shown below, factoring for the current Potential Agency Impact N-rating as defined in VER-EVA-EPA (Estimate Potential Agency Impact), internet reachability, and likely exploitability:","force":"SHOULD"}}},"VDR-TFR-RMN":{"id":"VDR-TFR-RMN","family":"VDR","scope":"all","subset":"TFR","name":"Remaining Vulnerabilities","statement":"Providers SHOULD mitigate or remediate remaining vulnerabilities during routine operations as determined necessary by the provider.","force":"SHOULD","updated":"2026-06-24"},"VDR-TFR-KEV":{"id":"VDR-TFR-KEV","family":"VDR","scope":"all","subset":"TFR","name":"Remediate KEVs","statement":"Providers SHOULD remediate Known Exploited Vulnerabilities according to the due dates in the CISA Known Exploited Vulnerabilities Catalog (even if the vulnerability has been fully mitigated) as required by CISA Binding Operational Directive (BOD) 26-04 or any successor guidance from CISA.","force":"SHOULD","updated":"2026-06-24"},"VDR-TFR-PSD":{"id":"VDR-TFR-PSD","family":"VDR","scope":"all","subset":"TFR","name":"Persistent Sample Detection","updated":"2026-06-24","byClass":{"a":{"statement":"Providers with Class A Certifications SHOULD persistently perform vulnerability detection on representative samples of similar machine-based information resources, at least once every 14 days.","force":"SHOULD","timeframe_type":"days","timeframe_num":14},"b":{"statement":"Providers with Class B Certifications SHOULD persistently perform vulnerability detection on representative samples of similar machine-based information resources, at least once every 7 days.","force":"SHOULD","timeframe_type":"days","timeframe_num":7},"c":{"statement":"Providers with Class C Certifications SHOULD persistently perform vulnerability detection on representative samples of similar machine-based information resources, at least once every 3 days.","force":"SHOULD","timeframe_type":"days","timeframe_num":3},"d":{"statement":"Providers with Class D Certifications SHOULD persistently perform vulnerability detection on representative samples of similar machine-based information resources, at least once per day.","force":"SHOULD","timeframe_type":"days","timeframe_num":1}}},"VDR-TFR-MVX":{"id":"VDR-TFR-MVX","family":"VDR","scope":"20x","subset":"TFR","name":"Persistent Machine Verification and Validation for 20x","updated":"2026-06-24","byClass":{"a":{"statement":"Providers of FedRAMP 20x Class A offerings SHOULD verify and validate the status of machine-based information resources at least once every month.","force":"SHOULD","timeframe_type":"months","timeframe_num":1},"b":{"statement":"Providers of FedRAMP 20x Class B offerings MUST verify and validate the status of machine-based information resources at least once every 7 days.","force":"MUST","timeframe_type":"days","timeframe_num":7},"c":{"statement":"Providers of FedRAMP 20x Class C offerings MUST verify and validate the status of machine-based information resources at least once every 3 days.","force":"MUST","timeframe_type":"days","timeframe_num":3}}},"VER-EVA-ELX":{"id":"VER-EVA-ELX","family":"VER","scope":"all","subset":"EVA","name":"Evaluate Exploitability","statement":"Providers MUST evaluate detected vulnerabilities, considering the context of the cloud service offering, to determine if they are likely exploitable vulnerabilities.","force":"MUST","notes":["The simple reality is that most traditional vulnerabilities discovered by scanners or during assessment are not likely to be exploitable; exploitation typically requires an unrealistic set of circumstances that will not occur during normal operation. The likelihood of exploitation will vary depending on so many factors that FedRAMP will not recommend a specific framework for approaching this beyond these rules.","The proof, ultimately, is in the pudding - providers who regularly evaluate vulnerabilities as not likely exploitable without careful consideration are more likely to suffer from an adverse impact where the root cause was an exploited vulnerability that was improperly evaluated. If done recklessly or deliberately, such actions will have a negative impact on a provider's FedRAMP Certification."],"updated":"2026-06-24"},"VER-EVA-EIR":{"id":"VER-EVA-EIR","family":"VER","scope":"all","subset":"EVA","name":"Evaluate Internet-Reachability","statement":"Providers MUST evaluate detected vulnerabilities, considering the context of the cloud service offering, to determine if they are internet-reachable vulnerabilities.","force":"MUST","notes":["FedRAMP focuses on internet-reachable (rather than internet-accessible) to ensure that any service that might receive a payload from the internet is prioritized if that service has a vulnerability that can be triggered by processing the data in the payload.","The simplest way to prevent exploitation of internet-reachable vulnerabilities is to intercept, inspect, filter, sanitize, reject, or otherwise deflect triggering payloads before they are processed by the vulnerable resource; once this prevention is in place the vulnerability should no longer be considered an internet-reachable vulnerability.","A classic example of an internet-reachable vulnerability on systems that are not typically internet-accessible is [SQL injection](https://en.wikipedia.org/wiki/SQL_injection), where an application stack behind a load balancer and firewall with no ability to route traffic to or from the internet can receive a payload indirectly from the internet that triggers the manipulation or compromise of data in a database that can only be accessed by an authorized connection from the application server on a private network.","Another simple example is the infamous Log4Shell (https://en.wikipedia.org/wiki/Log4Shell) vulnerability from 2021, where exploitation was possible via vulnerable internet-reachable resources deep in the application stack that were often not internet-accessible themselves."],"updated":"2026-06-24"},"VER-EVA-EPA":{"id":"VER-EVA-EPA","family":"VER","scope":"all","subset":"EVA","name":"Estimate Potential Agency Impact","statement":"Providers MUST evaluate detected vulnerabilities, considering the context of the cloud service offering, to estimate the likely potential agency impact of exploitation on government customers AND assign one of the following Potential Agency Impact N-ratings (PAIN):","force":"MUST","following_information_bullets":["**N0**: Exploitation is extremely unlikely to have any adverse effects on agencies that use the cloud service offering.","**N1**: Exploitation could be expected to have minimal customer effects on one or more agencies that use the cloud service offering.","**N2**: Exploitation could be expected to have narrow customer effects on one or more agencies that use the cloud service offering.","**N3**: Exploitation could be expected to have a disruptive customer effect on one agency that uses the cloud service offering.","**N4**: Exploitation could be expected to have a debilitating customer effect on one agency that uses the cloud service offering OR a disruptive customer effect on more than one federal agency that uses the cloud service offering.","**N5**: Exploitation could be expected to have a debilitating customer effect on more than one agency that uses the cloud service offering."],"controls":["ra-3"],"updated":"2026-10-13"},"VER-EVA-AIA":{"id":"VER-EVA-AIA","family":"VER","scope":"all","subset":"EVA","name":"Assume It's Automatable","statement":"Providers MUST assume the exploitation of vulnerabilities can be automated UNLESS they have evidence proving otherwise.","force":"MUST","updated":"2026-06-24"},"VER-EVA-GRV":{"id":"VER-EVA-GRV","family":"VER","scope":"all","subset":"EVA","name":"Group Vulnerabilities","statement":"Providers SHOULD evaluate detected vulnerabilities, considering the context of the cloud service offering, to identify logical groupings of affected information resources that may improve the efficiency and effectiveness of vulnerability response by consolidating further activity; FedRAMP Vulnerability Detection and Response rules are then applied to these consolidated groupings of vulnerabilities instead of each individual detected instance.","force":"SHOULD","updated":"2026-06-24"},"VER-EVA-EFP":{"id":"VER-EVA-EFP","family":"VER","scope":"all","subset":"EVA","name":"Evaluate False Positives","statement":"Providers SHOULD evaluate detected vulnerabilities, considering the context of the cloud service offering, to determine if they are false positive vulnerabilities.","force":"SHOULD","updated":"2026-06-24"},"VER-EVA-EFA":{"id":"VER-EVA-EFA","family":"VER","scope":"all","subset":"EVA","name":"Evaluation Factors","statement":"Providers SHOULD consider at least the following factors when considering the context of the cloud service offering to evaluate detected vulnerabilities:","force":"SHOULD","following_information":["**Criticality**: How important are the systems or information that might be impacted by the vulnerability?","**Reachability**: How might a threat actor reach the vulnerability and how likely is that?","**Exploitability**: How easy is it for a threat actor to exploit the vulnerability and how likely is that?","**Detectability**: How easy is it for a threat actor to become aware of the vulnerability and how likely is that?","**Prevalence**: How much of the cloud service offering is affected by the vulnerability?","**Privilege**: How much privileged authority or access is granted or can be gained from exploiting the vulnerability?","**Proximate Vulnerabilities**: How does this vulnerability interact with previously detected vulnerabilities, especially partially or fully mitigated vulnerabilities?","**Known Threats**: How might already known threats leverage the vulnerability and how likely is that?"],"controls":["ra-9"],"updated":"2026-10-13"},"VER-RPT-PER":{"id":"VER-RPT-PER","family":"VER","scope":"all","subset":"RPT","name":"Persistent Reporting","statement":"Providers MUST report vulnerability detection and response activity (including persistent verification and validation) to all necessary parties persistently, summarizing ALL activity since the previous report; these reports are FedRAMP Certification Data and are subject to FedRAMP Certification Data Sharing rules.","force":"MUST","controls":["si-7.2"],"schema":{"name":"FedRAMP Vulnerability Detail Report (VER-RPT-VDT)","url":"https://fedramp.gov/schemas/fedramp-vulnerability-detail-report-schema-2026-06-24.json"},"updated":"2026-10-13"},"VER-RPT-VDT":{"id":"VER-RPT-VDT","family":"VER","scope":"all","subset":"RPT","name":"Vulnerability Details","statement":"Providers MUST include the following information (if applicable) on detected vulnerabilities when reporting on vulnerability detection and response activity, UNLESS it is an accepted vulnerability:","force":"MUST","following_information":["Provider's internally assigned tracking identifier","Time and source of the detection","Time of completed evaluation","Is it an internet-reachable vulnerability or not?","Is it a likely exploitable vulnerability or not?","Historically and currently estimated Potential Agency Impact N-rating of exploitation","Time and Potential Agency Impact N-rating of each completed and evaluated reduction in Potential Agency Impact N-rating","Estimated time and target Potential Agency Impact N-rating of next reduction in Potential Agency Impact N-rating","Is it currently or is it likely to become an overdue vulnerability or not? If so, explain.","Any supplementary information the provider responsibly determines will help federal agencies assess or mitigate the risk to their federal customer data within the cloud service offering resulting from the vulnerability","Final disposition of the vulnerability"],"controls":["si-2.3"],"artifacts":{"all":["A recent vulnerability report or a sample vulnerability report"]},"schema":{"name":"FedRAMP Vulnerability Detail Report (VER-RPT-VDT)","url":"https://fedramp.gov/schemas/fedramp-vulnerability-detail-report-schema-2026-06-24.json"},"updated":"2026-10-13"},"VER-RPT-AVI":{"id":"VER-RPT-AVI","family":"VER","scope":"all","subset":"RPT","name":"Accepted Vulnerability Info","statement":"Providers MUST include the following information on accepted vulnerabilities when reporting on vulnerability detection and response activity:","force":"MUST","following_information":["Provider's internally assigned tracking identifier","Time and source of the detection","Time of completed evaluation","Is it an internet-reachable vulnerability or not?","Is it a likely exploitable vulnerability or not?","Currently estimated Potential Agency Impact N-rating","Explanation of why this is an accepted vulnerability","Any supplementary information the provider determines will responsibly help federal agencies assess or mitigate the risk to their federal customer data within the cloud service offering resulting from the accepted vulnerability"],"artifacts":{"all":["A recent vulnerability report or a sample vulnerability report"]},"schema":{"name":"FedRAMP Accepted Vulnerability Info (VER-RPT-AVI)","url":"https://fedramp.gov/schemas/fedramp-accepted-vulnerability-info-schema-2026-06-24.json"},"updated":"2026-06-24"},"VER-RPT-NID":{"id":"VER-RPT-NID","family":"VER","scope":"all","subset":"RPT","name":"Responsible Disclosure","statement":"Providers MUST NOT irresponsibly disclose specific sensitive information about vulnerabilities that would likely lead to exploitation, but MUST disclose sufficient information for informed risk-based decision-making to all necessary parties.","force":"MUST NOT","note":"This requirement will be superseded in the event of formal action related to an investigation or corrective action plan.","updated":"2026-06-24"},"VER-RPT-HLO":{"id":"VER-RPT-HLO","family":"VER","scope":"all","subset":"RPT","name":"High-Level Overviews","statement":"Providers SHOULD include high-level overviews of ALL vulnerability detection and response activities conducted during this period for the cloud service offering; this includes vulnerability disclosure programs, bug bounty programs, penetration testing, assessments, etc.","force":"SHOULD","updated":"2026-06-24"},"VER-RPT-RPD":{"id":"VER-RPT-RPD","family":"VER","scope":"all","subset":"RPT","name":"Responsible Public Disclosure","statement":"Providers MAY responsibly disclose vulnerabilities publicly or with other parties if the provider determines doing so will NOT likely lead to exploitation.","force":"MAY","updated":"2026-06-24"},"VER-TFR-MHR":{"id":"VER-TFR-MHR","family":"VER","scope":"all","subset":"TFR","name":"Monthly Activity Report","statement":"Providers MUST report vulnerability detection and response activity to all necessary parties in a consistent format that is human readable at least monthly.","force":"MUST","timeframe_type":"months","timeframe_num":1,"artifacts":{"all":["A recent vulnerability report or a sample vulnerability report"]},"updated":"2026-06-24"},"VER-TFR-MAV":{"id":"VER-TFR-MAV","family":"VER","scope":"all","subset":"TFR","name":"Mark Accepted Vulnerabilities","statement":"Providers MUST categorize any vulnerability that is not or will not be fully mitigated or remediated within 192 days of evaluation as an accepted vulnerability.","force":"MUST","timeframe_type":"days","timeframe_num":192,"updated":"2026-06-24"},"VER-TFR-MRH":{"id":"VER-TFR-MRH","family":"VER","scope":"all","subset":"TFR","name":"Historical Activity","schema":{"name":"FedRAMP Historical Vulnerability Evaluation and Reporting Activity (VER-TFR-MRH)","url":"https://fedramp.gov/schemas/fedramp-historical-ver-activity-schema-2026-06-24.json"},"updated":"2026-06-24","byClass":{"a":{"statement":"Providers with Class A Certifications MAY make all recent historical vulnerability detection and response activity available in JSON format for automated retrieval by all necessary parties (e.g. using an API service or similar); this information MAY be updated persistently, at least once every month.","force":"MAY","timeframe_type":"months","timeframe_num":1,"artifacts":{"all":["URL and access instructions for historical vulnerability detection and response activity in machine readable format"]}},"b":{"statement":"Providers with Class B Certifications SHOULD make all recent historical vulnerability detection and response activity available in JSON format for automated retrieval by all necessary parties (e.g. using an API service or similar); this information SHOULD be updated persistently, at least once every month.","force":"SHOULD","timeframe_type":"months","timeframe_num":1,"artifacts":{"all":["URL and access instructions for historical vulnerability detection and response activity in machine readable format","or an explanation of why machine readable content is not being provided"]}},"c":{"statement":"Providers with Class C Certifications SHOULD make all recent historical vulnerability detection and response activity available in JSON format for automated retrieval by all necessary parties (e.g. using an API service or similar); this information SHOULD be updated persistently, at least once every 14 days.","force":"SHOULD","timeframe_type":"days","timeframe_num":14,"artifacts":{"all":["URL and access instructions for historical vulnerability detection and response activity in machine readable format","or an explanation of why machine readable content is not being provided"]}},"d":{"statement":"Providers with Class D Certifications SHOULD make all recent historical vulnerability detection and response activity available in JSON format for automated retrieval by all necessary parties (e.g. using an API service or similar); this information SHOULD be updated persistently, at least once every 7 days.","force":"SHOULD","timeframe_type":"days","timeframe_num":7,"artifacts":{"all":["URL and access instructions for historical vulnerability detection and response activity in machine readable format","or an explanation of why machine readable content is not being provided"]}}}},"VER-TFR-EVU":{"id":"VER-TFR-EVU","family":"VER","scope":"all","subset":"TFR","name":"Evaluate Vulnerabilities Quickly","updated":"2026-06-24","byClass":{"a":{"statement":"Providers with Class A Certifications SHOULD evaluate ALL vulnerabilities as required by VER-EVA (Evaluation) within 14 days of detection.","force":"SHOULD","timeframe_type":"days","timeframe_num":14},"b":{"statement":"Providers with Class B Certifications SHOULD evaluate ALL vulnerabilities as required by VER-EVA (Evaluation) within 7 days of detection.","force":"SHOULD","timeframe_type":"days","timeframe_num":7},"c":{"statement":"Providers with Class C Certifications SHOULD evaluate ALL vulnerabilities as required by VER-EVA (Evaluation) within 5 days of detection.","force":"SHOULD","timeframe_type":"days","timeframe_num":5},"d":{"statement":"Providers with Class D Certifications SHOULD evaluate ALL vulnerabilities as required by VER-EVA (Evaluation) within 2 days of detection.","force":"SHOULD","timeframe_type":"days","timeframe_num":2}}},"VER-TFR-IRI":{"id":"VER-TFR-IRI","family":"VER","scope":"all","subset":"TFR","name":"Internet-Reachable Incidents","updated":"2026-06-24","byClass":{"a":{"statement":"Providers with Class A Certifications MAY treat internet-reachable likely exploitable vulnerabilities where Potential Agency Impact N-rating > 3 as a FedRAMP Reportable Incident until they are partially mitigated vulnerabilities at N3 or below.","force":"MAY"},"b":{"statement":"Providers with Class B Certifications MAY treat internet-reachable likely exploitable vulnerabilities where Potential Agency Impact N-rating > 3 as a FedRAMP Reportable Incident until they are partially mitigated vulnerabilities at N3 or below.","force":"MAY"},"c":{"statement":"Providers with Class C Certifications SHOULD treat internet-reachable likely exploitable vulnerabilities where Potential Agency Impact N-rating > 3 as a FedRAMP Reportable Incident until they are partially mitigated vulnerabilities at N3 or below.","force":"SHOULD"},"d":{"statement":"Providers with Class D Certifications SHOULD treat internet-reachable likely exploitable vulnerabilities where Potential Agency Impact N-rating > 3 as a FedRAMP Reportable Incident until they are partially mitigated vulnerabilities at N3 or below.","force":"SHOULD"}}},"VER-TFR-NRI":{"id":"VER-TFR-NRI","family":"VER","scope":"all","subset":"TFR","name":"Non-Internet-Reachable Incidents","updated":"2026-06-24","byClass":{"a":{"statement":"Providers with Class A Certifications MAY treat likely exploitable vulnerabilities that are NOT internet-reachable where Potential Agency Impact N-rating = 5 as a FedRAMP Reportable Incident until they are partially mitigated vulnerabilities at N4 or below.","force":"MAY"},"b":{"statement":"Providers with Class B Certifications MAY treat likely exploitable vulnerabilities that are NOT internet-reachable where Potential Agency Impact N-rating = 5 as a FedRAMP Reportable Incident until they are partially mitigated vulnerabilities at N4 or below.","force":"MAY"},"c":{"statement":"Providers with Class C Certifications MAY treat likely exploitable vulnerabilities that are NOT internet-reachable where Potential Agency Impact N-rating = 5 as a FedRAMP Reportable Incident until they are partially mitigated vulnerabilities at N4 or below.","force":"MAY"},"d":{"statement":"Providers with Class D Certifications SHOULD treat likely exploitable vulnerabilities that are NOT internet-reachable where Potential Agency Impact N-rating = 5 as a FedRAMP Reportable Incident until they are partially mitigated vulnerabilities at N4 or below.","force":"SHOULD"}}}},"classes":{"A":{"rules":[{"id":"AFC-CSO-CRA","force":"MUST"},{"id":"AFC-CSO-INB","force":"MUST"},{"id":"AFC-CSO-RCV","force":"MUST"},{"id":"CCM-OCR-AVL","force":"MUST"},{"id":"CCM-OCR-NRD","force":"MUST"},{"id":"CCM-QTR-MTG","force":"MAY"},{"id":"CDS-CSO-AVR","force":"SHOULD"},{"id":"CDS-CSO-PSM","force":"MAY"},{"id":"CDS-CSO-PUB","force":"MUST"},{"id":"CDS-CSO-UTC","force":"MUST"},{"id":"CDS-UTC-AAD","force":"MUST"},{"id":"CMU-CSO-UVM","force":"MAY"},{"id":"CPO-CSX-CPM","force":"SHOULD"},{"id":"FRC-APP-AFC","force":"MUST"},{"id":"FRC-APP-FCP","force":"MUST"},{"id":"FRC-APP-FIA","force":"MAY"},{"id":"FRC-APP-MLF","force":"MUST"},{"id":"FRC-APP-NTP","force":"MUST NOT"},{"id":"FRC-APP-USA","force":"MAY"},{"id":"FRC-CLA-ASF","force":"MUST"},{"id":"FRC-CLA-EAM","force":"MUST"},{"id":"FRC-CLA-IVV","force":"MAY"},{"id":"FRC-CLA-MFR","force":"MUST"},{"id":"FRC-CLA-OFR","force":"MAY"},{"id":"FRC-CLA-RFR","force":"SHOULD"},{"id":"FRC-CSO-FCP","force":"MUST"},{"id":"FRC-CSO-JSN","force":"MUST"},{"id":"FRC-CSO-MRA","force":"MUST"},{"id":"FRC-CSO-PKG","force":"MUST"},{"id":"FRC-CSO-POP","force":"MUST NOT"},{"id":"IEC-CSO-EFR","force":"MUST"},{"id":"IEC-CSO-FIR","force":"MUST"},{"id":"IEC-CSO-IIR","force":"SHOULD"},{"id":"IEC-CSO-OIR","force":"SHOULD"},{"id":"IVV-CSO-FIA","force":"MAY"},{"id":"IVV-CSX-AIA","force":"MUST"},{"id":"MAS-CSO-IIR","force":"MUST"},{"id":"MKT-CSO-MLR","force":"MUST"},{"id":"MKT-CSO-PML","force":"MUST"},{"id":"MKT-IIP-AGU","force":"MUST"},{"id":"MKT-IIP-DCP","force":"MUST"},{"id":"MKT-IIP-DLA","force":"MUST"},{"id":"SDR-CSX-KMT","force":"MAY"},{"id":"VDR-CSO-DET","force":"MUST"},{"id":"VDR-TFR-MVX","force":"SHOULD"},{"id":"VDR-TFR-PCD","force":"SHOULD"},{"id":"VDR-TFR-PDD","force":"SHOULD"},{"id":"VDR-TFR-PSD","force":"SHOULD"},{"id":"VDR-TFR-PVR","force":"SHOULD"},{"id":"VER-TFR-EVU","force":"SHOULD"},{"id":"VER-TFR-IRI","force":"MAY"},{"id":"VER-TFR-MRH","force":"MAY"},{"id":"VER-TFR-NRI","force":"MAY"}],"ksis":[{"id":"KSI-CED-RAT","force":"MUST"},{"id":"KSI-CMT-LMC","force":"MUST"},{"id":"KSI-CNA-RNT","force":"MUST"},{"id":"KSI-IAM-AAM","force":"MUST"},{"id":"KSI-IAM-APM","force":"MUST"},{"id":"KSI-INR-RIR","force":"MUST"},{"id":"KSI-SVC-SIN","force":"MUST"}],"counts":{"rules":53,"byForce":{"MAY":12,"MUST":28,"MUST NOT":2,"SHOULD":11},"ksis":7},"rev5Controls":[],"provisional":false},"B":{"rules":[{"id":"AFC-CSO-ACK","force":"SHOULD"},{"id":"AFC-CSO-CRA","force":"MUST"},{"id":"AFC-CSO-EMR","force":"MUST"},{"id":"AFC-CSO-IMA","force":"SHOULD"},{"id":"AFC-CSO-INB","force":"MUST"},{"id":"AFC-CSO-NOC","force":"MUST"},{"id":"AFC-CSO-RCV","force":"MUST"},{"id":"AFC-CSO-TFG","force":"MUST"},{"id":"CCM-OCR-AFS","force":"MUST"},{"id":"CCM-OCR-AVL","force":"MUST"},{"id":"CCM-OCR-FBM","force":"MUST"},{"id":"CCM-OCR-LSI","force":"MUST NOT"},{"id":"CCM-OCR-NRD","force":"MUST"},{"id":"CCM-OCR-RPS","force":"MAY"},{"id":"CCM-OCR-SOR","force":"SHOULD"},{"id":"CCM-QTR-ACT","force":"SHOULD"},{"id":"CCM-QTR-MTG","force":"SHOULD"},{"id":"CCM-QTR-NID","force":"MUST NOT"},{"id":"CCM-QTR-NRD","force":"MUST"},{"id":"CCM-QTR-REG","force":"MUST"},{"id":"CCM-QTR-RTP","force":"SHOULD NOT"},{"id":"CCM-QTR-RTR","force":"SHOULD"},{"id":"CCM-QTR-SAR","force":"SHOULD"},{"id":"CCM-QTR-SCR","force":"MAY"},{"id":"CCM-QTR-SRR","force":"MAY"},{"id":"CDS-CSO-AVR","force":"MUST"},{"id":"CDS-CSO-CBF","force":"MUST"},{"id":"CDS-CSO-FID","force":"MUST"},{"id":"CDS-CSO-FRC","force":"MUST"},{"id":"CDS-CSO-HAD","force":"MUST"},{"id":"CDS-CSO-IRP","force":"MUST"},{"id":"CDS-CSO-PSM","force":"MAY"},{"id":"CDS-CSO-PUB","force":"MUST"},{"id":"CDS-CSO-RIS","force":"MUST"},{"id":"CDS-CSO-RPS","force":"MAY"},{"id":"CDS-CSO-SVC","force":"MUST"},{"id":"CDS-CSO-UTC","force":"MUST"},{"id":"CDS-TRC-AAI","force":"MUST"},{"id":"CDS-TRC-ACL","force":"MUST"},{"id":"CDS-TRC-HMR","force":"SHOULD"},{"id":"CDS-TRC-PAC","force":"MUST"},{"id":"CDS-TRC-SSM","force":"SHOULD"},{"id":"CDS-TRC-USH","force":"MUST"},{"id":"CDS-UTC-AAD","force":"MUST"},{"id":"CDS-UTC-AGA","force":"SHOULD"},{"id":"CMU-CSO-CAT","force":"SHOULD"},{"id":"CMU-CSO-CMD","force":"MUST"},{"id":"CMU-CSO-UVM","force":"MAY"},{"id":"CPO-CSO-MTD","force":"MUST"},{"id":"CPO-CSO-OSA","force":"MUST"},{"id":"CPO-CSO-OVR","force":"MUST"},{"id":"CPO-CSX-CPM","force":"MUST"},{"id":"FRC-APP-AFC","force":"MUST"},{"id":"FRC-APP-FCP","force":"MUST"},{"id":"FRC-APP-FIA","force":"MUST"},{"id":"FRC-APP-MLF","force":"MUST"},{"id":"FRC-APP-NTP","force":"MUST NOT"},{"id":"FRC-APP-USA","force":"MAY"},{"id":"FRC-CSO-FCP","force":"MUST"},{"id":"FRC-CSO-JSN","force":"MUST"},{"id":"FRC-CSO-MRA","force":"MUST"},{"id":"FRC-CSO-PKG","force":"MUST"},{"id":"FRC-CSO-POP","force":"MUST NOT"},{"id":"FRC-CSX-MAS","force":"SHOULD"},{"id":"FRC-CSX-VVK","force":"SHOULD"},{"id":"FRC-CSX-VVR","force":"SHOULD"},{"id":"IEC-CSO-AIR","force":"SHOULD"},{"id":"IEC-CSO-DPR","force":"MUST"},{"id":"IEC-CSO-EFI","force":"SHOULD"},{"id":"IEC-CSO-EFR","force":"MUST"},{"id":"IEC-CSO-FIR","force":"MUST"},{"id":"IEC-CSO-IIR","force":"MUST"},{"id":"IEC-CSO-OIR","force":"MUST"},{"id":"IVV-CSO-DUS","force":"MUST"},{"id":"IVV-CSO-FIA","force":"MUST"},{"id":"IVV-CSO-ICP","force":"MUST"},{"id":"IVV-CSO-RAA","force":"MAY"},{"id":"IVV-CSO-SEE","force":"MUST"},{"id":"IVV-CSO-SEI","force":"MUST"},{"id":"IVV-CSO-STE","force":"SHOULD"},{"id":"IVV-CSO-USR","force":"MAY"},{"id":"IVV-CSX-AIA","force":"MUST"},{"id":"MAS-CSO-FLO","force":"MUST"},{"id":"MAS-CSO-IIR","force":"MUST"},{"id":"MAS-CSO-MDI","force":"MUST"},{"id":"MAS-CSO-SUP","force":"MAY"},{"id":"MAS-CSO-TPR","force":"MUST"},{"id":"MKT-CSO-MLR","force":"MUST"},{"id":"MKT-CSO-PML","force":"MUST"},{"id":"MKT-IIP-AGU","force":"MUST"},{"id":"MKT-IIP-DCP","force":"MUST"},{"id":"MKT-IIP-DLA","force":"MUST"},{"id":"SCG-CSO-AUP","force":"MUST"},{"id":"SCG-CSO-PUB","force":"SHOULD"},{"id":"SCG-CSO-RSC","force":"MUST"},{"id":"SCG-CSO-SDF","force":"SHOULD"},{"id":"SCG-ENH-API","force":"SHOULD"},{"id":"SCG-ENH-CMP","force":"SHOULD"},{"id":"SCG-ENH-EXP","force":"SHOULD"},{"id":"SCG-ENH-MRG","force":"SHOULD"},{"id":"SCG-ENH-VRH","force":"SHOULD"},{"id":"SCN-ADP-NTF","force":"MUST"},{"id":"SCN-CSO-ARI","force":"MAY"},{"id":"SCN-CSO-EMG","force":"MAY"},{"id":"SCN-CSO-EVA","force":"MUST"},{"id":"SCN-CSO-HIS","force":"MUST"},{"id":"SCN-CSO-HRM","force":"MUST"},{"id":"SCN-CSO-INF","force":"MUST"},{"id":"SCN-CSO-MAR","force":"MUST"},{"id":"SCN-CSO-NOM","force":"MAY"},{"id":"SCN-RTR-NNR","force":"SHOULD NOT"},{"id":"SCN-TRF-NAF","force":"MUST"},{"id":"SCN-TRF-NAV","force":"MUST"},{"id":"SCN-TRF-NFP","force":"MUST"},{"id":"SCN-TRF-NIP","force":"MUST"},{"id":"SCN-TRF-TPR","force":"SHOULD"},{"id":"SCN-TRF-UPD","force":"MUST"},{"id":"SDR-CSO-FRR","force":"MUST"},{"id":"SDR-CSO-MTD","force":"MUST"},{"id":"SDR-CSX-KMT","force":"SHOULD"},{"id":"SDR-CSX-KSI","force":"MUST"},{"id":"VDR-CSO-ADT","force":"SHOULD"},{"id":"VDR-CSO-AKE","force":"SHOULD NOT"},{"id":"VDR-CSO-DAC","force":"SHOULD"},{"id":"VDR-CSO-DET","force":"MUST"},{"id":"VDR-CSO-DFR","force":"SHOULD"},{"id":"VDR-CSO-FAV","force":"MUST"},{"id":"VDR-CSO-MSP","force":"SHOULD NOT"},{"id":"VDR-CSO-RES","force":"MUST"},{"id":"VDR-CSO-SIR","force":"MAY"},{"id":"VDR-TFR-KEV","force":"SHOULD"},{"id":"VDR-TFR-MVX","force":"MUST"},{"id":"VDR-TFR-NMV","force":"MUST"},{"id":"VDR-TFR-PCD","force":"SHOULD"},{"id":"VDR-TFR-PDD","force":"SHOULD"},{"id":"VDR-TFR-PSD","force":"SHOULD"},{"id":"VDR-TFR-PVR","force":"SHOULD"},{"id":"VDR-TFR-RMN","force":"SHOULD"},{"id":"VER-EVA-AIA","force":"MUST"},{"id":"VER-EVA-EFA","force":"SHOULD"},{"id":"VER-EVA-EFP","force":"SHOULD"},{"id":"VER-EVA-EIR","force":"MUST"},{"id":"VER-EVA-ELX","force":"MUST"},{"id":"VER-EVA-EPA","force":"MUST"},{"id":"VER-EVA-GRV","force":"SHOULD"},{"id":"VER-RPT-AVI","force":"MUST"},{"id":"VER-RPT-HLO","force":"SHOULD"},{"id":"VER-RPT-NID","force":"MUST NOT"},{"id":"VER-RPT-PER","force":"MUST"},{"id":"VER-RPT-RPD","force":"MAY"},{"id":"VER-RPT-VDT","force":"MUST"},{"id":"VER-TFR-EVU","force":"SHOULD"},{"id":"VER-TFR-IRI","force":"MAY"},{"id":"VER-TFR-MAV","force":"MUST"},{"id":"VER-TFR-MHR","force":"MUST"},{"id":"VER-TFR-MRH","force":"SHOULD"},{"id":"VER-TFR-NRI","force":"MAY"}],"ksis":[{"id":"KSI-CED-RAT"},{"id":"KSI-CMT-LMC"},{"id":"KSI-CMT-RMV"},{"id":"KSI-CMT-RVP"},{"id":"KSI-CMT-VTD"},{"id":"KSI-CNA-DFP"},{"id":"KSI-CNA-EIS","optional":true},{"id":"KSI-CNA-IBP"},{"id":"KSI-CNA-MAT"},{"id":"KSI-CNA-OFA"},{"id":"KSI-CNA-RNT"},{"id":"KSI-CNA-RVP"},{"id":"KSI-CNA-ULN"},{"id":"KSI-IAM-AAM"},{"id":"KSI-IAM-APM"},{"id":"KSI-IAM-ELP"},{"id":"KSI-IAM-JIT"},{"id":"KSI-IAM-SNU"},{"id":"KSI-IAM-SUS"},{"id":"KSI-INR-AAR"},{"id":"KSI-INR-RIR"},{"id":"KSI-INR-RPI"},{"id":"KSI-MLA-ALA","optional":true},{"id":"KSI-MLA-EVC"},{"id":"KSI-MLA-LET"},{"id":"KSI-MLA-OSM"},{"id":"KSI-MLA-RVL"},{"id":"KSI-PIY-GIV"},{"id":"KSI-PIY-RES"},{"id":"KSI-PIY-RIS"},{"id":"KSI-PIY-RSD"},{"id":"KSI-PIY-RVD"},{"id":"KSI-RPL-ABO"},{"id":"KSI-RPL-ARP"},{"id":"KSI-RPL-RRO"},{"id":"KSI-RPL-TRC"},{"id":"KSI-SCR-MIT"},{"id":"KSI-SCR-MON"},{"id":"KSI-SVC-ACM"},{"id":"KSI-SVC-ASM"},{"id":"KSI-SVC-EIS"},{"id":"KSI-SVC-PRR","optional":true},{"id":"KSI-SVC-RUD","optional":true},{"id":"KSI-SVC-SIN"},{"id":"KSI-SVC-VCM","optional":true},{"id":"KSI-SVC-VRI"}],"counts":{"rules":157,"byForce":{"MAY":17,"MUST":90,"MUST NOT":5,"SHOULD":41,"SHOULD NOT":4},"ksis":46},"rev5Controls":[{"label":"AC-01","oscal":"ac-1"},{"label":"AC-02","oscal":"ac-2"},{"label":"AC-03","oscal":"ac-3"},{"label":"AC-07","oscal":"ac-7"},{"label":"AC-08","oscal":"ac-8"},{"label":"AC-14","oscal":"ac-14"},{"label":"AC-17","oscal":"ac-17"},{"label":"AC-18","oscal":"ac-18"},{"label":"AC-19","oscal":"ac-19"},{"label":"AC-20","oscal":"ac-20"},{"label":"AC-22","oscal":"ac-22"},{"label":"AT-01","oscal":"at-1"},{"label":"AT-02","oscal":"at-2"},{"label":"AT-02 (02)","oscal":"at-2.2"},{"label":"AT-03","oscal":"at-3"},{"label":"AT-04","oscal":"at-4"},{"label":"AU-01","oscal":"au-1"},{"label":"AU-02","oscal":"au-2"},{"label":"AU-03","oscal":"au-3"},{"label":"AU-04","oscal":"au-4"},{"label":"AU-05","oscal":"au-5"},{"label":"AU-06","oscal":"au-6"},{"label":"AU-08","oscal":"au-8"},{"label":"AU-09","oscal":"au-9"},{"label":"AU-11","oscal":"au-11"},{"label":"AU-12","oscal":"au-12"},{"label":"CA-01","oscal":"ca-1"},{"label":"CA-02","oscal":"ca-2"},{"label":"CA-02 (01)","oscal":"ca-2.1"},{"label":"CA-03","oscal":"ca-3"},{"label":"CA-06","oscal":"ca-6"},{"label":"CA-07","oscal":"ca-7"},{"label":"CA-07 (04)","oscal":"ca-7.4"},{"label":"CA-08","oscal":"ca-8"},{"label":"CA-09","oscal":"ca-9"},{"label":"CM-01","oscal":"cm-1"},{"label":"CM-02","oscal":"cm-2"},{"label":"CM-04","oscal":"cm-4"},{"label":"CM-05","oscal":"cm-5"},{"label":"CM-06","oscal":"cm-6"},{"label":"CM-07","oscal":"cm-7"},{"label":"CM-08","oscal":"cm-8"},{"label":"CM-10","oscal":"cm-10"},{"label":"CM-11","oscal":"cm-11"},{"label":"CP-01","oscal":"cp-1"},{"label":"CP-02","oscal":"cp-2"},{"label":"CP-03","oscal":"cp-3"},{"label":"CP-04","oscal":"cp-4"},{"label":"CP-09","oscal":"cp-9"},{"label":"CP-10","oscal":"cp-10"},{"label":"IA-01","oscal":"ia-1"},{"label":"IA-02","oscal":"ia-2"},{"label":"IA-02 (01)","oscal":"ia-2.1"},{"label":"IA-02 (02)","oscal":"ia-2.2"},{"label":"IA-02 (08)","oscal":"ia-2.8"},{"label":"IA-02 (12)","oscal":"ia-2.12"},{"label":"IA-04","oscal":"ia-4"},{"label":"IA-05","oscal":"ia-5"},{"label":"IA-05 (01)","oscal":"ia-5.1"},{"label":"IA-06","oscal":"ia-6"},{"label":"IA-07","oscal":"ia-7"},{"label":"IA-08","oscal":"ia-8"},{"label":"IA-08 (01)","oscal":"ia-8.1"},{"label":"IA-08 (02)","oscal":"ia-8.2"},{"label":"IA-08 (04)","oscal":"ia-8.4"},{"label":"IA-11","oscal":"ia-11"},{"label":"IR-01","oscal":"ir-1"},{"label":"IR-02","oscal":"ir-2"},{"label":"IR-04","oscal":"ir-4"},{"label":"IR-05","oscal":"ir-5"},{"label":"IR-06","oscal":"ir-6"},{"label":"IR-07","oscal":"ir-7"},{"label":"IR-08","oscal":"ir-8"},{"label":"MA-01","oscal":"ma-1"},{"label":"MA-02","oscal":"ma-2"},{"label":"MA-04","oscal":"ma-4"},{"label":"MA-05","oscal":"ma-5"},{"label":"MP-01","oscal":"mp-1"},{"label":"MP-02","oscal":"mp-2"},{"label":"MP-06","oscal":"mp-6"},{"label":"MP-07","oscal":"mp-7"},{"label":"PE-01","oscal":"pe-1"},{"label":"PE-02","oscal":"pe-2"},{"label":"PE-03","oscal":"pe-3"},{"label":"PE-06","oscal":"pe-6"},{"label":"PE-08","oscal":"pe-8"},{"label":"PE-12","oscal":"pe-12"},{"label":"PE-13","oscal":"pe-13"},{"label":"PE-14","oscal":"pe-14"},{"label":"PE-15","oscal":"pe-15"},{"label":"PE-16","oscal":"pe-16"},{"label":"PL-01","oscal":"pl-1"},{"label":"PL-02","oscal":"pl-2"},{"label":"PL-04","oscal":"pl-4"},{"label":"PL-04 (01)","oscal":"pl-4.1"},{"label":"PL-08","oscal":"pl-8"},{"label":"PL-10","oscal":"pl-10"},{"label":"PL-11","oscal":"pl-11"},{"label":"PS-01","oscal":"ps-1"},{"label":"PS-02","oscal":"ps-2"},{"label":"PS-03","oscal":"ps-3"},{"label":"PS-04","oscal":"ps-4"},{"label":"PS-05","oscal":"ps-5"},{"label":"PS-06","oscal":"ps-6"},{"label":"PS-07","oscal":"ps-7"},{"label":"PS-08","oscal":"ps-8"},{"label":"PS-09","oscal":"ps-9"},{"label":"RA-01","oscal":"ra-1"},{"label":"RA-02","oscal":"ra-2"},{"label":"RA-03","oscal":"ra-3"},{"label":"RA-03 (01)","oscal":"ra-3.1"},{"label":"RA-05","oscal":"ra-5"},{"label":"RA-05 (02)","oscal":"ra-5.2"},{"label":"RA-05 (11)","oscal":"ra-5.11"},{"label":"RA-07","oscal":"ra-7"},{"label":"SA-01","oscal":"sa-1"},{"label":"SA-02","oscal":"sa-2"},{"label":"SA-03","oscal":"sa-3"},{"label":"SA-04","oscal":"sa-4"},{"label":"SA-04 (10)","oscal":"sa-4.10"},{"label":"SA-05","oscal":"sa-5"},{"label":"SA-08","oscal":"sa-8"},{"label":"SA-09","oscal":"sa-9"},{"label":"SA-22","oscal":"sa-22"},{"label":"SC-01","oscal":"sc-1"},{"label":"SC-05","oscal":"sc-5"},{"label":"SC-07","oscal":"sc-7"},{"label":"SC-08","oscal":"sc-8"},{"label":"SC-08 (01)","oscal":"sc-8.1"},{"label":"SC-12","oscal":"sc-12"},{"label":"SC-13","oscal":"sc-13"},{"label":"SC-15","oscal":"sc-15"},{"label":"SC-20","oscal":"sc-20"},{"label":"SC-21","oscal":"sc-21"},{"label":"SC-22","oscal":"sc-22"},{"label":"SC-28","oscal":"sc-28"},{"label":"SC-28 (01)","oscal":"sc-28.1"},{"label":"SC-39","oscal":"sc-39"},{"label":"SI-01","oscal":"si-1"},{"label":"SI-02","oscal":"si-2"},{"label":"SI-03","oscal":"si-3"},{"label":"SI-04","oscal":"si-4"},{"label":"SI-05","oscal":"si-5"},{"label":"SI-12","oscal":"si-12"},{"label":"SR-01","oscal":"sr-1"},{"label":"SR-02","oscal":"sr-2"},{"label":"SR-02 (01)","oscal":"sr-2.1"},{"label":"SR-03","oscal":"sr-3"},{"label":"SR-05","oscal":"sr-5"},{"label":"SR-08","oscal":"sr-8"},{"label":"SR-10","oscal":"sr-10"},{"label":"SR-11","oscal":"sr-11"},{"label":"SR-11 (01)","oscal":"sr-11.1"},{"label":"SR-11 (02)","oscal":"sr-11.2"},{"label":"SR-12","oscal":"sr-12"}],"provisional":false},"C":{"rules":[{"id":"AFC-CSO-ACK","force":"SHOULD"},{"id":"AFC-CSO-CRA","force":"MUST"},{"id":"AFC-CSO-EMR","force":"MUST"},{"id":"AFC-CSO-IMA","force":"SHOULD"},{"id":"AFC-CSO-INB","force":"MUST"},{"id":"AFC-CSO-NOC","force":"MUST"},{"id":"AFC-CSO-RCV","force":"MUST"},{"id":"AFC-CSO-TFG","force":"MUST"},{"id":"CCM-OCR-AFS","force":"MUST"},{"id":"CCM-OCR-AVL","force":"MUST"},{"id":"CCM-OCR-FBM","force":"MUST"},{"id":"CCM-OCR-LSI","force":"MUST NOT"},{"id":"CCM-OCR-NRD","force":"MUST"},{"id":"CCM-OCR-RPS","force":"MAY"},{"id":"CCM-OCR-SOR","force":"SHOULD"},{"id":"CCM-QTR-ACT","force":"SHOULD"},{"id":"CCM-QTR-MTG","force":"MUST"},{"id":"CCM-QTR-NID","force":"MUST NOT"},{"id":"CCM-QTR-NRD","force":"MUST"},{"id":"CCM-QTR-REG","force":"MUST"},{"id":"CCM-QTR-RTP","force":"SHOULD NOT"},{"id":"CCM-QTR-RTR","force":"SHOULD"},{"id":"CCM-QTR-SAR","force":"SHOULD"},{"id":"CCM-QTR-SCR","force":"MAY"},{"id":"CCM-QTR-SRR","force":"MAY"},{"id":"CDS-CSO-AVR","force":"MUST"},{"id":"CDS-CSO-CBF","force":"MUST"},{"id":"CDS-CSO-FID","force":"MUST"},{"id":"CDS-CSO-FRC","force":"MUST"},{"id":"CDS-CSO-HAD","force":"MUST"},{"id":"CDS-CSO-IRP","force":"MUST"},{"id":"CDS-CSO-PSM","force":"MAY"},{"id":"CDS-CSO-PUB","force":"MUST"},{"id":"CDS-CSO-RIS","force":"MUST"},{"id":"CDS-CSO-RPS","force":"MAY"},{"id":"CDS-CSO-SVC","force":"MUST"},{"id":"CDS-CSO-UTC","force":"MUST"},{"id":"CDS-TRC-AAI","force":"MUST"},{"id":"CDS-TRC-ACL","force":"MUST"},{"id":"CDS-TRC-HMR","force":"SHOULD"},{"id":"CDS-TRC-PAC","force":"MUST"},{"id":"CDS-TRC-SSM","force":"SHOULD"},{"id":"CDS-TRC-USH","force":"MUST"},{"id":"CDS-UTC-AAD","force":"MUST"},{"id":"CDS-UTC-AGA","force":"SHOULD"},{"id":"CMU-CSO-CAT","force":"SHOULD"},{"id":"CMU-CSO-CMD","force":"MUST"},{"id":"CMU-CSO-UVM","force":"SHOULD"},{"id":"CPO-CSO-MTD","force":"MUST"},{"id":"CPO-CSO-OSA","force":"MUST"},{"id":"CPO-CSO-OVR","force":"MUST"},{"id":"CPO-CSX-CPM","force":"MUST"},{"id":"FRC-APP-AFC","force":"MUST"},{"id":"FRC-APP-FCP","force":"MUST"},{"id":"FRC-APP-FIA","force":"MUST"},{"id":"FRC-APP-MLF","force":"MUST"},{"id":"FRC-APP-NTP","force":"MUST NOT"},{"id":"FRC-APP-USA","force":"MAY"},{"id":"FRC-CSO-FCP","force":"MUST"},{"id":"FRC-CSO-JSN","force":"MUST"},{"id":"FRC-CSO-MRA","force":"MUST"},{"id":"FRC-CSO-PKG","force":"MUST"},{"id":"FRC-CSO-POP","force":"MUST NOT"},{"id":"FRC-CSX-MAS","force":"SHOULD"},{"id":"FRC-CSX-VVK","force":"MUST"},{"id":"FRC-CSX-VVR","force":"SHOULD"},{"id":"IEC-CSO-AIR","force":"SHOULD"},{"id":"IEC-CSO-DPR","force":"MUST"},{"id":"IEC-CSO-EFI","force":"SHOULD"},{"id":"IEC-CSO-EFR","force":"MUST"},{"id":"IEC-CSO-FIR","force":"MUST"},{"id":"IEC-CSO-IIR","force":"MUST"},{"id":"IEC-CSO-OIR","force":"MUST"},{"id":"IVV-CSO-DUS","force":"MUST"},{"id":"IVV-CSO-FIA","force":"MUST"},{"id":"IVV-CSO-ICP","force":"MUST"},{"id":"IVV-CSO-RAA","force":"MAY"},{"id":"IVV-CSO-SEE","force":"MUST"},{"id":"IVV-CSO-SEI","force":"MUST"},{"id":"IVV-CSO-STE","force":"SHOULD"},{"id":"IVV-CSO-USR","force":"MAY"},{"id":"IVV-CSX-AIA","force":"MUST"},{"id":"MAS-CSO-FLO","force":"MUST"},{"id":"MAS-CSO-IIR","force":"MUST"},{"id":"MAS-CSO-MDI","force":"MUST"},{"id":"MAS-CSO-SUP","force":"MAY"},{"id":"MAS-CSO-TPR","force":"MUST"},{"id":"MKT-CSO-MLR","force":"MUST"},{"id":"MKT-CSO-PML","force":"MUST"},{"id":"MKT-IIP-AGU","force":"MUST"},{"id":"MKT-IIP-DCP","force":"MUST"},{"id":"MKT-IIP-DLA","force":"MUST"},{"id":"SCG-CSO-AUP","force":"MUST"},{"id":"SCG-CSO-PUB","force":"SHOULD"},{"id":"SCG-CSO-RSC","force":"MUST"},{"id":"SCG-CSO-SDF","force":"SHOULD"},{"id":"SCG-ENH-API","force":"SHOULD"},{"id":"SCG-ENH-CMP","force":"SHOULD"},{"id":"SCG-ENH-EXP","force":"SHOULD"},{"id":"SCG-ENH-MRG","force":"SHOULD"},{"id":"SCG-ENH-VRH","force":"SHOULD"},{"id":"SCN-ADP-NTF","force":"MUST"},{"id":"SCN-CSO-ARI","force":"MAY"},{"id":"SCN-CSO-EMG","force":"MAY"},{"id":"SCN-CSO-EVA","force":"MUST"},{"id":"SCN-CSO-HIS","force":"MUST"},{"id":"SCN-CSO-HRM","force":"MUST"},{"id":"SCN-CSO-INF","force":"MUST"},{"id":"SCN-CSO-MAR","force":"MUST"},{"id":"SCN-CSO-NOM","force":"MAY"},{"id":"SCN-RTR-NNR","force":"SHOULD NOT"},{"id":"SCN-TRF-NAF","force":"MUST"},{"id":"SCN-TRF-NAV","force":"MUST"},{"id":"SCN-TRF-NFP","force":"MUST"},{"id":"SCN-TRF-NIP","force":"MUST"},{"id":"SCN-TRF-TPR","force":"SHOULD"},{"id":"SCN-TRF-UPD","force":"MUST"},{"id":"SDR-CSO-FRR","force":"MUST"},{"id":"SDR-CSO-MTD","force":"MUST"},{"id":"SDR-CSX-KMT","force":"MUST"},{"id":"SDR-CSX-KSI","force":"MUST"},{"id":"VDR-CSO-ADT","force":"SHOULD"},{"id":"VDR-CSO-AKE","force":"SHOULD NOT"},{"id":"VDR-CSO-DAC","force":"SHOULD"},{"id":"VDR-CSO-DET","force":"MUST"},{"id":"VDR-CSO-DFR","force":"SHOULD"},{"id":"VDR-CSO-FAV","force":"MUST"},{"id":"VDR-CSO-MSP","force":"SHOULD NOT"},{"id":"VDR-CSO-RES","force":"MUST"},{"id":"VDR-CSO-SIR","force":"MAY"},{"id":"VDR-TFR-KEV","force":"SHOULD"},{"id":"VDR-TFR-MVX","force":"MUST"},{"id":"VDR-TFR-NMV","force":"MUST"},{"id":"VDR-TFR-PCD","force":"SHOULD"},{"id":"VDR-TFR-PDD","force":"SHOULD"},{"id":"VDR-TFR-PSD","force":"SHOULD"},{"id":"VDR-TFR-PVR","force":"SHOULD"},{"id":"VDR-TFR-RMN","force":"SHOULD"},{"id":"VER-EVA-AIA","force":"MUST"},{"id":"VER-EVA-EFA","force":"SHOULD"},{"id":"VER-EVA-EFP","force":"SHOULD"},{"id":"VER-EVA-EIR","force":"MUST"},{"id":"VER-EVA-ELX","force":"MUST"},{"id":"VER-EVA-EPA","force":"MUST"},{"id":"VER-EVA-GRV","force":"SHOULD"},{"id":"VER-RPT-AVI","force":"MUST"},{"id":"VER-RPT-HLO","force":"SHOULD"},{"id":"VER-RPT-NID","force":"MUST NOT"},{"id":"VER-RPT-PER","force":"MUST"},{"id":"VER-RPT-RPD","force":"MAY"},{"id":"VER-RPT-VDT","force":"MUST"},{"id":"VER-TFR-EVU","force":"SHOULD"},{"id":"VER-TFR-IRI","force":"SHOULD"},{"id":"VER-TFR-MAV","force":"MUST"},{"id":"VER-TFR-MHR","force":"MUST"},{"id":"VER-TFR-MRH","force":"SHOULD"},{"id":"VER-TFR-NRI","force":"MAY"}],"ksis":[{"id":"KSI-CED-RAT"},{"id":"KSI-CMT-LMC"},{"id":"KSI-CMT-RMV"},{"id":"KSI-CMT-RVP"},{"id":"KSI-CMT-VTD"},{"id":"KSI-CNA-DFP"},{"id":"KSI-CNA-EIS"},{"id":"KSI-CNA-IBP"},{"id":"KSI-CNA-MAT"},{"id":"KSI-CNA-OFA"},{"id":"KSI-CNA-RNT"},{"id":"KSI-CNA-RVP"},{"id":"KSI-CNA-ULN"},{"id":"KSI-IAM-AAM"},{"id":"KSI-IAM-APM"},{"id":"KSI-IAM-ELP"},{"id":"KSI-IAM-JIT"},{"id":"KSI-IAM-SNU"},{"id":"KSI-IAM-SUS"},{"id":"KSI-INR-AAR"},{"id":"KSI-INR-RIR"},{"id":"KSI-INR-RPI"},{"id":"KSI-MLA-ALA"},{"id":"KSI-MLA-EVC"},{"id":"KSI-MLA-LET"},{"id":"KSI-MLA-OSM"},{"id":"KSI-MLA-RVL"},{"id":"KSI-PIY-GIV"},{"id":"KSI-PIY-RES"},{"id":"KSI-PIY-RIS"},{"id":"KSI-PIY-RSD"},{"id":"KSI-PIY-RVD"},{"id":"KSI-RPL-ABO"},{"id":"KSI-RPL-ARP"},{"id":"KSI-RPL-RRO"},{"id":"KSI-RPL-TRC"},{"id":"KSI-SCR-MIT"},{"id":"KSI-SCR-MON"},{"id":"KSI-SVC-ACM"},{"id":"KSI-SVC-ASM"},{"id":"KSI-SVC-EIS"},{"id":"KSI-SVC-PRR"},{"id":"KSI-SVC-RUD"},{"id":"KSI-SVC-SIN"},{"id":"KSI-SVC-VCM"},{"id":"KSI-SVC-VRI"}],"counts":{"rules":157,"byForce":{"MAY":15,"MUST":93,"MUST NOT":5,"SHOULD":40,"SHOULD NOT":4},"ksis":46},"rev5Controls":[{"label":"AC-01","oscal":"ac-1"},{"label":"AC-02","oscal":"ac-2"},{"label":"AC-02 (01)","oscal":"ac-2.1"},{"label":"AC-02 (02)","oscal":"ac-2.2"},{"label":"AC-02 (03)","oscal":"ac-2.3"},{"label":"AC-02 (04)","oscal":"ac-2.4"},{"label":"AC-02 (05)","oscal":"ac-2.5"},{"label":"AC-02 (07)","oscal":"ac-2.7"},{"label":"AC-02 (09)","oscal":"ac-2.9"},{"label":"AC-02 (12)","oscal":"ac-2.12"},{"label":"AC-02 (13)","oscal":"ac-2.13"},{"label":"AC-03","oscal":"ac-3"},{"label":"AC-04","oscal":"ac-4"},{"label":"AC-04 (21)","oscal":"ac-4.21"},{"label":"AC-05","oscal":"ac-5"},{"label":"AC-06","oscal":"ac-6"},{"label":"AC-06 (01)","oscal":"ac-6.1"},{"label":"AC-06 (02)","oscal":"ac-6.2"},{"label":"AC-06 (05)","oscal":"ac-6.5"},{"label":"AC-06 (07)","oscal":"ac-6.7"},{"label":"AC-06 (09)","oscal":"ac-6.9"},{"label":"AC-06 (10)","oscal":"ac-6.10"},{"label":"AC-07","oscal":"ac-7"},{"label":"AC-08","oscal":"ac-8"},{"label":"AC-11","oscal":"ac-11"},{"label":"AC-11 (01)","oscal":"ac-11.1"},{"label":"AC-12","oscal":"ac-12"},{"label":"AC-14","oscal":"ac-14"},{"label":"AC-17","oscal":"ac-17"},{"label":"AC-17 (01)","oscal":"ac-17.1"},{"label":"AC-17 (02)","oscal":"ac-17.2"},{"label":"AC-17 (03)","oscal":"ac-17.3"},{"label":"AC-17 (04)","oscal":"ac-17.4"},{"label":"AC-18","oscal":"ac-18"},{"label":"AC-18 (01)","oscal":"ac-18.1"},{"label":"AC-18 (03)","oscal":"ac-18.3"},{"label":"AC-19","oscal":"ac-19"},{"label":"AC-19 (05)","oscal":"ac-19.5"},{"label":"AC-20","oscal":"ac-20"},{"label":"AC-20 (01)","oscal":"ac-20.1"},{"label":"AC-20 (02)","oscal":"ac-20.2"},{"label":"AC-21","oscal":"ac-21"},{"label":"AC-22","oscal":"ac-22"},{"label":"AT-01","oscal":"at-1"},{"label":"AT-02","oscal":"at-2"},{"label":"AT-02 (02)","oscal":"at-2.2"},{"label":"AT-02 (03)","oscal":"at-2.3"},{"label":"AT-03","oscal":"at-3"},{"label":"AT-04","oscal":"at-4"},{"label":"AU-01","oscal":"au-1"},{"label":"AU-02","oscal":"au-2"},{"label":"AU-03","oscal":"au-3"},{"label":"AU-03 (01)","oscal":"au-3.1"},{"label":"AU-04","oscal":"au-4"},{"label":"AU-05","oscal":"au-5"},{"label":"AU-06","oscal":"au-6"},{"label":"AU-06 (01)","oscal":"au-6.1"},{"label":"AU-06 (03)","oscal":"au-6.3"},{"label":"AU-07","oscal":"au-7"},{"label":"AU-07 (01)","oscal":"au-7.1"},{"label":"AU-08","oscal":"au-8"},{"label":"AU-09","oscal":"au-9"},{"label":"AU-09 (04)","oscal":"au-9.4"},{"label":"AU-11","oscal":"au-11"},{"label":"AU-12","oscal":"au-12"},{"label":"CA-01","oscal":"ca-1"},{"label":"CA-02","oscal":"ca-2"},{"label":"CA-02 (01)","oscal":"ca-2.1"},{"label":"CA-02 (03)","oscal":"ca-2.3"},{"label":"CA-03","oscal":"ca-3"},{"label":"CA-06","oscal":"ca-6"},{"label":"CA-07","oscal":"ca-7"},{"label":"CA-07 (01)","oscal":"ca-7.1"},{"label":"CA-07 (04)","oscal":"ca-7.4"},{"label":"CA-08","oscal":"ca-8"},{"label":"CA-08 (01)","oscal":"ca-8.1"},{"label":"CA-08 (02)","oscal":"ca-8.2"},{"label":"CA-09","oscal":"ca-9"},{"label":"CM-01","oscal":"cm-1"},{"label":"CM-02","oscal":"cm-2"},{"label":"CM-02 (02)","oscal":"cm-2.2"},{"label":"CM-02 (03)","oscal":"cm-2.3"},{"label":"CM-02 (07)","oscal":"cm-2.7"},{"label":"CM-03","oscal":"cm-3"},{"label":"CM-03 (02)","oscal":"cm-3.2"},{"label":"CM-03 (04)","oscal":"cm-3.4"},{"label":"CM-04","oscal":"cm-4"},{"label":"CM-04 (02)","oscal":"cm-4.2"},{"label":"CM-05","oscal":"cm-5"},{"label":"CM-05 (01)","oscal":"cm-5.1"},{"label":"CM-05 (05)","oscal":"cm-5.5"},{"label":"CM-06","oscal":"cm-6"},{"label":"CM-06 (01)","oscal":"cm-6.1"},{"label":"CM-07","oscal":"cm-7"},{"label":"CM-07 (01)","oscal":"cm-7.1"},{"label":"CM-07 (02)","oscal":"cm-7.2"},{"label":"CM-07 (05)","oscal":"cm-7.5"},{"label":"CM-08","oscal":"cm-8"},{"label":"CM-08 (01)","oscal":"cm-8.1"},{"label":"CM-08 (03)","oscal":"cm-8.3"},{"label":"CM-09","oscal":"cm-9"},{"label":"CM-10","oscal":"cm-10"},{"label":"CM-11","oscal":"cm-11"},{"label":"CM-12","oscal":"cm-12"},{"label":"CM-12 (01)","oscal":"cm-12.1"},{"label":"CP-01","oscal":"cp-1"},{"label":"CP-02","oscal":"cp-2"},{"label":"CP-02 (01)","oscal":"cp-2.1"},{"label":"CP-02 (03)","oscal":"cp-2.3"},{"label":"CP-02 (08)","oscal":"cp-2.8"},{"label":"CP-03","oscal":"cp-3"},{"label":"CP-04","oscal":"cp-4"},{"label":"CP-04 (01)","oscal":"cp-4.1"},{"label":"CP-06","oscal":"cp-6"},{"label":"CP-06 (01)","oscal":"cp-6.1"},{"label":"CP-06 (03)","oscal":"cp-6.3"},{"label":"CP-07","oscal":"cp-7"},{"label":"CP-07 (01)","oscal":"cp-7.1"},{"label":"CP-07 (02)","oscal":"cp-7.2"},{"label":"CP-07 (03)","oscal":"cp-7.3"},{"label":"CP-08","oscal":"cp-8"},{"label":"CP-08 (01)","oscal":"cp-8.1"},{"label":"CP-08 (02)","oscal":"cp-8.2"},{"label":"CP-09","oscal":"cp-9"},{"label":"CP-09 (01)","oscal":"cp-9.1"},{"label":"CP-09 (08)","oscal":"cp-9.8"},{"label":"CP-10","oscal":"cp-10"},{"label":"CP-10 (02)","oscal":"cp-10.2"},{"label":"IA-01","oscal":"ia-1"},{"label":"IA-02","oscal":"ia-2"},{"label":"IA-02 (01)","oscal":"ia-2.1"},{"label":"IA-02 (02)","oscal":"ia-2.2"},{"label":"IA-02 (05)","oscal":"ia-2.5"},{"label":"IA-02 (06)","oscal":"ia-2.6"},{"label":"IA-02 (08)","oscal":"ia-2.8"},{"label":"IA-02 (12)","oscal":"ia-2.12"},{"label":"IA-03","oscal":"ia-3"},{"label":"IA-04","oscal":"ia-4"},{"label":"IA-04 (04)","oscal":"ia-4.4"},{"label":"IA-05","oscal":"ia-5"},{"label":"IA-05 (01)","oscal":"ia-5.1"},{"label":"IA-05 (02)","oscal":"ia-5.2"},{"label":"IA-05 (06)","oscal":"ia-5.6"},{"label":"IA-05 (07)","oscal":"ia-5.7"},{"label":"IA-06","oscal":"ia-6"},{"label":"IA-07","oscal":"ia-7"},{"label":"IA-08","oscal":"ia-8"},{"label":"IA-08 (01)","oscal":"ia-8.1"},{"label":"IA-08 (02)","oscal":"ia-8.2"},{"label":"IA-08 (04)","oscal":"ia-8.4"},{"label":"IA-11","oscal":"ia-11"},{"label":"IA-12","oscal":"ia-12"},{"label":"IA-12 (02)","oscal":"ia-12.2"},{"label":"IA-12 (03)","oscal":"ia-12.3"},{"label":"IA-12 (05)","oscal":"ia-12.5"},{"label":"IR-01","oscal":"ir-1"},{"label":"IR-02","oscal":"ir-2"},{"label":"IR-03","oscal":"ir-3"},{"label":"IR-03 (02)","oscal":"ir-3.2"},{"label":"IR-04","oscal":"ir-4"},{"label":"IR-04 (01)","oscal":"ir-4.1"},{"label":"IR-05","oscal":"ir-5"},{"label":"IR-06","oscal":"ir-6"},{"label":"IR-06 (01)","oscal":"ir-6.1"},{"label":"IR-06 (03)","oscal":"ir-6.3"},{"label":"IR-07","oscal":"ir-7"},{"label":"IR-07 (01)","oscal":"ir-7.1"},{"label":"IR-08","oscal":"ir-8"},{"label":"IR-09","oscal":"ir-9"},{"label":"IR-09 (02)","oscal":"ir-9.2"},{"label":"IR-09 (03)","oscal":"ir-9.3"},{"label":"IR-09 (04)","oscal":"ir-9.4"},{"label":"MA-01","oscal":"ma-1"},{"label":"MA-02","oscal":"ma-2"},{"label":"MA-03","oscal":"ma-3"},{"label":"MA-03 (01)","oscal":"ma-3.1"},{"label":"MA-03 (02)","oscal":"ma-3.2"},{"label":"MA-03 (03)","oscal":"ma-3.3"},{"label":"MA-04","oscal":"ma-4"},{"label":"MA-05","oscal":"ma-5"},{"label":"MA-05 (01)","oscal":"ma-5.1"},{"label":"MA-06","oscal":"ma-6"},{"label":"MP-01","oscal":"mp-1"},{"label":"MP-02","oscal":"mp-2"},{"label":"MP-03","oscal":"mp-3"},{"label":"MP-04","oscal":"mp-4"},{"label":"MP-05","oscal":"mp-5"},{"label":"MP-06","oscal":"mp-6"},{"label":"MP-07","oscal":"mp-7"},{"label":"PE-01","oscal":"pe-1"},{"label":"PE-02","oscal":"pe-2"},{"label":"PE-03","oscal":"pe-3"},{"label":"PE-04","oscal":"pe-4"},{"label":"PE-05","oscal":"pe-5"},{"label":"PE-06","oscal":"pe-6"},{"label":"PE-06 (01)","oscal":"pe-6.1"},{"label":"PE-08","oscal":"pe-8"},{"label":"PE-09","oscal":"pe-9"},{"label":"PE-10","oscal":"pe-10"},{"label":"PE-11","oscal":"pe-11"},{"label":"PE-12","oscal":"pe-12"},{"label":"PE-13","oscal":"pe-13"},{"label":"PE-13 (01)","oscal":"pe-13.1"},{"label":"PE-13 (02)","oscal":"pe-13.2"},{"label":"PE-14","oscal":"pe-14"},{"label":"PE-15","oscal":"pe-15"},{"label":"PE-16","oscal":"pe-16"},{"label":"PE-17","oscal":"pe-17"},{"label":"PL-01","oscal":"pl-1"},{"label":"PL-02","oscal":"pl-2"},{"label":"PL-04","oscal":"pl-4"},{"label":"PL-04 (01)","oscal":"pl-4.1"},{"label":"PL-08","oscal":"pl-8"},{"label":"PL-10","oscal":"pl-10"},{"label":"PL-11","oscal":"pl-11"},{"label":"PS-01","oscal":"ps-1"},{"label":"PS-02","oscal":"ps-2"},{"label":"PS-03","oscal":"ps-3"},{"label":"PS-03 (03)","oscal":"ps-3.3"},{"label":"PS-04","oscal":"ps-4"},{"label":"PS-05","oscal":"ps-5"},{"label":"PS-06","oscal":"ps-6"},{"label":"PS-07","oscal":"ps-7"},{"label":"PS-08","oscal":"ps-8"},{"label":"PS-09","oscal":"ps-9"},{"label":"RA-01","oscal":"ra-1"},{"label":"RA-02","oscal":"ra-2"},{"label":"RA-03","oscal":"ra-3"},{"label":"RA-03 (01)","oscal":"ra-3.1"},{"label":"RA-05","oscal":"ra-5"},{"label":"RA-05 (02)","oscal":"ra-5.2"},{"label":"RA-05 (03)","oscal":"ra-5.3"},{"label":"RA-05 (05)","oscal":"ra-5.5"},{"label":"RA-05 (11)","oscal":"ra-5.11"},{"label":"RA-07","oscal":"ra-7"},{"label":"RA-09","oscal":"ra-9"},{"label":"SA-01","oscal":"sa-1"},{"label":"SA-02","oscal":"sa-2"},{"label":"SA-03","oscal":"sa-3"},{"label":"SA-04","oscal":"sa-4"},{"label":"SA-04 (01)","oscal":"sa-4.1"},{"label":"SA-04 (02)","oscal":"sa-4.2"},{"label":"SA-04 (09)","oscal":"sa-4.9"},{"label":"SA-04 (10)","oscal":"sa-4.10"},{"label":"SA-05","oscal":"sa-5"},{"label":"SA-08","oscal":"sa-8"},{"label":"SA-09","oscal":"sa-9"},{"label":"SA-09 (01)","oscal":"sa-9.1"},{"label":"SA-09 (02)","oscal":"sa-9.2"},{"label":"SA-09 (05)","oscal":"sa-9.5"},{"label":"SA-10","oscal":"sa-10"},{"label":"SA-11","oscal":"sa-11"},{"label":"SA-11 (01)","oscal":"sa-11.1"},{"label":"SA-11 (02)","oscal":"sa-11.2"},{"label":"SA-15","oscal":"sa-15"},{"label":"SA-15 (03)","oscal":"sa-15.3"},{"label":"SA-22","oscal":"sa-22"},{"label":"SC-01","oscal":"sc-1"},{"label":"SC-02","oscal":"sc-2"},{"label":"SC-04","oscal":"sc-4"},{"label":"SC-05","oscal":"sc-5"},{"label":"SC-07","oscal":"sc-7"},{"label":"SC-07 (03)","oscal":"sc-7.3"},{"label":"SC-07 (04)","oscal":"sc-7.4"},{"label":"SC-07 (05)","oscal":"sc-7.5"},{"label":"SC-07 (07)","oscal":"sc-7.7"},{"label":"SC-07 (08)","oscal":"sc-7.8"},{"label":"SC-07 (12)","oscal":"sc-7.12"},{"label":"SC-07 (18)","oscal":"sc-7.18"},{"label":"SC-08","oscal":"sc-8"},{"label":"SC-08 (01)","oscal":"sc-8.1"},{"label":"SC-10","oscal":"sc-10"},{"label":"SC-12","oscal":"sc-12"},{"label":"SC-13","oscal":"sc-13"},{"label":"SC-15","oscal":"sc-15"},{"label":"SC-17","oscal":"sc-17"},{"label":"SC-18","oscal":"sc-18"},{"label":"SC-20","oscal":"sc-20"},{"label":"SC-21","oscal":"sc-21"},{"label":"SC-22","oscal":"sc-22"},{"label":"SC-23","oscal":"sc-23"},{"label":"SC-28","oscal":"sc-28"},{"label":"SC-28 (01)","oscal":"sc-28.1"},{"label":"SC-39","oscal":"sc-39"},{"label":"SC-45","oscal":"sc-45"},{"label":"SC-45 (01)","oscal":"sc-45.1"},{"label":"SI-01","oscal":"si-1"},{"label":"SI-02","oscal":"si-2"},{"label":"SI-02 (02)","oscal":"si-2.2"},{"label":"SI-02 (03)","oscal":"si-2.3"},{"label":"SI-03","oscal":"si-3"},{"label":"SI-04","oscal":"si-4"},{"label":"SI-04 (01)","oscal":"si-4.1"},{"label":"SI-04 (02)","oscal":"si-4.2"},{"label":"SI-04 (04)","oscal":"si-4.4"},{"label":"SI-04 (05)","oscal":"si-4.5"},{"label":"SI-04 (16)","oscal":"si-4.16"},{"label":"SI-04 (18)","oscal":"si-4.18"},{"label":"SI-04 (23)","oscal":"si-4.23"},{"label":"SI-05","oscal":"si-5"},{"label":"SI-06","oscal":"si-6"},{"label":"SI-07","oscal":"si-7"},{"label":"SI-07 (01)","oscal":"si-7.1"},{"label":"SI-07 (07)","oscal":"si-7.7"},{"label":"SI-08","oscal":"si-8"},{"label":"SI-08 (02)","oscal":"si-8.2"},{"label":"SI-10","oscal":"si-10"},{"label":"SI-11","oscal":"si-11"},{"label":"SI-12","oscal":"si-12"},{"label":"SI-16","oscal":"si-16"},{"label":"SR-01","oscal":"sr-1"},{"label":"SR-02","oscal":"sr-2"},{"label":"SR-02 (01)","oscal":"sr-2.1"},{"label":"SR-03","oscal":"sr-3"},{"label":"SR-05","oscal":"sr-5"},{"label":"SR-06","oscal":"sr-6"},{"label":"SR-08","oscal":"sr-8"},{"label":"SR-10","oscal":"sr-10"},{"label":"SR-11","oscal":"sr-11"},{"label":"SR-11 (01)","oscal":"sr-11.1"},{"label":"SR-11 (02)","oscal":"sr-11.2"},{"label":"SR-12","oscal":"sr-12"}],"provisional":false},"D":{"rules":[{"id":"AFC-CSO-ACK","force":"SHOULD"},{"id":"AFC-CSO-CRA","force":"MUST"},{"id":"AFC-CSO-EMR","force":"MUST"},{"id":"AFC-CSO-IMA","force":"SHOULD"},{"id":"AFC-CSO-INB","force":"MUST"},{"id":"AFC-CSO-NOC","force":"MUST"},{"id":"AFC-CSO-RCV","force":"MUST"},{"id":"AFC-CSO-TFG","force":"MUST"},{"id":"CCM-OCR-AFS","force":"MUST"},{"id":"CCM-OCR-AVL","force":"MUST"},{"id":"CCM-OCR-FBM","force":"MUST"},{"id":"CCM-OCR-LSI","force":"MUST NOT"},{"id":"CCM-OCR-NRD","force":"MUST"},{"id":"CCM-OCR-RPS","force":"MAY"},{"id":"CCM-OCR-SOR","force":"SHOULD"},{"id":"CCM-QTR-ACT","force":"SHOULD"},{"id":"CCM-QTR-MTG","force":"MUST"},{"id":"CCM-QTR-NID","force":"MUST NOT"},{"id":"CCM-QTR-NRD","force":"MUST"},{"id":"CCM-QTR-REG","force":"MUST"},{"id":"CCM-QTR-RTP","force":"SHOULD NOT"},{"id":"CCM-QTR-RTR","force":"SHOULD"},{"id":"CCM-QTR-SAR","force":"SHOULD"},{"id":"CCM-QTR-SCR","force":"MAY"},{"id":"CCM-QTR-SRR","force":"MAY"},{"id":"CDS-CSO-AVR","force":"MUST"},{"id":"CDS-CSO-CBF","force":"MUST"},{"id":"CDS-CSO-FID","force":"MUST"},{"id":"CDS-CSO-FRC","force":"MUST"},{"id":"CDS-CSO-HAD","force":"MUST"},{"id":"CDS-CSO-IRP","force":"MUST"},{"id":"CDS-CSO-PSM","force":"MUST"},{"id":"CDS-CSO-PUB","force":"MUST"},{"id":"CDS-CSO-RIS","force":"MUST"},{"id":"CDS-CSO-RPS","force":"MAY"},{"id":"CDS-CSO-SVC","force":"MUST"},{"id":"CDS-CSO-UTC","force":"MUST"},{"id":"CDS-TRC-AAI","force":"MUST"},{"id":"CDS-TRC-ACL","force":"MUST"},{"id":"CDS-TRC-HMR","force":"SHOULD"},{"id":"CDS-TRC-PAC","force":"MUST"},{"id":"CDS-TRC-SSM","force":"SHOULD"},{"id":"CDS-TRC-USH","force":"MUST"},{"id":"CDS-UTC-AAD","force":"MUST"},{"id":"CDS-UTC-AGA","force":"SHOULD"},{"id":"CMU-CSO-CAT","force":"SHOULD"},{"id":"CMU-CSO-CMD","force":"MUST"},{"id":"CMU-CSO-UVM","force":"MUST"},{"id":"CPO-CSO-MTD","force":"MUST"},{"id":"CPO-CSO-OSA","force":"MUST"},{"id":"CPO-CSO-OVR","force":"MUST"},{"id":"CPO-CSX-CPM","force":"MUST"},{"id":"FRC-APP-AFC","force":"MUST"},{"id":"FRC-APP-FCP","force":"MUST"},{"id":"FRC-APP-FIA","force":"MUST"},{"id":"FRC-APP-MLF","force":"MUST"},{"id":"FRC-APP-NTP","force":"MUST NOT"},{"id":"FRC-APP-USA","force":"MAY"},{"id":"FRC-CSO-FCP","force":"MUST"},{"id":"FRC-CSO-JSN","force":"MUST"},{"id":"FRC-CSO-MRA","force":"MUST"},{"id":"FRC-CSO-PKG","force":"MUST"},{"id":"FRC-CSO-POP","force":"MUST NOT"},{"id":"FRC-CSX-MAS","force":"SHOULD"},{"id":"FRC-CSX-VVK","force":"MUST"},{"id":"FRC-CSX-VVR","force":"SHOULD"},{"id":"IEC-CSO-AIR","force":"SHOULD"},{"id":"IEC-CSO-DPR","force":"MUST"},{"id":"IEC-CSO-EFI","force":"SHOULD"},{"id":"IEC-CSO-EFR","force":"MUST"},{"id":"IEC-CSO-FIR","force":"MUST"},{"id":"IEC-CSO-IIR","force":"MUST"},{"id":"IEC-CSO-OIR","force":"MUST"},{"id":"IVV-CSO-DUS","force":"MUST"},{"id":"IVV-CSO-FIA","force":"MUST"},{"id":"IVV-CSO-ICP","force":"MUST"},{"id":"IVV-CSO-RAA","force":"MAY"},{"id":"IVV-CSO-SEE","force":"MUST"},{"id":"IVV-CSO-SEI","force":"MUST"},{"id":"IVV-CSO-STE","force":"SHOULD"},{"id":"IVV-CSO-USR","force":"MAY"},{"id":"IVV-CSX-AIA","force":"MUST"},{"id":"MAS-CSO-FLO","force":"MUST"},{"id":"MAS-CSO-IIR","force":"MUST"},{"id":"MAS-CSO-MDI","force":"MUST"},{"id":"MAS-CSO-SUP","force":"MAY"},{"id":"MAS-CSO-TPR","force":"MUST"},{"id":"MKT-CSO-MLR","force":"MUST"},{"id":"MKT-CSO-PML","force":"MUST"},{"id":"MKT-IIP-AGU","force":"MUST"},{"id":"MKT-IIP-DCP","force":"MUST"},{"id":"MKT-IIP-DLA","force":"MUST"},{"id":"SCG-CSO-AUP","force":"MUST"},{"id":"SCG-CSO-PUB","force":"SHOULD"},{"id":"SCG-CSO-RSC","force":"MUST"},{"id":"SCG-CSO-SDF","force":"SHOULD"},{"id":"SCG-ENH-API","force":"SHOULD"},{"id":"SCG-ENH-CMP","force":"SHOULD"},{"id":"SCG-ENH-EXP","force":"SHOULD"},{"id":"SCG-ENH-MRG","force":"SHOULD"},{"id":"SCG-ENH-VRH","force":"SHOULD"},{"id":"SCN-ADP-NTF","force":"MUST"},{"id":"SCN-CSO-ARI","force":"MAY"},{"id":"SCN-CSO-EMG","force":"MAY"},{"id":"SCN-CSO-EVA","force":"MUST"},{"id":"SCN-CSO-HIS","force":"MUST"},{"id":"SCN-CSO-HRM","force":"MUST"},{"id":"SCN-CSO-INF","force":"MUST"},{"id":"SCN-CSO-MAR","force":"MUST"},{"id":"SCN-CSO-NOM","force":"MAY"},{"id":"SCN-RTR-NNR","force":"SHOULD NOT"},{"id":"SCN-TRF-NAF","force":"MUST"},{"id":"SCN-TRF-NAV","force":"MUST"},{"id":"SCN-TRF-NFP","force":"MUST"},{"id":"SCN-TRF-NIP","force":"MUST"},{"id":"SCN-TRF-TPR","force":"SHOULD"},{"id":"SCN-TRF-UPD","force":"MUST"},{"id":"SDR-CSO-FRR","force":"MUST"},{"id":"SDR-CSO-MTD","force":"MUST"},{"id":"SDR-CSX-KMT","force":"MUST"},{"id":"SDR-CSX-KSI","force":"MUST"},{"id":"VDR-CSO-ADT","force":"SHOULD"},{"id":"VDR-CSO-AKE","force":"SHOULD NOT"},{"id":"VDR-CSO-DAC","force":"SHOULD"},{"id":"VDR-CSO-DET","force":"MUST"},{"id":"VDR-CSO-DFR","force":"SHOULD"},{"id":"VDR-CSO-FAV","force":"MUST"},{"id":"VDR-CSO-MSP","force":"SHOULD NOT"},{"id":"VDR-CSO-RES","force":"MUST"},{"id":"VDR-CSO-SIR","force":"MAY"},{"id":"VDR-TFR-KEV","force":"SHOULD"},{"id":"VDR-TFR-NMV","force":"MUST"},{"id":"VDR-TFR-PCD","force":"SHOULD"},{"id":"VDR-TFR-PDD","force":"SHOULD"},{"id":"VDR-TFR-PSD","force":"SHOULD"},{"id":"VDR-TFR-PVR","force":"SHOULD"},{"id":"VDR-TFR-RMN","force":"SHOULD"},{"id":"VER-EVA-AIA","force":"MUST"},{"id":"VER-EVA-EFA","force":"SHOULD"},{"id":"VER-EVA-EFP","force":"SHOULD"},{"id":"VER-EVA-EIR","force":"MUST"},{"id":"VER-EVA-ELX","force":"MUST"},{"id":"VER-EVA-EPA","force":"MUST"},{"id":"VER-EVA-GRV","force":"SHOULD"},{"id":"VER-RPT-AVI","force":"MUST"},{"id":"VER-RPT-HLO","force":"SHOULD"},{"id":"VER-RPT-NID","force":"MUST NOT"},{"id":"VER-RPT-PER","force":"MUST"},{"id":"VER-RPT-RPD","force":"MAY"},{"id":"VER-RPT-VDT","force":"MUST"},{"id":"VER-TFR-EVU","force":"SHOULD"},{"id":"VER-TFR-IRI","force":"SHOULD"},{"id":"VER-TFR-MAV","force":"MUST"},{"id":"VER-TFR-MHR","force":"MUST"},{"id":"VER-TFR-MRH","force":"SHOULD"},{"id":"VER-TFR-NRI","force":"SHOULD"}],"ksis":[{"id":"KSI-CED-RAT"},{"id":"KSI-CMT-LMC"},{"id":"KSI-CMT-RMV"},{"id":"KSI-CMT-RVP"},{"id":"KSI-CMT-VTD"},{"id":"KSI-CNA-DFP"},{"id":"KSI-CNA-EIS"},{"id":"KSI-CNA-IBP"},{"id":"KSI-CNA-MAT"},{"id":"KSI-CNA-OFA"},{"id":"KSI-CNA-RNT"},{"id":"KSI-CNA-RVP"},{"id":"KSI-CNA-ULN"},{"id":"KSI-IAM-AAM"},{"id":"KSI-IAM-APM"},{"id":"KSI-IAM-ELP"},{"id":"KSI-IAM-JIT"},{"id":"KSI-IAM-SNU"},{"id":"KSI-IAM-SUS"},{"id":"KSI-INR-AAR"},{"id":"KSI-INR-RIR"},{"id":"KSI-INR-RPI"},{"id":"KSI-MLA-ALA"},{"id":"KSI-MLA-EVC"},{"id":"KSI-MLA-LET"},{"id":"KSI-MLA-OSM"},{"id":"KSI-MLA-RVL"},{"id":"KSI-PIY-GIV"},{"id":"KSI-PIY-RES"},{"id":"KSI-PIY-RIS"},{"id":"KSI-PIY-RSD"},{"id":"KSI-PIY-RVD"},{"id":"KSI-RPL-ABO"},{"id":"KSI-RPL-ARP"},{"id":"KSI-RPL-RRO"},{"id":"KSI-RPL-TRC"},{"id":"KSI-SCR-MIT"},{"id":"KSI-SCR-MON"},{"id":"KSI-SVC-ACM"},{"id":"KSI-SVC-ASM"},{"id":"KSI-SVC-EIS"},{"id":"KSI-SVC-PRR"},{"id":"KSI-SVC-RUD"},{"id":"KSI-SVC-SIN"},{"id":"KSI-SVC-VCM"},{"id":"KSI-SVC-VRI"}],"counts":{"rules":156,"byForce":{"MAY":13,"MUST":94,"MUST NOT":5,"SHOULD":40,"SHOULD NOT":4},"ksis":46},"rev5Controls":[{"label":"AC-01","oscal":"ac-1"},{"label":"AC-02","oscal":"ac-2"},{"label":"AC-02 (01)","oscal":"ac-2.1"},{"label":"AC-02 (02)","oscal":"ac-2.2"},{"label":"AC-02 (03)","oscal":"ac-2.3"},{"label":"AC-02 (04)","oscal":"ac-2.4"},{"label":"AC-02 (05)","oscal":"ac-2.5"},{"label":"AC-02 (07)","oscal":"ac-2.7"},{"label":"AC-02 (09)","oscal":"ac-2.9"},{"label":"AC-02 (11)","oscal":"ac-2.11"},{"label":"AC-02 (12)","oscal":"ac-2.12"},{"label":"AC-02 (13)","oscal":"ac-2.13"},{"label":"AC-03","oscal":"ac-3"},{"label":"AC-04","oscal":"ac-4"},{"label":"AC-04 (04)","oscal":"ac-4.4"},{"label":"AC-04 (21)","oscal":"ac-4.21"},{"label":"AC-05","oscal":"ac-5"},{"label":"AC-06","oscal":"ac-6"},{"label":"AC-06 (01)","oscal":"ac-6.1"},{"label":"AC-06 (02)","oscal":"ac-6.2"},{"label":"AC-06 (03)","oscal":"ac-6.3"},{"label":"AC-06 (05)","oscal":"ac-6.5"},{"label":"AC-06 (07)","oscal":"ac-6.7"},{"label":"AC-06 (08)","oscal":"ac-6.8"},{"label":"AC-06 (09)","oscal":"ac-6.9"},{"label":"AC-06 (10)","oscal":"ac-6.10"},{"label":"AC-07","oscal":"ac-7"},{"label":"AC-08","oscal":"ac-8"},{"label":"AC-10","oscal":"ac-10"},{"label":"AC-11","oscal":"ac-11"},{"label":"AC-11 (01)","oscal":"ac-11.1"},{"label":"AC-12","oscal":"ac-12"},{"label":"AC-14","oscal":"ac-14"},{"label":"AC-17","oscal":"ac-17"},{"label":"AC-17 (01)","oscal":"ac-17.1"},{"label":"AC-17 (02)","oscal":"ac-17.2"},{"label":"AC-17 (03)","oscal":"ac-17.3"},{"label":"AC-17 (04)","oscal":"ac-17.4"},{"label":"AC-18","oscal":"ac-18"},{"label":"AC-18 (01)","oscal":"ac-18.1"},{"label":"AC-18 (03)","oscal":"ac-18.3"},{"label":"AC-18 (04)","oscal":"ac-18.4"},{"label":"AC-18 (05)","oscal":"ac-18.5"},{"label":"AC-19","oscal":"ac-19"},{"label":"AC-19 (05)","oscal":"ac-19.5"},{"label":"AC-20","oscal":"ac-20"},{"label":"AC-20 (01)","oscal":"ac-20.1"},{"label":"AC-20 (02)","oscal":"ac-20.2"},{"label":"AC-21","oscal":"ac-21"},{"label":"AC-22","oscal":"ac-22"},{"label":"AT-01","oscal":"at-1"},{"label":"AT-02","oscal":"at-2"},{"label":"AT-02 (02)","oscal":"at-2.2"},{"label":"AT-02 (03)","oscal":"at-2.3"},{"label":"AT-03","oscal":"at-3"},{"label":"AT-04","oscal":"at-4"},{"label":"AU-01","oscal":"au-1"},{"label":"AU-02","oscal":"au-2"},{"label":"AU-03","oscal":"au-3"},{"label":"AU-03 (01)","oscal":"au-3.1"},{"label":"AU-04","oscal":"au-4"},{"label":"AU-05","oscal":"au-5"},{"label":"AU-05 (01)","oscal":"au-5.1"},{"label":"AU-05 (02)","oscal":"au-5.2"},{"label":"AU-06","oscal":"au-6"},{"label":"AU-06 (01)","oscal":"au-6.1"},{"label":"AU-06 (03)","oscal":"au-6.3"},{"label":"AU-06 (04)","oscal":"au-6.4"},{"label":"AU-06 (05)","oscal":"au-6.5"},{"label":"AU-06 (06)","oscal":"au-6.6"},{"label":"AU-06 (07)","oscal":"au-6.7"},{"label":"AU-07","oscal":"au-7"},{"label":"AU-07 (01)","oscal":"au-7.1"},{"label":"AU-08","oscal":"au-8"},{"label":"AU-09","oscal":"au-9"},{"label":"AU-09 (02)","oscal":"au-9.2"},{"label":"AU-09 (03)","oscal":"au-9.3"},{"label":"AU-09 (04)","oscal":"au-9.4"},{"label":"AU-10","oscal":"au-10"},{"label":"AU-11","oscal":"au-11"},{"label":"AU-12","oscal":"au-12"},{"label":"AU-12 (01)","oscal":"au-12.1"},{"label":"AU-12 (03)","oscal":"au-12.3"},{"label":"CA-01","oscal":"ca-1"},{"label":"CA-02","oscal":"ca-2"},{"label":"CA-02 (01)","oscal":"ca-2.1"},{"label":"CA-02 (02)","oscal":"ca-2.2"},{"label":"CA-02 (03)","oscal":"ca-2.3"},{"label":"CA-03","oscal":"ca-3"},{"label":"CA-03 (06)","oscal":"ca-3.6"},{"label":"CA-06","oscal":"ca-6"},{"label":"CA-07","oscal":"ca-7"},{"label":"CA-07 (01)","oscal":"ca-7.1"},{"label":"CA-07 (04)","oscal":"ca-7.4"},{"label":"CA-08","oscal":"ca-8"},{"label":"CA-08 (01)","oscal":"ca-8.1"},{"label":"CA-08 (02)","oscal":"ca-8.2"},{"label":"CA-09","oscal":"ca-9"},{"label":"CM-01","oscal":"cm-1"},{"label":"CM-02","oscal":"cm-2"},{"label":"CM-02 (02)","oscal":"cm-2.2"},{"label":"CM-02 (03)","oscal":"cm-2.3"},{"label":"CM-02 (07)","oscal":"cm-2.7"},{"label":"CM-03","oscal":"cm-3"},{"label":"CM-03 (01)","oscal":"cm-3.1"},{"label":"CM-03 (02)","oscal":"cm-3.2"},{"label":"CM-03 (04)","oscal":"cm-3.4"},{"label":"CM-03 (06)","oscal":"cm-3.6"},{"label":"CM-04","oscal":"cm-4"},{"label":"CM-04 (01)","oscal":"cm-4.1"},{"label":"CM-04 (02)","oscal":"cm-4.2"},{"label":"CM-05","oscal":"cm-5"},{"label":"CM-05 (01)","oscal":"cm-5.1"},{"label":"CM-05 (05)","oscal":"cm-5.5"},{"label":"CM-06","oscal":"cm-6"},{"label":"CM-06 (01)","oscal":"cm-6.1"},{"label":"CM-06 (02)","oscal":"cm-6.2"},{"label":"CM-07","oscal":"cm-7"},{"label":"CM-07 (01)","oscal":"cm-7.1"},{"label":"CM-07 (02)","oscal":"cm-7.2"},{"label":"CM-07 (05)","oscal":"cm-7.5"},{"label":"CM-08","oscal":"cm-8"},{"label":"CM-08 (01)","oscal":"cm-8.1"},{"label":"CM-08 (02)","oscal":"cm-8.2"},{"label":"CM-08 (03)","oscal":"cm-8.3"},{"label":"CM-08 (04)","oscal":"cm-8.4"},{"label":"CM-09","oscal":"cm-9"},{"label":"CM-10","oscal":"cm-10"},{"label":"CM-11","oscal":"cm-11"},{"label":"CM-12","oscal":"cm-12"},{"label":"CM-12 (01)","oscal":"cm-12.1"},{"label":"CM-14","oscal":"cm-14"},{"label":"CP-01","oscal":"cp-1"},{"label":"CP-02","oscal":"cp-2"},{"label":"CP-02 (01)","oscal":"cp-2.1"},{"label":"CP-02 (02)","oscal":"cp-2.2"},{"label":"CP-02 (03)","oscal":"cp-2.3"},{"label":"CP-02 (05)","oscal":"cp-2.5"},{"label":"CP-02 (08)","oscal":"cp-2.8"},{"label":"CP-03","oscal":"cp-3"},{"label":"CP-03 (01)","oscal":"cp-3.1"},{"label":"CP-04","oscal":"cp-4"},{"label":"CP-04 (01)","oscal":"cp-4.1"},{"label":"CP-04 (02)","oscal":"cp-4.2"},{"label":"CP-06","oscal":"cp-6"},{"label":"CP-06 (01)","oscal":"cp-6.1"},{"label":"CP-06 (02)","oscal":"cp-6.2"},{"label":"CP-06 (03)","oscal":"cp-6.3"},{"label":"CP-07","oscal":"cp-7"},{"label":"CP-07 (01)","oscal":"cp-7.1"},{"label":"CP-07 (02)","oscal":"cp-7.2"},{"label":"CP-07 (03)","oscal":"cp-7.3"},{"label":"CP-07 (04)","oscal":"cp-7.4"},{"label":"CP-08","oscal":"cp-8"},{"label":"CP-08 (01)","oscal":"cp-8.1"},{"label":"CP-08 (02)","oscal":"cp-8.2"},{"label":"CP-08 (03)","oscal":"cp-8.3"},{"label":"CP-08 (04)","oscal":"cp-8.4"},{"label":"CP-09","oscal":"cp-9"},{"label":"CP-09 (01)","oscal":"cp-9.1"},{"label":"CP-09 (02)","oscal":"cp-9.2"},{"label":"CP-09 (03)","oscal":"cp-9.3"},{"label":"CP-09 (05)","oscal":"cp-9.5"},{"label":"CP-09 (08)","oscal":"cp-9.8"},{"label":"CP-10","oscal":"cp-10"},{"label":"CP-10 (02)","oscal":"cp-10.2"},{"label":"CP-10 (04)","oscal":"cp-10.4"},{"label":"IA-01","oscal":"ia-1"},{"label":"IA-02","oscal":"ia-2"},{"label":"IA-02 (01)","oscal":"ia-2.1"},{"label":"IA-02 (02)","oscal":"ia-2.2"},{"label":"IA-02 (05)","oscal":"ia-2.5"},{"label":"IA-02 (06)","oscal":"ia-2.6"},{"label":"IA-02 (08)","oscal":"ia-2.8"},{"label":"IA-02 (12)","oscal":"ia-2.12"},{"label":"IA-03","oscal":"ia-3"},{"label":"IA-04","oscal":"ia-4"},{"label":"IA-04 (04)","oscal":"ia-4.4"},{"label":"IA-05","oscal":"ia-5"},{"label":"IA-05 (01)","oscal":"ia-5.1"},{"label":"IA-05 (02)","oscal":"ia-5.2"},{"label":"IA-05 (06)","oscal":"ia-5.6"},{"label":"IA-05 (07)","oscal":"ia-5.7"},{"label":"IA-05 (08)","oscal":"ia-5.8"},{"label":"IA-05 (13)","oscal":"ia-5.13"},{"label":"IA-06","oscal":"ia-6"},{"label":"IA-07","oscal":"ia-7"},{"label":"IA-08","oscal":"ia-8"},{"label":"IA-08 (01)","oscal":"ia-8.1"},{"label":"IA-08 (02)","oscal":"ia-8.2"},{"label":"IA-08 (04)","oscal":"ia-8.4"},{"label":"IA-11","oscal":"ia-11"},{"label":"IA-12","oscal":"ia-12"},{"label":"IA-12 (02)","oscal":"ia-12.2"},{"label":"IA-12 (03)","oscal":"ia-12.3"},{"label":"IA-12 (04)","oscal":"ia-12.4"},{"label":"IA-12 (05)","oscal":"ia-12.5"},{"label":"IR-01","oscal":"ir-1"},{"label":"IR-02","oscal":"ir-2"},{"label":"IR-02 (01)","oscal":"ir-2.1"},{"label":"IR-02 (02)","oscal":"ir-2.2"},{"label":"IR-03","oscal":"ir-3"},{"label":"IR-03 (02)","oscal":"ir-3.2"},{"label":"IR-04","oscal":"ir-4"},{"label":"IR-04 (01)","oscal":"ir-4.1"},{"label":"IR-04 (02)","oscal":"ir-4.2"},{"label":"IR-04 (04)","oscal":"ir-4.4"},{"label":"IR-04 (06)","oscal":"ir-4.6"},{"label":"IR-04 (11)","oscal":"ir-4.11"},{"label":"IR-05","oscal":"ir-5"},{"label":"IR-05 (01)","oscal":"ir-5.1"},{"label":"IR-06","oscal":"ir-6"},{"label":"IR-06 (01)","oscal":"ir-6.1"},{"label":"IR-06 (03)","oscal":"ir-6.3"},{"label":"IR-07","oscal":"ir-7"},{"label":"IR-07 (01)","oscal":"ir-7.1"},{"label":"IR-08","oscal":"ir-8"},{"label":"IR-09","oscal":"ir-9"},{"label":"IR-09 (02)","oscal":"ir-9.2"},{"label":"IR-09 (03)","oscal":"ir-9.3"},{"label":"IR-09 (04)","oscal":"ir-9.4"},{"label":"MA-01","oscal":"ma-1"},{"label":"MA-02","oscal":"ma-2"},{"label":"MA-02 (02)","oscal":"ma-2.2"},{"label":"MA-03","oscal":"ma-3"},{"label":"MA-03 (01)","oscal":"ma-3.1"},{"label":"MA-03 (02)","oscal":"ma-3.2"},{"label":"MA-03 (03)","oscal":"ma-3.3"},{"label":"MA-04","oscal":"ma-4"},{"label":"MA-04 (03)","oscal":"ma-4.3"},{"label":"MA-05","oscal":"ma-5"},{"label":"MA-05 (01)","oscal":"ma-5.1"},{"label":"MA-06","oscal":"ma-6"},{"label":"MP-01","oscal":"mp-1"},{"label":"MP-02","oscal":"mp-2"},{"label":"MP-03","oscal":"mp-3"},{"label":"MP-04","oscal":"mp-4"},{"label":"MP-05","oscal":"mp-5"},{"label":"MP-06","oscal":"mp-6"},{"label":"MP-06 (01)","oscal":"mp-6.1"},{"label":"MP-06 (02)","oscal":"mp-6.2"},{"label":"MP-06 (03)","oscal":"mp-6.3"},{"label":"MP-07","oscal":"mp-7"},{"label":"PE-01","oscal":"pe-1"},{"label":"PE-02","oscal":"pe-2"},{"label":"PE-03","oscal":"pe-3"},{"label":"PE-03 (01)","oscal":"pe-3.1"},{"label":"PE-04","oscal":"pe-4"},{"label":"PE-05","oscal":"pe-5"},{"label":"PE-06","oscal":"pe-6"},{"label":"PE-06 (01)","oscal":"pe-6.1"},{"label":"PE-06 (04)","oscal":"pe-6.4"},{"label":"PE-08","oscal":"pe-8"},{"label":"PE-08 (01)","oscal":"pe-8.1"},{"label":"PE-09","oscal":"pe-9"},{"label":"PE-10","oscal":"pe-10"},{"label":"PE-11","oscal":"pe-11"},{"label":"PE-11 (01)","oscal":"pe-11.1"},{"label":"PE-12","oscal":"pe-12"},{"label":"PE-13","oscal":"pe-13"},{"label":"PE-13 (01)","oscal":"pe-13.1"},{"label":"PE-13 (02)","oscal":"pe-13.2"},{"label":"PE-14","oscal":"pe-14"},{"label":"PE-14 (02)","oscal":"pe-14.2"},{"label":"PE-15","oscal":"pe-15"},{"label":"PE-15 (01)","oscal":"pe-15.1"},{"label":"PE-16","oscal":"pe-16"},{"label":"PE-17","oscal":"pe-17"},{"label":"PE-18","oscal":"pe-18"},{"label":"PL-01","oscal":"pl-1"},{"label":"PL-02","oscal":"pl-2"},{"label":"PL-04","oscal":"pl-4"},{"label":"PL-04 (01)","oscal":"pl-4.1"},{"label":"PL-08","oscal":"pl-8"},{"label":"PL-10","oscal":"pl-10"},{"label":"PL-11","oscal":"pl-11"},{"label":"PS-01","oscal":"ps-1"},{"label":"PS-02","oscal":"ps-2"},{"label":"PS-03","oscal":"ps-3"},{"label":"PS-03 (03)","oscal":"ps-3.3"},{"label":"PS-04","oscal":"ps-4"},{"label":"PS-04 (02)","oscal":"ps-4.2"},{"label":"PS-05","oscal":"ps-5"},{"label":"PS-06","oscal":"ps-6"},{"label":"PS-07","oscal":"ps-7"},{"label":"PS-08","oscal":"ps-8"},{"label":"PS-09","oscal":"ps-9"},{"label":"RA-01","oscal":"ra-1"},{"label":"RA-02","oscal":"ra-2"},{"label":"RA-03","oscal":"ra-3"},{"label":"RA-03 (01)","oscal":"ra-3.1"},{"label":"RA-05","oscal":"ra-5"},{"label":"RA-05 (02)","oscal":"ra-5.2"},{"label":"RA-05 (03)","oscal":"ra-5.3"},{"label":"RA-05 (04)","oscal":"ra-5.4"},{"label":"RA-05 (05)","oscal":"ra-5.5"},{"label":"RA-05 (08)","oscal":"ra-5.8"},{"label":"RA-05 (11)","oscal":"ra-5.11"},{"label":"RA-07","oscal":"ra-7"},{"label":"RA-09","oscal":"ra-9"},{"label":"SA-01","oscal":"sa-1"},{"label":"SA-02","oscal":"sa-2"},{"label":"SA-03","oscal":"sa-3"},{"label":"SA-04","oscal":"sa-4"},{"label":"SA-04 (01)","oscal":"sa-4.1"},{"label":"SA-04 (02)","oscal":"sa-4.2"},{"label":"SA-04 (05)","oscal":"sa-4.5"},{"label":"SA-04 (09)","oscal":"sa-4.9"},{"label":"SA-04 (10)","oscal":"sa-4.10"},{"label":"SA-05","oscal":"sa-5"},{"label":"SA-08","oscal":"sa-8"},{"label":"SA-09","oscal":"sa-9"},{"label":"SA-09 (01)","oscal":"sa-9.1"},{"label":"SA-09 (02)","oscal":"sa-9.2"},{"label":"SA-09 (05)","oscal":"sa-9.5"},{"label":"SA-10","oscal":"sa-10"},{"label":"SA-11","oscal":"sa-11"},{"label":"SA-11 (01)","oscal":"sa-11.1"},{"label":"SA-11 (02)","oscal":"sa-11.2"},{"label":"SA-15","oscal":"sa-15"},{"label":"SA-15 (03)","oscal":"sa-15.3"},{"label":"SA-16","oscal":"sa-16"},{"label":"SA-17","oscal":"sa-17"},{"label":"SA-21","oscal":"sa-21"},{"label":"SA-22","oscal":"sa-22"},{"label":"SC-01","oscal":"sc-1"},{"label":"SC-02","oscal":"sc-2"},{"label":"SC-03","oscal":"sc-3"},{"label":"SC-04","oscal":"sc-4"},{"label":"SC-05","oscal":"sc-5"},{"label":"SC-07","oscal":"sc-7"},{"label":"SC-07 (03)","oscal":"sc-7.3"},{"label":"SC-07 (04)","oscal":"sc-7.4"},{"label":"SC-07 (05)","oscal":"sc-7.5"},{"label":"SC-07 (07)","oscal":"sc-7.7"},{"label":"SC-07 (08)","oscal":"sc-7.8"},{"label":"SC-07 (10)","oscal":"sc-7.10"},{"label":"SC-07 (12)","oscal":"sc-7.12"},{"label":"SC-07 (18)","oscal":"sc-7.18"},{"label":"SC-07 (20)","oscal":"sc-7.20"},{"label":"SC-07 (21)","oscal":"sc-7.21"},{"label":"SC-08","oscal":"sc-8"},{"label":"SC-08 (01)","oscal":"sc-8.1"},{"label":"SC-10","oscal":"sc-10"},{"label":"SC-12","oscal":"sc-12"},{"label":"SC-12 (01)","oscal":"sc-12.1"},{"label":"SC-13","oscal":"sc-13"},{"label":"SC-15","oscal":"sc-15"},{"label":"SC-17","oscal":"sc-17"},{"label":"SC-18","oscal":"sc-18"},{"label":"SC-20","oscal":"sc-20"},{"label":"SC-21","oscal":"sc-21"},{"label":"SC-22","oscal":"sc-22"},{"label":"SC-23","oscal":"sc-23"},{"label":"SC-24","oscal":"sc-24"},{"label":"SC-28","oscal":"sc-28"},{"label":"SC-28 (01)","oscal":"sc-28.1"},{"label":"SC-39","oscal":"sc-39"},{"label":"SC-45","oscal":"sc-45"},{"label":"SC-45 (01)","oscal":"sc-45.1"},{"label":"SI-01","oscal":"si-1"},{"label":"SI-02","oscal":"si-2"},{"label":"SI-02 (02)","oscal":"si-2.2"},{"label":"SI-02 (03)","oscal":"si-2.3"},{"label":"SI-03","oscal":"si-3"},{"label":"SI-04","oscal":"si-4"},{"label":"SI-04 (01)","oscal":"si-4.1"},{"label":"SI-04 (02)","oscal":"si-4.2"},{"label":"SI-04 (04)","oscal":"si-4.4"},{"label":"SI-04 (05)","oscal":"si-4.5"},{"label":"SI-04 (10)","oscal":"si-4.10"},{"label":"SI-04 (11)","oscal":"si-4.11"},{"label":"SI-04 (12)","oscal":"si-4.12"},{"label":"SI-04 (14)","oscal":"si-4.14"},{"label":"SI-04 (16)","oscal":"si-4.16"},{"label":"SI-04 (18)","oscal":"si-4.18"},{"label":"SI-04 (19)","oscal":"si-4.19"},{"label":"SI-04 (20)","oscal":"si-4.20"},{"label":"SI-04 (22)","oscal":"si-4.22"},{"label":"SI-04 (23)","oscal":"si-4.23"},{"label":"SI-05","oscal":"si-5"},{"label":"SI-05 (01)","oscal":"si-5.1"},{"label":"SI-06","oscal":"si-6"},{"label":"SI-07","oscal":"si-7"},{"label":"SI-07 (01)","oscal":"si-7.1"},{"label":"SI-07 (02)","oscal":"si-7.2"},{"label":"SI-07 (05)","oscal":"si-7.5"},{"label":"SI-07 (07)","oscal":"si-7.7"},{"label":"SI-07 (15)","oscal":"si-7.15"},{"label":"SI-08","oscal":"si-8"},{"label":"SI-08 (02)","oscal":"si-8.2"},{"label":"SI-10","oscal":"si-10"},{"label":"SI-11","oscal":"si-11"},{"label":"SI-12","oscal":"si-12"},{"label":"SI-16","oscal":"si-16"},{"label":"SR-01","oscal":"sr-1"},{"label":"SR-02","oscal":"sr-2"},{"label":"SR-02 (01)","oscal":"sr-2.1"},{"label":"SR-03","oscal":"sr-3"},{"label":"SR-05","oscal":"sr-5"},{"label":"SR-06","oscal":"sr-6"},{"label":"SR-08","oscal":"sr-8"},{"label":"SR-09","oscal":"sr-9"},{"label":"SR-09 (01)","oscal":"sr-9.1"},{"label":"SR-10","oscal":"sr-10"},{"label":"SR-11","oscal":"sr-11"},{"label":"SR-11 (01)","oscal":"sr-11.1"},{"label":"SR-11 (02)","oscal":"sr-11.2"},{"label":"SR-12","oscal":"sr-12"}],"provisional":true,"provisionalNote":"Providers with 20x Class D Certifications MUST significantly supersede the minimum requirements for lower Classes, with specifics to be set during the 20x Phase 4 Pilot."}},"mappedControls":["ac-10","ac-11","ac-11.1","ac-12","ac-14","ac-17","ac-17.1","ac-17.2","ac-17.3","ac-17.4","ac-18","ac-18.1","ac-18.3","ac-18.4","ac-19","ac-19.5","ac-2","ac-2.1","ac-2.11","ac-2.12","ac-2.13","ac-2.2","ac-2.3","ac-2.4","ac-2.5","ac-2.6","ac-2.7","ac-2.9","ac-20","ac-20.1","ac-21","ac-3","ac-4","ac-4.21","ac-5","ac-6","ac-6.1","ac-6.10","ac-6.2","ac-6.3","ac-6.5","ac-6.7","ac-6.8","ac-6.9","ac-7","at-2","at-2.2","at-2.3","at-3","at-3.5","at-4","au-10","au-11","au-12","au-12.1","au-12.3","au-2","au-3","au-3.1","au-3.3","au-4","au-5","au-5.1","au-5.2","au-6","au-6.1","au-6.3","au-6.4","au-6.5","au-6.7","au-7","au-7.1","au-8","au-9","au-9.3","au-9.4","ca-2","ca-2.1","ca-2.2","ca-2.3","ca-3","ca-3.6","ca-7","ca-7.1","ca-7.4","ca-8","ca-8.1","ca-8.2","ca-9","cm-11","cm-12","cm-12.1","cm-14","cm-2","cm-2.2","cm-2.3","cm-2.7","cm-3","cm-3.1","cm-3.2","cm-3.4","cm-3.6","cm-4","cm-4.2","cm-5","cm-5.1","cm-5.5","cm-6","cm-6.1","cm-6.2","cm-7","cm-7.1","cm-7.2","cm-7.5","cm-8","cm-8.1","cm-8.2","cm-8.3","cm-8.4","cm-9","cp-10","cp-10.2","cp-10.4","cp-2","cp-2.1","cp-2.3","cp-2.5","cp-2.8","cp-3","cp-3.1","cp-4","cp-4.1","cp-6","cp-6.1","cp-6.3","cp-7","cp-7.1","cp-7.2","cp-7.3","cp-8","cp-8.1","cp-8.2","cp-9","cp-9.1","cp-9.8","ia-11","ia-12","ia-12.2","ia-12.3","ia-12.5","ia-2","ia-2.1","ia-2.2","ia-2.5","ia-2.6","ia-2.8","ia-3","ia-4","ia-4.4","ia-5","ia-5.1","ia-5.2","ia-5.6","ia-5.7","ia-5.8","ia-6","ia-7","ia-8","ia-8.2","ia-8.4","ir-2","ir-2.1","ir-2.2","ir-2.3","ir-3","ir-3.2","ir-4","ir-4.1","ir-4.11","ir-4.2","ir-4.4","ir-4.6","ir-5","ir-5.1","ir-6","ir-6.1","ir-6.3","ir-7","ir-7.1","ir-8","ir-8.1","ir-9","ir-9.2","ir-9.3","ir-9.4","pl-10","pl-4","pl-4.1","pl-8","pl-9","pm-3","pm-7","ps-2","ps-3","ps-4","ps-5","ps-6","ps-7","ps-8","ps-9","ra-3","ra-3.1","ra-5","ra-5.11","ra-5.2","ra-5.3","ra-5.4","ra-5.5","ra-5.8","ra-7","ra-9","sa-10","sa-11","sa-11.1","sa-11.2","sa-15","sa-15.3","sa-16","sa-17","sa-2","sa-21","sa-22","sa-3","sa-4","sa-4.1","sa-4.2","sa-4.5","sa-4.9","sa-5","sa-8","sa-9","sa-9.1","sa-9.2","sa-9.5","sc-10","sc-12","sc-12.1","sc-13","sc-17","sc-18","sc-2","sc-20","sc-21","sc-22","sc-23","sc-24","sc-28","sc-28.1","sc-3","sc-39","sc-4","sc-45","sc-45.1","sc-5","sc-7","sc-7.10","sc-7.18","sc-7.20","sc-7.21","sc-7.3","sc-7.4","sc-7.5","sc-7.7","sc-7.8","sc-8","sc-8.1","si-10","si-11","si-12.3","si-16","si-18.4","si-2","si-2.2","si-2.3","si-3","si-4","si-4.1","si-4.11","si-4.12","si-4.16","si-4.18","si-4.19","si-4.2","si-4.20","si-4.22","si-4.4","si-4.5","si-5","si-5.1","si-6","si-7","si-7.1","si-7.15","si-7.2","si-7.5","si-7.7","si-8","si-8.2","sr-10","sr-11","sr-11.1","sr-2","sr-2.1","sr-3","sr-5","sr-6","sr-8"],"definitions":{"FRD-ACV":{"term":"Accepted Vulnerability","definition":"A vulnerability that the provider does not intend to fully mitigate or remediate, OR that has not or will not be fully mitigated or remediated within the maximum overdue period in FedRAMP Vulnerability Detection and Response rules."},"FRD-ADP":{"term":"Adaptive Change","definition":"A type of significant change that does not routinely recur and does not introduce substantive potential security risks that need to be assessed in depth."},"FRD-ADV":{"term":"Advisor","definition":"An entity that helps a provider understand, prepare for, or maintain FedRAMP Certification without replacing the provider's responsibility or the assessor's independence."},"FRD-AGY":{"term":"Agency","definition":"Has the meaning given in 44 U.S. Code § 3502 (1), which is \"any executive department, military department, Government corporation, Government controlled corporation, or other establishment in the executive branch of the Government (including the Executive Office of the President), or any independent regulatory agency, but does not include—(A) the Government Accountability Office; (B) Federal Election Commission; (C) the governments of the District of Columbia and of the territories and possessions of the United States, and their various subdivisions; or (D) Government-owned contractor-operated facilities, including laboratories engaged in national defense research and production activities.\""},"FRD-AAP":{"term":"All Affected Parties","definition":"All federal entities whose interests are affected directly or are likely to be affected directly in the event of a vulnerability or incident related to federal customer data. This always includes FedRAMP and directly impacted federal customer agencies."},"FRD-ANA":{"term":"All Necessary Assessors","definition":"All entities who participate in the FedRAMP assessment of a cloud service offering in the context of a FedRAMP Certification. This always includes FedRAMP and any FedRAMP Recognized independent assessor contracted by a provider to perform a FedRAMP assessment."},"FRD-ANP":{"term":"All Necessary Parties","definition":"All entities whose interests are affected directly by activity related to a specific cloud service offering in the context of FedRAMP Certifications. This always includes FedRAMP and any agency customer who is using the cloud service offering, but may include additional parties depending on agreements made by the cloud service provider (such as consultants or independent assessors). Potential agency customers or third-party cloud service providers should also be included in most cases but this is not a mandatory requirement under FedRAMP because the cloud service provider may choose who they wish to do business with."},"FRD-ART":{"term":"Artifacts","definition":"Security-related materials that supply information regarding or evidence of functions, policies, decisions, procedures, operations, or other such activities, for the purposes of obtaining and maintaining a FedRAMP Certification. All such artifacts are considered FedRAMP Certification Data and are included in the FedRAMP Certification Package."},"FRD-ASR":{"term":"Assessor","definition":"An assessor that performs assessment, verification, or validation activities for a cloud service offering seeking to obtain or maintain FedRAMP Certification; FedRAMP is the final assessor for FedRAMP Certification, but FedRAMP Recognized independent assessment services are typically also utilized."},"FRD-CCL":{"term":"Certification Class","definition":"The category of assurance that a cloud service offering supplies to federal government customers following FedRAMP Practices, increasing from minimal assurance at Class A to significant assurance at Class D; currently available categories are Class A, B, C, or D."},"FRD-CCC":{"term":"Certification Class Change","definition":"A type of significant change that is likely to change the FedRAMP Certification class for the entire cloud service offering (e.g. from Class B to Class C or from Class D to Class C)."},"FRD-CRD":{"term":"Certification Data","definition":"The collective information required by FedRAMP for initial and ongoing FedRAMP Certification of a cloud service offering, including the FedRAMP Certification Package."},"FRD-CRP":{"term":"Certification Package","definition":"Has meaning from 44 USC § 3607 (b)(8) given to \"authorization package\", which is \"the essential information that can be used by an agency to determine whether to authorize the operation of an information system or the use of a designated set of common controls for all cloud computing products and services [certified] by FedRAMP.\""},"FRD-CPH":{"term":"Certification Path","definition":"The underlying source of the FedRAMP Certification, either from a federal agency sponsored authorization to operate or directly from FedRAMP itself. The agency path is a legacy path that is only available for FedRAMP Rev5 and still requires review and approval from FedRAMP."},"FRD-CPF":{"term":"Certification Profile","definition":"The combination of a FedRAMP Certification Type (Rev5 or 20x), FedRAMP Certification Path (Program or Agency), and FedRAMP Certification Class (A, B, C, or D) for a cloud service offering."},"FRD-CTY":{"term":"Certification Type","definition":"The form of assurance that a cloud service offering supplies to federal government customers following FedRAMP Practices, either Rev5 or 20x. Rev5 follows a legacy approach based primarily on documented plans while 20x follows a modern approach based primarily on measured outcomes."},"FRD-CSO":{"term":"Cloud Service Offering","definition":"A specific, packaged cloud computing product or service supplied by a cloud service provider for use by customers, that is the subject of a FedRAMP Certification."},"FRD-DCE":{"term":"Debilitating Customer Effect","definition":"An unwanted customer effect that interrupts use of the cloud service for most users or compromises the integrity or confidentiality of most federal customer data. If the adverse customer effect is unknown then it should be treated as if it is debilitating until proven otherwise."},"FRD-DTM":{"term":"Deterministic Telemetry","definition":"Verifiable data collected directly from an authoritative source that represents a factual and reproducible observation of the attributes of a system such as the system's state, configuration, or behavior."},"FRD-DCF":{"term":"Disruptive Customer Effect","definition":"An unwanted customer effect that interrupts use of the cloud service for many users for less than 24 hours, or that compromises the integrity or confidentiality of large amounts or many types of federal customer data."},"FRD-DFT":{"term":"Drift","definition":"Changes to information resources that cause deviations from the intended and assessed state; common forms of drift include changes to configurations, deployed software, privileges, running processes, and availability."},"FRD-FPV":{"term":"False Positive Vulnerability","definition":"A detected vulnerability that is not actually present in an exploitable state in the information resource"},"FRD-FCD":{"term":"Federal Customer Data","definition":"All electronic information, content, and materials that an agency or its authorized users upload, store, or otherwise supply to a cloud service for processing or storage. This does NOT include account information, service metadata, analytics, telemetry, or other similar metadata generated by the cloud service provider."},"FRD-FCR":{"term":"FedRAMP Certification Report","definition":"A report that is produced by FedRAMP documenting the results of a FedRAMP Certification assessment. This report is typically produced after the initial FedRAMP Certification assessment on the Program Certification Path and updated as necessary during ongoing FedRAMP Certification, but may be produced at any time by FedRAMP as part of ongoing FedRAMP Certification activities for any cloud service offering (such as corrective action). Cloud service offerings must include these reports in their FedRAMP Certification Package."},"FRD-FCT":{"term":"FedRAMP Certified","definition":"The status of a cloud service offering that has received FedRAMP Certification and meets the legal requirement to be FedRAMP authorized."},"FRD-FIN":{"term":"FedRAMP Independent Assessment","definition":"An independent verification and validation assessment, performed by a FedRAMP Recognized independent assessment service or FedRAMP following FedRAMP rules. These assessments are typically first performed to obtain an initial FedRAMP Certification then repeated on an annual basis to maintain FedRAMP Certification."},"FRD-FPR":{"term":"FedRAMP Practices","definition":"The security measures, safeguards, precautions, procedures, activities, policies, capabilities, mechanisms, etc. that are expected to be in place by FedRAMP to demonstrate that information resources are properly protected, expressed in FedRAMP 20x Key Security Indicators or FedRAMP Rev5 Controls and supplemented by FedRAMP rules."},"FRD-FRA":{"term":"FedRAMP Recognized","definition":"The status of independent assessment services that are recognized by FedRAMP to perform assessment activities on behalf of FedRAMP for cloud service offerings seeking to obtain or maintain FedRAMP Certification."},"FRD-FRI":{"term":"FedRAMP Reportable Incident","definition":"An incident that affects the confidentiality or integrity of federal customer data or is likely to affect the confidentiality or integrity of federal customer data."},"FRD-FSI":{"term":"FedRAMP Security Inbox","definition":"An email address that follows the FedRAMP Security Inbox rules."},"FRD-FIR":{"term":"Final Incident Report (FIR)","definition":"A final report after recovery from an incident that is supplied by FedRAMP Certified cloud service providers to FedRAMP and agency customers, following FedRAMP Incident Evaluation and Communication rules."},"FRD-FMV":{"term":"Fully Mitigated Vulnerability","definition":"A vulnerability where the likelihood of exploitation or Potential Agency Impact N-rating has been reduced from the original evaluation until either are negligible, but the vulnerability is still detected."},"FRD-HAN":{"term":"Handle","definition":"Has the plain language meaning inclusive of any possible action taken with information, such as access, collect, control, create, display, disclose, disseminate, dispose, maintain, manipulate, process, receive, review, store, transmit, use... etc."},"FRD-INT":{"term":"Incident","definition":"Has the meaning given in 44 USC § 3552 (b)(2) which is \"an occurrence that (A) actually or imminently jeopardizes, without lawful authority, the integrity, confidentiality, or availability of information or an information system; or (B) constitutes a violation or imminent threat of violation of law, security policies, security procedures, or acceptable use policies.\""},"FRD-IRS":{"term":"Information Resource","definition":"Has the meaning from 44 USC § 3502 (6): \"information and related resources, such as personnel, equipment, funds, and information technology.\" This includes any aspect of the cloud service offering, both technical and managerial, including everything that makes up the business of the offering from non-machine-based information resources like organizational policies, procedures, employees, etc. to machine-based information resources like hardware, software, cloud services, code, etc."},"FRD-INC":{"term":"Initial Certification","definition":"The first FedRAMP Certification of a cloud service offering based on the applicable FedRAMP Practices."},"FRD-IFA":{"term":"Initial FedRAMP Assessment","definition":"The first full assessment of a cloud service offering obtaining FedRAMP Certification, coordinated by the provider with all necessary assessors, that results in a FedRAMP Certification."},"FRD-IIR":{"term":"Initial Incident Report (IIR)","definition":"An initial report about an incident that is supplied by FedRAMP Certified cloud service providers to FedRAMP and agency customers, following FedRAMP FedRAMP Incident Evaluation and Communication rules."},"FRD-IRV":{"term":"Internet-Reachable Vulnerability (IRV)","definition":"A vulnerability in a machine-based information resource that might be exploited or otherwise triggered by a payload originating from a source on the public internet."},"FRD-KEV":{"term":"Known Exploited Vulnerability (KEV)","definition":"Has the meaning given in CISA Binding Operational Directive 26-04, which is any vulnerability identified in CISA's Known Exploited Vulnerabilities catalog."},"FRD-LKY":{"term":"Likely","definition":"A reasonable degree of probability based on context."},"FRD-LEV":{"term":"Likely Exploitable Vulnerability (LEV)","definition":"A vulnerability that is not fully mitigated AND is reachable by a likely threat actor; AND a likely threat actor with knowledge of the vulnerability would likely gain unauthorized access, cause harm, disrupt operations, or otherwise have an undesired adverse impact within the cloud service offering by exploiting the vulnerability."},"FRD-MBI":{"term":"Machine-Based (Information Resources)","definition":"Any information technology information resource—including systems, processes, software, hardware, services, cloud-native capabilities, and any other such capability, component, or resource—that relies primarily on mechanical or electronic devices (i.e. computers) for operation."},"FRD-MGN":{"term":"Machine-Generated","definition":"Automatically produced by a computer process, application, or other mechanism without the intervention or manipulation of a human during production."},"FRD-MRD":{"term":"Machine-Readable","definition":"Has the meaning from 44 U.S. Code § 3502 (18) which is \"the term \"machine-readable\", when used with respect to data, means data in a format that can be easily processed by a computer without human intervention while ensuring no semantic meaning is lost\""},"FRD-MAY":{"term":"MAY","definition":"The rule is truly optional. Parties SHOULD address such rules in their security documentation by explaining their decisions about how they handle such rules."},"FRD-MCE":{"term":"Minimal Customer Effect","definition":"An unwanted customer effect that is only noticeable by some users. This includes minor inconveniences such as reduced performance."},"FRD-MST":{"term":"MUST","definition":"The rule is an absolute requirement. Parties MUST meet such rules and address them in their security documentation. Failure to follow the rule is a vulnerability likely requiring corrective action and/or the denial of initial or ongoing FedRAMP Certification."},"FRD-MNT":{"term":"MUST NOT","definition":"The rule is an absolute prohibition. Parties MUST meet such rules and address them in their security documentation. Failure to follow the rule is a vulnerability likely requiring corrective action and/or the denial of initial or ongoing FedRAMP Certification."},"FRD-NCE":{"term":"Narrow Customer Effect","definition":"An unwanted customer effect that interrupts use of the cloud service for some users for less than 12 hours, or that compromises the integrity or confidentiality of an extremely limited amount and type of federal customer data."},"FRD-ONC":{"term":"Ongoing Certification","definition":"The continued FedRAMP Certification of a cloud service offering based on the applicable FedRAMP Practices."},"FRD-OCR":{"term":"Ongoing Certification Report (OCR)","definition":"A regular report that is supplied by FedRAMP Certified cloud service providers to agency customers, following FedRAMP Collaborative Continuous Monitoring rules."},"FRD-OIR":{"term":"Ongoing Incident Report (OIR)","definition":"A recurring report about an ongoing incident that is supplied by FedRAMP Certified cloud service providers to FedRAMP and agency customers, following the FedRAMP Incident Evaluation and Communication rules."},"FRD-ODV":{"term":"Overdue Vulnerability","definition":"A vulnerability that the provider intends to fully mitigate or remediate but has not or will not do so within the time frames recommended or required by FedRAMP."},"FRD-PMV":{"term":"Partially Mitigated Vulnerability","definition":"A vulnerability where the likelihood or Potential Agency Impact N-rating has been reduced from the original evaluation but the risk of exploitation still exists and the vulnerability is still detected."},"FRD-PFA":{"term":"Persistent FedRAMP Assessment","definition":"Follow-on assessments of a cloud service offering focused on Key Security Indicators, coordinated by the provider with all necessary assessors, to maintain FedRAMP Certification or change its FedRAMP Certification class."},"FRD-PER":{"term":"Persistently","definition":"Occurring in a firm, steady way that is repeated over a long period of time in spite of obstacles or difficulties. Persistent activities may vary between actors, may occur irregularly, and may include interruptions or waiting periods between cycles. These attributes of persistent activities should be intentional, understood, and documented; the status of persistent activities will always be known."},"FRD-PAI":{"term":"Potential Agency Impact","definition":"The estimated cumulative effect of unauthorized access, disruption, harm, or other adverse impacts to all agencies using the cloud service that are likely to result from security incidents or the exploitation of vulnerabilities in the cloud service offering; as estimated following appropriate FedRAMP rules to calculate the Potential Agency Impact N-rating (PAIN)."},"FRD-PAC":{"term":"Privileged Account","definition":"An account with elevated privileges that enables administrative functions over some aspect of the cloud service offering that may affect the confidentiality, integrity, or availability of information beyond those given to normal users; levels of privilege may vary wildly."},"FRD-PRO":{"term":"Promptly","definition":"Without unnecessary delay."},"FRD-PRV":{"term":"Provider","definition":"The cloud service provider responsible for a cloud service offering in the context of FedRAMP Certification."},"FRD-QTR":{"term":"Quarterly Review","definition":"A regular synchronous meeting hosted by a FedRAMP Certified cloud service provider for agency customers, following FedRAMP Collaborative Continuous Monitoring rules."},"FRD-RGL":{"term":"Regularly","definition":"Performing the activity on a consistent, predictable, and repeated basis, at set intervals, automatically if possible, following a documented plan. These intervals may vary as appropriate between different activities."},"FRD-RMV":{"term":"Remediated Vulnerability","definition":"A vulnerability that has been neutralized or eliminated and is no longer detected."},"FRD-RSP":{"term":"Responsibly","definition":"In a way that shows that you have good judgment and the ability to act correctly and make decisions on your own."},"FRD-RTR":{"term":"Routine Recurring Change","definition":"The type of significant change that regularly and routinely recurs as part of ongoing operations, vulnerability mitigation, or vulnerability remediation."},"FRD-SCT":{"term":"Security Category","definition":"Has the meaning from NIST FIPS 199, which is \"The characterization of information or an information system based on an assessment of the potential impact that a loss of confidentiality, integrity, or availability of such information or information system would have on organizational operations, organizational assets, or individuals.\" Security categories are often referred to as \"impact levels\" and include Low, Moderate, and High."},"FRD-SDR":{"term":"Security Decision Record (SDR)","definition":"A persistently maintained, verified, and validated record of the security decisions made by a provider over the lifecycle of a cloud service offering. The Security Decision Record replaces the traditional System Security Plan and documents how applicable FedRAMP Practices are addressed, including implementation rationale, resulting customer risk, assessment findings, and supporting artifacts."},"FRD-SHD":{"term":"SHOULD","definition":"There may exist valid reasons in particular circumstances to ignore this rule, but the full implications must be understood and carefully weighed. Parties MUST address such rules in their security documentation by explaining their decisions about how they handle such rules."},"FRD-SNT":{"term":"SHOULD NOT","definition":"There may exist valid reasons in particular circumstances when the particular action is acceptable or even useful, but the full implications must be understood and carefully weighed. Parties MUST address such rules in their security documentation by explaining their decisions about how they handle such rules."},"FRD-SGC":{"term":"Significant Change","definition":"Has the meaning given in NIST SP 800-37 Rev. 2 which is \"a change that is likely to substantively affect the security or privacy posture of a system.\""},"FRD-TPR":{"term":"Third-Party Information Resource","definition":"Any information resource that is not entirely included in the Minimum Assessment Scope for the cloud service offering obtaining FedRAMP Certification."},"FRD-TLA":{"term":"Top-Level Administrative Account","definition":"The most privileged account with the highest level of access within a cloud service offering for a customer organization, typically with complete control over all aspects of the cloud service offering, including managing resources, users, access, privileges, and the account itself."},"FRD-TRF":{"term":"Transformative Change","definition":"The type of significant change that introduces substantive potential security risks that are likely to affect existing risk determinations and must be assessed in depth."},"FRD-TRC":{"term":"Trust Center","definition":"A secure repository or service used by cloud service providers to store and share FedRAMP Certification Data. Trust centers are the complete and definitive source for FedRAMP Certification Data and must follow the FedRAMP Certification Data Sharing rules to be FedRAMP-compatible."},"FRD-VLN":{"term":"Validation","definition":"Confirmation through objective evidence that implemented security capabilities and related certification data are suitable for their intended FedRAMP Certification use and support the expected security outcomes for a cloud service offering."},"FRD-VRF":{"term":"Verification","definition":"Confirmation through objective evidence that specified FedRAMP Practices have been fulfilled for a cloud service offering."},"FRD-VUL":{"term":"Vulnerability","definition":"Has the meaning given to \"security vulnerability\" in 6 USC § 650 (25), which is \"any attribute of hardware, software, process, or procedure that could enable or facilitate the defeat of [...] management, operational, and technical controls used to protect against an unauthorized effort to adversely affect the confidentiality, integrity, and availability of an information system or its information.\" This includes gaps in Rev5 Controls and 20x Key Security Indicators, software vulnerabilities, misconfigurations, exposures, weak credentials, insecure services, and all other such potential weaknesses in protection (intentional or unintentional)."},"FRD-VLD":{"term":"Vulnerability Detection","definition":"The systematic process of discovering and identifying security vulnerabilities in information resources through assessment, scanning, threat intelligence, vulnerability disclosure mechanisms, bug bounties, supply chain monitoring, and other capabilities. This process includes the initial discovery of a vulnerability's existence and the determination of affected information resources within a cloud service offering."},"FRD-VLR":{"term":"Vulnerability Response","definition":"The systematic process of tracking, evaluating, mitigating, monitoring, remediating, assessing exploitation, reporting, and otherwise managing detected vulnerabilities."}},"source":{"repo":"https://github.com/FedRAMP/rules","commit":"a89d78477ddea98dc57eca24f5007794c2b4eeb6","sha256":"fb48d677a85d77fb72735a325de2c1945a1e0ceab1d2e655292fe9ebe3e4e0b4","licence":"US government work: not subject to copyright in the United States (17 U.S.C. 105)."},"schemas":{"accepted-vulnerability-info":{"$schema":"https://json-schema.org/draft/2020-12/schema","$id":"https://fedramp.gov/schemas/fedramp-accepted-vulnerability-info-schema-2026-06-24.json","$schemaVersion":"0.1.1","type":"object","title":"FedRAMP Accepted Vulnerability Info (VER-RPT-AVI)","description":"Accepted vulnerability information required when reporting vulnerability detection and response activity per VER-RPT-AVI.","required":["certificationPackageOverviewUri","reportPeriod","acceptedVulnerabilities"],"properties":{"certificationPackageOverviewUri":{"$ref":"https://fedramp.gov/schemas/fedramp-common-definitions-schema-2026-06-24.json#/$defs/certificationPackageOverviewUri"},"reportPeriod":{"$ref":"https://fedramp.gov/schemas/fedramp-common-definitions-schema-2026-06-24.json#/$defs/reportPeriodDateTime","title":"Report Period","description":"Period summarized by this report. Per VER-RPT-PER, must cover all activity since the previous report."},"acceptedVulnerabilities":{"type":"array","title":"Accepted Vulnerabilities","description":"Accepted vulnerabilities with activity in this period. Non-accepted vulnerabilities are reported under VER-RPT-VDT.","items":{"$ref":"https://fedramp.gov/schemas/fedramp-common-definitions-schema-2026-06-24.json#/$defs/acceptedVulnerabilityInfo"}}}},"certification-package-overview":{"$schema":"https://json-schema.org/draft/2020-12/schema","$id":"https://fedramp.gov/schemas/fedramp-certification-package-overview-schema-2026-06-24.json","$schemaVersion":"0.1.6","type":"object","title":"FedRAMP Certification Package Overview (FRC-CSO-PKG)","description":"Identification, service properties, contacts, and supporting documentation for a Cloud Service Offering per FRC-CSO-PKG.","required":["serviceIdentification","serviceProperties","contactInformation"],"properties":{"serviceIdentification":{"type":"object","title":"Service Identification","description":"Basic identification details for the Cloud Service Offering.","required":["providerName","serviceName","serviceAcronym","serviceDescription","certificationType","fedRampPackageId","website","logo"],"properties":{"fedRampPackageId":{"type":"string","title":"FedRAMP ID","description":"Unique identifier assigned to the CSP by FedRAMP. If no FedRAMP ID is available, use the CSP's name and acronym."},"ueiNumber":{"type":"string","title":"UEI Number","description":"Unique Entity Identifier (UEI) assigned to the CSP by SAM.gov. If no UEI is available leave this blank. (CDS-CSO-PUB)"},"providerName":{"type":"string","title":"Provider Name","description":"Name of the Cloud Service Provider."},"serviceName":{"type":"string","title":"Service Name","description":"Full name of the Cloud Service Offering."},"serviceAcronym":{"type":"string","title":"Service Acronym","description":"Short acronym or abbreviation for the Cloud Service Offering."},"serviceDescription":{"type":"string","title":"Service Description","description":"A detailed description of the Cloud Service Offering. May use Markdown for formatting (CDS-CSO-PUB)."},"certificationType":{"type":"string","title":"Certification Type","description":"The FedRAMP certification type for the Cloud Service Offering.","enum":["20x","Rev5"]},"website":{"type":"string","format":"uri","title":"Website","description":"Official website for the Cloud Service Offering (CDS-CSO-PUB)."},"logo":{"$ref":"https://fedramp.gov/schemas/fedramp-common-definitions-schema-2026-06-24.json#/$defs/logoUri","title":"Logo","description":"URL of the CSP logo. Must point to a PNG, JPEG, GIF, SVG, WebP, ICO, BMP, or TIFF file (CDS-CSO-PUB)."}}},"serviceProperties":{"type":"object","title":"Service Properties","description":"Technical and operational properties of the Cloud Service Offering.","required":["serviceType","deploymentModel"],"properties":{"serviceType":{"type":"array","title":"Service Model","description":"Cloud service model(s). Select all that apply (CDS-CSO-PUB).","items":{"type":"string","enum":["SaaS","PaaS","IaaS"]},"minItems":1},"deploymentModel":{"type":"string","title":"Deployment Model","description":"Deployment model of the system (CDS-CSO-PUB).","enum":["Public Cloud","Government-Only Cloud","Hybrid Cloud","Community Cloud","Government Community Cloud"]},"businessCategory":{"type":"array","title":"Business Category","description":"Business Category(s) supported by the service (CDS-CSO-PUB).","items":{"type":"string","enum":["Accounting","Analytics","Artificial Intelligence (AI)","Collaboration","Communication","Construction","Contact Center","Content Management System (CMS)","Customer Relations Management (CRM)","Customer Service","Cybersecurity & Risk Management","Data Management","Design & Multimedia","Development Tools","Education & Training","Finance","Fleet Management","Governance, Risk, and Compliance (GRC)","Grant Management","Health & Wellness","Human Resources","Law Enforcement","Learning Management","Legal & Policy","Marketing & Sales","Media","Mobile Device Management (MDM)","Network Management","Operations Management","Research","Storage","System Administration","Talent Development","Talent Management","Travel Management","Virtual Private Network (VPN)"]},"minItems":1,"maxItems":10},"trustCenter":{"$ref":"#/$defs/repository","title":"Trust Center","description":"The URL and any access instructions needed for the Cloud Service Provider's FedRAMP Trust Center (CDS-CSO-UTC). Note: Rules for FedRAMP-Compatible Trust Centers are explained in the Certification Data Sharing Rules under the FedRAMP-Compatible Trust Centers section (id: CDS-TRC)."},"secureConfigurationGuidance":{"$ref":"#/$defs/repository","title":"Secure Configuration Guidance","description":"The URL and any access instructions needed for the Cloud Service Provider's Secure Configuration Guide (SCG-CSO-RSC)."},"additionalRepositories":{"type":"array","title":"Repositories","description":"Repository locations for system authorization documentation, policies, procedures, and assessment reports.","items":{"$ref":"#/$defs/repository"}},"nextOngoingCertificationReportDate":{"type":"string","format":"date","title":"Next Ongoing Certification Report Date","description":"The date of the next ongoing certification report for the Cloud Service Provider (CDS-CSO-PUB)."}}},"contactInformation":{"type":"array","title":"Contact Information","description":"Key contacts for the Cloud Service Provider. Must include at least one Security Contact and one Sales Contact (CDS-CSO-PUB).","items":{"$ref":"#/$defs/contactInfo"},"allOf":[{"contains":{"required":["contactType"],"properties":{"contactType":{"title":"Contact Type","description":"The role or category of this contact.","const":"Security"}}}},{"contains":{"required":["contactType"],"properties":{"contactType":{"title":"Contact Type","description":"The role or category of this contact.","const":"Sales"}}}}]},"assessor":{"type":"object","title":"Independent Assessor","description":"The Independent Assessment Service that performs verification and validation for the Cloud Service Offering (CDS-CSO-PUB).","required":["name","assessorID"],"properties":{"name":{"type":"string","title":"Assessor Name","description":"Name of the independent assessor."},"assessorID":{"type":"string","title":"Assessor's FedRAMP ID","description":"Unique identifier assigned to the assessor by FedRAMP.","pattern":"^\\d{6}$"}}},"advisors":{"type":"array","title":"Advisors","description":"Optional list of advisors associated with the Cloud Service Offering or organization. Multiple advisors may be provided if needed.","items":{"type":"object","title":"Advisor","description":"An advisor who provides guidance, support, or subject matter expertise.","required":["name"],"properties":{"name":{"type":"string","title":"Advisor Name","description":"Name of the advisor."}}}},"certifiedServices":{"type":"array","title":"Certified Services","description":"List of services offered by the provider that are included in this certification (CDS-CSO-SVC).","items":{"type":"object","title":"Certified Service","description":"A service offered by the provider that is included in this certification.","required":["serviceName","serviceDescription"],"properties":{"serviceName":{"type":"string","title":"Service Name","description":"Name of the service as it appears on the provider's website and in marketing materials."},"serviceDescription":{"type":"string","title":"Service Description","description":"Description of the service. May use Markdown for formatting."},"dateAvailable":{"type":"string","format":"date","title":"Date Available","description":"Date the service became available or was certified."}}}},"thirdPartyInformationResources":{"type":"object","title":"Third-Party Information Resources","description":"Third-party information resources within the Minimum Assessment Scope for the Cloud Service Offering (MAS-CSO-TPR).","properties":{"certified":{"type":"array","title":"FedRAMP Certified","description":"FedRAMP Certified third-party information resources.","items":{"type":"object","required":["fedRampCertifiedThirdPartyInformationResource","useCase"],"properties":{"fedRampCertifiedThirdPartyInformationResource":{"type":"string","title":"FedRAMP ID","description":"Unique FedRAMP ID of the third-party information resource."},"useCase":{"type":"string","title":"Use Case","description":"How this resource is used in the context of this offering."}}}},"nonCertified":{"type":"array","title":"Non-FedRAMP Certified","description":"Non-FedRAMP Certified third-party information resources.","items":{"type":"object","required":["name","provider","useCase"],"properties":{"name":{"type":"string","title":"Name","description":"Name of the third-party information resource."},"provider":{"type":"string","title":"Provider","description":"Name of the provider of the third-party information resource."},"website":{"type":"string","format":"uri","title":"Website","description":"Website of the third-party information resource."},"useCase":{"type":"string","title":"Use Case","description":"How this resource is used in the context of this offering."}}}}}}},"$defs":{"repository":{"type":"object","title":"Repository","description":"A repository location for system authorization documentation, policies, procedures, assessment reports, etc.","required":["repositoryType","url","repositoryDescription","authenticationRequired"],"properties":{"repositoryType":{"type":"array","title":"Repository Type","description":"The type(s) or categories of this repository. A single repository may satisfy multiple type requirements.","items":{"type":"string"},"minItems":1,"examples":[["Secure Configuration Guidance"],["Trust Center","Assessment Reports"]]},"url":{"type":"string","format":"uri","title":"Repository URL","description":"URL of the repository."},"repositoryDescription":{"type":"string","title":"Repository Description","description":"Description of the repository contents."},"authenticationRequired":{"type":"boolean","title":"Authentication Required","description":"Whether authentication is required to access the repository."},"accessRequestInstructions":{"type":"string","title":"Access Request Instructions","description":"Instructions for requesting access to the repository. May use Markdown for formatting."}},"if":{"required":["authenticationRequired"],"properties":{"authenticationRequired":{"title":"Authentication Required","description":"Whether authentication is required to access the repository.","const":true}}},"then":{"required":["accessRequestInstructions"]}},"contactInfo":{"type":"object","title":"Contact","description":"A contact for the Cloud Service Provider.","required":["contactType"],"properties":{"contactType":{"type":"string","title":"Contact Type","description":"The role or category of this contact.","examples":["Primary","Security","Sales"]},"contactName":{"type":"string","title":"Name","description":"Name of the contact. May be a specific person or the role of the contact."},"contactEmail":{"type":"string","format":"email","title":"Email","description":"Email address of the contact."},"contactPhone":{"type":"string","title":"Phone Number","description":"Phone number in ###-###-#### format (e.g. 202-555-0123).","pattern":"^[0-9]{3}-[0-9]{3}-[0-9]{4}$"}}}}},"common-definitions":{"$schema":"https://json-schema.org/draft/2020-12/schema","$id":"https://fedramp.gov/schemas/fedramp-common-definitions-schema-2026-06-24.json","$schemaVersion":"0.4.0","title":"FedRAMP Common Definitions","description":"Shared type definitions referenced by other FedRAMP schemas.","$defs":{"certificationPackageOverviewUri":{"type":"string","format":"uri","title":"Certification Package Overview","description":"Full URI of the provider's Certification Package Overview document."},"logoUri":{"type":"string","format":"uri","title":"Logo","description":"URL of an organization logo. Must point to a PNG, JPEG, GIF, SVG, WebP, ICO, BMP, or TIFF file.","pattern":"\\.(png|jpe?g|gif|svg|webp|ico|bmp|tiff?)([?#].*)?$"},"contactInformation":{"type":"object","title":"Contact Information","description":"Point of contact and website for an organization.","required":["pointOfContactName","jobTitle","email","phone","companyWebsite"],"properties":{"pointOfContactName":{"type":"string","title":"Point of Contact Name","description":"Full name of the point of contact for the organization."},"jobTitle":{"type":"string","title":"Job Title","description":"Job title of the point of contact."},"email":{"type":"string","format":"email","title":"Email","description":"Email address for the point of contact."},"phone":{"type":"string","title":"Phone","description":"Phone number for the point of contact."},"companyWebsite":{"type":"string","format":"uri","title":"Company Website","description":"Official website URL for the organization."}}},"nRating":{"type":"integer","title":"Potential Agency Impact N-Rating","description":"See VER-EVA-EPA or IEC-CSO-EFI for N1–N5 definitions.","enum":[1,2,3,4,5]},"detection":{"type":"object","title":"Detection","description":"Required information for a single detected vulnerability per VER-RPT-VDT.","required":["detectedAt","detectionSource"],"properties":{"detectedAt":{"type":"string","format":"date-time","title":"Detected At","description":"When the vulnerability was detected."},"detectionSource":{"type":"string","title":"Detection Source","description":"Tool or activity that identified the vulnerability (e.g., scanner, penetration test, bug bounty)."}}},"painReductionEvent":{"type":"object","title":"PAIN Reduction Event","description":"Required information for a single PAIN reduction event per VER-RPT-VDT.","required":["reducedAt","rating"],"properties":{"reducedAt":{"type":"string","format":"date-time","title":"Reduced At","description":"When the PAIN reduction was completed."},"rating":{"$ref":"#/$defs/nRating","title":"Rating After Reduction","description":"N-rating after the PAIN reduction."}}},"vulnerabilityDetail":{"type":"object","title":"Vulnerability Detail","description":"Required information for a single detected vulnerability per VER-RPT-VDT.","required":["providerTrackingId","detection","vulnerabilityDescription"],"properties":{"providerTrackingId":{"type":"string","title":"Provider Tracking ID","description":"Provider's internally assigned identifier for this vulnerability."},"detection":{"$ref":"#/$defs/detection"},"vulnerabilityDescription":{"type":"string","title":"Vulnerability Description","description":"Description of the vulnerability."},"potentialAgencyImpact":{"type":"string","title":"Potential Agency Impact","description":"Description of the potential impact."},"evaluationCompletedAt":{"type":"string","format":"date-time","title":"Evaluation Completed At","description":"When evaluation was completed. The clock for VER-TFR-MAV runs from this date."},"isInternetReachable":{"type":"boolean","title":"Is Internet-Reachable","description":"IRV classification per VER-EVA-EIR."},"isLikelyExploitable":{"type":"boolean","title":"Is Likely Exploitable","description":"LEV classification per VER-EVA-ELX and VER-EVA-AIA."},"currentRating":{"$ref":"#/$defs/nRating","title":"Current Rating","description":"Currently estimated Potential Agency Impact N-rating."},"projectedNextReduction":{"type":"object","title":"Projected Next Reduction","description":"Next planned mitigation step. Omit if fully mitigated or none planned.","required":["estimatedAt","targetRating"],"properties":{"estimatedAt":{"type":"string","format":"date-time","title":"Estimated At","description":"When the next reduction is expected."},"targetRating":{"$ref":"#/$defs/nRating","title":"Target Rating","description":"Next Potential Agency Impact N-rating."}}},"overdueStatus":{"type":"object","title":"Overdue Status","description":"See VER-TFR-EVU and VER-TFR-MAV for overdue definitions.","required":["isOverdue"],"properties":{"isOverdue":{"type":"boolean","title":"Is Overdue","description":"True if the vulnerability is overdue."},"explanation":{"type":"string","title":"Explanation","description":"Reason for the overdue status."}},"if":{"required":["isOverdue"],"properties":{"isOverdue":{"title":"Is Overdue","description":"True if the vulnerability is overdue.","const":true}}},"then":{"required":["explanation"]}},"supplementaryRiskInformation":{"type":"string","title":"Supplementary Risk Information","description":"Per VER-RPT-VDT field 11 and VER-RPT-NID."},"painReductionEvents":{"type":"array","title":"PAIN Reduction Events","description":"History of completed PAIN-rating reductions for this vulnerability per VER-RPT-VDT.","items":{"$ref":"#/$defs/painReductionEvent"}},"finalDisposition":{"type":"string","title":"Final Disposition","description":"Omit if still active.","enum":["Fully Mitigated","Partially Mitigated","Remediated","False Positive"]}}},"acceptedVulnerabilityInfo":{"type":"object","title":"Accepted Vulnerability Info","description":"Required information for a single accepted vulnerability per VER-RPT-AVI.","required":["vulnerabilityDetail","acceptanceRationale"],"properties":{"vulnerabilityDetail":{"$ref":"#/$defs/vulnerabilityDetail"},"acceptanceRationale":{"type":"string","title":"Acceptance Rationale","description":"Explanation of why this is an accepted vulnerability."}}},"reportPeriodDateTime":{"type":"object","title":"Report Period","description":"From and To dates for the report period.","required":["from","to"],"properties":{"from":{"type":"string","format":"date-time","title":"From","description":"Start date for the report period."},"to":{"type":"string","format":"date-time","title":"To","description":"End date for the report period."}}},"reportPeriodDate":{"type":"object","title":"Report Period","description":"From and To dates for the report period.","required":["from","to"],"properties":{"from":{"type":"string","format":"date","title":"From","description":"Start date for the report period."},"to":{"type":"string","format":"date","title":"To","description":"End date for the report period."}}}}},"historical-ver-activity":{"$schema":"https://json-schema.org/draft/2020-12/schema","$id":"https://fedramp.gov/schemas/fedramp-historical-ver-activity-schema-2026-06-24.json","$schemaVersion":"0.1.1","type":"object","title":"FedRAMP Historical Vulnerability Evaluation and Reporting Activity (VER-TFR-MRH)","description":"Machine-readable historical Vulnerability Evaluation and Reporting activity for automated retrieval per VER-TFR-MRH.","required":["certificationPackageOverviewUri","generatedAt","activeVulnerabilities","acceptedVulnerabilities"],"properties":{"certificationPackageOverviewUri":{"$ref":"https://fedramp.gov/schemas/fedramp-common-definitions-schema-2026-06-24.json#/$defs/certificationPackageOverviewUri"},"generatedAt":{"type":"string","format":"date-time","title":"Generated At","description":"When this snapshot was generated."},"activeVulnerabilities":{"type":"array","title":"Active Vulnerabilities","description":"All non-accepted vulnerabilities. Each record follows the fields required by VER-RPT-VDT.","items":{"$ref":"https://fedramp.gov/schemas/fedramp-common-definitions-schema-2026-06-24.json#/$defs/vulnerabilityDetail"}},"acceptedVulnerabilities":{"type":"array","title":"Accepted Vulnerabilities","description":"All accepted vulnerabilities. Each record follows the fields required by VER-RPT-AVI.","items":{"$ref":"https://fedramp.gov/schemas/fedramp-common-definitions-schema-2026-06-24.json#/$defs/acceptedVulnerabilityInfo"}}}},"incident-report":{"$schema":"https://json-schema.org/draft/2020-12/schema","$id":"https://fedramp.gov/schemas/fedramp-incident-report-schema-2026-06-24.json","$schemaVersion":"0.2.1","type":"object","title":"FedRAMP Incident Report (IEC-CSO-IIR / IEC-CSO-OIR / IEC-CSO-FIR)","description":"Unified schema for the three incident report types in the IEC-CSO lifecycle: Initial (IEC-CSO-IIR), Ongoing (IEC-CSO-OIR), and Final (IEC-CSO-FIR).","required":["certificationPackageOverviewUri","reportType","providerTrackingId"],"properties":{"certificationPackageOverviewUri":{"$ref":"https://fedramp.gov/schemas/fedramp-common-definitions-schema-2026-06-24.json#/$defs/certificationPackageOverviewUri"},"reportType":{"type":"string","title":"Report Type","description":"Initial = IEC-CSO-IIR; Ongoing = IEC-CSO-OIR; Final = IEC-CSO-FIR.","enum":["Initial","Ongoing","Final"]},"providerTrackingId":{"type":"string","title":"Provider Tracking ID","description":"Provider's internally assigned identifier for this incident. Must be consistent across IIR, OIR, and FIR reports for the same incident."},"federalIncidentCoordinator":{"type":"string","title":"Federal Incident Response Coordinator","description":"Contact information for the provider's federal incident response coordinator."},"incidentDescription":{"type":"string","title":"Incident Description","description":"Description of the incident."},"timeline":{"type":"object","title":"Timeline","description":"Timeline of the incident per IEC-CSO-IIR field 4.","properties":{"startedAt":{"type":"string","format":"date-time","title":"Started At","description":"When the incident started."},"detectedAt":{"type":"string","format":"date-time","title":"Detected At","description":"When the incident was detected."},"detectionSource":{"type":"string","title":"Detection Source","description":"Source of the incident detection."},"evaluationCompletedAt":{"type":"string","format":"date-time","title":"FedRAMP Reportable Incident Evaluation Completed At","description":"When the FedRAMP reportable incident evaluation was completed."},"milestones":{"type":"array","title":"Milestones","description":"Major events in the incident lifecycle.","items":{"$ref":"#/$defs/milestone"}}}},"potentialImpact":{"type":"object","title":"Potential Impact","description":"Describe the current and historical potential impact to your system.","properties":{"historicalRating":{"type":"array","title":"Historical Rating","description":"Historical rating of the incident.","items":{"$ref":"https://fedramp.gov/schemas/fedramp-common-definitions-schema-2026-06-24.json#/$defs/nRating"}},"currentRating":{"$ref":"https://fedramp.gov/schemas/fedramp-common-definitions-schema-2026-06-24.json#/$defs/nRating","title":"Current Rating","description":"Current rating of the incident."},"evaluationNotes":{"type":"string","title":"Evaluation Notes","description":"Explanation of the PAIN evaluation per IEC-CSO-EFI. Required if applicable."}}},"functionalImpact":{"type":"string","title":"Functional Impact","description":"Describe the actual or potential impact to federal agency customers."},"recoveryPlan":{"type":"string","title":"Recovery Plan","description":"Estimated recovery plan, milestones, and timelines."},"affectedAgencies":{"type":"array","title":"Likely Affected Customer Agencies","description":"List of customer agencies that may be affected by the incident.","items":{"type":"string"}},"observedActivity":{"type":"string","title":"Observed Incident Activity","description":"Per IEC-CSO-OIR."},"indicatorsOfCompromise":{"type":"array","title":"Indicators of Compromise","description":"Per IEC-CSO-OIR.","items":{"type":"string"}},"relatedCveIds":{"type":"array","title":"Related CVE Identifiers","description":"Per IEC-CSO-OIR. Include if applicable.","items":{"type":"string","pattern":"^CVE-[0-9]{4}-[0-9]{4,}$"}},"rootCause":{"type":"string","title":"Root Cause","description":"Per IEC-CSO-OIR."},"responseAndRecoveryActivities":{"type":"string","title":"Response and Recovery Activities","description":"Per IEC-CSO-OIR."},"resolvedAt":{"type":"string","format":"date-time","title":"Resolved At","description":"When the incident was resolved and recovery completed. Required for Final reports (IEC-CSO-FIR)."}},"if":{"required":["reportType"],"properties":{"reportType":{"title":"Report Type","description":"Initial = IEC-CSO-IIR; Ongoing = IEC-CSO-OIR; Final = IEC-CSO-FIR.","const":"Final"}}},"then":{"required":["resolvedAt"]},"$defs":{"milestone":{"type":"object","title":"Incident Milestone","description":"Major events in the incident lifecycle.","required":["occurredAt","milestoneDescription"],"properties":{"occurredAt":{"type":"string","format":"date-time","title":"Occurred At","description":"When the milestone occurred."},"milestoneDescription":{"type":"string","title":"Description","description":"Description of the milestone."}}}}},"ongoing-certification-report":{"$schema":"https://json-schema.org/draft/2020-12/schema","$id":"https://fedramp.gov/schemas/fedramp-ongoing-certification-report-schema-2026-06-24.json","$schemaVersion":"0.2.1","type":"object","title":"FedRAMP Ongoing Certification Report (CCM-OCR-AVL)","description":"Quarterly Ongoing Certification Report (OCR) per CCM-OCR-AVL, covering the entire period since the previous report.","required":["certificationPackageOverviewUri","reportPeriod","certificationDataChanges","plannedCertificationDataChanges","acceptedVulnerabilities","transformativeChanges","updatedRecommendations","activeAgencies","reportableIncidents"],"properties":{"certificationPackageOverviewUri":{"$ref":"https://fedramp.gov/schemas/fedramp-common-definitions-schema-2026-06-24.json#/$defs/certificationPackageOverviewUri"},"reportPeriod":{"$ref":"https://fedramp.gov/schemas/fedramp-common-definitions-schema-2026-06-24.json#/$defs/reportPeriodDate","title":"Report Period","description":"The 3-month period covered by this report."},"certificationDataChanges":{"type":"array","title":"Changes to FedRAMP Certification Data","description":"High-level summaries of changes to FedRAMP Certification Data since the previous report.","items":{"type":"string"}},"plannedCertificationDataChanges":{"type":"object","title":"Planned Changes to FedRAMP Certification Data","description":"High-level summaries of planned changes to FedRAMP Certification Data for at least the next 3 months.","required":["planningHorizonThrough","changes"],"properties":{"planningHorizonThrough":{"type":"string","format":"date","title":"Planning Horizon Through","description":"Date through which planned changes are covered (at least 3 months from report end)."},"changes":{"type":"array","title":"Changes","description":"Summary of planned changes to FedRAMP Certification Data.","items":{"type":"string"}}}},"acceptedVulnerabilities":{"type":"string","title":"Accepted Vulnerabilities","description":"Summary of accepted vulnerabilities. Full records are reported per VER-RPT-AVI."},"transformativeChanges":{"type":"array","title":"Transformative Changes","description":"High-level summaries of transformative changes during this period.","items":{"type":"string"}},"updatedRecommendations":{"type":"array","title":"Updated Recommendations","description":"Updated recommendations or best practices for security, configuration, usage, or similar aspects of the cloud service offering.","items":{"type":"string"}},"activeAgencies":{"type":"array","title":"Active Agencies","description":"List of all agencies directly using the product.","items":{"type":"string","title":"Agency"}},"reportableIncidents":{"type":"object","title":"FedRAMP Reportable Incidents","description":"FedRAMP Reportable Incidents during this period. An empty `incidents` array attests that none occurred.","required":["incidents"],"properties":{"incidents":{"type":"array","title":"Incidents","description":"Summary of each incident. Provide an empty array to attest that no FedRAMP Reportable Incidents occurred during this period.","items":{"$ref":"#/$defs/incidentSummary"}}}}},"$defs":{"incidentSummary":{"type":"object","title":"Incident Summary","description":"Summary of a FedRAMP Reportable Incident.","properties":{"summary":{"type":"string","title":"Summary","description":"Brief description of the incident."},"occurredAt":{"type":"string","format":"date-time","title":"Occurred At","description":"Date and time the incident occurred."},"resolvedAt":{"type":"string","format":"date-time","title":"Resolved At","description":"Date and time the incident was resolved."},"incidentLessonsLearned":{"type":"array","title":"Incident Lessons Learned","description":"Lessons learned and changes planned or made as a result of FedRAMP Reportable Incidents.","items":{"type":"string"}}}}}},"security-decision-record":{"$schema":"https://json-schema.org/draft/2020-12/schema","$id":"https://fedramp.gov/schemas/fedramp-security-decision-record-schema-2026-06-24.json","$schemaVersion":"1.1.1","type":"object","title":"FedRAMP Security Decision Record (SDR-CSO-FRR)","description":"JSON Schema for Cloud Service Provider (CSP) system submission for FedRAMP certification per SDR-CSO-FRR.","required":["certificationPackageOverviewUri","fedRampRequirements"],"properties":{"certificationPackageOverviewUri":{"$ref":"https://fedramp.gov/schemas/fedramp-common-definitions-schema-2026-06-24.json#/$defs/certificationPackageOverviewUri"},"metadata":{"type":"object","title":"Security Decision Record Metadata","description":"Basic metadata about this Security Decision Record, per SDR-CSO-MTD.","required":["version","lastUpdated","updateSource"],"properties":{"version":{"type":"string","title":"Version","description":"Version of this Security Decision Record."},"lastUpdated":{"type":"string","format":"date-time","title":"Last Updated","description":"Date and time this Security Decision Record was last updated."},"updateSource":{"type":"string","title":"Update Source","description":"Source of the update (e.g., person, team, or automated process)."}}},"portsAndProtocols":{"type":"array","title":"Ports and Protocols","description":"Ports and protocols used by the Cloud Service Offering","items":{"type":"object","title":"Port and Protocol","description":"Port and protocol exposed by the Cloud Service Offering","properties":{"serviceName":{"type":"string","title":"Service Name","description":"Name of the service exposed on this port."},"portNumber":{"type":"string","title":"Port Number","description":"Port number used by the service. For services that operate on a range of ports, provide the range in the format 'start-end'."},"transportProtocol":{"type":"string","title":"Transport Protocol","description":"Transport protocol used by the service"},"encryption":{"type":"string","title":"Encryption","description":"Encryption method used by the service (e.g., TLS, SSL, None)."},"purpose":{"type":"string","title":"Purpose","description":"Provide a general description of how the port and protocol are used in the Cloud Service Offering (e.g., Web access, database connection)."}}}},"securityControls":{"type":"array","title":"NIST 800-53 Security Controls","description":"Describe the security controls for the system.","items":{"type":"object","title":"NIST 800-53 Security Control","description":"NIST 800-53 Security Control","properties":{"controlId":{"type":"string","title":"NIST 800-53 Control ID","description":"NIST 800-53 Control ID","examples":["AC-1","AC-2","AC-3"]},"parameterValues":{"type":"array","title":"Parameter Values","description":"Parameter values for the control","items":{"type":"object","title":"Parameter Value","description":"Parameter value for the control","required":["parameterId","parameterValue"],"properties":{"parameterId":{"type":"string","title":"Parameter ID","description":"The parameter ID as defined in the NIST 800-53 Control Implementation Guide."},"parameterValue":{"type":"string","title":"Parameter Value","description":"The parameter value selected by the Cloud Service Provider. If the parameter is a boolean, provide 'true' or 'false'. If the parameter is a list, provide a comma-separated list of values."}}}},"controlImplementationStatus":{"type":"string","title":"Control Implementation Status","description":"Status of the control implementation","enum":["Implemented","Not Implemented","Partially Implemented"]},"controlImplementationDescription":{"type":"string","title":"Control Implementation Description","description":"Description of the control implementation. May use Markdown for formatting."}}}},"fedRampRequirements":{"type":"array","title":"FedRAMP Requirements","description":"Describe how any applicable FedRAMP required processes are met.","items":{"type":"object","title":"FedRAMP Requirement","description":"FedRAMP requirement","required":["frrID","frrImplementation"],"properties":{"frrID":{"type":"string","title":"FedRAMP Requirement ID","description":"FedRAMP requirement ID"},"frrImplementationStatus":{"type":"string","title":"Requirement Implementation Status","description":"Status of the requirement implementation.","enum":["Implemented","Not Implemented","Partially Implemented"]},"frrImplementation":{"type":"array","title":"Requirement Implementation Statements","description":"Description of the requirement implementation. May use Markdown for formatting.","items":{"$ref":"#/$defs/implementationStatement"}},"frrValidation":{"type":"array","title":"Requirement Validation Statements","description":"Description of the requirement validation. May use Markdown for formatting.","items":{"$ref":"#/$defs/validationStatement"}},"frrAssessment":{"type":"array","title":"Requirement Assessment Statements","description":"Description of the requirement assessment. May use Markdown for formatting.","items":{"$ref":"#/$defs/assessmentStatement"}}}}},"keySecurityIndicators":{"type":"array","title":"FedRAMP Key Security Indicators","description":"Describe how the system meets the FedRAMP Key Security Indicators (KSI).","items":{"type":"object","title":"FedRAMP Key Security Indicator","description":"How the Key Security Indicator objective is achieved and monitored","required":["ksiId","ksiImplementation","ksiValidation","ksiAssessment","ksiTests","ksiEvidence"],"properties":{"ksiId":{"type":"string","title":"FedRAMP KSI ID","description":"FedRAMP KSI ID"},"ksiImplementationStatus":{"type":"string","title":"KSI Implementation Status","description":"Status of the KSI implementation.","enum":["Implemented","Not Implemented","Partially Implemented"]},"ksiImplementation":{"type":"array","title":"KSI Implementation Statements","description":"Description of the Key Security Indicator implementation. May use Markdown for formatting.","items":{"$ref":"#/$defs/implementationStatement"}},"ksiValidation":{"type":"array","title":"KSI Validation Statements","description":"Description of the Key Security Indicator validation. May use Markdown for formatting.","items":{"$ref":"#/$defs/validationStatement"}},"ksiAssessment":{"type":"array","title":"KSI Assessment Statements","description":"Description of the Key Security Indicator assessment. May use Markdown for formatting.","items":{"$ref":"#/$defs/assessmentStatement"}},"ksiTests":{"type":"array","title":"KSI Tests","description":"List of tests used to validate the KSI implementation.","items":{"type":"string"}},"ksiEvidence":{"type":"array","title":"KSI Evidence","description":"Results of the security test used to validate the KSI implementation.","items":{"$ref":"#/$defs/evidence"}}}}}},"$defs":{"evidence":{"type":"object","title":"Evidence","description":"Results of the security test","properties":{"evidenceType":{"type":"string","title":"Evidence Type","description":"Type of evidence provided","enum":["Log","Report","Screenshot","Configuration","Policy","Procedure","Audit Record"]},"evidenceDescription":{"type":"string","title":"Evidence Description","description":"Detailed description of the evidence."},"evidenceLocation":{"type":"string","format":"uri","title":"Evidence Location","description":"URI to the evidence document"},"evidenceText":{"type":"string","title":"Evidence Content (Text)","description":"Evidence included as plain text such as the output of a command or log."},"lastUpdated":{"type":"string","format":"date","title":"Last Updated","description":"Date when the evidence was last updated"}}},"implementationStatement":{"type":"string","title":"Implementation","description":"Description of how the control/requirement/ksi is implemented. May use Markdown for formatting."},"validationStatement":{"type":"string","title":"Validation","description":"Description of the how the control/requirement/ksi is validated by the CSP internally. May use Markdown for formatting."},"assessmentStatement":{"type":"string","title":"Assessment","description":"Description of how the control/requirement/ksi is assessed by an independent validator. May use Markdown for formatting."}}},"significant-change-notifications":{"$schema":"https://json-schema.org/draft/2020-12/schema","$id":"https://fedramp.gov/schemas/fedramp-significant-change-notifications-schema-2026-06-24.json","$schemaVersion":"0.1.3","type":"object","title":"FedRAMP Significant Change Notification (SCN-CSO-INF)","description":"Required information for a Significant Change Notification per SCN-CSO-INF. Note per the rule: structure of the information may vary depending on how the provider tracks this internally.","required":["certificationPackageOverviewUri","changeType","changeDescription"],"properties":{"certificationPackageOverviewUri":{"$ref":"https://fedramp.gov/schemas/fedramp-common-definitions-schema-2026-06-24.json#/$defs/certificationPackageOverviewUri"},"assessorName":{"type":"string","title":"Assessor Name","description":"Name of the assessor involved in this change, if applicable."},"relatedVulnerability":{"type":"string","title":"Related Vulnerability","description":"Identifier or description of any related vulnerability driving this change, if applicable."},"changeType":{"type":"string","title":"Type","description":"Significant change type per SCN-CSO-EVA. Routine recurring changes (SCN-RTR) do not require a Significant Change Notification.","enum":["Adaptive","Transformative"]},"changeTypeExplanation":{"type":"string","title":"Categorization Explanation","description":"Explanation of why this change was categorized as the selected type."},"changeDescription":{"type":"string","title":"Description","description":"Short description of the change."},"reason":{"type":"string","title":"Reason for Change","description":"Reason for the change."},"customerImpact":{"type":"string","title":"Customer Impact","description":"Summary of customer impact, including changes to services and customer configuration responsibilities."},"planAndTimeline":{"type":"object","title":"Plan and Timeline","description":"Plan and timeline for the change, including verification, assessment, and/or validation of impacted Key Security Indicators (KSIs) or Rev5 Controls.","required":["summary"],"properties":{"summary":{"type":"string","title":"Summary","description":"Human readable summary of the timeline and plan for the change. May use Markdown for formatting."},"plannedStart":{"type":"string","format":"date","title":"Planned Start","description":"The first date on which changes will be made to the system."},"plannedCompletion":{"type":"string","format":"date","title":"Planned Completion","description":"The date on which the changes will be considered complete. This should include any planned testing and monitoring activities."},"milestones":{"type":"array","title":"Milestones","description":"Milestones for the change, including dates and descriptions.","items":{"type":"object","required":["milestoneDescription"],"properties":{"milestoneDescription":{"type":"string","title":"Description","description":"Human readable description of the milestone."},"targetDate":{"type":"string","format":"date","title":"Target Date","description":"The date on which the milestone is expected to be completed."}}}}}},"impactedControls":{"type":"array","title":"Impacted KSIs or Rev5 Controls","description":"KSI or control identifiers that will be verified, assessed, or validated as part of this change.","items":{"type":"string"}},"impactAnalysis":{"type":"string","title":"Business or Security Impact Analysis","description":"Copy or summary of the business or security impact analysis. May be the full text or a URI referencing the document."}}},"vulnerability-detail-report":{"$schema":"https://json-schema.org/draft/2020-12/schema","$id":"https://fedramp.gov/schemas/fedramp-vulnerability-detail-report-schema-2026-06-24.json","$schemaVersion":"0.1.1","type":"object","title":"FedRAMP Vulnerability Detail Report (VER-RPT-VDT)","description":"Vulnerability detection and response activity report per VER-RPT-VDT. Covers non-accepted vulnerabilities only; see VER-RPT-AVI for accepted vulnerabilities.","required":["certificationPackageOverviewUri","reportPeriod","vulnerabilities"],"properties":{"certificationPackageOverviewUri":{"$ref":"https://fedramp.gov/schemas/fedramp-common-definitions-schema-2026-06-24.json#/$defs/certificationPackageOverviewUri"},"reportPeriod":{"$ref":"https://fedramp.gov/schemas/fedramp-common-definitions-schema-2026-06-24.json#/$defs/reportPeriodDateTime","title":"Report Period","description":"Period summarized by this report. Per VER-RPT-PER, must cover all activity since the previous report."},"vulnerabilities":{"type":"array","title":"Vulnerabilities","description":"Non-accepted vulnerabilities with activity in this period.","items":{"$ref":"https://fedramp.gov/schemas/fedramp-common-definitions-schema-2026-06-24.json#/$defs/vulnerabilityDetail"}}}}},"schemaRules":{"accepted-vulnerability-info":["VER-RPT-AVI"],"certification-package-overview":["CDS-CSO-PUB","CDS-CSO-SVC","CDS-CSO-UTC","CPO-CSO-OVR","FRC-CSO-PKG","MAS-CSO-TPR","SCG-CSO-RSC"],"historical-ver-activity":["VER-TFR-MRH"],"incident-report":["IEC-CSO-EFI","IEC-CSO-FIR","IEC-CSO-IIR","IEC-CSO-OIR"],"ongoing-certification-report":["CCM-OCR-AVL"],"security-decision-record":["SDR-CSO-FRR","SDR-CSX-KMT","SDR-CSX-KSI"],"significant-change-notifications":["SCN-CSO-EVA","SCN-CSO-HRM","SCN-CSO-INF"],"vulnerability-detail-report":["VER-RPT-PER","VER-RPT-VDT"]},"built":"2026-10-14"}
+{"info":{"title":"FedRAMP Consolidated Rules for 2026","version":"2026.10.13.01","last_updated":"2026-10-13"},"defaultArtifacts":{"FRR":["Explanation of how the rule is followed, or an explanation of the reason and resulting risk to customers for not following the rule.","Verification that the implementation is appropriate for the rule, or that the reason for not implementing is accepted by a senior official.","Validation that the implementation is in place and working as intended, or that the reason for not implementing is accepted by a senior official.","Independent verification.","Independent validation."],"KSI":["Explanation of measures (and their objectives) that demonstrate the Key Security Indicator, or an explanation of the reason and resulting risk to customers for not having measures available for that Key Security Indicator.","Explanation of the cycle for any measures that are implemented persistently (if applicable).","Verification that the measures demonstrate the Key Security Indicator, or that the reason for not having them is accepted.","Verification that the automation in place is accurate and sufficient to demonstrate appropriate measures for the Key Security Indicator, or that automation is not necessary for each measure.","Validation that the measures are accurately produced and are in place and working as intended, or that the reason for not having them is valid."]},"themes":{"CED":{"id":"KSI-CED","name":"Cybersecurity Education","status":"stable"},"CMT":{"id":"KSI-CMT","name":"Change Management","status":"stable"},"CNA":{"id":"KSI-CNA","name":"Cloud Native Architecture","status":"stable"},"IAM":{"id":"KSI-IAM","name":"Identity and Access Management","status":"stable"},"INR":{"id":"KSI-INR","name":"Incident Response","status":"stable"},"MLA":{"id":"KSI-MLA","name":"Monitoring, Logging, and Auditing","status":"stable"},"PIY":{"id":"KSI-PIY","name":"Policy and Inventory","status":"stable"},"RPL":{"id":"KSI-RPL","name":"Recovery Planning","status":"stable"},"SCR":{"id":"KSI-SCR","name":"Supply Chain Risk","status":"stable"},"SVC":{"id":"KSI-SVC","name":"Service Configuration","status":"stable"}},"ksis":[{"id":"KSI-CED-RAT","theme":"CED","name":"Reviewing All Training","controls":["at-2","at-2.2","at-2.3","at-3","at-3.5","at-4","cm-11","cp-3","cp-3.1","ir-2","ir-2.1","ir-2.2","ir-2.3","ir-9.2","ir-9.4","pl-4","pl-4.1","ps-6","sr-11.1"],"updated":"2026-10-13","statement":"The effectiveness of relevant cybersecurity education and training is persistently reviewed, including at least general training for all employees, role-specific training for employees in high risk roles, training for development and engineering staff on secure software delivery, and training for staff involved with incident response or disaster recovery."},{"id":"KSI-CMT-LMC","theme":"CMT","name":"Logging Changes","controls":["au-2","ca-7.4","cm-3","cm-3.1","cm-3.2","cm-3.6","cm-4.2","cm-6","cm-8.3"],"updated":"2026-10-13","statement":"Modifications to the cloud service offering are logged and monitored."},{"id":"KSI-CMT-RMV","theme":"CMT","name":"Redeploying vs Modifying","controls":["cm-2","cm-3","cm-5","cm-6","cm-7","cm-8.1","si-3"],"updated":"2026-06-24","statement":"Changes to machine-based information resources are executed through the redeployment of version controlled resources rather than direct modification wherever reasonable."},{"id":"KSI-CMT-RVP","theme":"CMT","name":"Reviewing Change Procedures","controls":["cm-3","cm-3.2","cm-3.4","cm-5","cm-7.1","cm-9"],"updated":"2026-06-24","statement":"The effectiveness of documented change management procedures is persistently reviewed."},{"id":"KSI-CMT-VTD","theme":"CMT","name":"Validating Throughout Deployment","controls":["cm-3","cm-3.2","cm-4.2","cm-6.2","ir-9.4","si-2"],"updated":"2026-10-13","statement":"Persistent testing and validation of changes throughout deployment is automated."},{"id":"KSI-CNA-DFP","theme":"CNA","name":"Defining Functionality and Privileges","controls":["cm-2","cm-8.4","cp-10.4","ir-9.4","si-3"],"updated":"2026-10-13","statement":"The functionality and privileges for infrastructure and services are strictly defined."},{"id":"KSI-CNA-EIS","theme":"CNA","name":"Enforcing Intended State","controls":["ca-2.1","cm-11","cm-6.2","cp-10.4","ir-9.4","sc-24","sc-7.18","si-4.22","si-7","si-7.1","si-7.5","si-7.7"],"updated":"2026-10-13","byClass":{"b":"**Optional:** Automated services are used to persistently assess the security of all machine-based information resources and automatically enforce their intended operational state.","c":"Automated services are used to persistently assess the security of all machine-based information resources and automatically enforce their intended operational state."}},{"id":"KSI-CNA-IBP","theme":"CNA","name":"Implementing Best Practices","controls":["ac-17.3","cm-2","pl-10","sc-7.18"],"updated":"2026-10-13","statement":"The use and configuration of third-party machine-based information resources is persistently compared against the original provider's best practices and guidance."},{"id":"KSI-CNA-MAT","theme":"CNA","name":"Minimizing Attack Surface","controls":["ac-17.3","ac-18.1","ac-18.3","ac-20.1","ca-9","sc-10","sc-7.18","sc-7.3","sc-7.4","sc-7.5","sc-7.8","sc-8","si-10","si-11","si-16"],"updated":"2026-10-13","statement":"Machine-based information resources are persistently reviewed to ensure they have a minimal attack surface and that lateral movement is minimized if compromised."},{"id":"KSI-CNA-OFA","theme":"CNA","name":"Optimizing for Availability","controls":["cp-2.5","sc-12.1"],"updated":"2026-10-13","statement":"Machine-based information resources are persistently reviewed to ensure they are appropriately optimized for high availability and rapid recovery."},{"id":"KSI-CNA-RNT","theme":"CNA","name":"Restricting Network Traffic","controls":["ac-17.3","ca-9","cm-7.1","sc-7.10","sc-7.18","sc-7.20","sc-7.21","sc-7.5","si-10","si-4.11","si-4.18","si-4.4","si-8"],"updated":"2026-10-13","statement":"Machine-based information resources are persistently reviewed to ensure they are appropriately configured to limit inbound and outbound network traffic."},{"id":"KSI-CNA-RVP","theme":"CNA","name":"Reviewing Protections","controls":["ir-4.2","sc-5","sc-7.18","si-8","si-8.2"],"updated":"2026-10-13","statement":"The effectiveness of protection against denial of service attacks and other unwanted activity for machine-based information resources is persistently reviewed."},{"id":"KSI-CNA-ULN","theme":"CNA","name":"Using Logical Networking","controls":["ac-12","ac-17.3","ac-4.21","ca-9","cm-11","sc-10","sc-4","sc-7","sc-7.20","sc-7.21","sc-7.7","sc-8"],"updated":"2026-10-13","statement":"Logical networking and related capabilities are used and persistently reviewed to enforce traffic flow controls."},{"id":"KSI-IAM-AAM","theme":"IAM","name":"Automating Account Management","controls":["ac-2.13","ac-2.2","ac-2.3","ac-6.7","ia-12","ia-12.2","ia-12.3","ia-12.5","ia-4.4","ia-8.4"],"updated":"2026-10-13","statement":"The lifecycle and privileges of all accounts, roles, and groups are securely managed using automation."},{"id":"KSI-IAM-APM","theme":"IAM","name":"Adopting Passwordless Methods","controls":["ac-2","ac-3","ia-2","ia-2.1","ia-2.2","ia-2.6","ia-2.8","ia-5","ia-5.1","ia-5.2","ia-5.6","ia-5.8","ia-6","ia-8","ia-8.2","ia-8.4","sc-23"],"updated":"2026-10-13","statement":"Secure passwordless methods are used for user authentication and authorization when feasible, otherwise strong passwords with phishing-resistant MFA is used."},{"id":"KSI-IAM-ELP","theme":"IAM","name":"Ensuring Least Privilege","controls":["ac-12","ac-14","ac-17","ac-17.1","ac-17.2","ac-17.3","ac-18.4","ac-2.11","ac-2.5","ac-2.6","ac-2.7","ac-2.9","ac-20","ac-20.1","ac-21","ac-3","ac-4","ac-6","ac-6.3","ac-6.8","au-12.3","au-6.7","cm-2.7","cm-5.1","cm-5.5","cm-7.2","cm-9","ia-11","ia-2","ia-3","ia-4","ia-4.4","ia-5.2","ia-5.6","ir-4.6","ir-9.4","ps-2","ps-3","ps-4","ps-5","ps-6","ra-5.5","sc-2","sc-20","sc-21","sc-22","sc-23","sc-3","sc-39","sc-4","si-3","si-4.19"],"updated":"2026-10-13","statement":"Identity and access management measures are used and persistently reviewed to ensure each user or device can only access the resources they need."},{"id":"KSI-IAM-JIT","theme":"IAM","name":"Authorizing Just-in-Time","controls":["ac-17","ac-17.4","ac-2","ac-2.1","ac-2.11","ac-2.2","ac-2.3","ac-2.4","ac-2.6","ac-2.7","ac-20.1","ac-21","ac-3","ac-4","ac-5","ac-6","ac-6.1","ac-6.10","ac-6.2","ac-6.3","ac-6.5","ac-6.7","ac-6.8","ac-6.9","ac-7","au-10","au-12.3","au-9.4","ca-3.6","cm-5","cm-5.1","cm-5.5","cm-7","cm-7.2","cm-7.5","cm-9","ia-4","ia-4.4","ia-7","ir-4.6","ps-2","ps-3","ps-4","ps-5","ps-6","ps-9","ra-5.5","sc-2","sc-23","sc-3","sc-39"],"updated":"2026-10-13","statement":"A least-privileged, role and attribute-based, and just-in-time security authorization model is used and persistently reviewed for all user and non-user accounts and services."},{"id":"KSI-IAM-SNU","theme":"IAM","name":"Securing Non-User Authentication","controls":["ac-2","ac-2.2","ac-2.9","ac-4","ac-6.5","au-10","ia-2.5","ia-3","ia-5.2","ra-5.5"],"updated":"2026-10-13","statement":"Appropriately secure authentication methods are used and persistently reviewed for non-user accounts and services."},{"id":"KSI-IAM-SUS","theme":"IAM","name":"Responding to Suspicious Activity","controls":["ac-2","ac-2.1","ac-2.11","ac-2.12","ac-2.13","ac-2.3","ac-7","au-6.5","cm-5.1","cm-6.2","ir-4.2","ir-4.6","ps-4","ps-8","si-4","si-4.1","si-4.19","si-4.20","si-4.22","si-4.4"],"updated":"2026-10-13","statement":"Accounts with privileged access are disabled or otherwise secured in response to suspicious activity."},{"id":"KSI-INR-AAR","theme":"INR","name":"Generating After Action Reports","controls":["ir-3","ir-4","ir-4.1","ir-5.1","ir-8","ir-9.3"],"updated":"2026-10-13","statement":"Incident after action reports are generated and lessons learned are persistently incorporated."},{"id":"KSI-INR-RIR","theme":"INR","name":"Reviewing Incident Response Procedures","controls":["ir-4","ir-4.1","ir-4.11","ir-6","ir-6.1","ir-6.3","ir-7","ir-7.1","ir-8","ir-8.1","ir-9.3","si-4.5"],"updated":"2026-10-13","statement":"The effectiveness of documented incident response procedures is persistently reviewed."},{"id":"KSI-INR-RPI","theme":"INR","name":"Reviewing Past Incidents","controls":["ir-3","ir-4","ir-4.1","ir-4.11","ir-4.4","ir-5","ir-5.1","ir-8","ra-5.8"],"updated":"2026-10-13","statement":"Past incidents are persistently reviewed for patterns or vulnerabilities that were not previously apparent or identified."},{"id":"KSI-MLA-ALA","theme":"MLA","name":"Authorizing Log Access","controls":["au-12.3","au-6.7","si-11"],"updated":"2026-10-13","byClass":{"b":"**Optional:** A least-privileged, role and attribute-based, and just-in-time access authorization model is used and persistently reviewed for access to log data based on organizationally defined data sensitivity.","c":"A least-privileged, role and attribute-based, and just-in-time access authorization model is used and persistently reviewed for access to log data based on organizationally defined data sensitivity."}},{"id":"KSI-MLA-EVC","theme":"MLA","name":"Evaluating Configurations","controls":["ac-19","ca-7","cm-2","cm-6","cm-6.1","ra-3","si-7.7"],"updated":"2026-10-13","statement":"The configuration of machine-based information resources, especially infrastructure as code, is persistently evaluated and tested."},{"id":"KSI-MLA-LET","theme":"MLA","name":"Logging Event Types","controls":["ac-17.1","ac-2.4","ac-20.1","ac-6.9","au-10","au-12","au-2","au-7","au-7.1","cm-5.1","ir-9.4","si-4.19","si-4.20","si-4.4","si-4.5","si-7.7"],"updated":"2026-10-13","statement":"A list of information resources and event types that will be logged, monitored, and audited is maintained and persistently reviewed to ensure these activities occur."},{"id":"KSI-MLA-OSM","theme":"MLA","name":"Operating SIEM Capability","controls":["ac-17.1","ac-20.1","au-11","au-12.1","au-2","au-3","au-3.1","au-4","au-5","au-5.1","au-6.1","au-6.3","au-6.4","au-6.5","au-7","au-7.1","au-8","au-9","ir-4.1","si-4.16","si-4.2","si-4.4"],"updated":"2026-10-13","statement":"A Security Information and Event Management (SIEM) or similar system(s) is used and persistently reviewed for centralized, tamper-resistant logging of events, activities, and changes."},{"id":"KSI-MLA-RVL","theme":"MLA","name":"Reviewing Logs","controls":["ac-2.4","ac-6.9","au-2","au-6","au-6.1","au-7","ra-5.8","si-4","si-4.19","si-4.4"],"updated":"2026-10-13","statement":"Logs are persistently reviewed and audited."},{"id":"KSI-PIY-GIV","theme":"PIY","name":"Generating Inventories","controls":["cm-12","cm-12.1","cm-2.2","cm-7.5","cm-8","cm-8.1","cm-8.2","cm-8.4","cp-2.8"],"updated":"2026-10-13","statement":"Authoritative sources are used to automatically generate real-time inventories of all information resources when needed."},{"id":"KSI-PIY-RES","theme":"PIY","name":"Reviewing Executive Support","controls":[],"updated":"2026-06-24","statement":"Executive support for achieving the provider's security goals is persistently reviewed and demonstrated."},{"id":"KSI-PIY-RIS","theme":"PIY","name":"Reviewing Investments in Security","controls":["ac-5","ca-2","ca-2.2","cp-2.1","cp-4.1","ir-3.2","ir-4.11","pm-3","sa-2","sa-3","sr-2.1"],"updated":"2026-10-13","statement":"The effectiveness of the provider's investments in achieving security goals is persistently reviewed."},{"id":"KSI-PIY-RSD","theme":"PIY","name":"Reviewing Security in the SDLC","controls":["ac-5","au-3.3","cm-3.4","ia-5.7","pl-8","pm-7","ra-9","sa-3","sa-8","sc-18","sc-4","si-10","si-11","si-16"],"updated":"2026-10-13","statement":"The effectiveness of building security and privacy considerations into the Software Development Lifecycle and aligning with CISA Secure By Design principles is persistently reviewed."},{"id":"KSI-PIY-RVD","theme":"PIY","name":"Reviewing Vulnerability Disclosures","controls":["ra-5.11"],"updated":"2026-06-24","statement":"The effectiveness of the provider's vulnerability disclosure program is persistently reviewed."},{"id":"KSI-RPL-ABO","theme":"RPL","name":"Aligning Backups with Objectives","controls":["cm-2.3","cp-10","cp-10.2","cp-6","cp-9"],"updated":"2026-10-13","statement":"The alignment of machine-based information resource backups with defined recovery objectives is persistently reviewed."},{"id":"KSI-RPL-ARP","theme":"RPL","name":"Aligning Recovery Plan","controls":["cp-10","cp-10.2","cp-2","cp-2.1","cp-2.3","cp-4.1","cp-6","cp-6.1","cp-6.3","cp-7","cp-7.1","cp-7.2","cp-7.3","cp-8","cp-8.1","cp-8.2"],"updated":"2026-06-24","statement":"The alignment of recovery plans with defined recovery objectives is persistently reviewed."},{"id":"KSI-RPL-RRO","theme":"RPL","name":"Reviewing Recovery Objectives","controls":["cp-10","cp-2.3"],"updated":"2026-06-24","statement":"The desired Recovery Time Objectives (RTO) and Recovery Point Objectives (RPO) are defined and persistently reviewed for alignment with the provider's business needs and capabilities."},{"id":"KSI-RPL-TRC","theme":"RPL","name":"Testing Recovery Capabilities","controls":["cp-10","cp-2.1","cp-2.3","cp-4","cp-4.1","cp-6","cp-6.1","cp-9.1","ir-3","ir-3.2","ir-9.3","sc-12.1"],"updated":"2026-10-13","statement":"The capability to recover from incidents and contingencies aligned with defined recovery objectives is persistently tested."},{"id":"KSI-SCR-MIT","theme":"SCR","name":"Mitigating Supply Chain Risk","controls":["ac-19","ac-20","ca-7.4","ra-3","ra-3.1","sa-10","sa-11","sa-11.1","sa-11.2","sa-15","sa-15.3","sa-16","sa-17","sa-21","sa-22","sa-4","sa-4.1","sa-4.2","sa-4.5","sa-4.9","sa-9","sa-9.1","sa-9.2","sa-9.5","sc-18","si-7.1","si-7.15","sr-2","sr-3","sr-5","sr-6"],"updated":"2026-10-13","statement":"Persistently identify, review, and mitigate potential supply chain risks."},{"id":"KSI-SCR-MON","theme":"SCR","name":"Monitoring Supply Chain Risk","controls":["ac-19","ac-20","ca-2.3","ca-3","ir-6.3","ps-7","ra-3","ra-5","sa-9","si-5","sr-3","sr-5","sr-6","sr-8"],"updated":"2026-10-13","statement":"Third party software information resources are automatically monitored for upstream vulnerabilities using mechanisms that may include contractual notification requirements or active monitoring services."},{"id":"KSI-SVC-ACM","theme":"SVC","name":"Automating Configuration Management","controls":["ac-2.4","ac-6.8","cm-2","cm-2.2","cm-2.3","cm-6","cm-7.1","pl-10","pl-9","sa-5","sc-45","sc-45.1","sc-7.18","si-5","sr-10"],"updated":"2026-10-13","statement":"The configuration of machine-based information resources is managed using automation and persistently reviewed for drift."},{"id":"KSI-SVC-ASM","theme":"SVC","name":"Automating Secret Management","controls":["ac-17.2","ia-5.2","ia-5.6","sc-12","sc-12.1","sc-17"],"updated":"2026-10-13","statement":"Management, protection, and regular rotation of digital keys, certificates, and other secrets is automated and persistently reviewed."},{"id":"KSI-SVC-EIS","theme":"SVC","name":"Evaluating and Improving Security","controls":["ca-7.4","cm-12.1","cm-5.5","cm-7.1","ir-9.4","pl-8","ra-3","sc-39","sc-7","si-2.2","si-4","sr-10"],"updated":"2026-10-13","statement":"Information resources are persistently evaluated for opportunities to improve security and those improvements are persistently made."},{"id":"KSI-SVC-PRR","theme":"SVC","name":"Preventing Residual Risk","controls":["ac-19","ir-9.4","sc-12.1","sc-4","sc-7.18"],"updated":"2026-10-13","byClass":{"b":"**Optional:** Plans, procedures, and the state of information resources are persistently reviewed after making changes to limit and remove unwanted residual elements that would likely negatively affect the confidentiality, integrity, or availability of federal customer data.","c":"Plans, procedures, and the state of information resources are persistently reviewed after making changes to limit and remove unwanted residual elements that would likely negatively affect the confidentiality, integrity, or availability of federal customer data."}},{"id":"KSI-SVC-RUD","theme":"SVC","name":"Removing Unwanted Data","controls":["ir-9","si-12.3","si-18.4","si-8","si-8.2"],"updated":"2026-10-13","byClass":{"b":"**Optional:** Unwanted federal customer data is removed promptly when requested by an agency in alignment with customer agreements, including from backups if appropriate; this typically applies when a customer spills information or when a customer seeks to remove information from a service due to a change in usage.","c":"Unwanted federal customer data is removed promptly when requested by an agency in alignment with customer agreements, including from backups if appropriate; this typically applies when a customer spills information or when a customer seeks to remove information from a service due to a change in usage."}},{"id":"KSI-SVC-SIN","theme":"SVC","name":"Securing Information","controls":["ac-11","ac-11.1","ac-17.2","ac-19.5","ac-21","cp-9.8","ir-9.4","sc-13","sc-20","sc-21","sc-22","sc-23","sc-28","sc-28.1","sc-4","sc-7.18","sc-8","sc-8.1","si-4.18"],"updated":"2026-10-13","statement":"Information is encrypted or otherwise secured from unwanted access or modification."},{"id":"KSI-SVC-VCM","theme":"SVC","name":"Validating Communications","controls":["ac-10","ac-17.4","ac-18","ac-19","sc-23","si-4.22","si-7.1"],"updated":"2026-10-13","byClass":{"b":"**Optional:** The authenticity and integrity of communications between machine-based information resources is persistently validated using automation.","c":"The authenticity and integrity of communications between machine-based information resources is persistently validated using automation."}},{"id":"KSI-SVC-VRI","theme":"SVC","name":"Validating Resource Integrity","controls":["ac-17.4","ac-18","ac-19","au-9.3","cm-14","cm-2.2","cm-8.3","sc-13","sc-23","si-7","si-7.1","si-7.15","sr-10","sr-11"],"updated":"2026-10-13","statement":"Use cryptographic methods to validate the integrity of machine-based information resources."}],"families":{"AFC":{"name":"Addressing FedRAMP Communication","status":"stable","effective":{"all":{"is":"required","current_status":"Consolidated Rules for 2026","date":{"obtain":"2026-01-05","maintain":"2026-01-05","grace":{"default":"2026-07-01","until_next_assessment":false}}}}},"AGU":{"name":"Agency Use of FedRAMP Certified Cloud Services","status":"placeholder","effective":{"all":{"is":"required","current_status":"Consolidated Rules for 2026","date":{"obtain":"2026-07-04","maintain":"2026-07-04","optional_adoption":"2026-07-04","grace":{"default":"2026-07-04","until_next_assessment":false}}}}},"CCM":{"name":"Collaborative Continuous Monitoring","status":"stable","effective":{"20x":{"is":"required","current_status":"Consolidated Rules for 2026","date":{"obtain":"2026-07-04","maintain":"2027-01-01","optional_adoption":"2026-07-04","grace":{"default":"2027-01-01","until_next_assessment":true}}},"rev5":{"is":"required","current_status":"Consolidated Rules for 2026","date":{"obtain":"2027-01-01","maintain":"2027-04-02","optional_adoption":"2026-07-04","grace":{"default":"2027-10-01","until_next_assessment":false}}}}},"CDS":{"name":"Certification Data Sharing","status":"stable","effective":{"20x":{"is":"required","current_status":"Consolidated Rules for 2026","date":{"obtain":"2026-07-04","maintain":"2027-01-01","optional_adoption":"2026-07-04","grace":{"default":"2027-01-01","until_next_assessment":true}}},"rev5":{"is":"required","current_status":"Consolidated Rules for 2026","date":{"obtain":"2027-01-01","maintain":"2027-08-01","optional_adoption":"2026-07-04","grace":{"default":"2028-02-01","until_next_assessment":false}}}}},"CMU":{"name":"Cryptographic Module Use","status":"stable","effective":{"20x":{"is":"required","current_status":"Consolidated Rules for 2026","date":{"obtain":"2026-07-04","maintain":"2027-01-01","optional_adoption":"2026-07-04","grace":{"default":"2027-01-01","until_next_assessment":true}}},"rev5":{"is":"required","current_status":"Consolidated Rules for 2026","date":{"obtain":"2027-01-01","maintain":"2027-01-01","optional_adoption":"2026-07-04","grace":{"default":"2027-06-01","until_next_assessment":false}}}}},"CPO":{"name":"Certification Package Overview","status":"stable","effective":{"20x":{"is":"required","current_status":"Consolidated Rules for 2026","date":{"obtain":"2026-07-04","maintain":"2027-01-01","optional_adoption":"2026-07-04","grace":{"default":"2027-01-01","until_next_assessment":true}}},"rev5":{"is":"required","current_status":"Consolidated Rules for 2026","date":{"obtain":"2027-01-01","maintain":"2027-07-01","optional_adoption":"2026-07-04","grace":{"default":"2027-07-01","until_next_assessment":true}}}}},"FRC":{"name":"FedRAMP Certification","status":"stable","effective":{"20x":{"is":"required","current_status":"Consolidated Rules for 2026","date":{"obtain":"2026-07-04","maintain":"2027-01-01","optional_adoption":"2026-07-04","grace":{"default":"2027-01-01","until_next_assessment":true}}},"rev5":{"is":"required","current_status":"Consolidated Rules for 2026","date":{"obtain":"2027-01-01","maintain":"2027-01-01","optional_adoption":"2026-07-04","grace":{"default":"2027-01-01","until_next_assessment":true}}}}},"IEC":{"name":"Incident Evaluation and Communication","status":"stable","effective":{"20x":{"is":"required","current_status":"Consolidated Rules for 2026","date":{"obtain":"2026-07-04","maintain":"2027-01-01","optional_adoption":"2026-07-04","grace":{"default":"2027-01-01","until_next_assessment":true}}},"rev5":{"is":"required","current_status":"Consolidated Rules for 2026","date":{"obtain":"2027-01-01","maintain":"2027-01-01","optional_adoption":"2026-07-04","grace":{"default":"2027-06-01","until_next_assessment":false}}}}},"IVV":{"name":"Independent Verification and Validation","status":"stable","effective":{"20x":{"is":"required","current_status":"Consolidated Rules for 2026","date":{"obtain":"2026-07-04","maintain":"2027-01-01","optional_adoption":"2026-07-04","grace":{"default":"2027-01-01","until_next_assessment":true}}},"rev5":{"is":"required","current_status":"Consolidated Rules for 2026","date":{"obtain":"2027-01-01","maintain":"2027-01-01","optional_adoption":"2026-07-04","grace":{"default":"2027-01-01","until_next_assessment":true}}}}},"MAS":{"name":"Minimum Assessment Scope","status":"stable","effective":{"20x":{"is":"required","current_status":"Consolidated Rules for 2026","date":{"obtain":"2026-07-04","maintain":"2027-01-01","optional_adoption":"2026-07-04","grace":{"default":"2027-01-01","until_next_assessment":true}}},"rev5":{"is":"required","current_status":"Consolidated Rules for 2026","date":{"obtain":"2027-01-01","maintain":"2027-01-01","optional_adoption":"2026-07-04","grace":{"default":"2027-01-01","until_next_assessment":true}}}}},"MKT":{"name":"Marketplace Listing","status":"stable","effective":{"all":{"is":"required","current_status":"Consolidated Rules for 2026","date":{"obtain":"2026-07-04","maintain":"2026-07-04","optional_adoption":"2026-07-04","grace":{"default":"2026-07-04","until_next_assessment":false}}}}},"REC":{"name":"FedRAMP Recognition of Independent Assessment Services","status":"stable","effective":{"all":{"is":"required","current_status":"Consolidated Rules for 2026","date":{"obtain":"2026-07-04","maintain":"2026-07-04","optional_adoption":"2026-07-04","grace":{"default":"2026-07-04","until_next_assessment":false}}}}},"SCG":{"name":"Secure Configuration Guide","status":"stable","effective":{"all":{"is":"required","current_status":"Consolidated Rules for 2026","date":{"obtain":"2026-03-01","maintain":"2026-03-01","grace":{"default":"2026-07-01","until_next_assessment":false}}}}},"SCN":{"name":"Significant Change Notification","status":"stable","effective":{"20x":{"is":"required","current_status":"Consolidated Rules for 2026","date":{"obtain":"2026-07-04","maintain":"2027-01-01","optional_adoption":"2026-07-04","grace":{"default":"2027-01-01","until_next_assessment":true}}},"rev5":{"is":"required","current_status":"Consolidated Rules for 2026","date":{"obtain":"2027-01-01","maintain":"2027-01-01","optional_adoption":"2026-07-04","grace":{"default":"2027-06-01","until_next_assessment":false}}}}},"SDR":{"name":"Security Decision Record","status":"stable","effective":{"20x":{"is":"required","current_status":"Consolidated Rules for 2026","date":{"obtain":"2026-07-04","maintain":"2027-01-01","optional_adoption":"2026-07-04","grace":{"default":"2027-01-01","until_next_assessment":true}}},"rev5":{"is":"required","current_status":"Consolidated Rules for 2026","date":{"obtain":"2027-01-01","maintain":"2027-08-01","optional_adoption":"2026-07-04","grace":{"default":"2027-08-01","until_next_assessment":true}}}}},"VDR":{"name":"Vulnerability Detection and Response","status":"stable","effective":{"all":{"is":"required","current_status":"Mandated by CISA BOD 26-04","date":{"obtain":"2026-12-07","maintain":"2026-12-07","optional_adoption":"2026-07-04","grace":{"default":"2027-03-07","until_next_assessment":false}}}}},"VER":{"name":"Vulnerability Evaluation and Reporting","status":"stable","effective":{"all":{"is":"required","current_status":"Mandated by CISA BOD 26-04","date":{"obtain":"2026-12-07","maintain":"2026-12-07","optional_adoption":"2026-07-04","grace":{"default":"2027-03-07","until_next_assessment":false}}}}}},"rules":{"AFC-CSO-INB":{"id":"AFC-CSO-INB","family":"AFC","scope":"all","subset":"CSO","name":"Maintain a FedRAMP Security Inbox","statement":"Providers MUST establish and maintain an email address to receive messages from FedRAMP; this inbox is a FedRAMP Security Inbox (FSI).","force":"MUST","notes":["Unless otherwise notified, FedRAMP will use the listed Security Email on the Marketplace for these notifications.","If a provider establishes a new inbox in reaction to this guidance that is different from the Security Email then they must follow the AFC-CSO-NOC (Notification of Changes) rules to notify FedRAMP."],"related":["AFC-CSO-NOC"],"controls":["si-5"],"artifacts":{"all":["Email address to receive messages from FedRAMP"]},"updated":"2026-10-13"},"AFC-CSO-NOC":{"id":"AFC-CSO-NOC","family":"AFC","scope":"all","subset":"CSO","name":"Notification of Changes","statement":"Providers MUST immediately notify FedRAMP of any changes to the email address for their FedRAMP Security Inbox.","force":"MUST","artifacts":{"all":["Process, manual or automated, to notify FedRAMP of changes in the FedRAMP Security Inbox"]},"updated":"2026-06-24"},"AFC-CSO-TFG":{"id":"AFC-CSO-TFG","family":"AFC","scope":"all","subset":"CSO","name":"Trust @fedramp.gov and @gsa.gov","statement":"Providers MUST treat any email originating from an @fedramp.gov or @gsa.gov email address as if it was sent from FedRAMP by default; if such a message is confirmed to originate from someone other than FedRAMP then the FedRAMP Security Inbox rules no longer apply.","force":"MUST","artifacts":{"all":["Configuration settings for FSI mailbox","Automated validation to check FSI mailbox configuration"]},"updated":"2026-06-24"},"AFC-CSO-RCV":{"id":"AFC-CSO-RCV","family":"AFC","scope":"all","subset":"CSO","name":"Receive Email Without Disruption","statement":"Providers MUST receive and react to email messages from FedRAMP without disruption and without requiring additional actions from FedRAMP.","force":"MUST","note":"This requirement is intended to prevent cloud service providers from requiring FedRAMP to complete a CAPTCHA, log into a customer portal, or otherwise take service-specific actions that might prevent the security team from receiving the message.","updated":"2026-06-24"},"AFC-CSO-CRA":{"id":"AFC-CSO-CRA","family":"AFC","scope":"all","subset":"CSO","name":"Complete Required Actions","statement":"Providers MUST complete the required actions in Emergency or Emergency Test designated messages sent by FedRAMP within the timeframe included in the message.","force":"MUST","note":"Timeframes may vary by FedRAMP Certification class.","updated":"2026-06-24"},"AFC-CSO-EMR":{"id":"AFC-CSO-EMR","family":"AFC","scope":"all","subset":"CSO","name":"Emergency Message Routing","statement":"Providers MUST route Emergency designated messages sent by FedRAMP to a senior security official for their awareness.","force":"MUST","note":"Senior security officials are determined by the provider.","artifacts":{"all":["Configuration settings for FSI mailbox","Automated validation to check FSI mailbox configuration"]},"updated":"2026-06-24"},"AFC-CSO-IMA":{"id":"AFC-CSO-IMA","family":"AFC","scope":"all","subset":"CSO","name":"Important Message Actions","statement":"Providers SHOULD complete the required actions in Important designated messages sent by FedRAMP within the timeframe specified in the message.","force":"SHOULD","note":"Timeframes may vary by FedRAMP Certification class.","updated":"2026-06-24"},"AFC-CSO-ACK":{"id":"AFC-CSO-ACK","family":"AFC","scope":"all","subset":"CSO","name":"Acknowledge Receipt","statement":"Providers SHOULD promptly and automatically acknowledge the receipt of messages received from FedRAMP in their FedRAMP Security Inbox.","force":"SHOULD","updated":"2026-06-24"},"CCM-OCR-AVL":{"id":"CCM-OCR-AVL","family":"CCM","scope":"all","subset":"OCR","name":"Report Availability","statement":"Providers MUST supply an Ongoing Certification Report to all necessary parties every 3 months, covering the entire period since the previous summary, in a consistent format that is human readable; this report MUST include high-level summaries of at least the following information (if applicable):","force":"MUST","following_information":["Changes to FedRAMP Certification Data","Planned changes to FedRAMP Certification Data during at least the next 3 months","Accepted vulnerabilities","Transformative changes","Updated recommendations or best practices for security, configuration, usage, or similar aspects of the cloud service offering","A list of all agencies that are directly using the product","FedRAMP Reportable Incidents or an attestation that no such incidents occurred","Lessons learned and changes planned or made as a result of FedRAMP Reportable Incidents (if such occurred)"],"controls":["ca-7"],"timeframe_type":"months","timeframe_num":3,"artifacts":{"all":["Most recent Ongoing Certification Report. If the report is not available, the provider MUST provide a sample report that includes all required information.","How the report will be delivered"]},"schema":{"name":"FedRAMP Ongoing Certification Report (CCM-OCR-AVL)","url":"https://fedramp.gov/schemas/fedramp-ongoing-certification-report-schema-2026-06-24.json"},"updated":"2026-10-13"},"CCM-OCR-NRD":{"id":"CCM-OCR-NRD","family":"CCM","scope":"all","subset":"OCR","name":"Next Report Date","statement":"Providers MUST supply the target date for their next Ongoing Certification Report with other public FedRAMP Certification Data.","force":"MUST","updated":"2026-06-24"},"CCM-OCR-FBM":{"id":"CCM-OCR-FBM","family":"CCM","scope":"all","subset":"OCR","name":"Feedback Mechanism","statement":"Providers MUST supply an asynchronous mechanism for all necessary parties to provide feedback or ask questions about each Ongoing Certification Report.","force":"MUST","note":"This could be email by default but providers are encouraged to consider something more interactive as appropriate.","artifacts":{"all":["How to access the feedback mechanism."]},"updated":"2026-06-24"},"CCM-OCR-AFS":{"id":"CCM-OCR-AFS","family":"CCM","scope":"all","subset":"OCR","name":"Anonymized Feedback Summary","statement":"Providers MUST supply an anonymized and desensitized summary of the feedback, questions, and answers about each Ongoing Certification Report as an addendum to the Ongoing Certification Report OR in the next Ongoing Certification Report.","force":"MUST","note":"This is intended to encourage sharing of information and decrease the burden on the cloud service provider - providing this summary will reduce duplicate questions from agencies and ensure FedRAMP has access to this information. It is generally in the provider's interest to update this addendum frequently throughout the quarter.","artifacts":{"all":["How the summary will be delivered"]},"updated":"2026-06-24"},"CCM-OCR-LSI":{"id":"CCM-OCR-LSI","family":"CCM","scope":"all","subset":"OCR","name":"Limit Sensitive Information","statement":"Providers MUST NOT irresponsibly disclose sensitive information in an Ongoing Certification Report that would likely have an adverse effect on the cloud service offering.","force":"MUST NOT","updated":"2026-06-24"},"CCM-OCR-SOR":{"id":"CCM-OCR-SOR","family":"CCM","scope":"all","subset":"OCR","name":"Spread Out Reports","statement":"Providers SHOULD establish a regular 3 month cycle for Ongoing Certification Reports that is spread out from the beginning, middle, or end of each quarter.","force":"SHOULD","note":"This recommendation is intended to discourage hundreds of cloud service providers from releasing their Ongoing Certification Reports during the first or last week of each quarter because that is the easiest way for a single provider to track this deliverable; the result would overwhelm agencies with many cloud services. Widely used cloud service providers are encouraged to work with their customers to identify ideal timeframes for this cycle.","updated":"2026-06-24"},"CCM-OCR-RPS":{"id":"CCM-OCR-RPS","family":"CCM","scope":"all","subset":"OCR","name":"Responsible Public Certification Report Sharing","statement":"Providers MAY responsibly supply some or all of the information an Ongoing Certification Report to the public or other parties if the provider determines doing so will NOT likely have an adverse effect on the cloud service offering.","force":"MAY","updated":"2026-06-24"},"CCM-QTR-MTG":{"id":"CCM-QTR-MTG","family":"CCM","scope":"all","subset":"QTR","name":"Quarterly Review Meeting","controls":["ca-7"],"updated":"2026-10-13","byClass":{"a":{"statement":"Providers with Class A Certifications MAY host a synchronous Quarterly Review every 3 months, open to all necessary parties, to review aspects of the most recent Ongoing Certification Reports that the provider determines are of the most relevance to agencies.","force":"MAY","timeframe_type":"months","timeframe_num":3,"artifacts":{"all":["selected ordinal recurrence for the synchronous Quarterly Review cycle if applicable."]}},"b":{"statement":"Providers with Class B Certifications SHOULD host a synchronous Quarterly Review every 3 months, open to all necessary parties, to review aspects of the most recent Ongoing Certification Reports that the provider determines are of the most relevance to agencies.","force":"SHOULD","timeframe_type":"months","timeframe_num":3,"artifacts":{"all":["selected ordinal recurrence for the Ongoing Certification Report cycle if applicable OR explanation for why Ongoing Certification Reports are not being delivered."]}},"c":{"statement":"Providers with Class C Certifications MUST host a synchronous Quarterly Review every 3 months, open to all necessary parties, to review aspects of the most recent Ongoing Certification Reports that the provider determines are of the most relevance to agencies.","force":"MUST","timeframe_type":"months","timeframe_num":3,"artifacts":{"all":["selected ordinal recurrence for the Ongoing Certification Report cycle."]}},"d":{"statement":"Providers with Class D Certifications MUST host a synchronous Quarterly Review every 3 months, open to all necessary parties, to review aspects of the most recent Ongoing Certification Reports that the provider determines are of the most relevance to agencies.","force":"MUST","timeframe_type":"months","timeframe_num":3,"artifacts":{"all":["selected ordinal recurrence for the Ongoing Certification Report cycle."]}}}},"CCM-QTR-REG":{"id":"CCM-QTR-REG","family":"CCM","scope":"all","subset":"QTR","name":"Meeting Registration Info","statement":"Providers MUST supply either a registration link or a downloadable calendar file with meeting information for Quarterly Reviews to all necessary parties.","force":"MUST","artifacts":{"all":["URL to the registration page or calendar file."]},"updated":"2026-06-24"},"CCM-QTR-NRD":{"id":"CCM-QTR-NRD","family":"CCM","scope":"all","subset":"QTR","name":"Next Review Date","statement":"Providers MUST publicly supply the target date for their next Quarterly Review with other public FedRAMP Certification Data.","force":"MUST","updated":"2026-06-24"},"CCM-QTR-NID":{"id":"CCM-QTR-NID","family":"CCM","scope":"all","subset":"QTR","name":"No Irresponsible Disclosure","statement":"Providers MUST NOT irresponsibly disclose sensitive information in a Quarterly Review that would likely have an adverse effect on the cloud service offering.","force":"MUST NOT","updated":"2026-06-24"},"CCM-QTR-SAR":{"id":"CCM-QTR-SAR","family":"CCM","scope":"all","subset":"QTR","name":"Schedule Around Reports","statement":"Providers SHOULD regularly schedule Quarterly Reviews to occur at least 3 business days after releasing an Ongoing Certification Report AND within 10 business days of such release.","force":"SHOULD","timeframe_type":"bizdays","updated":"2026-06-24"},"CCM-QTR-ACT":{"id":"CCM-QTR-ACT","family":"CCM","scope":"all","subset":"QTR","name":"Additional Content","statement":"Providers SHOULD supply additional information in Quarterly Reviews that the provider determines is of interest, use, or otherwise relevant to agencies.","force":"SHOULD","controls":["ca-7"],"updated":"2026-10-13"},"CCM-QTR-RTR":{"id":"CCM-QTR-RTR","family":"CCM","scope":"all","subset":"QTR","name":"Record/Transcribe Reviews","statement":"Providers SHOULD record or transcribe Quarterly Reviews and supply them to all necessary parties.","force":"SHOULD","updated":"2026-06-24"},"CCM-QTR-RTP":{"id":"CCM-QTR-RTP","family":"CCM","scope":"all","subset":"QTR","name":"Restrict Third Parties","statement":"Providers SHOULD NOT invite third parties to attend Quarterly Reviews intended for agencies unless they have specific relevance.","force":"SHOULD NOT","note":"This is because agencies are less likely to actively participate in meetings with third parties; the cloud service provider's independent assessor should be considered relevant by default.","updated":"2026-06-24"},"CCM-QTR-SRR":{"id":"CCM-QTR-SRR","family":"CCM","scope":"all","subset":"QTR","name":"Share Recordings Responsibly","statement":"Providers MAY responsibly supply recordings or transcriptions of Quarterly Reviews to the public or other parties ONLY if the provider removes all agency information (comments, questions, names, etc.) AND determines doing so will NOT likely have an adverse effect on the cloud service offering.","force":"MAY","updated":"2026-06-24"},"CCM-QTR-SCR":{"id":"CCM-QTR-SCR","family":"CCM","scope":"all","subset":"QTR","name":"Share Content Responsibly","statement":"Providers MAY responsibly supply content prepared for a Quarterly Review to the public or other parties if the provider determines doing so will NOT likely have an adverse effect on the cloud service offering.","force":"MAY","updated":"2026-06-24"},"CDS-CSO-PUB":{"id":"CDS-CSO-PUB","family":"CDS","scope":"all","subset":"CSO","name":"Public Information","statement":"Providers MUST publicly share up-to-date information about the cloud service offering in both human-readable and JSON formats, including at least the following information that is available and applicable:","force":"MUST","notes":["Generally, this information should be available on a public webpage or publicly shared in a FedRAMP-compatible trust center.","The JSON data for this rule will be consumed by FedRAMP and agency GRC tools using automation with web-based tools. Do not expect FedRAMP or your customers to download this data directly, it should be accessible for common web frameworks. FedRAMP strongly recommends that application engineering experts be involved in making public JSON data and the related information available in a way that can work with web-based applications."],"following_information":["FedRAMP ID","Service Model","Deployment Model","Business Category","UEI Number","Sales Contact Information","Security Contact Information","Product Website Link","Link to Product Logo (must be a valid image link, properly named, that will display in a browser without processing - transparent PNG preferred)","Overall Service Description","Detailed list of specific services and their security categories (see CDS-CSO-SVC (Public Service List) (Service List))","Link to Secure Configuration Guidance","Overview of documentation supplied by the provider for the cloud service offering","Link to Trust Center landing page that includes instructions on accessing information in the trust center","Next Ongoing Certification Report date (see CCM-OCR-NRD (Next Report Date))","Current FedRAMP Recognized independent assessment service"],"related":["CDS-CSO-SVC","CCM-OCR-NRD"],"artifacts":{"all":["URL to the human-readable data.","URL to the machine-readable data."]},"schema":{"name":"FedRAMP Certification Package Overview (FRC-CSO-PKG)","url":"https://fedramp.gov/schemas/fedramp-certification-package-overview-schema-2026-06-24.json"},"updated":"2026-10-05"},"CDS-CSO-SVC":{"id":"CDS-CSO-SVC","family":"CDS","scope":"all","subset":"CSO","name":"Public Service List","statement":"Providers MUST publicly share a detailed list of specific services and their security categories that are included in the cloud service offering using clear feature or service names that align with standard public marketing materials; this list MUST be complete enough for a potential customer to determine which services are and are not included in the FedRAMP Minimum Assessment Scope without requesting access to underlying FedRAMP Certification Data.","force":"MUST","artifacts":{"all":["URL to the human-readable data.","URL to the machine-readable data (if applicable)."]},"schema":{"name":"FedRAMP Certification Package Overview (FRC-CSO-PKG)","url":"https://fedramp.gov/schemas/fedramp-certification-package-overview-schema-2026-06-24.json"},"updated":"2026-06-24"},"CDS-CSO-FID":{"id":"CDS-CSO-FID","family":"CDS","scope":"all","subset":"CSO","name":"Always Include FedRAMP ID","statement":"Providers MUST always include the FedRAMP ID of the related cloud service offering in all FedRAMP Certification Data once assigned, including all reports, notifications, and other communication that results from FedRAMP rules.","force":"MUST","notes":["The FedRAMP ID is supplied by FedRAMP after a cloud service offering is registered to be listed on the FedRAMP Marketplace - providers will need to use a placeholder until the FedRAMP ID is assigned.","Many providers have multiple cloud service offerings or use internal names that don't align to public materials; using the FedRAMP ID ensures we can easily align the communication with a specific cloud service offering."],"updated":"2026-06-24"},"CDS-CSO-FRC":{"id":"CDS-CSO-FRC","family":"CDS","scope":"all","subset":"CSO","name":"FedRAMP Certification Reports","statement":"Providers MUST include FedRAMP Certification Reports with their FedRAMP Certification Data without inappropriate modifications, and make such reports available within 2 weeks of receiving the materials from FedRAMP.","force":"MUST","note":"FedRAMP provides Certification Reports for all cloud service offerings following the Program Certification path as part of the initial and ongoing FedRAMP Certification process, and may provide Certification Reports for cloud service offerings following the Agency Certification path.","timeframe_type":"weeks","timeframe_num":2,"updated":"2026-06-24"},"CDS-CSO-AVR":{"id":"CDS-CSO-AVR","family":"CDS","scope":"all","subset":"CSO","name":"Availability Reporting","updated":"2026-06-24","byClass":{"a":{"statement":"Providers with Class A Certifications SHOULD maintain a web service, available to all necessary parties, that indicates current and historical availability of core services within the cloud service offering over at least the past 30 days, including availability incidents, in both human-readable and machine-readable formats; this service SHOULD be available even if the primary cloud service offering is unavailable.","force":"SHOULD"},"b":{"statement":"Providers with Class B Certifications MUST maintain a web service, available to all necessary parties, that indicates current and historical availability of core services within the cloud service offering over at least the past 30 days, including availability incidents, in both human-readable and machine-readable formats; this service MUST be available even if the primary cloud service offering is unavailable.","force":"MUST"},"c":{"statement":"Providers with Class C Certifications MUST maintain a web service, available to all necessary parties, that indicates current and historical availability of core services within the cloud service offering over at least the past 30 days, including availability incidents, in both human-readable and machine-readable formats; this service MUST be available even if the primary cloud service offering is unavailable.","force":"MUST"},"d":{"statement":"Providers with Class D Certifications MUST maintain a web service, available to all necessary parties, that indicates current and historical availability of core services within the cloud service offering over at least the past 30 days, including availability incidents, in both human-readable and machine-readable formats; this service MUST be available even if the primary cloud service offering is unavailable.","force":"MUST"}}},"CDS-CSO-UTC":{"id":"CDS-CSO-UTC","family":"CDS","scope":"all","subset":"CSO","name":"Use Trust Centers","statement":"Providers MUST use a FedRAMP-compatible trust center to store and share FedRAMP Certification Data with all necessary parties.","force":"MUST","note":"Rules for FedRAMP-Compatible Trust Centers are explained in the Certification Data Sharing Rules under the FedRAMP-Compatible Trust Centers section (id: CDS-TRC).","schema":{"name":"FedRAMP Certification Package Overview (FRC-CSO-PKG)","url":"https://fedramp.gov/schemas/fedramp-certification-package-overview-schema-2026-06-24.json"},"updated":"2026-06-24"},"CDS-CSO-CBF":{"id":"CDS-CSO-CBF","family":"CDS","scope":"all","subset":"CSO","name":"Consistency Between Formats","statement":"Providers MUST use automation to ensure information remains consistent between human-readable and machine-readable formats when FedRAMP Certification Data is provided in both formats.","force":"MUST","updated":"2026-06-24"},"CDS-CSO-RIS":{"id":"CDS-CSO-RIS","family":"CDS","scope":"all","subset":"CSO","name":"Responsible Information Sharing","statement":"Providers MUST provide sufficient information in FedRAMP Certification Data to support agency authorization decisions but SHOULD NOT include sensitive information that would likely enable a threat actor to gain unauthorized access, cause harm, disrupt operations, or otherwise have a negative adverse impact on the cloud service offering.","force":"MUST","note":"This is not a license to exclude accurate risk information, but specifics that would likely lead to compromise should be abstracted. A breach of confidentiality with FedRAMP Certification Data should be anticipated by a secure cloud service provider.","updated":"2026-06-24"},"CDS-CSO-IRP":{"id":"CDS-CSO-IRP","family":"CDS","scope":"all","subset":"CSO","name":"Include Relevant Policies","statement":"Providers MUST supply all relevant policies and procedures in the FedRAMP Certification Data, including a human-readable and machine-readable reference that explains at least the following about each included policy and procedure:","force":"MUST","following_information":["Name of policy or procedure","Name of file, document, web page, etc.","Brief summary of policy or procedure","Word count of document","Current version","Date of last update","Related FedRAMP Practices (if applicable)"],"artifacts":{"all":["Explanation of how to access this information."]},"updated":"2026-06-24"},"CDS-CSO-HAD":{"id":"CDS-CSO-HAD","family":"CDS","scope":"all","subset":"CSO","name":"Historical FedRAMP Certification Data","statement":"Providers MUST supply snapshots of FedRAMP Certification Data aligned to Ongoing Certification Reports to all necessary parties; these snapshots MUST be available for the duration of FedRAMP Certification.","force":"MUST","note":"Historical snapshots do not need to be reconstructed for periods before the provider's first Ongoing Certification Report, but should be maintained for all subsequent Ongoing Certification Reports.","artifacts":{"all":["Explanation of how to access this information."]},"updated":"2026-06-24"},"CDS-CSO-PSM":{"id":"CDS-CSO-PSM","family":"CDS","scope":"all","subset":"CSO","name":"Per-Service Certification Materials","notes":["Providers determine what they consider to be separate services, based on maximizing the customer experience for agencies who may only adopt some services and not others.","Providers are encouraged to provide a single comprehensive set of materials for all shared aspects of the service offering and only provide separate materials for unique aspects of each service to minimize the burden on providers and agencies."],"updated":"2026-06-24","byClass":{"a":{"statement":"Providers with Class A Certifications MAY supply per-service FedRAMP Certification materials.","force":"MAY","artifacts":{"all":["Explanation of the supplied materials, including how to access and use them."]}},"b":{"statement":"Providers with Class B Certifications MAY supply per-service FedRAMP Certification materials.","force":"MAY","artifacts":{"all":["Explanation of the supplied materials, including how to access and use them."]}},"c":{"statement":"Providers with Class C Certifications MAY supply per-service FedRAMP Certification materials.","force":"MAY","artifacts":{"all":["Explanation of the supplied materials, including how to access and use them."]}},"d":{"statement":"Providers with Class D Certifications MUST supply per-service FedRAMP Certification materials.","force":"MUST","artifacts":{"all":["Explanation of the supplied materials, including how to access and use them."]}}}},"CDS-CSO-RPS":{"id":"CDS-CSO-RPS","family":"CDS","scope":"all","subset":"CSO","name":"Responsible Public Package Sharing","statement":"Providers MAY responsibly share some or all of the information in a FedRAMP Certification Package publicly or with other parties if the provider determines doing so will NOT likely have an adverse effect on the cloud service offering.","force":"MAY","artifacts":{"all":["Explanation of if and how this information is shared with other parties."]},"updated":"2026-06-24"},"CDS-TRC-USH":{"id":"CDS-TRC-USH","family":"CDS","scope":"all","subset":"TRC","name":"Uninterrupted Sharing","statement":"Trust centers MUST share FedRAMP Certification Data with all necessary parties without interruption.","force":"MUST","note":"\"Without interruption\" means that parties should not have to request manual approval each time they need to access FedRAMP Certification Data or go through a complicated process. The preferred way of ensuring access without interruption is to use on-demand just-in-time access provisioning.","updated":"2026-06-24"},"CDS-TRC-PAC":{"id":"CDS-TRC-PAC","family":"CDS","scope":"all","subset":"TRC","name":"Programmatic Access","statement":"Trust centers MUST provide documented programmatic access to all FedRAMP Certification Data, including programmatic access to human-readable materials.","force":"MUST","artifacts":{"all":["URL to the documentation for programmatic access."]},"updated":"2026-06-24"},"CDS-TRC-AAI":{"id":"CDS-TRC-AAI","family":"CDS","scope":"all","subset":"TRC","name":"Agency Access Inventory","statement":"Trust centers MUST maintain an inventory and history of federal agency users or systems with access to FedRAMP Certification Data and MUST make this information available to FedRAMP upon request.","force":"MUST","artifacts":{"all":["Explanation of how FedRAMP can obtain this information."]},"updated":"2026-06-24"},"CDS-TRC-ACL":{"id":"CDS-TRC-ACL","family":"CDS","scope":"all","subset":"TRC","name":"Access Logging","statement":"Trust centers MUST log access to FedRAMP Certification Data and store summaries of access for at least six months; such information, as it pertains to specific parties, SHOULD be made available upon request by those parties.","force":"MUST","artifacts":{"all":["Explanation of how the appropriate parties can obtain this log information."]},"updated":"2026-06-24"},"CDS-TRC-HMR":{"id":"CDS-TRC-HMR","family":"CDS","scope":"all","subset":"TRC","name":"Human and Machine-Readable Certification Data","statement":"Trust centers SHOULD make FedRAMP Certification Data available to view and download in both human-readable and machine-readable formats.","force":"SHOULD","updated":"2026-06-24"},"CDS-TRC-SSM":{"id":"CDS-TRC-SSM","family":"CDS","scope":"all","subset":"TRC","name":"Self-Service Access Management","statement":"Trust centers SHOULD include features that encourage all necessary parties to provision and manage access to FedRAMP Certification Data for their users and services directly.","force":"SHOULD","artifacts":{"all":["URL or explanation how to access documentation of these features and capabilities."]},"updated":"2026-06-24"},"CDS-UTC-AAD":{"id":"CDS-UTC-AAD","family":"CDS","scope":"all","subset":"UTC","name":"Agency Access Denial","statement":"Providers MUST notify FedRAMP within 5 business days of denying an agency access request for FedRAMP Certification Data.","force":"MUST","timeframe_type":"bizdays","timeframe_num":5,"updated":"2026-06-24"},"CDS-UTC-AGA":{"id":"CDS-UTC-AGA","family":"CDS","scope":"all","subset":"UTC","name":"Agency Access","statement":"Providers SHOULD supply access to the FedRAMP Certification Package with agencies upon request.","force":"SHOULD","artifacts":{"all":["URL or explanation of how to request these materials.","Explanation of how the provider decides whether or not to share these materials or other related policies."]},"updated":"2026-06-24"},"CMU-CSO-CMD":{"id":"CMU-CSO-CMD","family":"CMU","scope":"all","subset":"CSO","name":"Cryptographic Module Documentation","statement":"Providers MUST document the cryptographic modules used in each service (or groups of services that use the same modules) where cryptographic services are used to protect federal customer data, including whether these modules are validated under the NIST Cryptographic Module Validation Program or are update streams of such modules.","force":"MUST","controls":["au-9.3","cm-3.6","ia-7","sc-28.1","sc-8.1"],"artifacts":{"all":["List of cryptographic modules including whether these modules are validated under the NIST Cryptographic Module Validation Program or are update streams of such modules."]},"updated":"2026-10-13"},"CMU-CSO-UVM":{"id":"CMU-CSO-UVM","family":"CMU","scope":"all","subset":"CSO","name":"Using Validated Cryptographic Modules","note":"Cryptographic modules include specific algorithms by definition; if an update stream of a cryptographic module adds new algorithms that were not previously validated then those algorithms can not be considered within the scope of update stream usage under these rules as they are new algorithms within the module that have never been validated.","controls":["ac-18","au-9.3","ia-7","sc-28.1","sc-8.1"],"updated":"2026-10-13","byClass":{"a":{"statement":"Providers with Class A Certifications MAY use cryptographic modules or update streams of cryptographic modules with active validations under the NIST Cryptographic Module Validation Program when using cryptographic services to protect federal customer data.","force":"MAY","artifacts":{"all":["List of cryptographic modules including whether these modules are validated under the NIST Cryptographic Module Validation Program or are update streams of such modules."]}},"b":{"statement":"Providers with Class B Certifications MAY use cryptographic modules or update streams of cryptographic modules with active validations under the NIST Cryptographic Module Validation Program when using cryptographic services to protect federal customer data.","force":"MAY","artifacts":{"all":["List of cryptographic modules including whether these modules are validated under the NIST Cryptographic Module Validation Program or are update streams of such modules."]}},"c":{"statement":"Providers with Class C Certifications SHOULD use cryptographic modules or update streams of cryptographic modules with active validations under the NIST Cryptographic Module Validation Program when using cryptographic services to protect federal customer data.","force":"SHOULD","artifacts":{"all":["List of cryptographic modules including whether these modules are validated under the NIST Cryptographic Module Validation Program or are update streams of such modules."]}},"d":{"statement":"Providers with Class D Certifications MUST use cryptographic modules or update streams of cryptographic modules with active validations under the NIST Cryptographic Module Validation Program when using cryptographic services to protect federal customer data.","force":"MUST","artifacts":{"all":["List of cryptographic modules including whether these modules are validated under the NIST Cryptographic Module Validation Program or are update streams of such modules."]}}}},"CMU-CSO-CAT":{"id":"CMU-CSO-CAT","family":"CMU","scope":"all","subset":"CSO","name":"Configuration of Agency Tenants","statement":"Providers SHOULD configure agency tenants by default to use cryptographic services that use cryptographic modules or update streams of cryptographic modules with active validations under the NIST Cryptographic Module Validation Program when such modules are available.","force":"SHOULD","artifacts":{"all":["List of cryptographic modules used by default including whether these modules are validated under the NIST Cryptographic Module Validation Program or are update streams of such modules."]},"updated":"2026-06-24"},"CPO-CSO-OVR":{"id":"CPO-CSO-OVR","family":"CPO","scope":"all","subset":"CSO","name":"Overview of the Cloud Service Offering","statement":"Providers MUST supply a Certification Package Overview within their FedRAMP Certification Package, in both human-readable and JSON formats, that includes at least all of the information required by the following rules:","force":"MUST","notes":["For FedRAMP Rev5, the Certification Package Overview replaces the historically required System Security Plan (not including appendices).","This list of rules may not apply to all FedRAMP Certification Classes or Types - if a rule does not apply then the information is not required."],"following_information":["Certification Package Overview: CPO-CSO-MTD (Certification Package Overview Metadata)","Certification Data Sharing: CDS-CSO-PUB (Public Information)","Certification Data Sharing: CDS-CSO-SVC (Public Service List)","Certification Data Sharing: CDS-CSO-IRP (Include Relevant Policies)","Minimum Assessment Scope: MAS-CSO-IIR (Identify Information Resources)","Minimum Assessment Scope: MAS-CSO-FLO (Information Flows and Security Categories)","Minimum Assessment Scope: MAS-CSO-TPR (Third-Party Information Resources)","Using Cryptographic Modules: CMU-CSO-CMD (Cryptographic Module Documentation)","Independent Verification and Validation: IVV-CSO-ICP (Inclusion in Certification Package)"],"related":["CPO-CSO-MTD","CDS-CSO-PUB","CDS-CSO-SVC","MAS-CSO-IIR","MAS-CSO-FLO","MAS-CSO-TPR","CMU-CSO-CMD","CDS-CSO-IRP","IVV-CSO-ICP"],"schema":{"name":"FedRAMP Certification Package Overview Schema","url":"https://fedramp.gov/schemas/fedramp-certification-package-overview-schema-2026-06-24.json"},"updated":"2026-06-24"},"CPO-CSO-MTD":{"id":"CPO-CSO-MTD","family":"CPO","scope":"all","subset":"CSO","name":"Certification Package Overview Metadata","statement":"Providers MUST also include the following basic metadata in their Certification Package Overview:","force":"MUST","following_information":["Name, title, and contact information of official that is responsible and accountable for the FedRAMP Certification Package","Version","Date and time of last update","Source of update"],"updated":"2026-06-24"},"CPO-CSO-OSA":{"id":"CPO-CSO-OSA","family":"CPO","scope":"all","subset":"CSO","name":"Overall Summary of Assessment in Certification Package","related":["IVV-IAS-OSA"],"controls":["ca-2","ca-2.1","ca-2.2","ca-7.1"],"updated":"2026-10-13","byClass":{"a":{"statement":"Providers seeking Class A Certification MAY also include an overall summary of their FedRAMP independent assessment in their Certification Package Overview.","force":"MAY"},"b":{"statement":"Providers seeking Class B Certification MUST also include the overall summary of their FedRAMP independent assessment, supplied by the assessor per IVV-IAS-OSA (Overall Summary of Assessment), in their Certification Package Overview.","force":"MUST"},"c":{"statement":"Providers seeking Class C Certification MUST also include the overall summary of their FedRAMP independent assessment, supplied by the assessor per IVV-IAS-OSA (Overall Summary of Assessment), in their Certification Package Overview.","force":"MUST"},"d":{"statement":"Providers seeking Class D Certification MUST also include the overall summary of their FedRAMP independent assessment, supplied by the assessor per IVV-IAS-OSA (Overall Summary of Assessment), in their Certification Package Overview.","force":"MUST"}}},"CPO-CSX-CPM":{"id":"CPO-CSX-CPM","family":"CPO","scope":"20x","subset":"CSX","name":"Certification Package Maintenance for 20x","notes":["Providers are expected to maintain their FedRAMP Certification Package using automation as changes occur to ensure they are never out of date.","This rule does not require or expect persistent human review of all materials in this cadence."],"updated":"2026-06-24","byClass":{"a":{"statement":"Providers with 20x Class A Certifications SHOULD persistently maintain their FedRAMP Certification Package to ensure it is up to date and complete at least once every 3 months.","force":"SHOULD","timeframe_type":"months","timeframe_num":3},"b":{"statement":"Providers with 20x Class B Certifications MUST persistently maintain their FedRAMP Certification Package to ensure it is up to date and complete at least once every month.","force":"MUST","timeframe_type":"months","timeframe_num":1},"c":{"statement":"Providers with 20x Class C Certifications MUST persistently maintain their FedRAMP Certification Package to ensure it is up to date and complete at least once every 2 weeks.","force":"MUST","timeframe_type":"weeks","timeframe_num":2},"d":{"statement":"Providers with 20x Class D Certifications MUST persistently maintain their FedRAMP Certification Package to ensure it is up to date and complete at least once every week.","force":"MUST","timeframe_type":"weeks","timeframe_num":1}}},"FRC-CSO-FCP":{"id":"FRC-CSO-FCP","family":"FRC","scope":"all","subset":"CSO","name":"FedRAMP Certification Profile","statement":"Providers MUST identify a target FedRAMP Certification Profile and apply all relevant FedRAMP Practices to the cloud service offering.","force":"MUST","note":"Information resources (including third-party information resources) MAY vary by security category as appropriate to the type of information handled by or impacted by the information resource.","updated":"2026-06-24"},"FRC-CSO-PKG":{"id":"FRC-CSO-PKG","family":"FRC","scope":"all","subset":"CSO","name":"FedRAMP Certification Package","statement":"Providers seeking a Certification MUST supply a complete FedRAMP Certification Package to FedRAMP for initial certification; the FedRAMP Certification Package MUST include at least the following information:","force":"MUST","following_information":["Information about the Cloud Service Offering following CPO-CSO-OVR (Overview of the Cloud Service Offering)","Implementation, Validation, and Assessment information for each relevant FedRAMP requirement/control/ksi as defined in SDR-CSO-FRR (FedRAMP Rules)","A real or example Ongoing Certification Report following CCM-OCR-AVL (Report Availability)"],"related":["CPO-CSO-OVR","SDR-CSO-FRR","CCM-OCR-AVL"],"schema":{"name":"FedRAMP Certification Package Overview (FRC-CSO-PKG)","url":"https://fedramp.gov/schemas/fedramp-certification-package-overview-schema-2026-06-24.json"},"updated":"2026-06-25"},"FRC-CSO-JSN":{"id":"FRC-CSO-JSN","family":"FRC","scope":"all","subset":"CSO","name":"FedRAMP JSON Schemas","statement":"Providers MUST supply machine-readable information in JSON documents that are valid against the corresponding JSON schema when a rule contains a FedRAMP JSON schema, UNLESS otherwise specified in the rule; public JSON data MUST be supplied in a manner compatible with modern web frameworks, including:","force":"MUST","notes":["FedRAMP JSON schemas are designed to be lightweight and flexible to establish a minimum set of structured information while allowing providers to improve on the format and structure of the information as needed to meet their needs and the needs of their customers.","Public JSON data is intended to be consumed by FedRAMP, agency GRC tools, and more - it should be available in a way that enables standard web-application use following standard web frameworks. Generally, if you can't write a web app to parse this data without configuring a browser to bypass security defaults then there has likely been a problem.","The Schema Validator available at fedramp.gov will not work properly if Cross-Origin Resource Sharing is not properly configured."],"following_information":["Cross-Origin Resource Sharing (CORS) should allow web applications running on a different domain to access the public JSON data directly.","Proper web application headers should be supplied for public JSON data, including at least setting Content-Type to application/json and X-Content-Type-Options: nosniff."],"updated":"2026-10-05"},"FRC-CSO-MRA":{"id":"FRC-CSO-MRA","family":"FRC","scope":"all","subset":"CSO","name":"Maintain Responsibility and Accountability","statement":"Providers MUST maintain responsibility and accountability for the accuracy and completeness of all information in the FedRAMP Certification Package, especially when they engage a third party (such as an independent assessor, advisory service, or external tools) to supply information on their behalf.","force":"MUST","updated":"2026-06-24"},"FRC-CSO-POP":{"id":"FRC-CSO-POP","family":"FRC","scope":"all","subset":"CSO","name":"Pick One Program Certification Type","statement":"Providers MUST NOT seek both FedRAMP Rev5 Program Certification and FedRAMP 20x Program Certification for the same cloud service offering; pick one type.","force":"MUST NOT","note":"This rule does not prevent a provider from seeking and maintaining a FedRAMP Rev5 Agency Certification and a FedRAMP 20x Program Certification for the same cloud service offering, however, doing so is strongly discouraged due to the increased complexity and risk of confusion for all parties.","updated":"2026-06-24"},"FRC-CLA-ASF":{"id":"FRC-CLA-ASF","family":"FRC","scope":"all","subset":"CLA","name":"Approved Alternative Security Frameworks","statement":"Providers seeking a FedRAMP Class A Certification MUST have completed a certification or equivalent process, including an independent assessment if applicable, from one of the following alternative security frameworks within the past 12 months:","force":"MUST","following_information":["FedRAMP Rev5 (including FedRAMP Ready) at any historical Impact Level","SOC 2 Type II","GovRAMP at any Impact Level"],"updated":"2026-06-24"},"FRC-CLA-EAM":{"id":"FRC-CLA-EAM","family":"FRC","scope":"all","subset":"CLA","name":"External Assessment Materials","statement":"Providers seeking a FedRAMP Class A Certification MUST supply the following materials from their alternative security framework assessment to all necessary parties:","force":"MUST","following_information":["SOC 2 Type II: Complete report, bridge or gap letter (if applicable), verified audit engagement documentation, estimated schedule for upcoming report, supplemental compliance evidence (if applicable)","FedRAMP Ready: Readiness Assessment Report, Security Assessment Plan, and any other materials required by FedRAMP.","GovRAMP: Readiness Assessment Report, Security Assessment Plan, and any other materials required by GovRAMP."],"updated":"2026-06-24"},"FRC-CLA-MFR":{"id":"FRC-CLA-MFR","family":"FRC","scope":"all","subset":"CLA","name":"Mandatory FedRAMP Rules for Class A","statement":"Providers seeking a Class A FedRAMP Certification MUST address all rules in this FedRAMP Class A Certification subset (FRC-CLA) AND the following additional FedRAMP Class A rules; the appropriate artifacts or information mapping for all rules MUST be supplied in the FedRAMP Certification Package.","force":"MUST","notes":["Some of these specific FedRAMP rules may not have similar counterparts in external frameworks and providers will need to implement new processes to follow these rules.","In general, for each of these FedRAMP requirements, providers should include a sufficiently detailed summary that reviewers will not need to dig into the related security framework materials to understand the related decisions - just saying \"see SOC 2 report\" is not particularly helpful.","Information about how the provider addresses the included Key Security Indicators are required to receive a class A certification even if the provider intends to pursue a Rev 5 Program Certification path in the future."],"following_information":["FedRAMP Certification: FRC-CSO-PKG (FedRAMP Certification Package)","FedRAMP Certification: FRC-CSO-JSN (FedRAMP JSON Schemas)","FedRAMP Certification: FRC-CSO-POP (Pick One Program Certification Type)","Minimum Assessment Scope: MAS-CSO-IIR (Identify Information Resources)","Certification Data Sharing: CDS-CSO-PUB (Public Information)","Certification Data Sharing: CDS-CSO-UTC (Use Trust Centers)","Certification Data Sharing: CDS-UTC-AAD (Agency Access Denial)","Addressing FedRAMP Communication: AFC-CSO-INB (Maintain a FedRAMP Security Inbox)","Addressing FedRAMP Communication: AFC-CSO-RCV (Receive Email Without Disruption)","Addressing FedRAMP Communication: AFC-CSO-CRA (Complete Required Actions)","Incident Evaluation and Communication: IEC-CSO-EFR (Evaluate FedRAMP Reportability)","Incident Evaluation and Communication: IEC-CSO-FIR (Final Incident Report)","Vulnerability Detection and Response: VDR-CSO-DET (Vulnerability Detection)","Collaborative Continuous Monitoring: CCM-OCR-AVL (Report Availability)","Collaborative Continuous Monitoring: CCM-OCR-NRD (Next Report Date)","Independent Verification and Validation: IVV-CSX-AIA (Annual Independent Assessments for 20x)","Key Security Indicators: KSI-CMT-LMC (Logging Changes)","Key Security Indicators: KSI-CNA-RNT (Restricting Network Traffic)","Key Security Indicators: KSI-CED-RAT (Reviewing All Training)","Key Security Indicators: KSI-IAM-AAM (Automating Account Management)","Key Security Indicators: KSI-IAM-APM (Adopting Passwordless Methods)","Key Security Indicators: KSI-INR-RIR (Reviewing Incident Response Procedures)","Key Security Indicators: KSI-SVC-SIN (Securing Information)"],"related":["FRC-CSO-POP","MAS-CSO-IIR","CDS-CSO-PUB","CDS-CSO-UTC","CDS-UTC-AAD","AFC-CSO-INB","AFC-CSO-RCV","AFC-CSO-CRA","IEC-CSO-EFR","IEC-CSO-FIR","VDR-CSO-DET","CCM-OCR-AVL","CCM-OCR-NRD","IVV-CSX-AIA","FRC-CSO-PKG","FRC-CSO-JSN","KSI-CMT-LMC","KSI-CNA-RNT","KSI-CED-RAT","KSI-IAM-AAM","KSI-INR-RIR","KSI-SVC-SIN","KSI-IAM-APM"],"updated":"2026-07-14"},"FRC-CLA-RFR":{"id":"FRC-CLA-RFR","family":"FRC","scope":"all","subset":"CLA","name":"Recommended FedRAMP Rules for Class A","statement":"Providers seeking a Class A FedRAMP Certification SHOULD address the following additional recommended FedRAMP Class A rules (if applicable):","force":"SHOULD","following_information":["Certification Data Sharing: CDS-CSO-AVR (Availability Reporting)","Certification Package Overview: CPO-CSF-CPM (Certification Package Maintenance for Rev5)","Certification Package Overview: CPO-CSX-CPM (Certification Package Maintenance for 20x)","Incident Evaluation and Communication: IEC-CSO-IIR (Initial Incident Report)","Incident Evaluation and Communication: IEC-CSO-OIR (Ongoing Incident Reports)","Vulnerability Detection and Response: VDR-TFR-MVX (Persistent Machine Verification and Validation for 20x)","Vulnerability Detection and Response: VDR-TFR-PCD (Persistently Complete Detection)","Vulnerability Detection and Response: VDR-TFR-PDD (Persistent Drift Detection)","Vulnerability Detection and Response: VDR-TFR-PSD (Persistent Sample Detection)","Vulnerability Detection and Response: VDR-TFR-PVR (Mitigation and Remediation Expectations)","Vulnerability Evaluation and Reporting: VER-TFR-EVU (Evaluate Vulnerabilities Quickly)"],"related":["CDS-CSO-AVR","CPO-CSF-CPM","CPO-CSX-CPM","IEC-CSO-IIR","IEC-CSO-OIR","VDR-TFR-MVX","VDR-TFR-PCD","VDR-TFR-PDD","VDR-TFR-PSD","VDR-TFR-PVR","VER-TFR-EVU"],"updated":"2026-06-24"},"FRC-CLA-OFR":{"id":"FRC-CLA-OFR","family":"FRC","scope":"all","subset":"CLA","name":"Address Optional FedRAMP Rules for Class A","statement":"Providers seeking a Class A FedRAMP Certification MAY address the following additional optional FedRAMP Class A rules (if applicable):","force":"MAY","following_information":["Collaborative Continuous Monitoring: CCM-QTR-MTG (Quarterly Review Meeting)","Certification Data Sharing: CDS-CSO-PSM (Per-Service Certification Materials)","Cryptographic Module Use: CMU-CSO-UVM (Using Validated Cryptographic Modules)","FedRAMP Certification: FRC-APP-FIA (Fresh Independent Assessment)","Independent Verification and Validation: IVV-CSO-FIA (FedRAMP Independent Assessments)","Security Decision Record: SDR-CSX-KMT (Key Security Indicator Metrics)","Vulnerability Evaluation and Reporting: VER-TFR-IRI (Internet-Reachable Incidents)","Vulnerability Evaluation and Reporting: VER-TFR-MRH (Historical Activity)","Vulnerability Evaluation and Reporting: VER-TFR-NRI (Non-Internet-Reachable Incidents)"],"related":["CCM-QTR-MTG","CDS-CSO-PSM","CMU-CSO-UVM","FRC-APP-FIA","IVV-CSO-FIA","SDR-CSX-KMT","VER-TFR-IRI","VER-TFR-MRH","VER-TFR-NRI"],"updated":"2026-06-24"},"FRC-CLA-IVV":{"id":"FRC-CLA-IVV","family":"FRC","scope":"all","subset":"CLA","name":"Optional Independent Verification and Validation","statement":"Providers seeking a FedRAMP Class A Certification MAY have the FedRAMP Certification Package independently verified and validated by a FedRAMP Recognized assessor before submission to FedRAMP.","force":"MAY","updated":"2026-06-24"},"FRC-APP-MLF":{"id":"FRC-APP-MLF","family":"FRC","scope":"all","subset":"APP","name":"Marketplace Listing First","statement":"Providers MUST be listed in the FedRAMP Marketplace before applying for FedRAMP Certification, including:","force":"MUST","following_information":["FedRAMP Marketplace: MKT-CSO-MLR (Marketplace Listing Requirements),","FedRAMP Marketplace: MKT-CSO-PML (Provider Marketplace Listing Requests)","FedRAMP Marketplace: MKT-IIP-AGU (Agency Use Cases)","FedRAMP Marketplace: MKT-IIP-DCP (Demonstrating Continuous Progress)"],"related":["MKT-CSO-MLR","MKT-CSO-PML","MKT-IIP-AGU","MKT-IIP-DCP"],"updated":"2026-06-24"},"FRC-APP-AFC":{"id":"FRC-APP-AFC","family":"FRC","scope":"all","subset":"APP","name":"Applying for FedRAMP Certification","statement":"Providers MUST complete the FedRAMP Certification Application Form in full to request an initial assessment by FedRAMP.","force":"MUST","updated":"2026-06-24"},"FRC-APP-FCP":{"id":"FRC-APP-FCP","family":"FRC","scope":"all","subset":"APP","name":"Fresh FedRAMP Certification Package","statement":"Providers MUST supply a fresh initial FedRAMP Certification Package that shows the current status of the cloud service offering as verified and validated by the provider within the previous 7 days.","force":"MUST","updated":"2026-06-24"},"FRC-APP-FIA":{"id":"FRC-APP-FIA","family":"FRC","scope":"all","subset":"APP","name":"Fresh Independent Assessment","updated":"2026-06-24","byClass":{"a":{"statement":"Providers seeking Class A Certification MAY supply a fresh initial FedRAMP independent assessment that was completed by a FedRAMP Recognized independent assessment service within the previous 3 months.","force":"MAY","timeframe_type":"months","timeframe_num":3},"b":{"statement":"Providers seeking Class B Certification MUST supply a fresh initial FedRAMP independent assessment that was completed by a FedRAMP Recognized independent assessment service within the previous 3 months.","force":"MUST","timeframe_type":"months","timeframe_num":3},"c":{"statement":"Providers seeking Class C Certification MUST supply a fresh initial FedRAMP independent assessment that was completed by a FedRAMP Recognized independent assessment service within the previous 3 months.","force":"MUST","timeframe_type":"months","timeframe_num":3},"d":{"statement":"Providers seeking Class D Certification MUST supply a fresh initial FedRAMP independent assessment that was completed by a FedRAMP Recognized independent assessment service within the previous 3 months.","force":"MUST","timeframe_type":"months","timeframe_num":3}}},"FRC-APP-NTP":{"id":"FRC-APP-NTP","family":"FRC","scope":"all","subset":"APP","name":"No Third-Party Applicants","statement":"Providers MUST NOT use a third party to apply for a FedRAMP Certification on their behalf; this includes independent assessment services.","force":"MUST NOT","notes":["FedRAMP previously allowed independent assessment services to submit applications on behalf of providers, but this caused confusion about who was responsible for the application and the information in it. Providers should apply directly to ensure clear accountability.","Providers may use third parties to help them prepare their application and assessment materials for submission."],"updated":"2026-06-24"},"FRC-APP-USA":{"id":"FRC-APP-USA","family":"FRC","scope":"all","subset":"APP","name":"Updating Stale Assessments","statement":"Providers MAY freshen a stale initial independent verification and validation assessment by having a FedRAMP Recognized independent assessment service review any changes between the original assessment and the current status of the cloud service offering in place of a full re-assessment, UNLESS the stale assessment is more than 9 months old.","force":"MAY","updated":"2026-06-24"},"FRC-APS-ATO":{"id":"FRC-APS-ATO","family":"FRC","scope":"all","subset":"APS","name":"Agency Authorization to Operate","statement":"Providers seeking a FedRAMP Rev5 Agency Certification MUST have completed the Authorization to Operate (ATO) process with their agency sponsor for the cloud service offering, concluding with a formal signed ATO letter that the agency has sent over official government channels to FedRAMP.","force":"MUST","updated":"2026-06-24"},"FRC-CCL-UCC":{"id":"FRC-CCL-UCC","family":"FRC","scope":"all","subset":"CCL","name":"Upgrading Certification Class","statement":"Providers MUST apply for a new FedRAMP Certification to upgrade their Certification Class; all applicable requirements MUST be met in advance.","force":"MUST","notes":["Upgrade paths include moving from A to B, C, or D; B to C or D; and C to D.","The preferred path is to incrementally update the implementation and assurance commitments within the current Certification Class until the provider has met all requirements for the target Certification Class, then apply for the new Certification Class."],"updated":"2026-06-24"},"FRC-CCL-DCC":{"id":"FRC-CCL-DCC","family":"FRC","scope":"all","subset":"CCL","name":"Downgrading Certification Class","statement":"Providers MUST apply for a new FedRAMP Certification to downgrade their Certification Class.","force":"MUST","notes":["Downgrade paths include moving from D to C, B, or A; C to B or A; or B to A.","FRC-CCL-DNP (Downgrade Notification Period) applies - please DO NOT downgrade Certification Class with providing advance notification to all necessary parties!"],"related":["FRC-CCL-DNP"],"updated":"2026-06-24"},"FRC-CCL-DNP":{"id":"FRC-CCL-DNP","family":"FRC","scope":"all","subset":"CCL","name":"Downgrade Notification Period","statement":"Providers SHOULD notify all necessary parties at least 120 days in advance of an intended downgrade or cancellation of FedRAMP Certification.","force":"SHOULD","note":"Downgrading or canceling FedRAMP Certification will have severe negative consequences for the provider and their agency customers and should only be done after careful consideration and planning... but if it must be done, notify all necessary parties as soon as possible.","updated":"2026-06-24"},"FRC-CSX-VVK":{"id":"FRC-CSX-VVK","family":"FRC","scope":"20x","subset":"CSX","name":"Automated Verification and Validation of Key Security Indicators","controls":["cm-2.2","si-6"],"updated":"2026-10-13","byClass":{"a":{"statement":"Providers seeking 20x Class A Certification MAY implement automated methods to persistently verify and validate the accuracy and completeness of Key Security Indicators.","force":"MAY"},"b":{"statement":"Providers seeking 20x Class B Certification SHOULD implement automated methods to persistently verify and validate the accuracy and completeness of Key Security Indicators with at least 1 automated method for each Key Security Indicator.","force":"SHOULD"},"c":{"statement":"Providers seeking 20x Class C Certification MUST implement automated methods to persistently verify and validate the accuracy and completeness of Key Security Indicators with at least 2 automated methods for each Key Security Indicator.","force":"MUST"},"d":{"statement":"Providers seeking 20x Class D Certification MUST implement automated methods to persistently verify and validate the accuracy and completeness of Key Security Indicators with at least 4 automated methods for each Key Security Indicator.","force":"MUST"}}},"FRC-CSX-VVR":{"id":"FRC-CSX-VVR","family":"FRC","scope":"20x","subset":"CSX","name":"Automated Verification and Validation of FedRAMP Rules","note":"Different rules will be easy to automate for different providers, depending on the implementation, so FedRAMP generally leaves this implementation up to providers based on what makes the most sense for their own business and approach.","controls":["si-6"],"updated":"2026-10-13","byClass":{"a":{"statement":"Providers seeking 20x Class A Certification MAY implement automated methods to persistently verify and validate the accuracy and completeness of the Security Decision Record for FedRAMP rules when applicable.","force":"MAY"},"b":{"statement":"Providers seeking 20x Class B Certification SHOULD implement automated methods to persistently verify and validate the accuracy and completeness of the Security Decision Record for FedRAMP rules when applicable.","force":"SHOULD"},"c":{"statement":"Providers seeking 20x Class C Certification SHOULD implement automated methods to persistently verify and validate the accuracy and completeness of the Security Decision Record for FedRAMP rules when applicable.","force":"SHOULD"},"d":{"statement":"Providers seeking 20x Class D Certification SHOULD implement automated methods to persistently verify and validate the accuracy and completeness of the Security Decision Record for FedRAMP rules when applicable.","force":"SHOULD"}}},"FRC-CSX-MAS":{"id":"FRC-CSX-MAS","family":"FRC","scope":"20x","subset":"CSX","name":"Application within MAS","statement":"Providers SHOULD apply ALL Key Security Indicators to ALL aspects of their cloud service offering that are within the FedRAMP Minimum Assessment Scope.","force":"SHOULD","updated":"2026-06-24"},"IEC-CSO-EFR":{"id":"IEC-CSO-EFR","family":"IEC","scope":"all","subset":"CSO","name":"Evaluate FedRAMP Reportability","statement":"Providers MUST promptly evaluate incidents to determine if they affect confidentiality or integrity of federal customer data or are likely to affect confidentiality or integrity of federal customer data; such incidents are FedRAMP Reportable Incidents and must be reported following the FedRAMP Incident Evaluation and Communication rules.","force":"MUST","controls":["au-5.2","ir-4.11"],"artifacts":{"all":["An incident log showing an example of one or more incidents being evaluated including the reason for the determination. The log can be from real incidents, simulated incidents, or a combination of sources."]},"updated":"2026-10-13"},"IEC-CSO-DPR":{"id":"IEC-CSO-DPR","family":"IEC","scope":"all","subset":"CSO","name":"Default PAIN Rating","statement":"Providers MUST treat FedRAMP Reportable Incidents as if they have a Potential Agency Impact N-rating (PAIN) of 5 UNLESS they promptly estimate the PAIN rating following the rule in IEC-CSO-EFI (Estimate Federal Impact).","force":"MUST","related":["IEC-CSO-EFI"],"updated":"2026-06-24"},"IEC-CSO-IIR":{"id":"IEC-CSO-IIR","family":"IEC","scope":"all","subset":"CSO","name":"Initial Incident Report","related":["IEC-CSO-EFI"],"controls":["au-5.2","ir-5"],"schema":{"name":"FedRAMP Incident Report (IEC-CSO-IIR / IEC-CSO-OIR / IEC-CSO-FIR)","url":"https://fedramp.gov/schemas/fedramp-incident-report-schema-2026-06-24.json"},"updated":"2026-10-13","byClass":{"a":{"statement":"Providers with Class A Certifications SHOULD responsibly notify all affected parties after identifying FedRAMP Reportable Incidents by providing an Initial Incident Report with as much of the following information that is available at the time of reporting and/or the current relevant status for each item:","force":"SHOULD","following_information":["Contact information for the federal incident response coordinator","Provider's internally assigned tracking identifier","Description of the incident","Timeline of the incident, including start time, time and source of detection, time of completed FedRAMP Reportable Incident evaluation, and other major incident milestones determined by the provider","Historically and currently estimated Potential Agency Impact N-rating (PAIN) of the incident, including an explanation of the evaluation following the requirements in IEC-CSO-EFI (Estimate Federal Impact) (if applicable)","Functional impact to federal agency customers (include impact to confidentiality and/or integrity and the impacted federal customer data types)","Estimated recovery plan, milestones, and timelines","List of likely affected customer agencies"],"artifacts":{"all":["An Initial Incident Report for one or more incidents. The report can be from real incidents, simulated incidents, or a combination of sources."]}},"b":{"statement":"Providers with Class B Certifications MUST responsibly notify all affected parties after identifying FedRAMP Reportable Incidents by providing an Initial Incident Report with as much of the following information that is available at the time of reporting and/or the current relevant status for each item:","force":"MUST","following_information":["Contact information for the federal incident response coordinator.","Provider's internally assigned tracking identifier","Description of the incident","Timeline of the incident, including start time, time and source of detection, time of completed FedRAMP Reportable Incident evaluation, and other major incident milestones determined by the provider","Historically and currently estimated Potential Agency Impact N-rating (PAIN) of the incident, including an explanation of the evaluation following the requirements in IEC-CSO-EFI (Estimate Federal Impact) (if applicable)","Functional impact to federal agency customers (include impact to confidentiality and/or integrity and the impacted federal customer data types)","Estimated recovery plan, milestones, and timelines","List of likely affected customer agencies"],"artifacts":{"all":["An Initial Incident Report for one or more incidents. The report can be from real incidents, simulated incidents, or a combination of sources."]}},"c":{"statement":"Providers with Class C Certifications MUST responsibly notify all affected parties after identifying FedRAMP Reportable Incidents by providing an Initial Incident Report with as much of the following information that is available at the time of reporting and/or the current relevant status for each item:","force":"MUST","following_information":["Contact information for the federal incident response coordinator.","Provider's internally assigned tracking identifier","Description of the incident","Timeline of the incident, including start time, time and source of detection, time of completed FedRAMP Reportable Incident evaluation, and other major incident milestones determined by the provider","Historically and currently estimated Potential Agency Impact N-rating (PAIN) of the incident, including an explanation of the evaluation following the requirements in IEC-CSO-EFI (Estimate Federal Impact) (if applicable)","Functional impact to federal agency customers (include impact to confidentiality and/or integrity and the impacted federal customer data types)","Estimated recovery plan, milestones, and timelines","List of likely affected customer agencies"],"artifacts":{"all":["An Initial Incident Report for one or more incidents. The report can be from real incidents, simulated incidents, or a combination of sources."]}},"d":{"statement":"Providers with Class D Certifications MUST responsibly notify all affected parties after identifying FedRAMP Reportable Incidents by providing an Initial Incident Report with as much of the following information that is available at the time of reporting and/or the current relevant status for each item:","force":"MUST","following_information":["Contact information for the federal incident response coordinator.","Provider's internally assigned tracking identifier","Description of the incident","Timeline of the incident, including start time, time and source of detection, time of completed FedRAMP Reportable Incident evaluation, and other major incident milestones determined by the provider","Historically and currently estimated Potential Agency Impact N-rating (PAIN) of the incident, including an explanation of the evaluation following the requirements in IEC-CSO-EFI (Estimate Federal Impact) (if applicable)","Functional impact to federal agency customers (include impact to confidentiality and/or integrity and the impacted federal customer data types)","Estimated recovery plan, milestones, and timelines","List of likely affected customer agencies"],"artifacts":{"all":["An Initial Incident Report for one or more incidents. The report can be from real incidents, simulated incidents, or a combination of sources."]}}}},"IEC-CSO-OIR":{"id":"IEC-CSO-OIR","family":"IEC","scope":"all","subset":"CSO","name":"Ongoing Incident Reports","controls":["ir-5"],"schema":{"name":"FedRAMP Incident Report (IEC-CSO-IIR / IEC-CSO-OIR / IEC-CSO-FIR)","url":"https://fedramp.gov/schemas/fedramp-incident-report-schema-2026-06-24.json"},"updated":"2026-10-13","byClass":{"a":{"statement":"Providers with Class A Certifications SHOULD responsibly notify all affected parties of ongoing activity as new information becomes available during incident response for FedRAMP Reportable Incidents, including updates (or lack of updates) to all previously reported information and as much of the following additional information that is available and/or the current relevant status for each item:","force":"SHOULD","following_information":["Observed incident activity","Indicators of compromise","Related Common Vulnerabilities and Exposures (CVE) identifier (if applicable)","Root cause","Response and recovery activities"],"artifacts":{"all":["An Ongoing Incident Report for one or more incidents. The report can be from real incidents, simulated incidents, or a combination of sources."]}},"b":{"statement":"Providers with Class B Certifications MUST responsibly notify all affected parties of ongoing activity as new information becomes available during incident response for FedRAMP Reportable Incidents, including updates (or lack of updates) to all previously reported information and as much of the following additional information that is available and/or the current relevant status for each item:","force":"MUST","following_information":["Observed incident activity","Indicators of compromise","Related Common Vulnerabilities and Exposures (CVE) identifier, if applicable","Root cause","Response and recovery activities"],"artifacts":{"all":["An Ongoing Incident Report for one or more incidents. The report can be from real incidents, simulated incidents, or a combination of sources."]}},"c":{"statement":"Providers with Class C Certifications MUST responsibly notify all affected parties of ongoing activity as new information becomes available during incident response for FedRAMP Reportable Incidents, including updates (or lack of updates) to all previously reported information and as much of the following additional information that is available and/or the current relevant status for each item:","force":"MUST","following_information":["Observed incident activity","Indicators of compromise","Related Common Vulnerabilities and Exposures (CVE) identifier, if applicable","Root cause","Response and recovery activities"],"artifacts":{"all":["An Ongoing Incident Report for one or more incidents. The report can be from real incidents, simulated incidents, or a combination of sources."]}},"d":{"statement":"Providers with Class D Certifications MUST responsibly notify all affected parties of ongoing activity as new information becomes available during incident response for FedRAMP Reportable Incidents, including updates (or lack of updates) to all previously reported information and as much of the following additional information that is available and/or the current relevant status for each item:","force":"MUST","following_information":["Observed incident activity","Indicators of compromise","Related Common Vulnerabilities and Exposures (CVE) identifier, if applicable","Root cause","Response and recovery activities"],"artifacts":{"all":["An Ongoing Incident Report for one or more incidents. The report can be from real incidents, simulated incidents, or a combination of sources."]}}}},"IEC-CSO-FIR":{"id":"IEC-CSO-FIR","family":"IEC","scope":"all","subset":"CSO","name":"Final Incident Report","controls":["ir-5"],"schema":{"name":"FedRAMP Incident Report (IEC-CSO-IIR / IEC-CSO-OIR / IEC-CSO-FIR)","url":"https://fedramp.gov/schemas/fedramp-incident-report-schema-2026-06-24.json"},"updated":"2026-10-13","byClass":{"a":{"statement":"Providers with Class A Certifications MUST responsibly notify all affected parties by providing a Final Incident Report once the incident has been resolved and recovery is complete, including final updates to all previously reported information.","force":"MUST","artifacts":{"all":["An Final Incident Report for one or more incidents. The report can be from real incidents, simulated incidents, or a combination of sources."]}},"b":{"statement":"Providers with Class B Certifications MUST responsibly notify all affected parties by providing a Final Incident Report once the incident has been resolved and recovery is complete, including final updates to all previously reported information.","force":"MUST","artifacts":{"all":["An Final Incident Report for one or more incidents. The report can be from real incidents, simulated incidents, or a combination of sources."]}},"c":{"statement":"Providers with Class C Certifications MUST responsibly notify all affected parties by providing a Final Incident Report once the incident has been resolved and recovery is complete, including final updates to all previously reported information.","force":"MUST","artifacts":{"all":["An Final Incident Report for one or more incidents. The report can be from real incidents, simulated incidents, or a combination of sources."]}},"d":{"statement":"Providers with Class D Certifications MUST responsibly notify all affected parties by providing a Final Incident Report once the incident has been resolved and recovery is complete, including final updates to all previously reported information.","force":"MUST","artifacts":{"all":["An Final Incident Report for one or more incidents. The report can be from real incidents, simulated incidents, or a combination of sources."]}}}},"IEC-CSO-EFI":{"id":"IEC-CSO-EFI","family":"IEC","scope":"all","subset":"CSO","name":"Estimate Federal Impact","statement":"Providers SHOULD promptly estimate the likely adverse impact of an incident on agency customers to assign a Potential Agency Impact N-rating; this step is called Incident Rating.","force":"SHOULD","note":"All incidents must be assigned a default PAIN-5 as required by IEC-CSO-DPR (Default PAIN Rating) if this step is not completed.","following_information_bullets":["**N1** for a likely minimal customer effect on 1 or more agencies.","**N2** for a likely narrow customer effect on 1 or more agencies.","**N3** for a likely disruptive customer effect on 1 agency.","**N4** for a likely debilitating customer effect on 1 agency or a likely disruptive customer effect on more than 1 agency.","**N5** for a likely debilitating customer effect on more than 1 agency."],"related":["IEC-CSO-DPR"],"artifacts":{"all":["An incident log showing an example of one or more incidents being evaluated including the reason for the determination. The log can be from real incidents, simulated incidents, or a combination of sources."]},"schema":{"name":"FedRAMP Incident Report (IEC-CSO-IIR / IEC-CSO-OIR / IEC-CSO-FIR)","url":"https://fedramp.gov/schemas/fedramp-incident-report-schema-2026-06-24.json"},"updated":"2026-06-24"},"IEC-CSO-AIR":{"id":"IEC-CSO-AIR","family":"IEC","scope":"all","subset":"CSO","name":"Automated Incident Reporting","statement":"Providers SHOULD use automation to minimize human intervention in the process of reporting FedRAMP Reportable Incidents to all affected parties.","force":"SHOULD","updated":"2026-06-24"},"IVV-CSO-FIA":{"id":"IVV-CSO-FIA","family":"IVV","scope":"all","subset":"CSO","name":"FedRAMP Independent Assessments","notes":["The first such completed assessment is typically called an \"initial assessment\" while following assessments are called \"annual assessments.\"","The specific requirements for independent verification and validation assessments are documented by the FedRAMP Certification Class and Type.","The option for assessment by FedRAMP directly is limited to cloud services that are explicitly prioritized by FedRAMP, in consultation with the FedRAMP Board and the federal Chief Information Officers Council; this is _extremely_ rare.","FedRAMP Recognized independent assessment services are listed on the FedRAMP Marketplace."],"controls":["ca-2","ca-2.1","ca-2.2","ca-7.1","ca-7.4"],"updated":"2026-10-13","byClass":{"a":{"statement":"Providers with Class A Certifications MAY persistently complete an independent verification and validation assessment of all applicable FedRAMP rules with a FedRAMP Recognized independent assessment service OR FedRAMP at least once per year; this is a FedRAMP independent assessment.","force":"MAY","timeframe_type":"years","timeframe_num":1},"b":{"statement":"Providers with Class B Certifications MUST persistently complete an independent verification and validation assessment of all applicable FedRAMP rules with a FedRAMP Recognized independent assessment service OR FedRAMP at least once per year; this is a FedRAMP independent assessment.","force":"MUST","timeframe_type":"years","timeframe_num":1},"c":{"statement":"Providers with Class C Certifications MUST persistently complete an independent verification and validation assessment of all applicable FedRAMP rules with a FedRAMP Recognized independent assessment service OR FedRAMP at least once per year; this is a FedRAMP independent assessment.","force":"MUST","timeframe_type":"years","timeframe_num":1},"d":{"statement":"Providers with Class D Certifications MUST persistently complete an independent verification and validation assessment of all applicable FedRAMP rules with a FedRAMP Recognized independent assessment service OR FedRAMP at least once per year; this is a FedRAMP independent assessment.","force":"MUST","timeframe_type":"years","timeframe_num":1}}},"IVV-CSO-SEI":{"id":"IVV-CSO-SEI","family":"IVV","scope":"all","subset":"CSO","name":"Supply Evidence of Implementation","statement":"Providers MUST supply evidence to all necessary assessors of the implementation of the measures that have been documented to meet FedRAMP Practices; this evidence is the result of verification.","force":"MUST","note":"For example, if the documentation says that firewall rules are used to block traffic then the cloud service provider would verify that firewall rules are in place to block traffic and supply that evidence to assessors (preferably by allowing them to see how firewall configurations are deployed from a source of truth).","updated":"2026-06-24"},"IVV-CSO-SEE":{"id":"IVV-CSO-SEE","family":"IVV","scope":"all","subset":"CSO","name":"Supply Evidence of Effectiveness","statement":"Providers MUST supply evidence to all necessary assessors of the effectiveness of the measures that have been implemented to meet FedRAMP Practices; this evidence is the result of validation.","force":"MUST","note":"For example, after verifying that firewalls are configured to block traffic following IVV-CSO-SEI (Supply Evidence of Implementation), the provider would validate that traffic is actually being blocked and supply evidence of that validation to assessors (such as by allowing them to see metrics on the traffic that is blocked vs not).","related":["IVV-CSO-SEI"],"updated":"2026-06-24"},"IVV-CSO-ICP":{"id":"IVV-CSO-ICP","family":"IVV","scope":"all","subset":"CSO","name":"Inclusion in Certification Package","statement":"Providers MUST supply the results of FedRAMP independent assessments in their FedRAMP Certification Package without inappropriate modification.","force":"MUST","notes":["Inappropriate modification in this context means changing the underlying intent/etc. of the content provided by the independent assessment service - the content itself may be modified for presentation, formatting, etc. as needed.","This rule is related to IVV-IAS-VIP (Verify Inclusion in Certification Package)."],"related":["IVV-IAS-VIP"],"updated":"2026-06-24"},"IVV-CSO-DUS":{"id":"IVV-CSO-DUS","family":"IVV","scope":"all","subset":"CSO","name":"Document Use of Representative Samples","statement":"Providers MUST document and explain the use of representative samples during verification and validation when using representative samples as allowed by IVV-CSO-USR (Use Representative Samples).","force":"MUST","related":["IVV-CSO-USR"],"updated":"2026-06-24"},"IVV-CSO-STE":{"id":"IVV-CSO-STE","family":"IVV","scope":"all","subset":"CSO","name":"Supply Technical Explanations","statement":"Providers SHOULD supply all necessary assessors with technical explanations, demonstrations, and other relevant supporting information about the technical capabilities they employ to address FedRAMP rules; this SHOULD be supplied as necessary to ensure the assessor can effectively complete verification and validation.","force":"SHOULD","updated":"2026-06-24"},"IVV-CSO-USR":{"id":"IVV-CSO-USR","family":"IVV","scope":"all","subset":"CSO","name":"Use Representative Samples","statement":"Providers MAY use representative samples as appropriate during verification and validation.","force":"MAY","note":"Many modern cloud services using effective automation do not need to use representative sampling and are capable of persistently verifying and validating the majority of their security measures automatically.","updated":"2026-06-24"},"IVV-CSO-RAA":{"id":"IVV-CSO-RAA","family":"IVV","scope":"all","subset":"CSO","name":"Receiving Assessor Advice","statement":"Providers MAY ask for and accept advice from their assessor during assessment regarding techniques and procedures that will improve their security posture or the effectiveness, clarity, and accuracy of their verification, validation and reporting procedures, UNLESS doing so is likely to compromise the objectivity and integrity of the assessment.","force":"MAY","updated":"2026-06-24"},"IVV-CSX-AIA":{"id":"IVV-CSX-AIA","family":"IVV","scope":"20x","subset":"CSX","name":"Annual Independent Assessments for 20x","updated":"2026-06-24","byClass":{"a":{"statement":"Providers with 20x Class A Certifications MUST meet the expectations of their underlying alternative security framework as part of their persistent independent verification and validation assessment.","force":"MUST"},"b":{"statement":"Providers with 20x Class B Certifications MUST include all Key Security Indicators in a FedRAMP independent assessment at least once per year.","force":"MUST","timeframe_type":"years","timeframe_num":1},"c":{"statement":"Providers with 20x Class C Certifications MUST include all Key Security Indicators in a FedRAMP independent assessment at least once per year.","force":"MUST","timeframe_type":"years","timeframe_num":1},"d":{"statement":"Providers with 20x Class D Certifications MUST include all Key Security Indicators in a FedRAMP independent assessment at least once per year.","force":"MUST","timeframe_type":"years","timeframe_num":1}}},"MAS-CSO-IIR":{"id":"MAS-CSO-IIR","family":"MAS","scope":"all","subset":"CSO","name":"Identify Information Resources","statement":"Providers MUST identify a set of information resources to assess for FedRAMP Certification that includes all information resources that are likely to handle federal customer data or likely to impact the confidentiality, integrity, or availability of federal customer data handled by the cloud service offering; this set of information resources is the cloud service offering.","force":"MUST","notes":["Certain categories of cloud computing products and services are specified as entirely outside the scope of FedRAMP by the Director of the Office of Management and Budget. All such products and services are therefore not included in the cloud service offering for FedRAMP. For more, see https://fedramp.gov/scope.","Software produced by cloud service providers that is delivered separately for installation on agency systems and not operated in a shared responsibility model (typically including agents, application clients, mobile applications, etc. that are not fully managed by the cloud service provider) is not a cloud computing product or service and is entirely outside the scope of FedRAMP under the FedRAMP Certification Act. All such software is therefore not included in the cloud service offering for FedRAMP. For more, see https://fedramp.gov/scope.","All aspects of the cloud service offering are determined and maintained by the cloud service provider in accordance with related FedRAMP Certification rules and documented by the cloud service provider in their FedRAMP Certification Package."],"controls":["cm-8.4","ra-3","si-4.19"],"artifacts":{"all":["A machine readable output containing all required data of the components of the cloud service offering that are likely to handle federal customer data or likely to impact the confidentiality, integrity, or availability of federal customer data handled by the cloud service offering.","A human readable explanation of how the machine readable output is derived.","The code for the automated process used to generate the machine readable output."]},"updated":"2026-10-13"},"MAS-CSO-FLO":{"id":"MAS-CSO-FLO","family":"MAS","scope":"all","subset":"CSO","name":"Information Flows and Security Categories","statement":"Providers MUST clearly identify, document, and explain information flows and security categories for ALL information resources or sets of information resources in the cloud service offering.","force":"MUST","note":"Information resources (including third-party information resources) MAY vary by security category as appropriate to the type of information handled by or impacted by the information resource.","controls":["ac-4","cm-12","cm-12.1","ra-3","si-4.19"],"artifacts":{"all":["A machine readable output containing all required data of the permitted connections between components of the cloud service offering that are likely to handle federal customer data or likely to impact the confidentiality, integrity, or availability of federal customer data handled by the cloud service offering.","A human readable explanation of how the machine readable output is derived.","The code for the automated process used to generate the machine readable output."]},"updated":"2026-10-13"},"MAS-CSO-TPR":{"id":"MAS-CSO-TPR","family":"MAS","scope":"all","subset":"CSO","name":"Third-Party Information Resources","statement":"Providers MUST address the potential impact to federal customer data from third-party information resources used by the cloud service offering, ONLY IF MAS-CSO-IIR (Identify Information Resources) APPLIES, by documenting the following information about each applicable third-party information resource:","force":"MUST","following_information":["General usage and configuration","Explanation or justification for use","Mitigation measures in place to reduce the potential impact to federal customer data","Compensating controls in place to reduce the potential impact to federal customer data"],"related":["MAS-CSO-IIR"],"controls":["ra-3"],"artifacts":{"all":["A machine readable output containing all required data of the third-party information resources of the cloud service offering that are likely to handle federal customer data or likely to impact the confidentiality, integrity, or availability of federal customer data handled by the cloud service offering.","A human readable explanation of how the machine readable output is derived.","The code for the automated process used to generate the machine readable output."]},"schema":{"name":"FedRAMP Certification Package Overview (FRC-CSO-PKG)","url":"https://fedramp.gov/schemas/fedramp-certification-package-overview-schema-2026-06-24.json"},"updated":"2026-10-13"},"MAS-CSO-MDI":{"id":"MAS-CSO-MDI","family":"MAS","scope":"all","subset":"CSO","name":"Metadata Inclusion","statement":"Providers MUST include metadata (including metadata about federal customer data) in the Minimum Assessment Scope ONLY IF MAS-CSO-IIR (Identify Information Resources) APPLIES.","force":"MUST","related":["MAS-CSO-IIR"],"artifacts":{"all":["A machine readable output containing all required data of the metadata collected or maintained by the cloud service offering that are likely to handle federal customer data or likely to impact the confidentiality, integrity, or availability of federal customer data handled by the cloud service offering.","A human readable explanation of how the machine readable output is derived.","The code for the automated process used to generate the machine readable output."]},"updated":"2026-06-24"},"MAS-CSO-SUP":{"id":"MAS-CSO-SUP","family":"MAS","scope":"all","subset":"CSO","name":"Supplemental Information","statement":"Providers MAY include additional materials about other information resources that are not part of the cloud service offering in a FedRAMP Certification Package supplement; these resources will not be FedRAMP Certified and MUST be clearly marked and separated from the cloud service offering.","force":"MAY","note":"This is intended to allow inclusion of things like security materials for apps, supplemental marketing collateral, and other information that is not part of the cloud service offering but may be useful to agencies.","updated":"2026-06-24"},"MKT-CSO-MLR":{"id":"MKT-CSO-MLR","family":"MKT","scope":"all","subset":"CSO","name":"Marketplace Listing Requirements","statement":"Providers MUST address at least these FedRAMP rules to apply for a new FedRAMP Marketplace listing OR to request updates to an existing listing:","force":"MUST","following_information":["Certification Data Sharing: CDS-CSO-PUB (Public Information)"],"related":["CDS-CSO-PUB"],"updated":"2026-06-24"},"MKT-CSO-PML":{"id":"MKT-CSO-PML","family":"MKT","scope":"all","subset":"CSO","name":"Provider Marketplace Listing Requests","statement":"Providers MUST notify FedRAMP using the FedRAMP Marketplace Providing Listing Request Form to request a listing in the FedRAMP Marketplace.","force":"MUST","note":"FedRAMP does not accept applications for a FedRAMP Marketplace Listing via email!","updated":"2026-06-24"},"MKT-IIP-AGU":{"id":"MKT-IIP-AGU","family":"MKT","scope":"all","subset":"IIP","name":"Agency Use Cases","statement":"Providers MUST demonstrate that a cloud service offering is intended for one of the following use cases:","force":"MUST","notes":["FedRAMP will not list products or services that are outside the explicit statutory scope of FedRAMP; See MKT-FRP-SOF (Scope of FedRAMP).","Services used by private companies to meet other compliance requirements (such as CMMC) that do not also meet one of the above use cases are outside the scope of FedRAMP."],"following_information":["Direct Use: The product will be used directly by agency customers for integration into a federal information system that falls within the scope of 44 USC § 3506 and will receive an agency Authorization to Operate.","Indirect Use: The product will be included as a third-party information resource in other cloud service offerings that are directly used by agency customers."],"related":["MKT-FRP-SOF"],"updated":"2026-06-24"},"MKT-IIP-DCP":{"id":"MKT-IIP-DCP","family":"MKT","scope":"all","subset":"IIP","name":"Demonstrating Continuous Progress","statement":"Providers MUST demonstrate continuous progress towards a FedRAMP Certification, documented in their Trust Center or website and updated at least quarterly; progress is measured by the provider against documented goals and milestones.","force":"MUST","note":"This is an opportunity for a business to showcase its goals and progress, and should be seen as a marketing and customer experience challenge instead of a compliance challenge.","updated":"2026-06-24"},"MKT-IIP-DLA":{"id":"MKT-IIP-DLA","family":"MKT","scope":"all","subset":"IIP","name":"Deadline for Assessment","statement":"Providers MUST demonstrate that an assessment for a FedRAMP Certification Class B, C, or D has been scheduled within 2 years of initial listing in the Initial Implementation Phase.","force":"MUST","timeframe_type":"years","timeframe_num":2,"updated":"2026-06-24"},"SCG-CSO-RSC":{"id":"SCG-CSO-RSC","family":"SCG","scope":"all","subset":"CSO","name":"Recommended Secure Configuration","statement":"Providers MUST create, maintain, and make available recommendations for securely configuring their cloud services (the Secure Configuration Guide) that includes at least the following information:","force":"MUST","notes":["These rules refer to this guidance as a Secure Configuration Guide but cloud service providers may make this guidance available in various appropriate forms that provide the best customer experience.","This guidance should explain how top-level administrative accounts and privileged accounts are named and referred to in the cloud service offering."],"following_information":["Required: Instructions on how to securely access, configure, operate, and decommission top-level administrative accounts that control enterprise access to the entire cloud service offering.","Required: Explanations of security-related settings that can be operated only by top-level administrative accounts and their security implications.","Recommended: Explanations of security-related settings that can be operated only by privileged accounts and their security implications."],"controls":["cm-7"],"artifacts":{"all":["URL to the human-readable data.","URL to the machine-readable data."]},"schema":{"name":"FedRAMP Certification Package Overview (FRC-CSO-PKG)","url":"https://fedramp.gov/schemas/fedramp-certification-package-overview-schema-2026-06-24.json"},"updated":"2026-10-13"},"SCG-CSO-AUP":{"id":"SCG-CSO-AUP","family":"SCG","scope":"all","subset":"CSO","name":"Use Instructions","statement":"Providers MUST include instructions in the FedRAMP Certification Package that explain how to obtain and use the Secure Configuration Guide.","force":"MUST","note":"These instructions may appear in a variety of ways; it is up to the provider to do so in the most appropriate and effective ways for their specific customer needs.","artifacts":{"all":["URL or explanation of how to request these materials.","Explanation of how the provider decides whether or not to share these materials or other related policies."]},"updated":"2026-06-24"},"SCG-CSO-PUB":{"id":"SCG-CSO-PUB","family":"SCG","scope":"all","subset":"CSO","name":"Public Secure Configuration Guidance","statement":"Providers SHOULD make the Secure Configuration Guide available publicly.","force":"SHOULD","artifacts":{"all":["Explanation of how to access this information","or explanation why this functionality is not available"]},"updated":"2026-06-24"},"SCG-CSO-SDF":{"id":"SCG-CSO-SDF","family":"SCG","scope":"all","subset":"CSO","name":"Secure Defaults","statement":"Providers SHOULD set all settings to their recommended secure defaults for top-level administrative accounts and privileged accounts when initially provisioned.","force":"SHOULD","artifacts":{"all":["Explanation of how to access this information","or explanation why this functionality is not available"]},"updated":"2026-06-24"},"SCG-ENH-CMP":{"id":"SCG-ENH-CMP","family":"SCG","scope":"all","subset":"ENH","name":"Comparison Capability","statement":"Providers SHOULD offer the capability to compare all current settings for top-level administrative accounts and privileged accounts to the recommended secure defaults.","force":"SHOULD","artifacts":{"all":["Explanation of how to access this information","or explanation why this functionality is not available"]},"updated":"2026-06-24"},"SCG-ENH-EXP":{"id":"SCG-ENH-EXP","family":"SCG","scope":"all","subset":"ENH","name":"Export Capability","statement":"Providers SHOULD offer the capability to export all security settings in a machine-readable format.","force":"SHOULD","artifacts":{"all":["Explanation of how to access this information","or explanation why this functionality is not available"]},"updated":"2026-06-24"},"SCG-ENH-API":{"id":"SCG-ENH-API","family":"SCG","scope":"all","subset":"ENH","name":"API Capability","statement":"Providers SHOULD offer the capability to view and adjust security settings via an API or similar capability.","force":"SHOULD","artifacts":{"all":["Explanation of how to access this information","or explanation why this functionality is not available"]},"updated":"2026-06-24"},"SCG-ENH-MRG":{"id":"SCG-ENH-MRG","family":"SCG","scope":"all","subset":"ENH","name":"Machine-Readable Guidance","statement":"Providers SHOULD also provide the Secure Configuration Guide in a machine-readable format that can be used by customers or third-party tools to compare against current settings.","force":"SHOULD","artifacts":{"all":["Explanation of how to access this information","or explanation why this functionality is not available"]},"updated":"2026-06-24"},"SCG-ENH-VRH":{"id":"SCG-ENH-VRH","family":"SCG","scope":"all","subset":"ENH","name":"Versioning and Release History","statement":"Providers SHOULD provide versioning and a release history for recommended secure default settings for top-level administrative accounts and privileged accounts as they are adjusted over time.","force":"SHOULD","artifacts":{"all":["Explanation of how to access this information","or explanation why this functionality is not available"]},"updated":"2026-06-24"},"SCN-CSO-EVA":{"id":"SCN-CSO-EVA","family":"SCN","scope":"all","subset":"CSO","name":"Evaluate Changes","statement":"Providers MUST evaluate all potential significant changes to determine the type of significant change and follow the appropriate Significant Change Notification rules.","force":"MUST","following_information":["Is it a significant change? --> Continue evaluation and follow the Significant Change Notification rules.","If it is, is it an FedRAMP Certification class change?  --> This requires a new assessment and cannot be done under the Significant Change Notification rules.","If it is not, is it a routine recurring change? --> Follow the Routine Recurring Change rules (SCN-RTR Routine Recurring Changes).","If it is not, is it a transformative change? --> Follow the Transformative Change rules (SCN-TRF Transformative Changes).","If it is not, then it is an adaptive change --> Follow the Adaptive Change rules (SCN-ADP Adaptive Changes)."],"controls":["cm-4"],"artifacts":{"all":["Evidence of significant change evaluation including a description fo the change, the determined type, and an explanation for the decision. At least one example must be provided for each type of change. Real examples are prefered but the provider may use fictitious examples as long as the example provides evidence of the decision making process."]},"schema":{"name":"FedRAMP Significant Change Notification (SCN-CSO-INF)","url":"https://fedramp.gov/schemas/fedramp-significant-change-notifications-schema-2026-06-24.json"},"updated":"2026-10-13"},"SCN-CSO-MAR":{"id":"SCN-CSO-MAR","family":"SCN","scope":"all","subset":"CSO","name":"Maintain Audit Records","statement":"Providers MUST maintain auditable records of the significant change evaluation activities required by SCN-CSO-EVA (Evaluate Changes) and make them available to FedRAMP as requested.","force":"MUST","note":"These audit records must be available to FedRAMP on request; these records do not need to be included in the FedRAMP Certification Package by default and do not need to be emailed to FedRAMP continuously.","related":["SCN-CSO-EVA"],"artifacts":{"all":["Explanation of how FedRAMP can obtain this information."]},"updated":"2026-06-24"},"SCN-CSO-INF":{"id":"SCN-CSO-INF","family":"SCN","scope":"all","subset":"CSO","name":"Required Information","statement":"Providers MUST include at least the following information in Significant Change Notifications:","force":"MUST","note":"Structure of the information may vary depending on how the provider tracks this internally.","following_information":["Service Offering FedRAMP ID","Assessor Name (if applicable)","Related Vulnerability (if applicable)","Significant Change type and explanation of categorization","Short description of change","Reason for change","Summary of customer impact, including changes to services and customer configuration responsibilities","Plan and timeline for the change, including for the verification, assessment, and/or validation of impacted Key Security Indicators or Rev5 Controls","Copy of the business or security impact analysis","Name and title of approver"],"artifacts":{"all":["A recent Significant Change Notification or sample Significant Change Notification"]},"schema":{"name":"FedRAMP Significant Change Notification (SCN-CSO-INF)","url":"https://fedramp.gov/schemas/fedramp-significant-change-notifications-schema-2026-06-24.json"},"updated":"2026-06-24"},"SCN-CSO-HIS":{"id":"SCN-CSO-HIS","family":"SCN","scope":"all","subset":"CSO","name":"Historical Notifications","statement":"Providers MUST keep 12 months of historical Significant Change Notifications available with their FedRAMP Certification Data.","force":"MUST","artifacts":{"all":["Explanation of how FedRAMP can obtain this information."]},"updated":"2026-06-24"},"SCN-CSO-HRM":{"id":"SCN-CSO-HRM","family":"SCN","scope":"all","subset":"CSO","name":"Human and Machine-Readable Notifications","statement":"Providers MUST make ALL Significant Change Notifications and related audit records available in human-readable and JSON formats.","force":"MUST","artifacts":{"all":["URL or explanation of how to request these materials.","Explanation of how the provider decides whether or not to share these materials or other related policies."]},"schema":{"name":"FedRAMP Significant Change Notifications Schema","url":"https://fedramp.gov/schemas/fedramp-significant-change-notifications-schema-2026-06-24.json"},"updated":"2026-06-24"},"SCN-CSO-ARI":{"id":"SCN-CSO-ARI","family":"SCN","scope":"all","subset":"CSO","name":"Additional Relevant Information","statement":"Providers MAY include additional relevant information in Significant Change Notifications.","force":"MAY","note":"This allows providers to convey whatever additional information they think is relevant without worrying about negative consequences from not following an exact template.","updated":"2026-06-24"},"SCN-CSO-NOM":{"id":"SCN-CSO-NOM","family":"SCN","scope":"all","subset":"CSO","name":"Notification Mechanisms","statement":"Providers MAY notify necessary parties in a variety of ways as long as the mechanism for notification is clearly documented in the FedRAMP Certification Package and easily accessible.","force":"MAY","notes":["The sharing mechanism should be designed based on the needs of the provider and their customers and may vary between providers.","The default sharing mechanism for most providers during the SCN beta was to send an email to agency customers and upload a copy of the notification to the provider's secure sharing location."],"artifacts":{"all":["Current list of available notification mechanisms"]},"updated":"2026-06-24"},"SCN-CSO-EMG":{"id":"SCN-CSO-EMG","family":"SCN","scope":"all","subset":"CSO","name":"Emergency Changes","statement":"Providers MAY execute significant changes (including transformative changes) during an emergency or incident without following the Significant Change Notification rules in advance. In such emergencies, providers MUST follow all relevant procedures, notify all necessary parties, retroactively provide all Significant Change Notification materials, and complete appropriate assessment after the incident.","force":"MAY","note":"Procedures for emergency changes should be documented in the FedRAMP Certification Package.","controls":["ir-4.2"],"updated":"2026-10-13"},"SCN-ADP-NTF":{"id":"SCN-ADP-NTF","family":"SCN","scope":"all","subset":"ADP","name":"Notification Requirements","statement":"Providers MUST notify all necessary parties within 10 business days after finishing adaptive changes, also including the following information:","force":"MUST","notes":["Activities that match the adaptive significant change type are a frequent and normal part of iteratively improving a service by deploying new functionality or modifying existing functionality in a way that is typically transparent to customers and does not introduce significant new security risks.","In general, most changes that do not happen regularly will be adaptive changes. This change type deliberately covers a wide range of activities in a way that requires assessment and consideration."],"following_information":["Summary of any new risks identified and/or vulnerabilities resulting from the change (if applicable)"],"timeframe_type":"bizdays","timeframe_num":10,"artifacts":{"all":["At least the most recent SCN notification including the date it was sent and the date the change was applied. Additional examples may be provided. If no SCN notifications have been sent then this artifact is not required."]},"updated":"2026-06-24"},"SCN-RTR-NNR":{"id":"SCN-RTR-NNR","family":"SCN","scope":"all","subset":"RTR","name":"No Notification Requirements","statement":"Providers SHOULD NOT make formal Significant Change Notifications for routine recurring changes; this type of change is exempted from notification requirements.","force":"SHOULD NOT","notes":["Activities that match the routine recurring significant change type are performed regularly and routinely by cloud service providers to address flaws or vulnerabilities, address incidents, and generally perform the typical maintenance and service delivery changes expected during day-to-day operations.","These changes leverage mature processes and capabilities to identify, mitigate, and remediate risks as part of the change. They are often entirely automated and may occur without human intervention, even though they have an impact on security of the service.","If the activity does not occur regularly and routinely then it cannot be a significant change of this type (e.g., replacing all physical firewalls to remediate a vulnerability is obviously not regular or routine)."],"updated":"2026-06-24"},"SCN-TRF-NIP":{"id":"SCN-TRF-NIP","family":"SCN","scope":"all","subset":"TRF","name":"Notification of Initial Plans","statement":"Providers MUST notify all necessary parties of initial plans for transformative changes at least 30 business days before starting transformative changes, including a summary of any likely security impacts or changes in risk.","force":"MUST","timeframe_type":"bizdays","timeframe_num":30,"artifacts":{"all":["At least the most recent initial SCN notification for a transformative change including the date it was sent and the date the change was applied. Additional examples may be provided. If no transformative SCN notifications have been sent then this artifact is not required."]},"updated":"2026-06-24"},"SCN-TRF-NFP":{"id":"SCN-TRF-NFP","family":"SCN","scope":"all","subset":"TRF","name":"Notification of Final Plans","statement":"Providers MUST notify all necessary parties of final plans for transformative changes at least 10 business days before starting transformative changes, including updates to all previously sent information.","force":"MUST","timeframe_type":"bizdays","timeframe_num":10,"artifacts":{"all":["At least the most recent final SCN notification for a transformative change including the date it was sent and the date the change was applied. Additional examples may be provided. If no transformative SCN notifications have been sent then this artifact is not required."]},"updated":"2026-06-24"},"SCN-TRF-NAF":{"id":"SCN-TRF-NAF","family":"SCN","scope":"all","subset":"TRF","name":"Notification After Finishing","statement":"Providers MUST notify all necessary parties within 5 business days after finishing transformative changes, including updates to all previously sent information.","force":"MUST","timeframe_type":"bizdays","timeframe_num":5,"artifacts":{"all":["At least the most recent post deployment SCN notification for a transformative change including the date it was sent and the date the change was applied. Additional examples may be provided. If no transformative SCN notifications have been sent then this artifact is not required."]},"updated":"2026-06-24"},"SCN-TRF-NAV":{"id":"SCN-TRF-NAV","family":"SCN","scope":"all","subset":"TRF","name":"Notification After Verification","statement":"Providers MUST notify all necessary parties within 5 business days after completing the verification, assessment, and/or validation of transformative changes, also including the following information:","force":"MUST","following_information":["Updates to all previously sent information","Summary of any new risks identified and/or vulnerabilities resulting from the change (if applicable)","Copy of the security assessment report (if applicable)"],"timeframe_type":"bizdays","timeframe_num":5,"artifacts":{"all":["At least the most recent after verification SCN notification for a transformative change including the date it was sent and the date the change was applied. Additional examples may be provided. If no transformative SCN notifications have been sent then this artifact is not required."]},"updated":"2026-06-24"},"SCN-TRF-UPD":{"id":"SCN-TRF-UPD","family":"SCN","scope":"all","subset":"TRF","name":"Update Documentation","statement":"Providers MUST publish updated service documentation and other materials to reflect transformative changes within 30 business days after finishing transformative changes.","force":"MUST","note":"This requirement is focused on service documentation like user guides, information listed in the marketplace, and other such materials; it does not require updating the system security plan or FedRAMP Certification Package.","timeframe_type":"bizdays","timeframe_num":30,"artifacts":{"all":["Date of the most recent transformative change and the date of the corresponding documentation update. If no documentation updates were required as the result of this change, explain how this was determined."]},"updated":"2026-06-24"},"SCN-TRF-TPR":{"id":"SCN-TRF-TPR","family":"SCN","scope":"all","subset":"TRF","name":"Third-Party Review","statement":"Providers SHOULD engage a third-party assessor to review the scope and impact of the planned change before starting transformative changes if human validation is necessary; such reviews SHOULD be limited to security decisions that require human validation.","force":"SHOULD","note":"Activities that match the transformative significant change type are rare for a cloud service offering, adjusted for the size, scale, and complexity of the service. Small cloud service offerings may go years without transformative changes, while hyperscale providers may release multiple transformative changes per year.","artifacts":{"all":["Third Party assesment report OR explanation why a third party assessor was not engaged"]},"updated":"2026-06-24"},"SDR-CSO-FRR":{"id":"SDR-CSO-FRR","family":"SDR","scope":"all","subset":"CSO","name":"FedRAMP Rules","statement":"Providers MUST supply a Security Decision Record, in both human-readable and JSON formats, that includes at least all of the following information for each applicable FedRAMP rule:","force":"MUST","following_information":["Explanation of how the rule is followed, or an explanation of the reason and resulting risk to customers for not following the rule.","Verification that the implementation is appropriate for the rule, or that the reason for not implementing is accepted by a senior official.","Validation that the implementation is in place and working as intended, or that the reason for not implementing is accepted by a senior official.","Independent verification.","Independent validation.","Any responses or clarifications to the comments in the independent verification or validation.","Rule-specific artifacts (if applicable)."],"schema":{"name":"FedRAMP Security Decision Record Schema","url":"https://fedramp.gov/schemas/fedramp-security-decision-record-schema-2026-06-24.json"},"updated":"2026-06-24"},"SDR-CSO-MTD":{"id":"SDR-CSO-MTD","family":"SDR","scope":"all","subset":"CSO","name":"Security Decision Record Metadata","statement":"Providers MUST also include the following basic metadata in their Security Decision Record:","force":"MUST","following_information":["Version","Date and time of last update","Source of update"],"updated":"2026-06-24"},"SDR-CSX-KSI":{"id":"SDR-CSX-KSI","family":"SDR","scope":"20x","subset":"CSX","name":"Key Security Indicators","statement":"Providers MUST also include short and simple high-level summaries of at least the following for each applicable Key Security Indicator:","force":"MUST","following_information":["Explanation of measures (and their objectives) that demonstrate the Key Security Indicator, or an explanation of the reason and resulting risk to customers for not having measures available for that Key Security Indicator.","Explanation of the cycle for any measures that are implemented persistently (if applicable).","Verification that the measures demonstrate the Key Security Indicator, or that the reason for not having them is accepted.","Verification that the automation in place is accurate and sufficient to demonstrate appropriate measures for the Key Security Indicator, or that automation is not necessary for each measure.","Validation that the measures are accurately produced and are in place and working as intended, or that the reason for not having them is valid."],"schema":{"name":"FedRAMP Security Decision Record Schema","url":"https://fedramp.gov/schemas/fedramp-security-decision-record-schema-2026-06-24.json"},"updated":"2026-06-24"},"SDR-CSX-KMT":{"id":"SDR-CSX-KMT","family":"SDR","scope":"20x","subset":"CSX","name":"Key Security Indicator Metrics","note":"For initial FedRAMP Certification, providers will need to have mechanisms in place and agree to meet this requirement in the event the cloud service has not been operating with related metrics available for the required period prior to applying for initial certification.","schema":{"name":"FedRAMP Security Decision Record Schema","url":"https://fedramp.gov/schemas/fedramp-security-decision-record-schema-2026-06-24.json"},"updated":"2026-10-08","byClass":{"a":{"statement":"Providers with 20x Class A Certifications MAY also include historical metrics in their Security Decision Record.","force":"MAY"},"b":{"statement":"Providers with 20x Class B Certifications SHOULD also include historical metrics in their Security Decision Record, supplying at least the following information for each applicable Key Security Indicator:","force":"SHOULD","following_information":["Summary of each metric over the past 30 days","Summary of metric up to the past year (where available)"]},"c":{"statement":"Providers with 20x Class C Certifications MUST also include historical metrics in their Security Decision Record, supplying at least the following information for each applicable Key Security Indicator:","force":"MUST","following_information":["Summary of each metric over the past 30 days","Summary of metric up to the past year (where available)","All daily metric data (including status of persistent validation) up to the past year (where available)"]},"d":{"statement":"Providers with 20x Class D Certifications MUST significantly supersede the minimum requirements for lower Classes, with specifics to be set during the 20x Phase 4 Pilot.","force":"MUST"}}},"VDR-CSO-DET":{"id":"VDR-CSO-DET","family":"VDR","scope":"all","subset":"CSO","name":"Vulnerability Detection","statement":"Providers MUST systematically, persistently, and promptly discover and identify vulnerabilities within their cloud service offering using appropriate techniques such as assessment, scanning, threat intelligence, vulnerability disclosure mechanisms, bug bounties, penetration testing, incident response, automated control testing, supply chain monitoring, and other relevant capabilities; this process is called vulnerability detection. Vulnerability detection includes persistently verifying and validating that information resources and processes are operating as intended and documented for FedRAMP Practices.","force":"MUST","notes":["FedRAMP's vulnerability detection (and response) rules are intended to set modern expectations for maintaining the security of a cloud service. Historical FedRAMP guidance on vulnerability scanning or continuous monitoring generally focused only on CVE-type vulnerabilities while leaving other types of vulnerabilities and exposures unaddressed.","Providers are encouraged to leverage their existing holistic security review, architecture review, and similar processes to meet these requirements. FedRAMP strongly discourages providers from implementing separate vulnerability detection and response processes for FedRAMP reporting that are operated by independent compliance branches unless these processes are consuming data directly from the areas of the cloud service that actively maintain it."],"controls":["au-5.2","au-6","ca-8","ca-8.1","ca-8.2","ra-5","ra-5.2","ra-5.3","ra-5.4","si-2","si-3","si-4.1","si-4.12","si-4.18","si-4.22","si-5.1"],"updated":"2026-10-13"},"VDR-CSO-RES":{"id":"VDR-CSO-RES","family":"VDR","scope":"all","subset":"CSO","name":"Vulnerability Response","statement":"Providers MUST systematically, persistently, and promptly track, evaluate, monitor, mitigate, remediate, assess exploitation of, report, and otherwise manage all detected vulnerabilities within their cloud service offering; this process is called vulnerability response.","force":"MUST","notes":["If it is not possible to fully mitigate vulnerabilities or remediate vulnerabilities, providers SHOULD instead partially mitigate vulnerabilities promptly, progressively, and persistently.","FedRAMP does not use the terms \"mitigation\" and \"remediation\" interchangeably. Mitigation is the process of reducing the risk and impact of a vulnerability through partial mitigation and even full mitigation; remediation is the process of entirely eliminating the vulnerability. A fully mitigated vulnerability will still exist (with negligible risk) until it has been remediated. This separation is based on the plain language definitions of these words.","Please refer to FedRAMP Definitions for strict interpretation in the FedRAMP context."],"controls":["au-5.2","ir-4.11","ir-9.3","ra-7","si-2","si-3"],"updated":"2026-10-13"},"VDR-CSO-FAV":{"id":"VDR-CSO-FAV","family":"VDR","scope":"all","subset":"CSO","name":"Failures Are Vulnerabilities","statement":"Providers MUST treat problems or failures with their vulnerability detection and response processes as vulnerabilities.","force":"MUST","controls":["au-5.2","si-4","si-4.1","si-7.7"],"updated":"2026-10-13"},"VDR-CSO-DFR":{"id":"VDR-CSO-DFR","family":"VDR","scope":"all","subset":"CSO","name":"Design For Resilience","statement":"Providers SHOULD make design and architecture decisions for their cloud service offering that mitigate the risk of vulnerabilities by default AND decrease the risk and complexity of vulnerability detection and response.","force":"SHOULD","updated":"2026-06-24"},"VDR-CSO-ADT":{"id":"VDR-CSO-ADT","family":"VDR","scope":"all","subset":"CSO","name":"Automate Detection","statement":"Providers SHOULD use automated services to improve and streamline vulnerability detection and response.","force":"SHOULD","controls":["ra-5","si-2.2","si-3","si-4.2","si-4.5"],"updated":"2026-10-13"},"VDR-CSO-DAC":{"id":"VDR-CSO-DAC","family":"VDR","scope":"all","subset":"CSO","name":"Detect After Changes","statement":"Providers SHOULD automatically perform vulnerability detection on representative samples of new or significantly changed information resources.","force":"SHOULD","controls":["ra-5"],"updated":"2026-10-13"},"VDR-CSO-MSP":{"id":"VDR-CSO-MSP","family":"VDR","scope":"all","subset":"CSO","name":"Maintain Security","statement":"Providers SHOULD NOT weaken the security of information resources to facilitate vulnerability scanning, detection, or assessment activities.","force":"SHOULD NOT","controls":["ra-5.5","si-2"],"updated":"2026-10-13"},"VDR-CSO-AKE":{"id":"VDR-CSO-AKE","family":"VDR","scope":"all","subset":"CSO","name":"Avoid KEVs","statement":"Providers SHOULD NOT deploy or otherwise activate new machine-based information resources with Known Exploited Vulnerabilities.","force":"SHOULD NOT","controls":["ra-5","si-5"],"updated":"2026-10-13"},"VDR-CSO-SIR":{"id":"VDR-CSO-SIR","family":"VDR","scope":"all","subset":"CSO","name":"Sampling","statement":"Providers MAY sample effectively identical information resources, especially machine-based information resources, when performing vulnerability detection UNLESS doing so would decrease the efficiency or effectiveness of vulnerability detection.","force":"MAY","controls":["ra-5.3","ra-5.5"],"updated":"2026-10-13"},"VDR-TFR-NMV":{"id":"VDR-TFR-NMV","family":"VDR","scope":"all","subset":"TFR","name":"Non-Machine Verification and Validation","statement":"Providers MUST verify and validate the status of non-machine-based information resources at least once every 3 months.","force":"MUST","timeframe_type":"months","timeframe_num":3,"updated":"2026-06-24"},"VDR-TFR-PDD":{"id":"VDR-TFR-PDD","family":"VDR","scope":"all","subset":"TFR","name":"Persistent Drift Detection","controls":["si-4.22","si-7","si-7.1"],"updated":"2026-10-13","byClass":{"a":{"statement":"Providers with Class A Certifications SHOULD persistently perform vulnerability detection on all information resources that are likely to drift, at least once every 3 months.","force":"SHOULD","timeframe_type":"months","timeframe_num":3},"b":{"statement":"Providers with Class B Certifications SHOULD persistently perform vulnerability detection on all information resources that are likely to drift, at least once every month.","force":"SHOULD","timeframe_type":"months","timeframe_num":1},"c":{"statement":"Providers with Class C Certifications SHOULD persistently perform vulnerability detection on all information resources that are likely to drift, at least once every 14 days.","force":"SHOULD","timeframe_type":"days","timeframe_num":14},"d":{"statement":"Providers with Class D Certifications SHOULD persistently perform vulnerability detection on all information resources that are likely to drift, at least once every 7 days.","force":"SHOULD","timeframe_type":"days","timeframe_num":7}}},"VDR-TFR-PCD":{"id":"VDR-TFR-PCD","family":"VDR","scope":"all","subset":"TFR","name":"Persistently Complete Detection","updated":"2026-06-24","byClass":{"a":{"statement":"Providers with Class A Certifications SHOULD persistently perform vulnerability detection on all information resources that are NOT likely to drift, at least once every 6 months.","force":"SHOULD","timeframe_type":"months","timeframe_num":6},"b":{"statement":"Providers with Class B Certifications SHOULD persistently perform vulnerability detection on all information resources that are NOT likely to drift, at least once every 6 months.","force":"SHOULD","timeframe_type":"months","timeframe_num":6},"c":{"statement":"Providers with Class C Certifications SHOULD persistently perform vulnerability detection on all information resources that are NOT likely to drift, at least once every month.","force":"SHOULD","timeframe_type":"months","timeframe_num":1},"d":{"statement":"Providers with Class D Certifications SHOULD persistently perform vulnerability detection on all information resources that are NOT likely to drift, at least once every month.","force":"SHOULD","timeframe_type":"months","timeframe_num":1}}},"VDR-TFR-PVR":{"id":"VDR-TFR-PVR","family":"VDR","scope":"all","subset":"TFR","name":"Mitigation and Remediation Expectations","related":["VER-EVA-EPA"],"controls":["si-2.3"],"updated":"2026-10-13","byClass":{"a":{"statement":"Providers with Class A Certifications SHOULD partially mitigate vulnerabilities, fully mitigate vulnerabilities, or remediate vulnerabilities to a lower potential agency impact within the timeframes from evaluation shown below, factoring for the current Potential Agency Impact N-rating as defined in VER-EVA-EPA (Estimate Potential Agency Impact), internet reachability, and likely exploitability.","force":"SHOULD"},"b":{"statement":"Providers with Class B Certifications SHOULD partially mitigate vulnerabilities, fully mitigate vulnerabilities, or remediate vulnerabilities to a lower potential agency impact within the timeframes from evaluation shown below, factoring for the current Potential Agency Impact N-rating as defined in VER-EVA-EPA (Estimate Potential Agency Impact), internet reachability, and likely exploitability:","force":"SHOULD"},"c":{"statement":"Providers with Class C Certifications SHOULD partially mitigate vulnerabilities, fully mitigate vulnerabilities, or remediate vulnerabilities to a lower Potential Agency Impact N-rating within the timeframes from evaluation shown below, factoring for the current Potential Agency Impact N-rating as defined in VER-EVA-EPA (Estimate Potential Agency Impact), internet reachability, and likely exploitability:","force":"SHOULD"},"d":{"statement":"Providers with Class D Certifications SHOULD partially mitigate vulnerabilities, fully mitigate vulnerabilities, or remediate vulnerabilities to a lower Potential Agency Impact N-rating within the maximum timeframes from evaluation shown below, factoring for the current Potential Agency Impact N-rating as defined in VER-EVA-EPA (Estimate Potential Agency Impact), internet reachability, and likely exploitability:","force":"SHOULD"}}},"VDR-TFR-RMN":{"id":"VDR-TFR-RMN","family":"VDR","scope":"all","subset":"TFR","name":"Remaining Vulnerabilities","statement":"Providers SHOULD mitigate or remediate remaining vulnerabilities during routine operations as determined necessary by the provider.","force":"SHOULD","updated":"2026-06-24"},"VDR-TFR-KEV":{"id":"VDR-TFR-KEV","family":"VDR","scope":"all","subset":"TFR","name":"Remediate KEVs","statement":"Providers SHOULD remediate Known Exploited Vulnerabilities according to the due dates in the CISA Known Exploited Vulnerabilities Catalog (even if the vulnerability has been fully mitigated) as required by CISA Binding Operational Directive (BOD) 26-04 or any successor guidance from CISA.","force":"SHOULD","updated":"2026-06-24"},"VDR-TFR-PSD":{"id":"VDR-TFR-PSD","family":"VDR","scope":"all","subset":"TFR","name":"Persistent Sample Detection","updated":"2026-06-24","byClass":{"a":{"statement":"Providers with Class A Certifications SHOULD persistently perform vulnerability detection on representative samples of similar machine-based information resources, at least once every 14 days.","force":"SHOULD","timeframe_type":"days","timeframe_num":14},"b":{"statement":"Providers with Class B Certifications SHOULD persistently perform vulnerability detection on representative samples of similar machine-based information resources, at least once every 7 days.","force":"SHOULD","timeframe_type":"days","timeframe_num":7},"c":{"statement":"Providers with Class C Certifications SHOULD persistently perform vulnerability detection on representative samples of similar machine-based information resources, at least once every 3 days.","force":"SHOULD","timeframe_type":"days","timeframe_num":3},"d":{"statement":"Providers with Class D Certifications SHOULD persistently perform vulnerability detection on representative samples of similar machine-based information resources, at least once per day.","force":"SHOULD","timeframe_type":"days","timeframe_num":1}}},"VDR-TFR-MVX":{"id":"VDR-TFR-MVX","family":"VDR","scope":"20x","subset":"TFR","name":"Persistent Machine Verification and Validation for 20x","updated":"2026-06-24","byClass":{"a":{"statement":"Providers of FedRAMP 20x Class A offerings SHOULD verify and validate the status of machine-based information resources at least once every month.","force":"SHOULD","timeframe_type":"months","timeframe_num":1},"b":{"statement":"Providers of FedRAMP 20x Class B offerings MUST verify and validate the status of machine-based information resources at least once every 7 days.","force":"MUST","timeframe_type":"days","timeframe_num":7},"c":{"statement":"Providers of FedRAMP 20x Class C offerings MUST verify and validate the status of machine-based information resources at least once every 3 days.","force":"MUST","timeframe_type":"days","timeframe_num":3}}},"VER-EVA-ELX":{"id":"VER-EVA-ELX","family":"VER","scope":"all","subset":"EVA","name":"Evaluate Exploitability","statement":"Providers MUST evaluate detected vulnerabilities, considering the context of the cloud service offering, to determine if they are likely exploitable vulnerabilities.","force":"MUST","notes":["The simple reality is that most traditional vulnerabilities discovered by scanners or during assessment are not likely to be exploitable; exploitation typically requires an unrealistic set of circumstances that will not occur during normal operation. The likelihood of exploitation will vary depending on so many factors that FedRAMP will not recommend a specific framework for approaching this beyond these rules.","The proof, ultimately, is in the pudding - providers who regularly evaluate vulnerabilities as not likely exploitable without careful consideration are more likely to suffer from an adverse impact where the root cause was an exploited vulnerability that was improperly evaluated. If done recklessly or deliberately, such actions will have a negative impact on a provider's FedRAMP Certification."],"updated":"2026-06-24"},"VER-EVA-EIR":{"id":"VER-EVA-EIR","family":"VER","scope":"all","subset":"EVA","name":"Evaluate Internet-Reachability","statement":"Providers MUST evaluate detected vulnerabilities, considering the context of the cloud service offering, to determine if they are internet-reachable vulnerabilities.","force":"MUST","notes":["FedRAMP focuses on internet-reachable (rather than internet-accessible) to ensure that any service that might receive a payload from the internet is prioritized if that service has a vulnerability that can be triggered by processing the data in the payload.","The simplest way to prevent exploitation of internet-reachable vulnerabilities is to intercept, inspect, filter, sanitize, reject, or otherwise deflect triggering payloads before they are processed by the vulnerable resource; once this prevention is in place the vulnerability should no longer be considered an internet-reachable vulnerability.","A classic example of an internet-reachable vulnerability on systems that are not typically internet-accessible is [SQL injection](https://en.wikipedia.org/wiki/SQL_injection), where an application stack behind a load balancer and firewall with no ability to route traffic to or from the internet can receive a payload indirectly from the internet that triggers the manipulation or compromise of data in a database that can only be accessed by an authorized connection from the application server on a private network.","Another simple example is the infamous Log4Shell (https://en.wikipedia.org/wiki/Log4Shell) vulnerability from 2021, where exploitation was possible via vulnerable internet-reachable resources deep in the application stack that were often not internet-accessible themselves."],"updated":"2026-06-24"},"VER-EVA-EPA":{"id":"VER-EVA-EPA","family":"VER","scope":"all","subset":"EVA","name":"Estimate Potential Agency Impact","statement":"Providers MUST evaluate detected vulnerabilities, considering the context of the cloud service offering, to estimate the likely potential agency impact of exploitation on government customers AND assign one of the following Potential Agency Impact N-ratings (PAIN):","force":"MUST","following_information_bullets":["**N0**: Exploitation is extremely unlikely to have any adverse effects on agencies that use the cloud service offering.","**N1**: Exploitation could be expected to have minimal customer effects on one or more agencies that use the cloud service offering.","**N2**: Exploitation could be expected to have narrow customer effects on one or more agencies that use the cloud service offering.","**N3**: Exploitation could be expected to have a disruptive customer effect on one agency that uses the cloud service offering.","**N4**: Exploitation could be expected to have a debilitating customer effect on one agency that uses the cloud service offering OR a disruptive customer effect on more than one federal agency that uses the cloud service offering.","**N5**: Exploitation could be expected to have a debilitating customer effect on more than one agency that uses the cloud service offering."],"controls":["ra-3"],"updated":"2026-10-13"},"VER-EVA-AIA":{"id":"VER-EVA-AIA","family":"VER","scope":"all","subset":"EVA","name":"Assume It's Automatable","statement":"Providers MUST assume the exploitation of vulnerabilities can be automated UNLESS they have evidence proving otherwise.","force":"MUST","updated":"2026-06-24"},"VER-EVA-GRV":{"id":"VER-EVA-GRV","family":"VER","scope":"all","subset":"EVA","name":"Group Vulnerabilities","statement":"Providers SHOULD evaluate detected vulnerabilities, considering the context of the cloud service offering, to identify logical groupings of affected information resources that may improve the efficiency and effectiveness of vulnerability response by consolidating further activity; FedRAMP Vulnerability Detection and Response rules are then applied to these consolidated groupings of vulnerabilities instead of each individual detected instance.","force":"SHOULD","updated":"2026-06-24"},"VER-EVA-EFP":{"id":"VER-EVA-EFP","family":"VER","scope":"all","subset":"EVA","name":"Evaluate False Positives","statement":"Providers SHOULD evaluate detected vulnerabilities, considering the context of the cloud service offering, to determine if they are false positive vulnerabilities.","force":"SHOULD","updated":"2026-06-24"},"VER-EVA-EFA":{"id":"VER-EVA-EFA","family":"VER","scope":"all","subset":"EVA","name":"Evaluation Factors","statement":"Providers SHOULD consider at least the following factors when considering the context of the cloud service offering to evaluate detected vulnerabilities:","force":"SHOULD","following_information":["**Criticality**: How important are the systems or information that might be impacted by the vulnerability?","**Reachability**: How might a threat actor reach the vulnerability and how likely is that?","**Exploitability**: How easy is it for a threat actor to exploit the vulnerability and how likely is that?","**Detectability**: How easy is it for a threat actor to become aware of the vulnerability and how likely is that?","**Prevalence**: How much of the cloud service offering is affected by the vulnerability?","**Privilege**: How much privileged authority or access is granted or can be gained from exploiting the vulnerability?","**Proximate Vulnerabilities**: How does this vulnerability interact with previously detected vulnerabilities, especially partially or fully mitigated vulnerabilities?","**Known Threats**: How might already known threats leverage the vulnerability and how likely is that?"],"controls":["ra-9"],"updated":"2026-10-13"},"VER-RPT-PER":{"id":"VER-RPT-PER","family":"VER","scope":"all","subset":"RPT","name":"Persistent Reporting","statement":"Providers MUST report vulnerability detection and response activity (including persistent verification and validation) to all necessary parties persistently, summarizing ALL activity since the previous report; these reports are FedRAMP Certification Data and are subject to FedRAMP Certification Data Sharing rules.","force":"MUST","controls":["si-7.2"],"schema":{"name":"FedRAMP Vulnerability Detail Report (VER-RPT-VDT)","url":"https://fedramp.gov/schemas/fedramp-vulnerability-detail-report-schema-2026-06-24.json"},"updated":"2026-10-13"},"VER-RPT-VDT":{"id":"VER-RPT-VDT","family":"VER","scope":"all","subset":"RPT","name":"Vulnerability Details","statement":"Providers MUST include the following information (if applicable) on detected vulnerabilities when reporting on vulnerability detection and response activity, UNLESS it is an accepted vulnerability:","force":"MUST","following_information":["Provider's internally assigned tracking identifier","Time and source of the detection","Time of completed evaluation","Is it an internet-reachable vulnerability or not?","Is it a likely exploitable vulnerability or not?","Historically and currently estimated Potential Agency Impact N-rating of exploitation","Time and Potential Agency Impact N-rating of each completed and evaluated reduction in Potential Agency Impact N-rating","Estimated time and target Potential Agency Impact N-rating of next reduction in Potential Agency Impact N-rating","Is it currently or is it likely to become an overdue vulnerability or not? If so, explain.","Any supplementary information the provider responsibly determines will help federal agencies assess or mitigate the risk to their federal customer data within the cloud service offering resulting from the vulnerability","Final disposition of the vulnerability"],"controls":["si-2.3"],"artifacts":{"all":["A recent vulnerability report or a sample vulnerability report"]},"schema":{"name":"FedRAMP Vulnerability Detail Report (VER-RPT-VDT)","url":"https://fedramp.gov/schemas/fedramp-vulnerability-detail-report-schema-2026-06-24.json"},"updated":"2026-10-13"},"VER-RPT-AVI":{"id":"VER-RPT-AVI","family":"VER","scope":"all","subset":"RPT","name":"Accepted Vulnerability Info","statement":"Providers MUST include the following information on accepted vulnerabilities when reporting on vulnerability detection and response activity:","force":"MUST","following_information":["Provider's internally assigned tracking identifier","Time and source of the detection","Time of completed evaluation","Is it an internet-reachable vulnerability or not?","Is it a likely exploitable vulnerability or not?","Currently estimated Potential Agency Impact N-rating","Explanation of why this is an accepted vulnerability","Any supplementary information the provider determines will responsibly help federal agencies assess or mitigate the risk to their federal customer data within the cloud service offering resulting from the accepted vulnerability"],"artifacts":{"all":["A recent vulnerability report or a sample vulnerability report"]},"schema":{"name":"FedRAMP Accepted Vulnerability Info (VER-RPT-AVI)","url":"https://fedramp.gov/schemas/fedramp-accepted-vulnerability-info-schema-2026-06-24.json"},"updated":"2026-06-24"},"VER-RPT-NID":{"id":"VER-RPT-NID","family":"VER","scope":"all","subset":"RPT","name":"Responsible Disclosure","statement":"Providers MUST NOT irresponsibly disclose specific sensitive information about vulnerabilities that would likely lead to exploitation, but MUST disclose sufficient information for informed risk-based decision-making to all necessary parties.","force":"MUST NOT","note":"This requirement will be superseded in the event of formal action related to an investigation or corrective action plan.","updated":"2026-06-24"},"VER-RPT-HLO":{"id":"VER-RPT-HLO","family":"VER","scope":"all","subset":"RPT","name":"High-Level Overviews","statement":"Providers SHOULD include high-level overviews of ALL vulnerability detection and response activities conducted during this period for the cloud service offering; this includes vulnerability disclosure programs, bug bounty programs, penetration testing, assessments, etc.","force":"SHOULD","updated":"2026-06-24"},"VER-RPT-RPD":{"id":"VER-RPT-RPD","family":"VER","scope":"all","subset":"RPT","name":"Responsible Public Disclosure","statement":"Providers MAY responsibly disclose vulnerabilities publicly or with other parties if the provider determines doing so will NOT likely lead to exploitation.","force":"MAY","updated":"2026-06-24"},"VER-TFR-MHR":{"id":"VER-TFR-MHR","family":"VER","scope":"all","subset":"TFR","name":"Monthly Activity Report","statement":"Providers MUST report vulnerability detection and response activity to all necessary parties in a consistent format that is human readable at least monthly.","force":"MUST","timeframe_type":"months","timeframe_num":1,"artifacts":{"all":["A recent vulnerability report or a sample vulnerability report"]},"updated":"2026-06-24"},"VER-TFR-MAV":{"id":"VER-TFR-MAV","family":"VER","scope":"all","subset":"TFR","name":"Mark Accepted Vulnerabilities","statement":"Providers MUST categorize any vulnerability that is not or will not be fully mitigated or remediated within 192 days of evaluation as an accepted vulnerability.","force":"MUST","timeframe_type":"days","timeframe_num":192,"updated":"2026-06-24"},"VER-TFR-MRH":{"id":"VER-TFR-MRH","family":"VER","scope":"all","subset":"TFR","name":"Historical Activity","schema":{"name":"FedRAMP Historical Vulnerability Evaluation and Reporting Activity (VER-TFR-MRH)","url":"https://fedramp.gov/schemas/fedramp-historical-ver-activity-schema-2026-06-24.json"},"updated":"2026-06-24","byClass":{"a":{"statement":"Providers with Class A Certifications MAY make all recent historical vulnerability detection and response activity available in JSON format for automated retrieval by all necessary parties (e.g. using an API service or similar); this information MAY be updated persistently, at least once every month.","force":"MAY","timeframe_type":"months","timeframe_num":1,"artifacts":{"all":["URL and access instructions for historical vulnerability detection and response activity in machine readable format"]}},"b":{"statement":"Providers with Class B Certifications SHOULD make all recent historical vulnerability detection and response activity available in JSON format for automated retrieval by all necessary parties (e.g. using an API service or similar); this information SHOULD be updated persistently, at least once every month.","force":"SHOULD","timeframe_type":"months","timeframe_num":1,"artifacts":{"all":["URL and access instructions for historical vulnerability detection and response activity in machine readable format","or an explanation of why machine readable content is not being provided"]}},"c":{"statement":"Providers with Class C Certifications SHOULD make all recent historical vulnerability detection and response activity available in JSON format for automated retrieval by all necessary parties (e.g. using an API service or similar); this information SHOULD be updated persistently, at least once every 14 days.","force":"SHOULD","timeframe_type":"days","timeframe_num":14,"artifacts":{"all":["URL and access instructions for historical vulnerability detection and response activity in machine readable format","or an explanation of why machine readable content is not being provided"]}},"d":{"statement":"Providers with Class D Certifications SHOULD make all recent historical vulnerability detection and response activity available in JSON format for automated retrieval by all necessary parties (e.g. using an API service or similar); this information SHOULD be updated persistently, at least once every 7 days.","force":"SHOULD","timeframe_type":"days","timeframe_num":7,"artifacts":{"all":["URL and access instructions for historical vulnerability detection and response activity in machine readable format","or an explanation of why machine readable content is not being provided"]}}}},"VER-TFR-EVU":{"id":"VER-TFR-EVU","family":"VER","scope":"all","subset":"TFR","name":"Evaluate Vulnerabilities Quickly","updated":"2026-06-24","byClass":{"a":{"statement":"Providers with Class A Certifications SHOULD evaluate ALL vulnerabilities as required by VER-EVA (Evaluation) within 14 days of detection.","force":"SHOULD","timeframe_type":"days","timeframe_num":14},"b":{"statement":"Providers with Class B Certifications SHOULD evaluate ALL vulnerabilities as required by VER-EVA (Evaluation) within 7 days of detection.","force":"SHOULD","timeframe_type":"days","timeframe_num":7},"c":{"statement":"Providers with Class C Certifications SHOULD evaluate ALL vulnerabilities as required by VER-EVA (Evaluation) within 5 days of detection.","force":"SHOULD","timeframe_type":"days","timeframe_num":5},"d":{"statement":"Providers with Class D Certifications SHOULD evaluate ALL vulnerabilities as required by VER-EVA (Evaluation) within 2 days of detection.","force":"SHOULD","timeframe_type":"days","timeframe_num":2}}},"VER-TFR-IRI":{"id":"VER-TFR-IRI","family":"VER","scope":"all","subset":"TFR","name":"Internet-Reachable Incidents","updated":"2026-06-24","byClass":{"a":{"statement":"Providers with Class A Certifications MAY treat internet-reachable likely exploitable vulnerabilities where Potential Agency Impact N-rating > 3 as a FedRAMP Reportable Incident until they are partially mitigated vulnerabilities at N3 or below.","force":"MAY"},"b":{"statement":"Providers with Class B Certifications MAY treat internet-reachable likely exploitable vulnerabilities where Potential Agency Impact N-rating > 3 as a FedRAMP Reportable Incident until they are partially mitigated vulnerabilities at N3 or below.","force":"MAY"},"c":{"statement":"Providers with Class C Certifications SHOULD treat internet-reachable likely exploitable vulnerabilities where Potential Agency Impact N-rating > 3 as a FedRAMP Reportable Incident until they are partially mitigated vulnerabilities at N3 or below.","force":"SHOULD"},"d":{"statement":"Providers with Class D Certifications SHOULD treat internet-reachable likely exploitable vulnerabilities where Potential Agency Impact N-rating > 3 as a FedRAMP Reportable Incident until they are partially mitigated vulnerabilities at N3 or below.","force":"SHOULD"}}},"VER-TFR-NRI":{"id":"VER-TFR-NRI","family":"VER","scope":"all","subset":"TFR","name":"Non-Internet-Reachable Incidents","updated":"2026-06-24","byClass":{"a":{"statement":"Providers with Class A Certifications MAY treat likely exploitable vulnerabilities that are NOT internet-reachable where Potential Agency Impact N-rating = 5 as a FedRAMP Reportable Incident until they are partially mitigated vulnerabilities at N4 or below.","force":"MAY"},"b":{"statement":"Providers with Class B Certifications MAY treat likely exploitable vulnerabilities that are NOT internet-reachable where Potential Agency Impact N-rating = 5 as a FedRAMP Reportable Incident until they are partially mitigated vulnerabilities at N4 or below.","force":"MAY"},"c":{"statement":"Providers with Class C Certifications MAY treat likely exploitable vulnerabilities that are NOT internet-reachable where Potential Agency Impact N-rating = 5 as a FedRAMP Reportable Incident until they are partially mitigated vulnerabilities at N4 or below.","force":"MAY"},"d":{"statement":"Providers with Class D Certifications SHOULD treat likely exploitable vulnerabilities that are NOT internet-reachable where Potential Agency Impact N-rating = 5 as a FedRAMP Reportable Incident until they are partially mitigated vulnerabilities at N4 or below.","force":"SHOULD"}}}},"classes":{"A":{"rules":[{"id":"AFC-CSO-CRA","force":"MUST"},{"id":"AFC-CSO-INB","force":"MUST"},{"id":"AFC-CSO-RCV","force":"MUST"},{"id":"CCM-OCR-AVL","force":"MUST"},{"id":"CCM-OCR-NRD","force":"MUST"},{"id":"CCM-QTR-MTG","force":"MAY"},{"id":"CDS-CSO-AVR","force":"SHOULD"},{"id":"CDS-CSO-PSM","force":"MAY"},{"id":"CDS-CSO-PUB","force":"MUST"},{"id":"CDS-CSO-UTC","force":"MUST"},{"id":"CDS-UTC-AAD","force":"MUST"},{"id":"CMU-CSO-UVM","force":"MAY"},{"id":"CPO-CSX-CPM","force":"SHOULD"},{"id":"FRC-APP-AFC","force":"MUST"},{"id":"FRC-APP-FCP","force":"MUST"},{"id":"FRC-APP-FIA","force":"MAY"},{"id":"FRC-APP-MLF","force":"MUST"},{"id":"FRC-APP-NTP","force":"MUST NOT"},{"id":"FRC-APP-USA","force":"MAY"},{"id":"FRC-CLA-ASF","force":"MUST"},{"id":"FRC-CLA-EAM","force":"MUST"},{"id":"FRC-CLA-IVV","force":"MAY"},{"id":"FRC-CLA-MFR","force":"MUST"},{"id":"FRC-CLA-OFR","force":"MAY"},{"id":"FRC-CLA-RFR","force":"SHOULD"},{"id":"FRC-CSO-FCP","force":"MUST"},{"id":"FRC-CSO-JSN","force":"MUST"},{"id":"FRC-CSO-MRA","force":"MUST"},{"id":"FRC-CSO-PKG","force":"MUST"},{"id":"FRC-CSO-POP","force":"MUST NOT"},{"id":"IEC-CSO-EFR","force":"MUST"},{"id":"IEC-CSO-FIR","force":"MUST"},{"id":"IEC-CSO-IIR","force":"SHOULD"},{"id":"IEC-CSO-OIR","force":"SHOULD"},{"id":"IVV-CSO-FIA","force":"MAY"},{"id":"IVV-CSX-AIA","force":"MUST"},{"id":"MAS-CSO-IIR","force":"MUST"},{"id":"MKT-CSO-MLR","force":"MUST"},{"id":"MKT-CSO-PML","force":"MUST"},{"id":"MKT-IIP-AGU","force":"MUST"},{"id":"MKT-IIP-DCP","force":"MUST"},{"id":"MKT-IIP-DLA","force":"MUST"},{"id":"SDR-CSX-KMT","force":"MAY"},{"id":"VDR-CSO-DET","force":"MUST"},{"id":"VDR-TFR-MVX","force":"SHOULD"},{"id":"VDR-TFR-PCD","force":"SHOULD"},{"id":"VDR-TFR-PDD","force":"SHOULD"},{"id":"VDR-TFR-PSD","force":"SHOULD"},{"id":"VDR-TFR-PVR","force":"SHOULD"},{"id":"VER-TFR-EVU","force":"SHOULD"},{"id":"VER-TFR-IRI","force":"MAY"},{"id":"VER-TFR-MRH","force":"MAY"},{"id":"VER-TFR-NRI","force":"MAY"}],"ksis":[{"id":"KSI-CED-RAT","force":"MUST"},{"id":"KSI-CMT-LMC","force":"MUST"},{"id":"KSI-CNA-RNT","force":"MUST"},{"id":"KSI-IAM-AAM","force":"MUST"},{"id":"KSI-IAM-APM","force":"MUST"},{"id":"KSI-INR-RIR","force":"MUST"},{"id":"KSI-SVC-SIN","force":"MUST"}],"counts":{"rules":53,"byForce":{"MAY":12,"MUST":28,"MUST NOT":2,"SHOULD":11},"ksis":7},"rev5Controls":[],"provisional":false},"B":{"rules":[{"id":"AFC-CSO-ACK","force":"SHOULD"},{"id":"AFC-CSO-CRA","force":"MUST"},{"id":"AFC-CSO-EMR","force":"MUST"},{"id":"AFC-CSO-IMA","force":"SHOULD"},{"id":"AFC-CSO-INB","force":"MUST"},{"id":"AFC-CSO-NOC","force":"MUST"},{"id":"AFC-CSO-RCV","force":"MUST"},{"id":"AFC-CSO-TFG","force":"MUST"},{"id":"CCM-OCR-AFS","force":"MUST"},{"id":"CCM-OCR-AVL","force":"MUST"},{"id":"CCM-OCR-FBM","force":"MUST"},{"id":"CCM-OCR-LSI","force":"MUST NOT"},{"id":"CCM-OCR-NRD","force":"MUST"},{"id":"CCM-OCR-RPS","force":"MAY"},{"id":"CCM-OCR-SOR","force":"SHOULD"},{"id":"CCM-QTR-ACT","force":"SHOULD"},{"id":"CCM-QTR-MTG","force":"SHOULD"},{"id":"CCM-QTR-NID","force":"MUST NOT"},{"id":"CCM-QTR-NRD","force":"MUST"},{"id":"CCM-QTR-REG","force":"MUST"},{"id":"CCM-QTR-RTP","force":"SHOULD NOT"},{"id":"CCM-QTR-RTR","force":"SHOULD"},{"id":"CCM-QTR-SAR","force":"SHOULD"},{"id":"CCM-QTR-SCR","force":"MAY"},{"id":"CCM-QTR-SRR","force":"MAY"},{"id":"CDS-CSO-AVR","force":"MUST"},{"id":"CDS-CSO-CBF","force":"MUST"},{"id":"CDS-CSO-FID","force":"MUST"},{"id":"CDS-CSO-FRC","force":"MUST"},{"id":"CDS-CSO-HAD","force":"MUST"},{"id":"CDS-CSO-IRP","force":"MUST"},{"id":"CDS-CSO-PSM","force":"MAY"},{"id":"CDS-CSO-PUB","force":"MUST"},{"id":"CDS-CSO-RIS","force":"MUST"},{"id":"CDS-CSO-RPS","force":"MAY"},{"id":"CDS-CSO-SVC","force":"MUST"},{"id":"CDS-CSO-UTC","force":"MUST"},{"id":"CDS-TRC-AAI","force":"MUST"},{"id":"CDS-TRC-ACL","force":"MUST"},{"id":"CDS-TRC-HMR","force":"SHOULD"},{"id":"CDS-TRC-PAC","force":"MUST"},{"id":"CDS-TRC-SSM","force":"SHOULD"},{"id":"CDS-TRC-USH","force":"MUST"},{"id":"CDS-UTC-AAD","force":"MUST"},{"id":"CDS-UTC-AGA","force":"SHOULD"},{"id":"CMU-CSO-CAT","force":"SHOULD"},{"id":"CMU-CSO-CMD","force":"MUST"},{"id":"CMU-CSO-UVM","force":"MAY"},{"id":"CPO-CSO-MTD","force":"MUST"},{"id":"CPO-CSO-OSA","force":"MUST"},{"id":"CPO-CSO-OVR","force":"MUST"},{"id":"CPO-CSX-CPM","force":"MUST"},{"id":"FRC-APP-AFC","force":"MUST"},{"id":"FRC-APP-FCP","force":"MUST"},{"id":"FRC-APP-FIA","force":"MUST"},{"id":"FRC-APP-MLF","force":"MUST"},{"id":"FRC-APP-NTP","force":"MUST NOT"},{"id":"FRC-APP-USA","force":"MAY"},{"id":"FRC-CSO-FCP","force":"MUST"},{"id":"FRC-CSO-JSN","force":"MUST"},{"id":"FRC-CSO-MRA","force":"MUST"},{"id":"FRC-CSO-PKG","force":"MUST"},{"id":"FRC-CSO-POP","force":"MUST NOT"},{"id":"FRC-CSX-MAS","force":"SHOULD"},{"id":"FRC-CSX-VVK","force":"SHOULD"},{"id":"FRC-CSX-VVR","force":"SHOULD"},{"id":"IEC-CSO-AIR","force":"SHOULD"},{"id":"IEC-CSO-DPR","force":"MUST"},{"id":"IEC-CSO-EFI","force":"SHOULD"},{"id":"IEC-CSO-EFR","force":"MUST"},{"id":"IEC-CSO-FIR","force":"MUST"},{"id":"IEC-CSO-IIR","force":"MUST"},{"id":"IEC-CSO-OIR","force":"MUST"},{"id":"IVV-CSO-DUS","force":"MUST"},{"id":"IVV-CSO-FIA","force":"MUST"},{"id":"IVV-CSO-ICP","force":"MUST"},{"id":"IVV-CSO-RAA","force":"MAY"},{"id":"IVV-CSO-SEE","force":"MUST"},{"id":"IVV-CSO-SEI","force":"MUST"},{"id":"IVV-CSO-STE","force":"SHOULD"},{"id":"IVV-CSO-USR","force":"MAY"},{"id":"IVV-CSX-AIA","force":"MUST"},{"id":"MAS-CSO-FLO","force":"MUST"},{"id":"MAS-CSO-IIR","force":"MUST"},{"id":"MAS-CSO-MDI","force":"MUST"},{"id":"MAS-CSO-SUP","force":"MAY"},{"id":"MAS-CSO-TPR","force":"MUST"},{"id":"MKT-CSO-MLR","force":"MUST"},{"id":"MKT-CSO-PML","force":"MUST"},{"id":"MKT-IIP-AGU","force":"MUST"},{"id":"MKT-IIP-DCP","force":"MUST"},{"id":"MKT-IIP-DLA","force":"MUST"},{"id":"SCG-CSO-AUP","force":"MUST"},{"id":"SCG-CSO-PUB","force":"SHOULD"},{"id":"SCG-CSO-RSC","force":"MUST"},{"id":"SCG-CSO-SDF","force":"SHOULD"},{"id":"SCG-ENH-API","force":"SHOULD"},{"id":"SCG-ENH-CMP","force":"SHOULD"},{"id":"SCG-ENH-EXP","force":"SHOULD"},{"id":"SCG-ENH-MRG","force":"SHOULD"},{"id":"SCG-ENH-VRH","force":"SHOULD"},{"id":"SCN-ADP-NTF","force":"MUST"},{"id":"SCN-CSO-ARI","force":"MAY"},{"id":"SCN-CSO-EMG","force":"MAY"},{"id":"SCN-CSO-EVA","force":"MUST"},{"id":"SCN-CSO-HIS","force":"MUST"},{"id":"SCN-CSO-HRM","force":"MUST"},{"id":"SCN-CSO-INF","force":"MUST"},{"id":"SCN-CSO-MAR","force":"MUST"},{"id":"SCN-CSO-NOM","force":"MAY"},{"id":"SCN-RTR-NNR","force":"SHOULD NOT"},{"id":"SCN-TRF-NAF","force":"MUST"},{"id":"SCN-TRF-NAV","force":"MUST"},{"id":"SCN-TRF-NFP","force":"MUST"},{"id":"SCN-TRF-NIP","force":"MUST"},{"id":"SCN-TRF-TPR","force":"SHOULD"},{"id":"SCN-TRF-UPD","force":"MUST"},{"id":"SDR-CSO-FRR","force":"MUST"},{"id":"SDR-CSO-MTD","force":"MUST"},{"id":"SDR-CSX-KMT","force":"SHOULD"},{"id":"SDR-CSX-KSI","force":"MUST"},{"id":"VDR-CSO-ADT","force":"SHOULD"},{"id":"VDR-CSO-AKE","force":"SHOULD NOT"},{"id":"VDR-CSO-DAC","force":"SHOULD"},{"id":"VDR-CSO-DET","force":"MUST"},{"id":"VDR-CSO-DFR","force":"SHOULD"},{"id":"VDR-CSO-FAV","force":"MUST"},{"id":"VDR-CSO-MSP","force":"SHOULD NOT"},{"id":"VDR-CSO-RES","force":"MUST"},{"id":"VDR-CSO-SIR","force":"MAY"},{"id":"VDR-TFR-KEV","force":"SHOULD"},{"id":"VDR-TFR-MVX","force":"MUST"},{"id":"VDR-TFR-NMV","force":"MUST"},{"id":"VDR-TFR-PCD","force":"SHOULD"},{"id":"VDR-TFR-PDD","force":"SHOULD"},{"id":"VDR-TFR-PSD","force":"SHOULD"},{"id":"VDR-TFR-PVR","force":"SHOULD"},{"id":"VDR-TFR-RMN","force":"SHOULD"},{"id":"VER-EVA-AIA","force":"MUST"},{"id":"VER-EVA-EFA","force":"SHOULD"},{"id":"VER-EVA-EFP","force":"SHOULD"},{"id":"VER-EVA-EIR","force":"MUST"},{"id":"VER-EVA-ELX","force":"MUST"},{"id":"VER-EVA-EPA","force":"MUST"},{"id":"VER-EVA-GRV","force":"SHOULD"},{"id":"VER-RPT-AVI","force":"MUST"},{"id":"VER-RPT-HLO","force":"SHOULD"},{"id":"VER-RPT-NID","force":"MUST NOT"},{"id":"VER-RPT-PER","force":"MUST"},{"id":"VER-RPT-RPD","force":"MAY"},{"id":"VER-RPT-VDT","force":"MUST"},{"id":"VER-TFR-EVU","force":"SHOULD"},{"id":"VER-TFR-IRI","force":"MAY"},{"id":"VER-TFR-MAV","force":"MUST"},{"id":"VER-TFR-MHR","force":"MUST"},{"id":"VER-TFR-MRH","force":"SHOULD"},{"id":"VER-TFR-NRI","force":"MAY"}],"ksis":[{"id":"KSI-CED-RAT"},{"id":"KSI-CMT-LMC"},{"id":"KSI-CMT-RMV"},{"id":"KSI-CMT-RVP"},{"id":"KSI-CMT-VTD"},{"id":"KSI-CNA-DFP"},{"id":"KSI-CNA-EIS","optional":true},{"id":"KSI-CNA-IBP"},{"id":"KSI-CNA-MAT"},{"id":"KSI-CNA-OFA"},{"id":"KSI-CNA-RNT"},{"id":"KSI-CNA-RVP"},{"id":"KSI-CNA-ULN"},{"id":"KSI-IAM-AAM"},{"id":"KSI-IAM-APM"},{"id":"KSI-IAM-ELP"},{"id":"KSI-IAM-JIT"},{"id":"KSI-IAM-SNU"},{"id":"KSI-IAM-SUS"},{"id":"KSI-INR-AAR"},{"id":"KSI-INR-RIR"},{"id":"KSI-INR-RPI"},{"id":"KSI-MLA-ALA","optional":true},{"id":"KSI-MLA-EVC"},{"id":"KSI-MLA-LET"},{"id":"KSI-MLA-OSM"},{"id":"KSI-MLA-RVL"},{"id":"KSI-PIY-GIV"},{"id":"KSI-PIY-RES"},{"id":"KSI-PIY-RIS"},{"id":"KSI-PIY-RSD"},{"id":"KSI-PIY-RVD"},{"id":"KSI-RPL-ABO"},{"id":"KSI-RPL-ARP"},{"id":"KSI-RPL-RRO"},{"id":"KSI-RPL-TRC"},{"id":"KSI-SCR-MIT"},{"id":"KSI-SCR-MON"},{"id":"KSI-SVC-ACM"},{"id":"KSI-SVC-ASM"},{"id":"KSI-SVC-EIS"},{"id":"KSI-SVC-PRR","optional":true},{"id":"KSI-SVC-RUD","optional":true},{"id":"KSI-SVC-SIN"},{"id":"KSI-SVC-VCM","optional":true},{"id":"KSI-SVC-VRI"}],"counts":{"rules":157,"byForce":{"MAY":17,"MUST":90,"MUST NOT":5,"SHOULD":41,"SHOULD NOT":4},"ksis":46},"rev5Controls":[{"label":"AC-01","oscal":"ac-1"},{"label":"AC-02","oscal":"ac-2"},{"label":"AC-03","oscal":"ac-3"},{"label":"AC-07","oscal":"ac-7"},{"label":"AC-08","oscal":"ac-8"},{"label":"AC-14","oscal":"ac-14"},{"label":"AC-17","oscal":"ac-17"},{"label":"AC-18","oscal":"ac-18"},{"label":"AC-19","oscal":"ac-19"},{"label":"AC-20","oscal":"ac-20"},{"label":"AC-22","oscal":"ac-22"},{"label":"AT-01","oscal":"at-1"},{"label":"AT-02","oscal":"at-2"},{"label":"AT-02 (02)","oscal":"at-2.2"},{"label":"AT-03","oscal":"at-3"},{"label":"AT-04","oscal":"at-4"},{"label":"AU-01","oscal":"au-1"},{"label":"AU-02","oscal":"au-2"},{"label":"AU-03","oscal":"au-3"},{"label":"AU-04","oscal":"au-4"},{"label":"AU-05","oscal":"au-5"},{"label":"AU-06","oscal":"au-6"},{"label":"AU-08","oscal":"au-8"},{"label":"AU-09","oscal":"au-9"},{"label":"AU-11","oscal":"au-11"},{"label":"AU-12","oscal":"au-12"},{"label":"CA-01","oscal":"ca-1"},{"label":"CA-02","oscal":"ca-2"},{"label":"CA-02 (01)","oscal":"ca-2.1"},{"label":"CA-03","oscal":"ca-3"},{"label":"CA-06","oscal":"ca-6"},{"label":"CA-07","oscal":"ca-7"},{"label":"CA-07 (04)","oscal":"ca-7.4"},{"label":"CA-08","oscal":"ca-8"},{"label":"CA-09","oscal":"ca-9"},{"label":"CM-01","oscal":"cm-1"},{"label":"CM-02","oscal":"cm-2"},{"label":"CM-04","oscal":"cm-4"},{"label":"CM-05","oscal":"cm-5"},{"label":"CM-06","oscal":"cm-6"},{"label":"CM-07","oscal":"cm-7"},{"label":"CM-08","oscal":"cm-8"},{"label":"CM-10","oscal":"cm-10"},{"label":"CM-11","oscal":"cm-11"},{"label":"CP-01","oscal":"cp-1"},{"label":"CP-02","oscal":"cp-2"},{"label":"CP-03","oscal":"cp-3"},{"label":"CP-04","oscal":"cp-4"},{"label":"CP-09","oscal":"cp-9"},{"label":"CP-10","oscal":"cp-10"},{"label":"IA-01","oscal":"ia-1"},{"label":"IA-02","oscal":"ia-2"},{"label":"IA-02 (01)","oscal":"ia-2.1"},{"label":"IA-02 (02)","oscal":"ia-2.2"},{"label":"IA-02 (08)","oscal":"ia-2.8"},{"label":"IA-02 (12)","oscal":"ia-2.12"},{"label":"IA-04","oscal":"ia-4"},{"label":"IA-05","oscal":"ia-5"},{"label":"IA-05 (01)","oscal":"ia-5.1"},{"label":"IA-06","oscal":"ia-6"},{"label":"IA-07","oscal":"ia-7"},{"label":"IA-08","oscal":"ia-8"},{"label":"IA-08 (01)","oscal":"ia-8.1"},{"label":"IA-08 (02)","oscal":"ia-8.2"},{"label":"IA-08 (04)","oscal":"ia-8.4"},{"label":"IA-11","oscal":"ia-11"},{"label":"IR-01","oscal":"ir-1"},{"label":"IR-02","oscal":"ir-2"},{"label":"IR-04","oscal":"ir-4"},{"label":"IR-05","oscal":"ir-5"},{"label":"IR-06","oscal":"ir-6"},{"label":"IR-07","oscal":"ir-7"},{"label":"IR-08","oscal":"ir-8"},{"label":"MA-01","oscal":"ma-1"},{"label":"MA-02","oscal":"ma-2"},{"label":"MA-04","oscal":"ma-4"},{"label":"MA-05","oscal":"ma-5"},{"label":"MP-01","oscal":"mp-1"},{"label":"MP-02","oscal":"mp-2"},{"label":"MP-06","oscal":"mp-6"},{"label":"MP-07","oscal":"mp-7"},{"label":"PE-01","oscal":"pe-1"},{"label":"PE-02","oscal":"pe-2"},{"label":"PE-03","oscal":"pe-3"},{"label":"PE-06","oscal":"pe-6"},{"label":"PE-08","oscal":"pe-8"},{"label":"PE-12","oscal":"pe-12"},{"label":"PE-13","oscal":"pe-13"},{"label":"PE-14","oscal":"pe-14"},{"label":"PE-15","oscal":"pe-15"},{"label":"PE-16","oscal":"pe-16"},{"label":"PL-01","oscal":"pl-1"},{"label":"PL-02","oscal":"pl-2"},{"label":"PL-04","oscal":"pl-4"},{"label":"PL-04 (01)","oscal":"pl-4.1"},{"label":"PL-08","oscal":"pl-8"},{"label":"PL-10","oscal":"pl-10"},{"label":"PL-11","oscal":"pl-11"},{"label":"PS-01","oscal":"ps-1"},{"label":"PS-02","oscal":"ps-2"},{"label":"PS-03","oscal":"ps-3"},{"label":"PS-04","oscal":"ps-4"},{"label":"PS-05","oscal":"ps-5"},{"label":"PS-06","oscal":"ps-6"},{"label":"PS-07","oscal":"ps-7"},{"label":"PS-08","oscal":"ps-8"},{"label":"PS-09","oscal":"ps-9"},{"label":"RA-01","oscal":"ra-1"},{"label":"RA-02","oscal":"ra-2"},{"label":"RA-03","oscal":"ra-3"},{"label":"RA-03 (01)","oscal":"ra-3.1"},{"label":"RA-05","oscal":"ra-5"},{"label":"RA-05 (02)","oscal":"ra-5.2"},{"label":"RA-05 (11)","oscal":"ra-5.11"},{"label":"RA-07","oscal":"ra-7"},{"label":"SA-01","oscal":"sa-1"},{"label":"SA-02","oscal":"sa-2"},{"label":"SA-03","oscal":"sa-3"},{"label":"SA-04","oscal":"sa-4"},{"label":"SA-04 (10)","oscal":"sa-4.10"},{"label":"SA-05","oscal":"sa-5"},{"label":"SA-08","oscal":"sa-8"},{"label":"SA-09","oscal":"sa-9"},{"label":"SA-22","oscal":"sa-22"},{"label":"SC-01","oscal":"sc-1"},{"label":"SC-05","oscal":"sc-5"},{"label":"SC-07","oscal":"sc-7"},{"label":"SC-08","oscal":"sc-8"},{"label":"SC-08 (01)","oscal":"sc-8.1"},{"label":"SC-12","oscal":"sc-12"},{"label":"SC-13","oscal":"sc-13"},{"label":"SC-15","oscal":"sc-15"},{"label":"SC-20","oscal":"sc-20"},{"label":"SC-21","oscal":"sc-21"},{"label":"SC-22","oscal":"sc-22"},{"label":"SC-28","oscal":"sc-28"},{"label":"SC-28 (01)","oscal":"sc-28.1"},{"label":"SC-39","oscal":"sc-39"},{"label":"SI-01","oscal":"si-1"},{"label":"SI-02","oscal":"si-2"},{"label":"SI-03","oscal":"si-3"},{"label":"SI-04","oscal":"si-4"},{"label":"SI-05","oscal":"si-5"},{"label":"SI-12","oscal":"si-12"},{"label":"SR-01","oscal":"sr-1"},{"label":"SR-02","oscal":"sr-2"},{"label":"SR-02 (01)","oscal":"sr-2.1"},{"label":"SR-03","oscal":"sr-3"},{"label":"SR-05","oscal":"sr-5"},{"label":"SR-08","oscal":"sr-8"},{"label":"SR-10","oscal":"sr-10"},{"label":"SR-11","oscal":"sr-11"},{"label":"SR-11 (01)","oscal":"sr-11.1"},{"label":"SR-11 (02)","oscal":"sr-11.2"},{"label":"SR-12","oscal":"sr-12"}],"provisional":false},"C":{"rules":[{"id":"AFC-CSO-ACK","force":"SHOULD"},{"id":"AFC-CSO-CRA","force":"MUST"},{"id":"AFC-CSO-EMR","force":"MUST"},{"id":"AFC-CSO-IMA","force":"SHOULD"},{"id":"AFC-CSO-INB","force":"MUST"},{"id":"AFC-CSO-NOC","force":"MUST"},{"id":"AFC-CSO-RCV","force":"MUST"},{"id":"AFC-CSO-TFG","force":"MUST"},{"id":"CCM-OCR-AFS","force":"MUST"},{"id":"CCM-OCR-AVL","force":"MUST"},{"id":"CCM-OCR-FBM","force":"MUST"},{"id":"CCM-OCR-LSI","force":"MUST NOT"},{"id":"CCM-OCR-NRD","force":"MUST"},{"id":"CCM-OCR-RPS","force":"MAY"},{"id":"CCM-OCR-SOR","force":"SHOULD"},{"id":"CCM-QTR-ACT","force":"SHOULD"},{"id":"CCM-QTR-MTG","force":"MUST"},{"id":"CCM-QTR-NID","force":"MUST NOT"},{"id":"CCM-QTR-NRD","force":"MUST"},{"id":"CCM-QTR-REG","force":"MUST"},{"id":"CCM-QTR-RTP","force":"SHOULD NOT"},{"id":"CCM-QTR-RTR","force":"SHOULD"},{"id":"CCM-QTR-SAR","force":"SHOULD"},{"id":"CCM-QTR-SCR","force":"MAY"},{"id":"CCM-QTR-SRR","force":"MAY"},{"id":"CDS-CSO-AVR","force":"MUST"},{"id":"CDS-CSO-CBF","force":"MUST"},{"id":"CDS-CSO-FID","force":"MUST"},{"id":"CDS-CSO-FRC","force":"MUST"},{"id":"CDS-CSO-HAD","force":"MUST"},{"id":"CDS-CSO-IRP","force":"MUST"},{"id":"CDS-CSO-PSM","force":"MAY"},{"id":"CDS-CSO-PUB","force":"MUST"},{"id":"CDS-CSO-RIS","force":"MUST"},{"id":"CDS-CSO-RPS","force":"MAY"},{"id":"CDS-CSO-SVC","force":"MUST"},{"id":"CDS-CSO-UTC","force":"MUST"},{"id":"CDS-TRC-AAI","force":"MUST"},{"id":"CDS-TRC-ACL","force":"MUST"},{"id":"CDS-TRC-HMR","force":"SHOULD"},{"id":"CDS-TRC-PAC","force":"MUST"},{"id":"CDS-TRC-SSM","force":"SHOULD"},{"id":"CDS-TRC-USH","force":"MUST"},{"id":"CDS-UTC-AAD","force":"MUST"},{"id":"CDS-UTC-AGA","force":"SHOULD"},{"id":"CMU-CSO-CAT","force":"SHOULD"},{"id":"CMU-CSO-CMD","force":"MUST"},{"id":"CMU-CSO-UVM","force":"SHOULD"},{"id":"CPO-CSO-MTD","force":"MUST"},{"id":"CPO-CSO-OSA","force":"MUST"},{"id":"CPO-CSO-OVR","force":"MUST"},{"id":"CPO-CSX-CPM","force":"MUST"},{"id":"FRC-APP-AFC","force":"MUST"},{"id":"FRC-APP-FCP","force":"MUST"},{"id":"FRC-APP-FIA","force":"MUST"},{"id":"FRC-APP-MLF","force":"MUST"},{"id":"FRC-APP-NTP","force":"MUST NOT"},{"id":"FRC-APP-USA","force":"MAY"},{"id":"FRC-CSO-FCP","force":"MUST"},{"id":"FRC-CSO-JSN","force":"MUST"},{"id":"FRC-CSO-MRA","force":"MUST"},{"id":"FRC-CSO-PKG","force":"MUST"},{"id":"FRC-CSO-POP","force":"MUST NOT"},{"id":"FRC-CSX-MAS","force":"SHOULD"},{"id":"FRC-CSX-VVK","force":"MUST"},{"id":"FRC-CSX-VVR","force":"SHOULD"},{"id":"IEC-CSO-AIR","force":"SHOULD"},{"id":"IEC-CSO-DPR","force":"MUST"},{"id":"IEC-CSO-EFI","force":"SHOULD"},{"id":"IEC-CSO-EFR","force":"MUST"},{"id":"IEC-CSO-FIR","force":"MUST"},{"id":"IEC-CSO-IIR","force":"MUST"},{"id":"IEC-CSO-OIR","force":"MUST"},{"id":"IVV-CSO-DUS","force":"MUST"},{"id":"IVV-CSO-FIA","force":"MUST"},{"id":"IVV-CSO-ICP","force":"MUST"},{"id":"IVV-CSO-RAA","force":"MAY"},{"id":"IVV-CSO-SEE","force":"MUST"},{"id":"IVV-CSO-SEI","force":"MUST"},{"id":"IVV-CSO-STE","force":"SHOULD"},{"id":"IVV-CSO-USR","force":"MAY"},{"id":"IVV-CSX-AIA","force":"MUST"},{"id":"MAS-CSO-FLO","force":"MUST"},{"id":"MAS-CSO-IIR","force":"MUST"},{"id":"MAS-CSO-MDI","force":"MUST"},{"id":"MAS-CSO-SUP","force":"MAY"},{"id":"MAS-CSO-TPR","force":"MUST"},{"id":"MKT-CSO-MLR","force":"MUST"},{"id":"MKT-CSO-PML","force":"MUST"},{"id":"MKT-IIP-AGU","force":"MUST"},{"id":"MKT-IIP-DCP","force":"MUST"},{"id":"MKT-IIP-DLA","force":"MUST"},{"id":"SCG-CSO-AUP","force":"MUST"},{"id":"SCG-CSO-PUB","force":"SHOULD"},{"id":"SCG-CSO-RSC","force":"MUST"},{"id":"SCG-CSO-SDF","force":"SHOULD"},{"id":"SCG-ENH-API","force":"SHOULD"},{"id":"SCG-ENH-CMP","force":"SHOULD"},{"id":"SCG-ENH-EXP","force":"SHOULD"},{"id":"SCG-ENH-MRG","force":"SHOULD"},{"id":"SCG-ENH-VRH","force":"SHOULD"},{"id":"SCN-ADP-NTF","force":"MUST"},{"id":"SCN-CSO-ARI","force":"MAY"},{"id":"SCN-CSO-EMG","force":"MAY"},{"id":"SCN-CSO-EVA","force":"MUST"},{"id":"SCN-CSO-HIS","force":"MUST"},{"id":"SCN-CSO-HRM","force":"MUST"},{"id":"SCN-CSO-INF","force":"MUST"},{"id":"SCN-CSO-MAR","force":"MUST"},{"id":"SCN-CSO-NOM","force":"MAY"},{"id":"SCN-RTR-NNR","force":"SHOULD NOT"},{"id":"SCN-TRF-NAF","force":"MUST"},{"id":"SCN-TRF-NAV","force":"MUST"},{"id":"SCN-TRF-NFP","force":"MUST"},{"id":"SCN-TRF-NIP","force":"MUST"},{"id":"SCN-TRF-TPR","force":"SHOULD"},{"id":"SCN-TRF-UPD","force":"MUST"},{"id":"SDR-CSO-FRR","force":"MUST"},{"id":"SDR-CSO-MTD","force":"MUST"},{"id":"SDR-CSX-KMT","force":"MUST"},{"id":"SDR-CSX-KSI","force":"MUST"},{"id":"VDR-CSO-ADT","force":"SHOULD"},{"id":"VDR-CSO-AKE","force":"SHOULD NOT"},{"id":"VDR-CSO-DAC","force":"SHOULD"},{"id":"VDR-CSO-DET","force":"MUST"},{"id":"VDR-CSO-DFR","force":"SHOULD"},{"id":"VDR-CSO-FAV","force":"MUST"},{"id":"VDR-CSO-MSP","force":"SHOULD NOT"},{"id":"VDR-CSO-RES","force":"MUST"},{"id":"VDR-CSO-SIR","force":"MAY"},{"id":"VDR-TFR-KEV","force":"SHOULD"},{"id":"VDR-TFR-MVX","force":"MUST"},{"id":"VDR-TFR-NMV","force":"MUST"},{"id":"VDR-TFR-PCD","force":"SHOULD"},{"id":"VDR-TFR-PDD","force":"SHOULD"},{"id":"VDR-TFR-PSD","force":"SHOULD"},{"id":"VDR-TFR-PVR","force":"SHOULD"},{"id":"VDR-TFR-RMN","force":"SHOULD"},{"id":"VER-EVA-AIA","force":"MUST"},{"id":"VER-EVA-EFA","force":"SHOULD"},{"id":"VER-EVA-EFP","force":"SHOULD"},{"id":"VER-EVA-EIR","force":"MUST"},{"id":"VER-EVA-ELX","force":"MUST"},{"id":"VER-EVA-EPA","force":"MUST"},{"id":"VER-EVA-GRV","force":"SHOULD"},{"id":"VER-RPT-AVI","force":"MUST"},{"id":"VER-RPT-HLO","force":"SHOULD"},{"id":"VER-RPT-NID","force":"MUST NOT"},{"id":"VER-RPT-PER","force":"MUST"},{"id":"VER-RPT-RPD","force":"MAY"},{"id":"VER-RPT-VDT","force":"MUST"},{"id":"VER-TFR-EVU","force":"SHOULD"},{"id":"VER-TFR-IRI","force":"SHOULD"},{"id":"VER-TFR-MAV","force":"MUST"},{"id":"VER-TFR-MHR","force":"MUST"},{"id":"VER-TFR-MRH","force":"SHOULD"},{"id":"VER-TFR-NRI","force":"MAY"}],"ksis":[{"id":"KSI-CED-RAT"},{"id":"KSI-CMT-LMC"},{"id":"KSI-CMT-RMV"},{"id":"KSI-CMT-RVP"},{"id":"KSI-CMT-VTD"},{"id":"KSI-CNA-DFP"},{"id":"KSI-CNA-EIS"},{"id":"KSI-CNA-IBP"},{"id":"KSI-CNA-MAT"},{"id":"KSI-CNA-OFA"},{"id":"KSI-CNA-RNT"},{"id":"KSI-CNA-RVP"},{"id":"KSI-CNA-ULN"},{"id":"KSI-IAM-AAM"},{"id":"KSI-IAM-APM"},{"id":"KSI-IAM-ELP"},{"id":"KSI-IAM-JIT"},{"id":"KSI-IAM-SNU"},{"id":"KSI-IAM-SUS"},{"id":"KSI-INR-AAR"},{"id":"KSI-INR-RIR"},{"id":"KSI-INR-RPI"},{"id":"KSI-MLA-ALA"},{"id":"KSI-MLA-EVC"},{"id":"KSI-MLA-LET"},{"id":"KSI-MLA-OSM"},{"id":"KSI-MLA-RVL"},{"id":"KSI-PIY-GIV"},{"id":"KSI-PIY-RES"},{"id":"KSI-PIY-RIS"},{"id":"KSI-PIY-RSD"},{"id":"KSI-PIY-RVD"},{"id":"KSI-RPL-ABO"},{"id":"KSI-RPL-ARP"},{"id":"KSI-RPL-RRO"},{"id":"KSI-RPL-TRC"},{"id":"KSI-SCR-MIT"},{"id":"KSI-SCR-MON"},{"id":"KSI-SVC-ACM"},{"id":"KSI-SVC-ASM"},{"id":"KSI-SVC-EIS"},{"id":"KSI-SVC-PRR"},{"id":"KSI-SVC-RUD"},{"id":"KSI-SVC-SIN"},{"id":"KSI-SVC-VCM"},{"id":"KSI-SVC-VRI"}],"counts":{"rules":157,"byForce":{"MAY":15,"MUST":93,"MUST NOT":5,"SHOULD":40,"SHOULD NOT":4},"ksis":46},"rev5Controls":[{"label":"AC-01","oscal":"ac-1"},{"label":"AC-02","oscal":"ac-2"},{"label":"AC-02 (01)","oscal":"ac-2.1"},{"label":"AC-02 (02)","oscal":"ac-2.2"},{"label":"AC-02 (03)","oscal":"ac-2.3"},{"label":"AC-02 (04)","oscal":"ac-2.4"},{"label":"AC-02 (05)","oscal":"ac-2.5"},{"label":"AC-02 (07)","oscal":"ac-2.7"},{"label":"AC-02 (09)","oscal":"ac-2.9"},{"label":"AC-02 (12)","oscal":"ac-2.12"},{"label":"AC-02 (13)","oscal":"ac-2.13"},{"label":"AC-03","oscal":"ac-3"},{"label":"AC-04","oscal":"ac-4"},{"label":"AC-04 (21)","oscal":"ac-4.21"},{"label":"AC-05","oscal":"ac-5"},{"label":"AC-06","oscal":"ac-6"},{"label":"AC-06 (01)","oscal":"ac-6.1"},{"label":"AC-06 (02)","oscal":"ac-6.2"},{"label":"AC-06 (05)","oscal":"ac-6.5"},{"label":"AC-06 (07)","oscal":"ac-6.7"},{"label":"AC-06 (09)","oscal":"ac-6.9"},{"label":"AC-06 (10)","oscal":"ac-6.10"},{"label":"AC-07","oscal":"ac-7"},{"label":"AC-08","oscal":"ac-8"},{"label":"AC-11","oscal":"ac-11"},{"label":"AC-11 (01)","oscal":"ac-11.1"},{"label":"AC-12","oscal":"ac-12"},{"label":"AC-14","oscal":"ac-14"},{"label":"AC-17","oscal":"ac-17"},{"label":"AC-17 (01)","oscal":"ac-17.1"},{"label":"AC-17 (02)","oscal":"ac-17.2"},{"label":"AC-17 (03)","oscal":"ac-17.3"},{"label":"AC-17 (04)","oscal":"ac-17.4"},{"label":"AC-18","oscal":"ac-18"},{"label":"AC-18 (01)","oscal":"ac-18.1"},{"label":"AC-18 (03)","oscal":"ac-18.3"},{"label":"AC-19","oscal":"ac-19"},{"label":"AC-19 (05)","oscal":"ac-19.5"},{"label":"AC-20","oscal":"ac-20"},{"label":"AC-20 (01)","oscal":"ac-20.1"},{"label":"AC-20 (02)","oscal":"ac-20.2"},{"label":"AC-21","oscal":"ac-21"},{"label":"AC-22","oscal":"ac-22"},{"label":"AT-01","oscal":"at-1"},{"label":"AT-02","oscal":"at-2"},{"label":"AT-02 (02)","oscal":"at-2.2"},{"label":"AT-02 (03)","oscal":"at-2.3"},{"label":"AT-03","oscal":"at-3"},{"label":"AT-04","oscal":"at-4"},{"label":"AU-01","oscal":"au-1"},{"label":"AU-02","oscal":"au-2"},{"label":"AU-03","oscal":"au-3"},{"label":"AU-03 (01)","oscal":"au-3.1"},{"label":"AU-04","oscal":"au-4"},{"label":"AU-05","oscal":"au-5"},{"label":"AU-06","oscal":"au-6"},{"label":"AU-06 (01)","oscal":"au-6.1"},{"label":"AU-06 (03)","oscal":"au-6.3"},{"label":"AU-07","oscal":"au-7"},{"label":"AU-07 (01)","oscal":"au-7.1"},{"label":"AU-08","oscal":"au-8"},{"label":"AU-09","oscal":"au-9"},{"label":"AU-09 (04)","oscal":"au-9.4"},{"label":"AU-11","oscal":"au-11"},{"label":"AU-12","oscal":"au-12"},{"label":"CA-01","oscal":"ca-1"},{"label":"CA-02","oscal":"ca-2"},{"label":"CA-02 (01)","oscal":"ca-2.1"},{"label":"CA-02 (03)","oscal":"ca-2.3"},{"label":"CA-03","oscal":"ca-3"},{"label":"CA-06","oscal":"ca-6"},{"label":"CA-07","oscal":"ca-7"},{"label":"CA-07 (01)","oscal":"ca-7.1"},{"label":"CA-07 (04)","oscal":"ca-7.4"},{"label":"CA-08","oscal":"ca-8"},{"label":"CA-08 (01)","oscal":"ca-8.1"},{"label":"CA-08 (02)","oscal":"ca-8.2"},{"label":"CA-09","oscal":"ca-9"},{"label":"CM-01","oscal":"cm-1"},{"label":"CM-02","oscal":"cm-2"},{"label":"CM-02 (02)","oscal":"cm-2.2"},{"label":"CM-02 (03)","oscal":"cm-2.3"},{"label":"CM-02 (07)","oscal":"cm-2.7"},{"label":"CM-03","oscal":"cm-3"},{"label":"CM-03 (02)","oscal":"cm-3.2"},{"label":"CM-03 (04)","oscal":"cm-3.4"},{"label":"CM-04","oscal":"cm-4"},{"label":"CM-04 (02)","oscal":"cm-4.2"},{"label":"CM-05","oscal":"cm-5"},{"label":"CM-05 (01)","oscal":"cm-5.1"},{"label":"CM-05 (05)","oscal":"cm-5.5"},{"label":"CM-06","oscal":"cm-6"},{"label":"CM-06 (01)","oscal":"cm-6.1"},{"label":"CM-07","oscal":"cm-7"},{"label":"CM-07 (01)","oscal":"cm-7.1"},{"label":"CM-07 (02)","oscal":"cm-7.2"},{"label":"CM-07 (05)","oscal":"cm-7.5"},{"label":"CM-08","oscal":"cm-8"},{"label":"CM-08 (01)","oscal":"cm-8.1"},{"label":"CM-08 (03)","oscal":"cm-8.3"},{"label":"CM-09","oscal":"cm-9"},{"label":"CM-10","oscal":"cm-10"},{"label":"CM-11","oscal":"cm-11"},{"label":"CM-12","oscal":"cm-12"},{"label":"CM-12 (01)","oscal":"cm-12.1"},{"label":"CP-01","oscal":"cp-1"},{"label":"CP-02","oscal":"cp-2"},{"label":"CP-02 (01)","oscal":"cp-2.1"},{"label":"CP-02 (03)","oscal":"cp-2.3"},{"label":"CP-02 (08)","oscal":"cp-2.8"},{"label":"CP-03","oscal":"cp-3"},{"label":"CP-04","oscal":"cp-4"},{"label":"CP-04 (01)","oscal":"cp-4.1"},{"label":"CP-06","oscal":"cp-6"},{"label":"CP-06 (01)","oscal":"cp-6.1"},{"label":"CP-06 (03)","oscal":"cp-6.3"},{"label":"CP-07","oscal":"cp-7"},{"label":"CP-07 (01)","oscal":"cp-7.1"},{"label":"CP-07 (02)","oscal":"cp-7.2"},{"label":"CP-07 (03)","oscal":"cp-7.3"},{"label":"CP-08","oscal":"cp-8"},{"label":"CP-08 (01)","oscal":"cp-8.1"},{"label":"CP-08 (02)","oscal":"cp-8.2"},{"label":"CP-09","oscal":"cp-9"},{"label":"CP-09 (01)","oscal":"cp-9.1"},{"label":"CP-09 (08)","oscal":"cp-9.8"},{"label":"CP-10","oscal":"cp-10"},{"label":"CP-10 (02)","oscal":"cp-10.2"},{"label":"IA-01","oscal":"ia-1"},{"label":"IA-02","oscal":"ia-2"},{"label":"IA-02 (01)","oscal":"ia-2.1"},{"label":"IA-02 (02)","oscal":"ia-2.2"},{"label":"IA-02 (05)","oscal":"ia-2.5"},{"label":"IA-02 (06)","oscal":"ia-2.6"},{"label":"IA-02 (08)","oscal":"ia-2.8"},{"label":"IA-02 (12)","oscal":"ia-2.12"},{"label":"IA-03","oscal":"ia-3"},{"label":"IA-04","oscal":"ia-4"},{"label":"IA-04 (04)","oscal":"ia-4.4"},{"label":"IA-05","oscal":"ia-5"},{"label":"IA-05 (01)","oscal":"ia-5.1"},{"label":"IA-05 (02)","oscal":"ia-5.2"},{"label":"IA-05 (06)","oscal":"ia-5.6"},{"label":"IA-05 (07)","oscal":"ia-5.7"},{"label":"IA-06","oscal":"ia-6"},{"label":"IA-07","oscal":"ia-7"},{"label":"IA-08","oscal":"ia-8"},{"label":"IA-08 (01)","oscal":"ia-8.1"},{"label":"IA-08 (02)","oscal":"ia-8.2"},{"label":"IA-08 (04)","oscal":"ia-8.4"},{"label":"IA-11","oscal":"ia-11"},{"label":"IA-12","oscal":"ia-12"},{"label":"IA-12 (02)","oscal":"ia-12.2"},{"label":"IA-12 (03)","oscal":"ia-12.3"},{"label":"IA-12 (05)","oscal":"ia-12.5"},{"label":"IR-01","oscal":"ir-1"},{"label":"IR-02","oscal":"ir-2"},{"label":"IR-03","oscal":"ir-3"},{"label":"IR-03 (02)","oscal":"ir-3.2"},{"label":"IR-04","oscal":"ir-4"},{"label":"IR-04 (01)","oscal":"ir-4.1"},{"label":"IR-05","oscal":"ir-5"},{"label":"IR-06","oscal":"ir-6"},{"label":"IR-06 (01)","oscal":"ir-6.1"},{"label":"IR-06 (03)","oscal":"ir-6.3"},{"label":"IR-07","oscal":"ir-7"},{"label":"IR-07 (01)","oscal":"ir-7.1"},{"label":"IR-08","oscal":"ir-8"},{"label":"IR-09","oscal":"ir-9"},{"label":"IR-09 (02)","oscal":"ir-9.2"},{"label":"IR-09 (03)","oscal":"ir-9.3"},{"label":"IR-09 (04)","oscal":"ir-9.4"},{"label":"MA-01","oscal":"ma-1"},{"label":"MA-02","oscal":"ma-2"},{"label":"MA-03","oscal":"ma-3"},{"label":"MA-03 (01)","oscal":"ma-3.1"},{"label":"MA-03 (02)","oscal":"ma-3.2"},{"label":"MA-03 (03)","oscal":"ma-3.3"},{"label":"MA-04","oscal":"ma-4"},{"label":"MA-05","oscal":"ma-5"},{"label":"MA-05 (01)","oscal":"ma-5.1"},{"label":"MA-06","oscal":"ma-6"},{"label":"MP-01","oscal":"mp-1"},{"label":"MP-02","oscal":"mp-2"},{"label":"MP-03","oscal":"mp-3"},{"label":"MP-04","oscal":"mp-4"},{"label":"MP-05","oscal":"mp-5"},{"label":"MP-06","oscal":"mp-6"},{"label":"MP-07","oscal":"mp-7"},{"label":"PE-01","oscal":"pe-1"},{"label":"PE-02","oscal":"pe-2"},{"label":"PE-03","oscal":"pe-3"},{"label":"PE-04","oscal":"pe-4"},{"label":"PE-05","oscal":"pe-5"},{"label":"PE-06","oscal":"pe-6"},{"label":"PE-06 (01)","oscal":"pe-6.1"},{"label":"PE-08","oscal":"pe-8"},{"label":"PE-09","oscal":"pe-9"},{"label":"PE-10","oscal":"pe-10"},{"label":"PE-11","oscal":"pe-11"},{"label":"PE-12","oscal":"pe-12"},{"label":"PE-13","oscal":"pe-13"},{"label":"PE-13 (01)","oscal":"pe-13.1"},{"label":"PE-13 (02)","oscal":"pe-13.2"},{"label":"PE-14","oscal":"pe-14"},{"label":"PE-15","oscal":"pe-15"},{"label":"PE-16","oscal":"pe-16"},{"label":"PE-17","oscal":"pe-17"},{"label":"PL-01","oscal":"pl-1"},{"label":"PL-02","oscal":"pl-2"},{"label":"PL-04","oscal":"pl-4"},{"label":"PL-04 (01)","oscal":"pl-4.1"},{"label":"PL-08","oscal":"pl-8"},{"label":"PL-10","oscal":"pl-10"},{"label":"PL-11","oscal":"pl-11"},{"label":"PS-01","oscal":"ps-1"},{"label":"PS-02","oscal":"ps-2"},{"label":"PS-03","oscal":"ps-3"},{"label":"PS-03 (03)","oscal":"ps-3.3"},{"label":"PS-04","oscal":"ps-4"},{"label":"PS-05","oscal":"ps-5"},{"label":"PS-06","oscal":"ps-6"},{"label":"PS-07","oscal":"ps-7"},{"label":"PS-08","oscal":"ps-8"},{"label":"PS-09","oscal":"ps-9"},{"label":"RA-01","oscal":"ra-1"},{"label":"RA-02","oscal":"ra-2"},{"label":"RA-03","oscal":"ra-3"},{"label":"RA-03 (01)","oscal":"ra-3.1"},{"label":"RA-05","oscal":"ra-5"},{"label":"RA-05 (02)","oscal":"ra-5.2"},{"label":"RA-05 (03)","oscal":"ra-5.3"},{"label":"RA-05 (05)","oscal":"ra-5.5"},{"label":"RA-05 (11)","oscal":"ra-5.11"},{"label":"RA-07","oscal":"ra-7"},{"label":"RA-09","oscal":"ra-9"},{"label":"SA-01","oscal":"sa-1"},{"label":"SA-02","oscal":"sa-2"},{"label":"SA-03","oscal":"sa-3"},{"label":"SA-04","oscal":"sa-4"},{"label":"SA-04 (01)","oscal":"sa-4.1"},{"label":"SA-04 (02)","oscal":"sa-4.2"},{"label":"SA-04 (09)","oscal":"sa-4.9"},{"label":"SA-04 (10)","oscal":"sa-4.10"},{"label":"SA-05","oscal":"sa-5"},{"label":"SA-08","oscal":"sa-8"},{"label":"SA-09","oscal":"sa-9"},{"label":"SA-09 (01)","oscal":"sa-9.1"},{"label":"SA-09 (02)","oscal":"sa-9.2"},{"label":"SA-09 (05)","oscal":"sa-9.5"},{"label":"SA-10","oscal":"sa-10"},{"label":"SA-11","oscal":"sa-11"},{"label":"SA-11 (01)","oscal":"sa-11.1"},{"label":"SA-11 (02)","oscal":"sa-11.2"},{"label":"SA-15","oscal":"sa-15"},{"label":"SA-15 (03)","oscal":"sa-15.3"},{"label":"SA-22","oscal":"sa-22"},{"label":"SC-01","oscal":"sc-1"},{"label":"SC-02","oscal":"sc-2"},{"label":"SC-04","oscal":"sc-4"},{"label":"SC-05","oscal":"sc-5"},{"label":"SC-07","oscal":"sc-7"},{"label":"SC-07 (03)","oscal":"sc-7.3"},{"label":"SC-07 (04)","oscal":"sc-7.4"},{"label":"SC-07 (05)","oscal":"sc-7.5"},{"label":"SC-07 (07)","oscal":"sc-7.7"},{"label":"SC-07 (08)","oscal":"sc-7.8"},{"label":"SC-07 (12)","oscal":"sc-7.12"},{"label":"SC-07 (18)","oscal":"sc-7.18"},{"label":"SC-08","oscal":"sc-8"},{"label":"SC-08 (01)","oscal":"sc-8.1"},{"label":"SC-10","oscal":"sc-10"},{"label":"SC-12","oscal":"sc-12"},{"label":"SC-13","oscal":"sc-13"},{"label":"SC-15","oscal":"sc-15"},{"label":"SC-17","oscal":"sc-17"},{"label":"SC-18","oscal":"sc-18"},{"label":"SC-20","oscal":"sc-20"},{"label":"SC-21","oscal":"sc-21"},{"label":"SC-22","oscal":"sc-22"},{"label":"SC-23","oscal":"sc-23"},{"label":"SC-28","oscal":"sc-28"},{"label":"SC-28 (01)","oscal":"sc-28.1"},{"label":"SC-39","oscal":"sc-39"},{"label":"SC-45","oscal":"sc-45"},{"label":"SC-45 (01)","oscal":"sc-45.1"},{"label":"SI-01","oscal":"si-1"},{"label":"SI-02","oscal":"si-2"},{"label":"SI-02 (02)","oscal":"si-2.2"},{"label":"SI-02 (03)","oscal":"si-2.3"},{"label":"SI-03","oscal":"si-3"},{"label":"SI-04","oscal":"si-4"},{"label":"SI-04 (01)","oscal":"si-4.1"},{"label":"SI-04 (02)","oscal":"si-4.2"},{"label":"SI-04 (04)","oscal":"si-4.4"},{"label":"SI-04 (05)","oscal":"si-4.5"},{"label":"SI-04 (16)","oscal":"si-4.16"},{"label":"SI-04 (18)","oscal":"si-4.18"},{"label":"SI-04 (23)","oscal":"si-4.23"},{"label":"SI-05","oscal":"si-5"},{"label":"SI-06","oscal":"si-6"},{"label":"SI-07","oscal":"si-7"},{"label":"SI-07 (01)","oscal":"si-7.1"},{"label":"SI-07 (07)","oscal":"si-7.7"},{"label":"SI-08","oscal":"si-8"},{"label":"SI-08 (02)","oscal":"si-8.2"},{"label":"SI-10","oscal":"si-10"},{"label":"SI-11","oscal":"si-11"},{"label":"SI-12","oscal":"si-12"},{"label":"SI-16","oscal":"si-16"},{"label":"SR-01","oscal":"sr-1"},{"label":"SR-02","oscal":"sr-2"},{"label":"SR-02 (01)","oscal":"sr-2.1"},{"label":"SR-03","oscal":"sr-3"},{"label":"SR-05","oscal":"sr-5"},{"label":"SR-06","oscal":"sr-6"},{"label":"SR-08","oscal":"sr-8"},{"label":"SR-10","oscal":"sr-10"},{"label":"SR-11","oscal":"sr-11"},{"label":"SR-11 (01)","oscal":"sr-11.1"},{"label":"SR-11 (02)","oscal":"sr-11.2"},{"label":"SR-12","oscal":"sr-12"}],"provisional":false},"D":{"rules":[{"id":"AFC-CSO-ACK","force":"SHOULD"},{"id":"AFC-CSO-CRA","force":"MUST"},{"id":"AFC-CSO-EMR","force":"MUST"},{"id":"AFC-CSO-IMA","force":"SHOULD"},{"id":"AFC-CSO-INB","force":"MUST"},{"id":"AFC-CSO-NOC","force":"MUST"},{"id":"AFC-CSO-RCV","force":"MUST"},{"id":"AFC-CSO-TFG","force":"MUST"},{"id":"CCM-OCR-AFS","force":"MUST"},{"id":"CCM-OCR-AVL","force":"MUST"},{"id":"CCM-OCR-FBM","force":"MUST"},{"id":"CCM-OCR-LSI","force":"MUST NOT"},{"id":"CCM-OCR-NRD","force":"MUST"},{"id":"CCM-OCR-RPS","force":"MAY"},{"id":"CCM-OCR-SOR","force":"SHOULD"},{"id":"CCM-QTR-ACT","force":"SHOULD"},{"id":"CCM-QTR-MTG","force":"MUST"},{"id":"CCM-QTR-NID","force":"MUST NOT"},{"id":"CCM-QTR-NRD","force":"MUST"},{"id":"CCM-QTR-REG","force":"MUST"},{"id":"CCM-QTR-RTP","force":"SHOULD NOT"},{"id":"CCM-QTR-RTR","force":"SHOULD"},{"id":"CCM-QTR-SAR","force":"SHOULD"},{"id":"CCM-QTR-SCR","force":"MAY"},{"id":"CCM-QTR-SRR","force":"MAY"},{"id":"CDS-CSO-AVR","force":"MUST"},{"id":"CDS-CSO-CBF","force":"MUST"},{"id":"CDS-CSO-FID","force":"MUST"},{"id":"CDS-CSO-FRC","force":"MUST"},{"id":"CDS-CSO-HAD","force":"MUST"},{"id":"CDS-CSO-IRP","force":"MUST"},{"id":"CDS-CSO-PSM","force":"MUST"},{"id":"CDS-CSO-PUB","force":"MUST"},{"id":"CDS-CSO-RIS","force":"MUST"},{"id":"CDS-CSO-RPS","force":"MAY"},{"id":"CDS-CSO-SVC","force":"MUST"},{"id":"CDS-CSO-UTC","force":"MUST"},{"id":"CDS-TRC-AAI","force":"MUST"},{"id":"CDS-TRC-ACL","force":"MUST"},{"id":"CDS-TRC-HMR","force":"SHOULD"},{"id":"CDS-TRC-PAC","force":"MUST"},{"id":"CDS-TRC-SSM","force":"SHOULD"},{"id":"CDS-TRC-USH","force":"MUST"},{"id":"CDS-UTC-AAD","force":"MUST"},{"id":"CDS-UTC-AGA","force":"SHOULD"},{"id":"CMU-CSO-CAT","force":"SHOULD"},{"id":"CMU-CSO-CMD","force":"MUST"},{"id":"CMU-CSO-UVM","force":"MUST"},{"id":"CPO-CSO-MTD","force":"MUST"},{"id":"CPO-CSO-OSA","force":"MUST"},{"id":"CPO-CSO-OVR","force":"MUST"},{"id":"CPO-CSX-CPM","force":"MUST"},{"id":"FRC-APP-AFC","force":"MUST"},{"id":"FRC-APP-FCP","force":"MUST"},{"id":"FRC-APP-FIA","force":"MUST"},{"id":"FRC-APP-MLF","force":"MUST"},{"id":"FRC-APP-NTP","force":"MUST NOT"},{"id":"FRC-APP-USA","force":"MAY"},{"id":"FRC-CSO-FCP","force":"MUST"},{"id":"FRC-CSO-JSN","force":"MUST"},{"id":"FRC-CSO-MRA","force":"MUST"},{"id":"FRC-CSO-PKG","force":"MUST"},{"id":"FRC-CSO-POP","force":"MUST NOT"},{"id":"FRC-CSX-MAS","force":"SHOULD"},{"id":"FRC-CSX-VVK","force":"MUST"},{"id":"FRC-CSX-VVR","force":"SHOULD"},{"id":"IEC-CSO-AIR","force":"SHOULD"},{"id":"IEC-CSO-DPR","force":"MUST"},{"id":"IEC-CSO-EFI","force":"SHOULD"},{"id":"IEC-CSO-EFR","force":"MUST"},{"id":"IEC-CSO-FIR","force":"MUST"},{"id":"IEC-CSO-IIR","force":"MUST"},{"id":"IEC-CSO-OIR","force":"MUST"},{"id":"IVV-CSO-DUS","force":"MUST"},{"id":"IVV-CSO-FIA","force":"MUST"},{"id":"IVV-CSO-ICP","force":"MUST"},{"id":"IVV-CSO-RAA","force":"MAY"},{"id":"IVV-CSO-SEE","force":"MUST"},{"id":"IVV-CSO-SEI","force":"MUST"},{"id":"IVV-CSO-STE","force":"SHOULD"},{"id":"IVV-CSO-USR","force":"MAY"},{"id":"IVV-CSX-AIA","force":"MUST"},{"id":"MAS-CSO-FLO","force":"MUST"},{"id":"MAS-CSO-IIR","force":"MUST"},{"id":"MAS-CSO-MDI","force":"MUST"},{"id":"MAS-CSO-SUP","force":"MAY"},{"id":"MAS-CSO-TPR","force":"MUST"},{"id":"MKT-CSO-MLR","force":"MUST"},{"id":"MKT-CSO-PML","force":"MUST"},{"id":"MKT-IIP-AGU","force":"MUST"},{"id":"MKT-IIP-DCP","force":"MUST"},{"id":"MKT-IIP-DLA","force":"MUST"},{"id":"SCG-CSO-AUP","force":"MUST"},{"id":"SCG-CSO-PUB","force":"SHOULD"},{"id":"SCG-CSO-RSC","force":"MUST"},{"id":"SCG-CSO-SDF","force":"SHOULD"},{"id":"SCG-ENH-API","force":"SHOULD"},{"id":"SCG-ENH-CMP","force":"SHOULD"},{"id":"SCG-ENH-EXP","force":"SHOULD"},{"id":"SCG-ENH-MRG","force":"SHOULD"},{"id":"SCG-ENH-VRH","force":"SHOULD"},{"id":"SCN-ADP-NTF","force":"MUST"},{"id":"SCN-CSO-ARI","force":"MAY"},{"id":"SCN-CSO-EMG","force":"MAY"},{"id":"SCN-CSO-EVA","force":"MUST"},{"id":"SCN-CSO-HIS","force":"MUST"},{"id":"SCN-CSO-HRM","force":"MUST"},{"id":"SCN-CSO-INF","force":"MUST"},{"id":"SCN-CSO-MAR","force":"MUST"},{"id":"SCN-CSO-NOM","force":"MAY"},{"id":"SCN-RTR-NNR","force":"SHOULD NOT"},{"id":"SCN-TRF-NAF","force":"MUST"},{"id":"SCN-TRF-NAV","force":"MUST"},{"id":"SCN-TRF-NFP","force":"MUST"},{"id":"SCN-TRF-NIP","force":"MUST"},{"id":"SCN-TRF-TPR","force":"SHOULD"},{"id":"SCN-TRF-UPD","force":"MUST"},{"id":"SDR-CSO-FRR","force":"MUST"},{"id":"SDR-CSO-MTD","force":"MUST"},{"id":"SDR-CSX-KMT","force":"MUST"},{"id":"SDR-CSX-KSI","force":"MUST"},{"id":"VDR-CSO-ADT","force":"SHOULD"},{"id":"VDR-CSO-AKE","force":"SHOULD NOT"},{"id":"VDR-CSO-DAC","force":"SHOULD"},{"id":"VDR-CSO-DET","force":"MUST"},{"id":"VDR-CSO-DFR","force":"SHOULD"},{"id":"VDR-CSO-FAV","force":"MUST"},{"id":"VDR-CSO-MSP","force":"SHOULD NOT"},{"id":"VDR-CSO-RES","force":"MUST"},{"id":"VDR-CSO-SIR","force":"MAY"},{"id":"VDR-TFR-KEV","force":"SHOULD"},{"id":"VDR-TFR-NMV","force":"MUST"},{"id":"VDR-TFR-PCD","force":"SHOULD"},{"id":"VDR-TFR-PDD","force":"SHOULD"},{"id":"VDR-TFR-PSD","force":"SHOULD"},{"id":"VDR-TFR-PVR","force":"SHOULD"},{"id":"VDR-TFR-RMN","force":"SHOULD"},{"id":"VER-EVA-AIA","force":"MUST"},{"id":"VER-EVA-EFA","force":"SHOULD"},{"id":"VER-EVA-EFP","force":"SHOULD"},{"id":"VER-EVA-EIR","force":"MUST"},{"id":"VER-EVA-ELX","force":"MUST"},{"id":"VER-EVA-EPA","force":"MUST"},{"id":"VER-EVA-GRV","force":"SHOULD"},{"id":"VER-RPT-AVI","force":"MUST"},{"id":"VER-RPT-HLO","force":"SHOULD"},{"id":"VER-RPT-NID","force":"MUST NOT"},{"id":"VER-RPT-PER","force":"MUST"},{"id":"VER-RPT-RPD","force":"MAY"},{"id":"VER-RPT-VDT","force":"MUST"},{"id":"VER-TFR-EVU","force":"SHOULD"},{"id":"VER-TFR-IRI","force":"SHOULD"},{"id":"VER-TFR-MAV","force":"MUST"},{"id":"VER-TFR-MHR","force":"MUST"},{"id":"VER-TFR-MRH","force":"SHOULD"},{"id":"VER-TFR-NRI","force":"SHOULD"}],"ksis":[{"id":"KSI-CED-RAT"},{"id":"KSI-CMT-LMC"},{"id":"KSI-CMT-RMV"},{"id":"KSI-CMT-RVP"},{"id":"KSI-CMT-VTD"},{"id":"KSI-CNA-DFP"},{"id":"KSI-CNA-EIS"},{"id":"KSI-CNA-IBP"},{"id":"KSI-CNA-MAT"},{"id":"KSI-CNA-OFA"},{"id":"KSI-CNA-RNT"},{"id":"KSI-CNA-RVP"},{"id":"KSI-CNA-ULN"},{"id":"KSI-IAM-AAM"},{"id":"KSI-IAM-APM"},{"id":"KSI-IAM-ELP"},{"id":"KSI-IAM-JIT"},{"id":"KSI-IAM-SNU"},{"id":"KSI-IAM-SUS"},{"id":"KSI-INR-AAR"},{"id":"KSI-INR-RIR"},{"id":"KSI-INR-RPI"},{"id":"KSI-MLA-ALA"},{"id":"KSI-MLA-EVC"},{"id":"KSI-MLA-LET"},{"id":"KSI-MLA-OSM"},{"id":"KSI-MLA-RVL"},{"id":"KSI-PIY-GIV"},{"id":"KSI-PIY-RES"},{"id":"KSI-PIY-RIS"},{"id":"KSI-PIY-RSD"},{"id":"KSI-PIY-RVD"},{"id":"KSI-RPL-ABO"},{"id":"KSI-RPL-ARP"},{"id":"KSI-RPL-RRO"},{"id":"KSI-RPL-TRC"},{"id":"KSI-SCR-MIT"},{"id":"KSI-SCR-MON"},{"id":"KSI-SVC-ACM"},{"id":"KSI-SVC-ASM"},{"id":"KSI-SVC-EIS"},{"id":"KSI-SVC-PRR"},{"id":"KSI-SVC-RUD"},{"id":"KSI-SVC-SIN"},{"id":"KSI-SVC-VCM"},{"id":"KSI-SVC-VRI"}],"counts":{"rules":156,"byForce":{"MAY":13,"MUST":94,"MUST NOT":5,"SHOULD":40,"SHOULD NOT":4},"ksis":46},"rev5Controls":[{"label":"AC-01","oscal":"ac-1"},{"label":"AC-02","oscal":"ac-2"},{"label":"AC-02 (01)","oscal":"ac-2.1"},{"label":"AC-02 (02)","oscal":"ac-2.2"},{"label":"AC-02 (03)","oscal":"ac-2.3"},{"label":"AC-02 (04)","oscal":"ac-2.4"},{"label":"AC-02 (05)","oscal":"ac-2.5"},{"label":"AC-02 (07)","oscal":"ac-2.7"},{"label":"AC-02 (09)","oscal":"ac-2.9"},{"label":"AC-02 (11)","oscal":"ac-2.11"},{"label":"AC-02 (12)","oscal":"ac-2.12"},{"label":"AC-02 (13)","oscal":"ac-2.13"},{"label":"AC-03","oscal":"ac-3"},{"label":"AC-04","oscal":"ac-4"},{"label":"AC-04 (04)","oscal":"ac-4.4"},{"label":"AC-04 (21)","oscal":"ac-4.21"},{"label":"AC-05","oscal":"ac-5"},{"label":"AC-06","oscal":"ac-6"},{"label":"AC-06 (01)","oscal":"ac-6.1"},{"label":"AC-06 (02)","oscal":"ac-6.2"},{"label":"AC-06 (03)","oscal":"ac-6.3"},{"label":"AC-06 (05)","oscal":"ac-6.5"},{"label":"AC-06 (07)","oscal":"ac-6.7"},{"label":"AC-06 (08)","oscal":"ac-6.8"},{"label":"AC-06 (09)","oscal":"ac-6.9"},{"label":"AC-06 (10)","oscal":"ac-6.10"},{"label":"AC-07","oscal":"ac-7"},{"label":"AC-08","oscal":"ac-8"},{"label":"AC-10","oscal":"ac-10"},{"label":"AC-11","oscal":"ac-11"},{"label":"AC-11 (01)","oscal":"ac-11.1"},{"label":"AC-12","oscal":"ac-12"},{"label":"AC-14","oscal":"ac-14"},{"label":"AC-17","oscal":"ac-17"},{"label":"AC-17 (01)","oscal":"ac-17.1"},{"label":"AC-17 (02)","oscal":"ac-17.2"},{"label":"AC-17 (03)","oscal":"ac-17.3"},{"label":"AC-17 (04)","oscal":"ac-17.4"},{"label":"AC-18","oscal":"ac-18"},{"label":"AC-18 (01)","oscal":"ac-18.1"},{"label":"AC-18 (03)","oscal":"ac-18.3"},{"label":"AC-18 (04)","oscal":"ac-18.4"},{"label":"AC-18 (05)","oscal":"ac-18.5"},{"label":"AC-19","oscal":"ac-19"},{"label":"AC-19 (05)","oscal":"ac-19.5"},{"label":"AC-20","oscal":"ac-20"},{"label":"AC-20 (01)","oscal":"ac-20.1"},{"label":"AC-20 (02)","oscal":"ac-20.2"},{"label":"AC-21","oscal":"ac-21"},{"label":"AC-22","oscal":"ac-22"},{"label":"AT-01","oscal":"at-1"},{"label":"AT-02","oscal":"at-2"},{"label":"AT-02 (02)","oscal":"at-2.2"},{"label":"AT-02 (03)","oscal":"at-2.3"},{"label":"AT-03","oscal":"at-3"},{"label":"AT-04","oscal":"at-4"},{"label":"AU-01","oscal":"au-1"},{"label":"AU-02","oscal":"au-2"},{"label":"AU-03","oscal":"au-3"},{"label":"AU-03 (01)","oscal":"au-3.1"},{"label":"AU-04","oscal":"au-4"},{"label":"AU-05","oscal":"au-5"},{"label":"AU-05 (01)","oscal":"au-5.1"},{"label":"AU-05 (02)","oscal":"au-5.2"},{"label":"AU-06","oscal":"au-6"},{"label":"AU-06 (01)","oscal":"au-6.1"},{"label":"AU-06 (03)","oscal":"au-6.3"},{"label":"AU-06 (04)","oscal":"au-6.4"},{"label":"AU-06 (05)","oscal":"au-6.5"},{"label":"AU-06 (06)","oscal":"au-6.6"},{"label":"AU-06 (07)","oscal":"au-6.7"},{"label":"AU-07","oscal":"au-7"},{"label":"AU-07 (01)","oscal":"au-7.1"},{"label":"AU-08","oscal":"au-8"},{"label":"AU-09","oscal":"au-9"},{"label":"AU-09 (02)","oscal":"au-9.2"},{"label":"AU-09 (03)","oscal":"au-9.3"},{"label":"AU-09 (04)","oscal":"au-9.4"},{"label":"AU-10","oscal":"au-10"},{"label":"AU-11","oscal":"au-11"},{"label":"AU-12","oscal":"au-12"},{"label":"AU-12 (01)","oscal":"au-12.1"},{"label":"AU-12 (03)","oscal":"au-12.3"},{"label":"CA-01","oscal":"ca-1"},{"label":"CA-02","oscal":"ca-2"},{"label":"CA-02 (01)","oscal":"ca-2.1"},{"label":"CA-02 (02)","oscal":"ca-2.2"},{"label":"CA-02 (03)","oscal":"ca-2.3"},{"label":"CA-03","oscal":"ca-3"},{"label":"CA-03 (06)","oscal":"ca-3.6"},{"label":"CA-06","oscal":"ca-6"},{"label":"CA-07","oscal":"ca-7"},{"label":"CA-07 (01)","oscal":"ca-7.1"},{"label":"CA-07 (04)","oscal":"ca-7.4"},{"label":"CA-08","oscal":"ca-8"},{"label":"CA-08 (01)","oscal":"ca-8.1"},{"label":"CA-08 (02)","oscal":"ca-8.2"},{"label":"CA-09","oscal":"ca-9"},{"label":"CM-01","oscal":"cm-1"},{"label":"CM-02","oscal":"cm-2"},{"label":"CM-02 (02)","oscal":"cm-2.2"},{"label":"CM-02 (03)","oscal":"cm-2.3"},{"label":"CM-02 (07)","oscal":"cm-2.7"},{"label":"CM-03","oscal":"cm-3"},{"label":"CM-03 (01)","oscal":"cm-3.1"},{"label":"CM-03 (02)","oscal":"cm-3.2"},{"label":"CM-03 (04)","oscal":"cm-3.4"},{"label":"CM-03 (06)","oscal":"cm-3.6"},{"label":"CM-04","oscal":"cm-4"},{"label":"CM-04 (01)","oscal":"cm-4.1"},{"label":"CM-04 (02)","oscal":"cm-4.2"},{"label":"CM-05","oscal":"cm-5"},{"label":"CM-05 (01)","oscal":"cm-5.1"},{"label":"CM-05 (05)","oscal":"cm-5.5"},{"label":"CM-06","oscal":"cm-6"},{"label":"CM-06 (01)","oscal":"cm-6.1"},{"label":"CM-06 (02)","oscal":"cm-6.2"},{"label":"CM-07","oscal":"cm-7"},{"label":"CM-07 (01)","oscal":"cm-7.1"},{"label":"CM-07 (02)","oscal":"cm-7.2"},{"label":"CM-07 (05)","oscal":"cm-7.5"},{"label":"CM-08","oscal":"cm-8"},{"label":"CM-08 (01)","oscal":"cm-8.1"},{"label":"CM-08 (02)","oscal":"cm-8.2"},{"label":"CM-08 (03)","oscal":"cm-8.3"},{"label":"CM-08 (04)","oscal":"cm-8.4"},{"label":"CM-09","oscal":"cm-9"},{"label":"CM-10","oscal":"cm-10"},{"label":"CM-11","oscal":"cm-11"},{"label":"CM-12","oscal":"cm-12"},{"label":"CM-12 (01)","oscal":"cm-12.1"},{"label":"CM-14","oscal":"cm-14"},{"label":"CP-01","oscal":"cp-1"},{"label":"CP-02","oscal":"cp-2"},{"label":"CP-02 (01)","oscal":"cp-2.1"},{"label":"CP-02 (02)","oscal":"cp-2.2"},{"label":"CP-02 (03)","oscal":"cp-2.3"},{"label":"CP-02 (05)","oscal":"cp-2.5"},{"label":"CP-02 (08)","oscal":"cp-2.8"},{"label":"CP-03","oscal":"cp-3"},{"label":"CP-03 (01)","oscal":"cp-3.1"},{"label":"CP-04","oscal":"cp-4"},{"label":"CP-04 (01)","oscal":"cp-4.1"},{"label":"CP-04 (02)","oscal":"cp-4.2"},{"label":"CP-06","oscal":"cp-6"},{"label":"CP-06 (01)","oscal":"cp-6.1"},{"label":"CP-06 (02)","oscal":"cp-6.2"},{"label":"CP-06 (03)","oscal":"cp-6.3"},{"label":"CP-07","oscal":"cp-7"},{"label":"CP-07 (01)","oscal":"cp-7.1"},{"label":"CP-07 (02)","oscal":"cp-7.2"},{"label":"CP-07 (03)","oscal":"cp-7.3"},{"label":"CP-07 (04)","oscal":"cp-7.4"},{"label":"CP-08","oscal":"cp-8"},{"label":"CP-08 (01)","oscal":"cp-8.1"},{"label":"CP-08 (02)","oscal":"cp-8.2"},{"label":"CP-08 (03)","oscal":"cp-8.3"},{"label":"CP-08 (04)","oscal":"cp-8.4"},{"label":"CP-09","oscal":"cp-9"},{"label":"CP-09 (01)","oscal":"cp-9.1"},{"label":"CP-09 (02)","oscal":"cp-9.2"},{"label":"CP-09 (03)","oscal":"cp-9.3"},{"label":"CP-09 (05)","oscal":"cp-9.5"},{"label":"CP-09 (08)","oscal":"cp-9.8"},{"label":"CP-10","oscal":"cp-10"},{"label":"CP-10 (02)","oscal":"cp-10.2"},{"label":"CP-10 (04)","oscal":"cp-10.4"},{"label":"IA-01","oscal":"ia-1"},{"label":"IA-02","oscal":"ia-2"},{"label":"IA-02 (01)","oscal":"ia-2.1"},{"label":"IA-02 (02)","oscal":"ia-2.2"},{"label":"IA-02 (05)","oscal":"ia-2.5"},{"label":"IA-02 (06)","oscal":"ia-2.6"},{"label":"IA-02 (08)","oscal":"ia-2.8"},{"label":"IA-02 (12)","oscal":"ia-2.12"},{"label":"IA-03","oscal":"ia-3"},{"label":"IA-04","oscal":"ia-4"},{"label":"IA-04 (04)","oscal":"ia-4.4"},{"label":"IA-05","oscal":"ia-5"},{"label":"IA-05 (01)","oscal":"ia-5.1"},{"label":"IA-05 (02)","oscal":"ia-5.2"},{"label":"IA-05 (06)","oscal":"ia-5.6"},{"label":"IA-05 (07)","oscal":"ia-5.7"},{"label":"IA-05 (08)","oscal":"ia-5.8"},{"label":"IA-05 (13)","oscal":"ia-5.13"},{"label":"IA-06","oscal":"ia-6"},{"label":"IA-07","oscal":"ia-7"},{"label":"IA-08","oscal":"ia-8"},{"label":"IA-08 (01)","oscal":"ia-8.1"},{"label":"IA-08 (02)","oscal":"ia-8.2"},{"label":"IA-08 (04)","oscal":"ia-8.4"},{"label":"IA-11","oscal":"ia-11"},{"label":"IA-12","oscal":"ia-12"},{"label":"IA-12 (02)","oscal":"ia-12.2"},{"label":"IA-12 (03)","oscal":"ia-12.3"},{"label":"IA-12 (04)","oscal":"ia-12.4"},{"label":"IA-12 (05)","oscal":"ia-12.5"},{"label":"IR-01","oscal":"ir-1"},{"label":"IR-02","oscal":"ir-2"},{"label":"IR-02 (01)","oscal":"ir-2.1"},{"label":"IR-02 (02)","oscal":"ir-2.2"},{"label":"IR-03","oscal":"ir-3"},{"label":"IR-03 (02)","oscal":"ir-3.2"},{"label":"IR-04","oscal":"ir-4"},{"label":"IR-04 (01)","oscal":"ir-4.1"},{"label":"IR-04 (02)","oscal":"ir-4.2"},{"label":"IR-04 (04)","oscal":"ir-4.4"},{"label":"IR-04 (06)","oscal":"ir-4.6"},{"label":"IR-04 (11)","oscal":"ir-4.11"},{"label":"IR-05","oscal":"ir-5"},{"label":"IR-05 (01)","oscal":"ir-5.1"},{"label":"IR-06","oscal":"ir-6"},{"label":"IR-06 (01)","oscal":"ir-6.1"},{"label":"IR-06 (03)","oscal":"ir-6.3"},{"label":"IR-07","oscal":"ir-7"},{"label":"IR-07 (01)","oscal":"ir-7.1"},{"label":"IR-08","oscal":"ir-8"},{"label":"IR-09","oscal":"ir-9"},{"label":"IR-09 (02)","oscal":"ir-9.2"},{"label":"IR-09 (03)","oscal":"ir-9.3"},{"label":"IR-09 (04)","oscal":"ir-9.4"},{"label":"MA-01","oscal":"ma-1"},{"label":"MA-02","oscal":"ma-2"},{"label":"MA-02 (02)","oscal":"ma-2.2"},{"label":"MA-03","oscal":"ma-3"},{"label":"MA-03 (01)","oscal":"ma-3.1"},{"label":"MA-03 (02)","oscal":"ma-3.2"},{"label":"MA-03 (03)","oscal":"ma-3.3"},{"label":"MA-04","oscal":"ma-4"},{"label":"MA-04 (03)","oscal":"ma-4.3"},{"label":"MA-05","oscal":"ma-5"},{"label":"MA-05 (01)","oscal":"ma-5.1"},{"label":"MA-06","oscal":"ma-6"},{"label":"MP-01","oscal":"mp-1"},{"label":"MP-02","oscal":"mp-2"},{"label":"MP-03","oscal":"mp-3"},{"label":"MP-04","oscal":"mp-4"},{"label":"MP-05","oscal":"mp-5"},{"label":"MP-06","oscal":"mp-6"},{"label":"MP-06 (01)","oscal":"mp-6.1"},{"label":"MP-06 (02)","oscal":"mp-6.2"},{"label":"MP-06 (03)","oscal":"mp-6.3"},{"label":"MP-07","oscal":"mp-7"},{"label":"PE-01","oscal":"pe-1"},{"label":"PE-02","oscal":"pe-2"},{"label":"PE-03","oscal":"pe-3"},{"label":"PE-03 (01)","oscal":"pe-3.1"},{"label":"PE-04","oscal":"pe-4"},{"label":"PE-05","oscal":"pe-5"},{"label":"PE-06","oscal":"pe-6"},{"label":"PE-06 (01)","oscal":"pe-6.1"},{"label":"PE-06 (04)","oscal":"pe-6.4"},{"label":"PE-08","oscal":"pe-8"},{"label":"PE-08 (01)","oscal":"pe-8.1"},{"label":"PE-09","oscal":"pe-9"},{"label":"PE-10","oscal":"pe-10"},{"label":"PE-11","oscal":"pe-11"},{"label":"PE-11 (01)","oscal":"pe-11.1"},{"label":"PE-12","oscal":"pe-12"},{"label":"PE-13","oscal":"pe-13"},{"label":"PE-13 (01)","oscal":"pe-13.1"},{"label":"PE-13 (02)","oscal":"pe-13.2"},{"label":"PE-14","oscal":"pe-14"},{"label":"PE-14 (02)","oscal":"pe-14.2"},{"label":"PE-15","oscal":"pe-15"},{"label":"PE-15 (01)","oscal":"pe-15.1"},{"label":"PE-16","oscal":"pe-16"},{"label":"PE-17","oscal":"pe-17"},{"label":"PE-18","oscal":"pe-18"},{"label":"PL-01","oscal":"pl-1"},{"label":"PL-02","oscal":"pl-2"},{"label":"PL-04","oscal":"pl-4"},{"label":"PL-04 (01)","oscal":"pl-4.1"},{"label":"PL-08","oscal":"pl-8"},{"label":"PL-10","oscal":"pl-10"},{"label":"PL-11","oscal":"pl-11"},{"label":"PS-01","oscal":"ps-1"},{"label":"PS-02","oscal":"ps-2"},{"label":"PS-03","oscal":"ps-3"},{"label":"PS-03 (03)","oscal":"ps-3.3"},{"label":"PS-04","oscal":"ps-4"},{"label":"PS-04 (02)","oscal":"ps-4.2"},{"label":"PS-05","oscal":"ps-5"},{"label":"PS-06","oscal":"ps-6"},{"label":"PS-07","oscal":"ps-7"},{"label":"PS-08","oscal":"ps-8"},{"label":"PS-09","oscal":"ps-9"},{"label":"RA-01","oscal":"ra-1"},{"label":"RA-02","oscal":"ra-2"},{"label":"RA-03","oscal":"ra-3"},{"label":"RA-03 (01)","oscal":"ra-3.1"},{"label":"RA-05","oscal":"ra-5"},{"label":"RA-05 (02)","oscal":"ra-5.2"},{"label":"RA-05 (03)","oscal":"ra-5.3"},{"label":"RA-05 (04)","oscal":"ra-5.4"},{"label":"RA-05 (05)","oscal":"ra-5.5"},{"label":"RA-05 (08)","oscal":"ra-5.8"},{"label":"RA-05 (11)","oscal":"ra-5.11"},{"label":"RA-07","oscal":"ra-7"},{"label":"RA-09","oscal":"ra-9"},{"label":"SA-01","oscal":"sa-1"},{"label":"SA-02","oscal":"sa-2"},{"label":"SA-03","oscal":"sa-3"},{"label":"SA-04","oscal":"sa-4"},{"label":"SA-04 (01)","oscal":"sa-4.1"},{"label":"SA-04 (02)","oscal":"sa-4.2"},{"label":"SA-04 (05)","oscal":"sa-4.5"},{"label":"SA-04 (09)","oscal":"sa-4.9"},{"label":"SA-04 (10)","oscal":"sa-4.10"},{"label":"SA-05","oscal":"sa-5"},{"label":"SA-08","oscal":"sa-8"},{"label":"SA-09","oscal":"sa-9"},{"label":"SA-09 (01)","oscal":"sa-9.1"},{"label":"SA-09 (02)","oscal":"sa-9.2"},{"label":"SA-09 (05)","oscal":"sa-9.5"},{"label":"SA-10","oscal":"sa-10"},{"label":"SA-11","oscal":"sa-11"},{"label":"SA-11 (01)","oscal":"sa-11.1"},{"label":"SA-11 (02)","oscal":"sa-11.2"},{"label":"SA-15","oscal":"sa-15"},{"label":"SA-15 (03)","oscal":"sa-15.3"},{"label":"SA-16","oscal":"sa-16"},{"label":"SA-17","oscal":"sa-17"},{"label":"SA-21","oscal":"sa-21"},{"label":"SA-22","oscal":"sa-22"},{"label":"SC-01","oscal":"sc-1"},{"label":"SC-02","oscal":"sc-2"},{"label":"SC-03","oscal":"sc-3"},{"label":"SC-04","oscal":"sc-4"},{"label":"SC-05","oscal":"sc-5"},{"label":"SC-07","oscal":"sc-7"},{"label":"SC-07 (03)","oscal":"sc-7.3"},{"label":"SC-07 (04)","oscal":"sc-7.4"},{"label":"SC-07 (05)","oscal":"sc-7.5"},{"label":"SC-07 (07)","oscal":"sc-7.7"},{"label":"SC-07 (08)","oscal":"sc-7.8"},{"label":"SC-07 (10)","oscal":"sc-7.10"},{"label":"SC-07 (12)","oscal":"sc-7.12"},{"label":"SC-07 (18)","oscal":"sc-7.18"},{"label":"SC-07 (20)","oscal":"sc-7.20"},{"label":"SC-07 (21)","oscal":"sc-7.21"},{"label":"SC-08","oscal":"sc-8"},{"label":"SC-08 (01)","oscal":"sc-8.1"},{"label":"SC-10","oscal":"sc-10"},{"label":"SC-12","oscal":"sc-12"},{"label":"SC-12 (01)","oscal":"sc-12.1"},{"label":"SC-13","oscal":"sc-13"},{"label":"SC-15","oscal":"sc-15"},{"label":"SC-17","oscal":"sc-17"},{"label":"SC-18","oscal":"sc-18"},{"label":"SC-20","oscal":"sc-20"},{"label":"SC-21","oscal":"sc-21"},{"label":"SC-22","oscal":"sc-22"},{"label":"SC-23","oscal":"sc-23"},{"label":"SC-24","oscal":"sc-24"},{"label":"SC-28","oscal":"sc-28"},{"label":"SC-28 (01)","oscal":"sc-28.1"},{"label":"SC-39","oscal":"sc-39"},{"label":"SC-45","oscal":"sc-45"},{"label":"SC-45 (01)","oscal":"sc-45.1"},{"label":"SI-01","oscal":"si-1"},{"label":"SI-02","oscal":"si-2"},{"label":"SI-02 (02)","oscal":"si-2.2"},{"label":"SI-02 (03)","oscal":"si-2.3"},{"label":"SI-03","oscal":"si-3"},{"label":"SI-04","oscal":"si-4"},{"label":"SI-04 (01)","oscal":"si-4.1"},{"label":"SI-04 (02)","oscal":"si-4.2"},{"label":"SI-04 (04)","oscal":"si-4.4"},{"label":"SI-04 (05)","oscal":"si-4.5"},{"label":"SI-04 (10)","oscal":"si-4.10"},{"label":"SI-04 (11)","oscal":"si-4.11"},{"label":"SI-04 (12)","oscal":"si-4.12"},{"label":"SI-04 (14)","oscal":"si-4.14"},{"label":"SI-04 (16)","oscal":"si-4.16"},{"label":"SI-04 (18)","oscal":"si-4.18"},{"label":"SI-04 (19)","oscal":"si-4.19"},{"label":"SI-04 (20)","oscal":"si-4.20"},{"label":"SI-04 (22)","oscal":"si-4.22"},{"label":"SI-04 (23)","oscal":"si-4.23"},{"label":"SI-05","oscal":"si-5"},{"label":"SI-05 (01)","oscal":"si-5.1"},{"label":"SI-06","oscal":"si-6"},{"label":"SI-07","oscal":"si-7"},{"label":"SI-07 (01)","oscal":"si-7.1"},{"label":"SI-07 (02)","oscal":"si-7.2"},{"label":"SI-07 (05)","oscal":"si-7.5"},{"label":"SI-07 (07)","oscal":"si-7.7"},{"label":"SI-07 (15)","oscal":"si-7.15"},{"label":"SI-08","oscal":"si-8"},{"label":"SI-08 (02)","oscal":"si-8.2"},{"label":"SI-10","oscal":"si-10"},{"label":"SI-11","oscal":"si-11"},{"label":"SI-12","oscal":"si-12"},{"label":"SI-16","oscal":"si-16"},{"label":"SR-01","oscal":"sr-1"},{"label":"SR-02","oscal":"sr-2"},{"label":"SR-02 (01)","oscal":"sr-2.1"},{"label":"SR-03","oscal":"sr-3"},{"label":"SR-05","oscal":"sr-5"},{"label":"SR-06","oscal":"sr-6"},{"label":"SR-08","oscal":"sr-8"},{"label":"SR-09","oscal":"sr-9"},{"label":"SR-09 (01)","oscal":"sr-9.1"},{"label":"SR-10","oscal":"sr-10"},{"label":"SR-11","oscal":"sr-11"},{"label":"SR-11 (01)","oscal":"sr-11.1"},{"label":"SR-11 (02)","oscal":"sr-11.2"},{"label":"SR-12","oscal":"sr-12"}],"provisional":true,"provisionalNote":"Providers with 20x Class D Certifications MUST significantly supersede the minimum requirements for lower Classes, with specifics to be set during the 20x Phase 4 Pilot."}},"mappedControls":["ac-10","ac-11","ac-11.1","ac-12","ac-14","ac-17","ac-17.1","ac-17.2","ac-17.3","ac-17.4","ac-18","ac-18.1","ac-18.3","ac-18.4","ac-19","ac-19.5","ac-2","ac-2.1","ac-2.11","ac-2.12","ac-2.13","ac-2.2","ac-2.3","ac-2.4","ac-2.5","ac-2.6","ac-2.7","ac-2.9","ac-20","ac-20.1","ac-21","ac-3","ac-4","ac-4.21","ac-5","ac-6","ac-6.1","ac-6.10","ac-6.2","ac-6.3","ac-6.5","ac-6.7","ac-6.8","ac-6.9","ac-7","at-2","at-2.2","at-2.3","at-3","at-3.5","at-4","au-10","au-11","au-12","au-12.1","au-12.3","au-2","au-3","au-3.1","au-3.3","au-4","au-5","au-5.1","au-5.2","au-6","au-6.1","au-6.3","au-6.4","au-6.5","au-6.7","au-7","au-7.1","au-8","au-9","au-9.3","au-9.4","ca-2","ca-2.1","ca-2.2","ca-2.3","ca-3","ca-3.6","ca-7","ca-7.1","ca-7.4","ca-8","ca-8.1","ca-8.2","ca-9","cm-11","cm-12","cm-12.1","cm-14","cm-2","cm-2.2","cm-2.3","cm-2.7","cm-3","cm-3.1","cm-3.2","cm-3.4","cm-3.6","cm-4","cm-4.2","cm-5","cm-5.1","cm-5.5","cm-6","cm-6.1","cm-6.2","cm-7","cm-7.1","cm-7.2","cm-7.5","cm-8","cm-8.1","cm-8.2","cm-8.3","cm-8.4","cm-9","cp-10","cp-10.2","cp-10.4","cp-2","cp-2.1","cp-2.3","cp-2.5","cp-2.8","cp-3","cp-3.1","cp-4","cp-4.1","cp-6","cp-6.1","cp-6.3","cp-7","cp-7.1","cp-7.2","cp-7.3","cp-8","cp-8.1","cp-8.2","cp-9","cp-9.1","cp-9.8","ia-11","ia-12","ia-12.2","ia-12.3","ia-12.5","ia-2","ia-2.1","ia-2.2","ia-2.5","ia-2.6","ia-2.8","ia-3","ia-4","ia-4.4","ia-5","ia-5.1","ia-5.2","ia-5.6","ia-5.7","ia-5.8","ia-6","ia-7","ia-8","ia-8.2","ia-8.4","ir-2","ir-2.1","ir-2.2","ir-2.3","ir-3","ir-3.2","ir-4","ir-4.1","ir-4.11","ir-4.2","ir-4.4","ir-4.6","ir-5","ir-5.1","ir-6","ir-6.1","ir-6.3","ir-7","ir-7.1","ir-8","ir-8.1","ir-9","ir-9.2","ir-9.3","ir-9.4","pl-10","pl-4","pl-4.1","pl-8","pl-9","pm-3","pm-7","ps-2","ps-3","ps-4","ps-5","ps-6","ps-7","ps-8","ps-9","ra-3","ra-3.1","ra-5","ra-5.11","ra-5.2","ra-5.3","ra-5.4","ra-5.5","ra-5.8","ra-7","ra-9","sa-10","sa-11","sa-11.1","sa-11.2","sa-15","sa-15.3","sa-16","sa-17","sa-2","sa-21","sa-22","sa-3","sa-4","sa-4.1","sa-4.2","sa-4.5","sa-4.9","sa-5","sa-8","sa-9","sa-9.1","sa-9.2","sa-9.5","sc-10","sc-12","sc-12.1","sc-13","sc-17","sc-18","sc-2","sc-20","sc-21","sc-22","sc-23","sc-24","sc-28","sc-28.1","sc-3","sc-39","sc-4","sc-45","sc-45.1","sc-5","sc-7","sc-7.10","sc-7.18","sc-7.20","sc-7.21","sc-7.3","sc-7.4","sc-7.5","sc-7.7","sc-7.8","sc-8","sc-8.1","si-10","si-11","si-12.3","si-16","si-18.4","si-2","si-2.2","si-2.3","si-3","si-4","si-4.1","si-4.11","si-4.12","si-4.16","si-4.18","si-4.19","si-4.2","si-4.20","si-4.22","si-4.4","si-4.5","si-5","si-5.1","si-6","si-7","si-7.1","si-7.15","si-7.2","si-7.5","si-7.7","si-8","si-8.2","sr-10","sr-11","sr-11.1","sr-2","sr-2.1","sr-3","sr-5","sr-6","sr-8"],"definitions":{"FRD-ACV":{"term":"Accepted Vulnerability","definition":"A vulnerability that the provider does not intend to fully mitigate or remediate, OR that has not or will not be fully mitigated or remediated within the maximum overdue period in FedRAMP Vulnerability Detection and Response rules."},"FRD-ADP":{"term":"Adaptive Change","definition":"A type of significant change that does not routinely recur and does not introduce substantive potential security risks that need to be assessed in depth."},"FRD-ADV":{"term":"Advisor","definition":"An entity that helps a provider understand, prepare for, or maintain FedRAMP Certification without replacing the provider's responsibility or the assessor's independence."},"FRD-AGY":{"term":"Agency","definition":"Has the meaning given in 44 U.S. Code § 3502 (1), which is \"any executive department, military department, Government corporation, Government controlled corporation, or other establishment in the executive branch of the Government (including the Executive Office of the President), or any independent regulatory agency, but does not include—(A) the Government Accountability Office; (B) Federal Election Commission; (C) the governments of the District of Columbia and of the territories and possessions of the United States, and their various subdivisions; or (D) Government-owned contractor-operated facilities, including laboratories engaged in national defense research and production activities.\""},"FRD-AAP":{"term":"All Affected Parties","definition":"All federal entities whose interests are affected directly or are likely to be affected directly in the event of a vulnerability or incident related to federal customer data. This always includes FedRAMP and directly impacted federal customer agencies."},"FRD-ANA":{"term":"All Necessary Assessors","definition":"All entities who participate in the FedRAMP assessment of a cloud service offering in the context of a FedRAMP Certification. This always includes FedRAMP and any FedRAMP Recognized independent assessor contracted by a provider to perform a FedRAMP assessment."},"FRD-ANP":{"term":"All Necessary Parties","definition":"All entities whose interests are affected directly by activity related to a specific cloud service offering in the context of FedRAMP Certifications. This always includes FedRAMP and any agency customer who is using the cloud service offering, but may include additional parties depending on agreements made by the cloud service provider (such as consultants or independent assessors). Potential agency customers or third-party cloud service providers should also be included in most cases but this is not a mandatory requirement under FedRAMP because the cloud service provider may choose who they wish to do business with."},"FRD-ART":{"term":"Artifacts","definition":"Security-related materials that supply information regarding or evidence of functions, policies, decisions, procedures, operations, or other such activities, for the purposes of obtaining and maintaining a FedRAMP Certification. All such artifacts are considered FedRAMP Certification Data and are included in the FedRAMP Certification Package."},"FRD-ASR":{"term":"Assessor","definition":"An assessor that performs assessment, verification, or validation activities for a cloud service offering seeking to obtain or maintain FedRAMP Certification; FedRAMP is the final assessor for FedRAMP Certification, but FedRAMP Recognized independent assessment services are typically also utilized."},"FRD-CCL":{"term":"Certification Class","definition":"The category of assurance that a cloud service offering supplies to federal government customers following FedRAMP Practices, increasing from minimal assurance at Class A to significant assurance at Class D; currently available categories are Class A, B, C, or D."},"FRD-CCC":{"term":"Certification Class Change","definition":"A type of significant change that is likely to change the FedRAMP Certification class for the entire cloud service offering (e.g. from Class B to Class C or from Class D to Class C)."},"FRD-CRD":{"term":"Certification Data","definition":"The collective information required by FedRAMP for initial and ongoing FedRAMP Certification of a cloud service offering, including the FedRAMP Certification Package."},"FRD-CRP":{"term":"Certification Package","definition":"Has meaning from 44 USC § 3607 (b)(8) given to \"authorization package\", which is \"the essential information that can be used by an agency to determine whether to authorize the operation of an information system or the use of a designated set of common controls for all cloud computing products and services [certified] by FedRAMP.\""},"FRD-CPH":{"term":"Certification Path","definition":"The underlying source of the FedRAMP Certification, either from a federal agency sponsored authorization to operate or directly from FedRAMP itself. The agency path is a legacy path that is only available for FedRAMP Rev5 and still requires review and approval from FedRAMP."},"FRD-CPF":{"term":"Certification Profile","definition":"The combination of a FedRAMP Certification Type (Rev5 or 20x), FedRAMP Certification Path (Program or Agency), and FedRAMP Certification Class (A, B, C, or D) for a cloud service offering."},"FRD-CTY":{"term":"Certification Type","definition":"The form of assurance that a cloud service offering supplies to federal government customers following FedRAMP Practices, either Rev5 or 20x. Rev5 follows a legacy approach based primarily on documented plans while 20x follows a modern approach based primarily on measured outcomes."},"FRD-CSO":{"term":"Cloud Service Offering","definition":"A specific, packaged cloud computing product or service supplied by a cloud service provider for use by customers, that is the subject of a FedRAMP Certification."},"FRD-DCE":{"term":"Debilitating Customer Effect","definition":"An unwanted customer effect that interrupts use of the cloud service for most users or compromises the integrity or confidentiality of most federal customer data. If the adverse customer effect is unknown then it should be treated as if it is debilitating until proven otherwise."},"FRD-DTM":{"term":"Deterministic Telemetry","definition":"Verifiable data collected directly from an authoritative source that represents a factual and reproducible observation of the attributes of a system such as the system's state, configuration, or behavior."},"FRD-DCF":{"term":"Disruptive Customer Effect","definition":"An unwanted customer effect that interrupts use of the cloud service for many users for less than 24 hours, or that compromises the integrity or confidentiality of large amounts or many types of federal customer data."},"FRD-DFT":{"term":"Drift","definition":"Changes to information resources that cause deviations from the intended and assessed state; common forms of drift include changes to configurations, deployed software, privileges, running processes, and availability."},"FRD-FPV":{"term":"False Positive Vulnerability","definition":"A detected vulnerability that is not actually present in an exploitable state in the information resource"},"FRD-FCD":{"term":"Federal Customer Data","definition":"All electronic information, content, and materials that an agency or its authorized users upload, store, or otherwise supply to a cloud service for processing or storage. This does NOT include account information, service metadata, analytics, telemetry, or other similar metadata generated by the cloud service provider."},"FRD-FCR":{"term":"FedRAMP Certification Report","definition":"A report that is produced by FedRAMP documenting the results of a FedRAMP Certification assessment. This report is typically produced after the initial FedRAMP Certification assessment on the Program Certification Path and updated as necessary during ongoing FedRAMP Certification, but may be produced at any time by FedRAMP as part of ongoing FedRAMP Certification activities for any cloud service offering (such as corrective action). Cloud service offerings must include these reports in their FedRAMP Certification Package."},"FRD-FCT":{"term":"FedRAMP Certified","definition":"The status of a cloud service offering that has received FedRAMP Certification and meets the legal requirement to be FedRAMP authorized."},"FRD-FIN":{"term":"FedRAMP Independent Assessment","definition":"An independent verification and validation assessment, performed by a FedRAMP Recognized independent assessment service or FedRAMP following FedRAMP rules. These assessments are typically first performed to obtain an initial FedRAMP Certification then repeated on an annual basis to maintain FedRAMP Certification."},"FRD-FPR":{"term":"FedRAMP Practices","definition":"The security measures, safeguards, precautions, procedures, activities, policies, capabilities, mechanisms, etc. that are expected to be in place by FedRAMP to demonstrate that information resources are properly protected, expressed in FedRAMP 20x Key Security Indicators or FedRAMP Rev5 Controls and supplemented by FedRAMP rules."},"FRD-FRA":{"term":"FedRAMP Recognized","definition":"The status of independent assessment services that are recognized by FedRAMP to perform assessment activities on behalf of FedRAMP for cloud service offerings seeking to obtain or maintain FedRAMP Certification."},"FRD-FRI":{"term":"FedRAMP Reportable Incident","definition":"An incident that affects the confidentiality or integrity of federal customer data or is likely to affect the confidentiality or integrity of federal customer data."},"FRD-FSI":{"term":"FedRAMP Security Inbox","definition":"An email address that follows the FedRAMP Security Inbox rules."},"FRD-FIR":{"term":"Final Incident Report (FIR)","definition":"A final report after recovery from an incident that is supplied by FedRAMP Certified cloud service providers to FedRAMP and agency customers, following FedRAMP Incident Evaluation and Communication rules."},"FRD-FMV":{"term":"Fully Mitigated Vulnerability","definition":"A vulnerability where the likelihood of exploitation or Potential Agency Impact N-rating has been reduced from the original evaluation until either are negligible, but the vulnerability is still detected."},"FRD-HAN":{"term":"Handle","definition":"Has the plain language meaning inclusive of any possible action taken with information, such as access, collect, control, create, display, disclose, disseminate, dispose, maintain, manipulate, process, receive, review, store, transmit, use... etc."},"FRD-INT":{"term":"Incident","definition":"Has the meaning given in 44 USC § 3552 (b)(2) which is \"an occurrence that (A) actually or imminently jeopardizes, without lawful authority, the integrity, confidentiality, or availability of information or an information system; or (B) constitutes a violation or imminent threat of violation of law, security policies, security procedures, or acceptable use policies.\""},"FRD-IRS":{"term":"Information Resource","definition":"Has the meaning from 44 USC § 3502 (6): \"information and related resources, such as personnel, equipment, funds, and information technology.\" This includes any aspect of the cloud service offering, both technical and managerial, including everything that makes up the business of the offering from non-machine-based information resources like organizational policies, procedures, employees, etc. to machine-based information resources like hardware, software, cloud services, code, etc."},"FRD-INC":{"term":"Initial Certification","definition":"The first FedRAMP Certification of a cloud service offering based on the applicable FedRAMP Practices."},"FRD-IFA":{"term":"Initial FedRAMP Assessment","definition":"The first full assessment of a cloud service offering obtaining FedRAMP Certification, coordinated by the provider with all necessary assessors, that results in a FedRAMP Certification."},"FRD-IIR":{"term":"Initial Incident Report (IIR)","definition":"An initial report about an incident that is supplied by FedRAMP Certified cloud service providers to FedRAMP and agency customers, following FedRAMP FedRAMP Incident Evaluation and Communication rules."},"FRD-IRV":{"term":"Internet-Reachable Vulnerability (IRV)","definition":"A vulnerability in a machine-based information resource that might be exploited or otherwise triggered by a payload originating from a source on the public internet."},"FRD-KEV":{"term":"Known Exploited Vulnerability (KEV)","definition":"Has the meaning given in CISA Binding Operational Directive 26-04, which is any vulnerability identified in CISA's Known Exploited Vulnerabilities catalog."},"FRD-LKY":{"term":"Likely","definition":"A reasonable degree of probability based on context."},"FRD-LEV":{"term":"Likely Exploitable Vulnerability (LEV)","definition":"A vulnerability that is not fully mitigated AND is reachable by a likely threat actor; AND a likely threat actor with knowledge of the vulnerability would likely gain unauthorized access, cause harm, disrupt operations, or otherwise have an undesired adverse impact within the cloud service offering by exploiting the vulnerability."},"FRD-MBI":{"term":"Machine-Based (Information Resources)","definition":"Any information technology information resource—including systems, processes, software, hardware, services, cloud-native capabilities, and any other such capability, component, or resource—that relies primarily on mechanical or electronic devices (i.e. computers) for operation."},"FRD-MGN":{"term":"Machine-Generated","definition":"Automatically produced by a computer process, application, or other mechanism without the intervention or manipulation of a human during production."},"FRD-MRD":{"term":"Machine-Readable","definition":"Has the meaning from 44 U.S. Code § 3502 (18) which is \"the term \"machine-readable\", when used with respect to data, means data in a format that can be easily processed by a computer without human intervention while ensuring no semantic meaning is lost\""},"FRD-MAY":{"term":"MAY","definition":"The rule is truly optional. Parties SHOULD address such rules in their security documentation by explaining their decisions about how they handle such rules."},"FRD-MCE":{"term":"Minimal Customer Effect","definition":"An unwanted customer effect that is only noticeable by some users. This includes minor inconveniences such as reduced performance."},"FRD-MST":{"term":"MUST","definition":"The rule is an absolute requirement. Parties MUST meet such rules and address them in their security documentation. Failure to follow the rule is a vulnerability likely requiring corrective action and/or the denial of initial or ongoing FedRAMP Certification."},"FRD-MNT":{"term":"MUST NOT","definition":"The rule is an absolute prohibition. Parties MUST meet such rules and address them in their security documentation. Failure to follow the rule is a vulnerability likely requiring corrective action and/or the denial of initial or ongoing FedRAMP Certification."},"FRD-NCE":{"term":"Narrow Customer Effect","definition":"An unwanted customer effect that interrupts use of the cloud service for some users for less than 12 hours, or that compromises the integrity or confidentiality of an extremely limited amount and type of federal customer data."},"FRD-ONC":{"term":"Ongoing Certification","definition":"The continued FedRAMP Certification of a cloud service offering based on the applicable FedRAMP Practices."},"FRD-OCR":{"term":"Ongoing Certification Report (OCR)","definition":"A regular report that is supplied by FedRAMP Certified cloud service providers to agency customers, following FedRAMP Collaborative Continuous Monitoring rules."},"FRD-OIR":{"term":"Ongoing Incident Report (OIR)","definition":"A recurring report about an ongoing incident that is supplied by FedRAMP Certified cloud service providers to FedRAMP and agency customers, following the FedRAMP Incident Evaluation and Communication rules."},"FRD-ODV":{"term":"Overdue Vulnerability","definition":"A vulnerability that the provider intends to fully mitigate or remediate but has not or will not do so within the time frames recommended or required by FedRAMP."},"FRD-PMV":{"term":"Partially Mitigated Vulnerability","definition":"A vulnerability where the likelihood or Potential Agency Impact N-rating has been reduced from the original evaluation but the risk of exploitation still exists and the vulnerability is still detected."},"FRD-PFA":{"term":"Persistent FedRAMP Assessment","definition":"Follow-on assessments of a cloud service offering focused on Key Security Indicators, coordinated by the provider with all necessary assessors, to maintain FedRAMP Certification or change its FedRAMP Certification class."},"FRD-PER":{"term":"Persistently","definition":"Occurring in a firm, steady way that is repeated over a long period of time in spite of obstacles or difficulties. Persistent activities may vary between actors, may occur irregularly, and may include interruptions or waiting periods between cycles. These attributes of persistent activities should be intentional, understood, and documented; the status of persistent activities will always be known."},"FRD-PAI":{"term":"Potential Agency Impact","definition":"The estimated cumulative effect of unauthorized access, disruption, harm, or other adverse impacts to all agencies using the cloud service that are likely to result from security incidents or the exploitation of vulnerabilities in the cloud service offering; as estimated following appropriate FedRAMP rules to calculate the Potential Agency Impact N-rating (PAIN)."},"FRD-PAC":{"term":"Privileged Account","definition":"An account with elevated privileges that enables administrative functions over some aspect of the cloud service offering that may affect the confidentiality, integrity, or availability of information beyond those given to normal users; levels of privilege may vary wildly."},"FRD-PRO":{"term":"Promptly","definition":"Without unnecessary delay."},"FRD-PRV":{"term":"Provider","definition":"The cloud service provider responsible for a cloud service offering in the context of FedRAMP Certification."},"FRD-QTR":{"term":"Quarterly Review","definition":"A regular synchronous meeting hosted by a FedRAMP Certified cloud service provider for agency customers, following FedRAMP Collaborative Continuous Monitoring rules."},"FRD-RGL":{"term":"Regularly","definition":"Performing the activity on a consistent, predictable, and repeated basis, at set intervals, automatically if possible, following a documented plan. These intervals may vary as appropriate between different activities."},"FRD-RMV":{"term":"Remediated Vulnerability","definition":"A vulnerability that has been neutralized or eliminated and is no longer detected."},"FRD-RSP":{"term":"Responsibly","definition":"In a way that shows that you have good judgment and the ability to act correctly and make decisions on your own."},"FRD-RTR":{"term":"Routine Recurring Change","definition":"The type of significant change that regularly and routinely recurs as part of ongoing operations, vulnerability mitigation, or vulnerability remediation."},"FRD-SCT":{"term":"Security Category","definition":"Has the meaning from NIST FIPS 199, which is \"The characterization of information or an information system based on an assessment of the potential impact that a loss of confidentiality, integrity, or availability of such information or information system would have on organizational operations, organizational assets, or individuals.\" Security categories are often referred to as \"impact levels\" and include Low, Moderate, and High."},"FRD-SDR":{"term":"Security Decision Record (SDR)","definition":"A persistently maintained, verified, and validated record of the security decisions made by a provider over the lifecycle of a cloud service offering. The Security Decision Record replaces the traditional System Security Plan and documents how applicable FedRAMP Practices are addressed, including implementation rationale, resulting customer risk, assessment findings, and supporting artifacts."},"FRD-SHD":{"term":"SHOULD","definition":"There may exist valid reasons in particular circumstances to ignore this rule, but the full implications must be understood and carefully weighed. Parties MUST address such rules in their security documentation by explaining their decisions about how they handle such rules."},"FRD-SNT":{"term":"SHOULD NOT","definition":"There may exist valid reasons in particular circumstances when the particular action is acceptable or even useful, but the full implications must be understood and carefully weighed. Parties MUST address such rules in their security documentation by explaining their decisions about how they handle such rules."},"FRD-SGC":{"term":"Significant Change","definition":"Has the meaning given in NIST SP 800-37 Rev. 2 which is \"a change that is likely to substantively affect the security or privacy posture of a system.\""},"FRD-TPR":{"term":"Third-Party Information Resource","definition":"Any information resource that is not entirely included in the Minimum Assessment Scope for the cloud service offering obtaining FedRAMP Certification."},"FRD-TLA":{"term":"Top-Level Administrative Account","definition":"The most privileged account with the highest level of access within a cloud service offering for a customer organization, typically with complete control over all aspects of the cloud service offering, including managing resources, users, access, privileges, and the account itself."},"FRD-TRF":{"term":"Transformative Change","definition":"The type of significant change that introduces substantive potential security risks that are likely to affect existing risk determinations and must be assessed in depth."},"FRD-TRC":{"term":"Trust Center","definition":"A secure repository or service used by cloud service providers to store and share FedRAMP Certification Data. Trust centers are the complete and definitive source for FedRAMP Certification Data and must follow the FedRAMP Certification Data Sharing rules to be FedRAMP-compatible."},"FRD-VLN":{"term":"Validation","definition":"Confirmation through objective evidence that implemented security capabilities and related certification data are suitable for their intended FedRAMP Certification use and support the expected security outcomes for a cloud service offering."},"FRD-VRF":{"term":"Verification","definition":"Confirmation through objective evidence that specified FedRAMP Practices have been fulfilled for a cloud service offering."},"FRD-VUL":{"term":"Vulnerability","definition":"Has the meaning given to \"security vulnerability\" in 6 USC § 650 (25), which is \"any attribute of hardware, software, process, or procedure that could enable or facilitate the defeat of [...] management, operational, and technical controls used to protect against an unauthorized effort to adversely affect the confidentiality, integrity, and availability of an information system or its information.\" This includes gaps in Rev5 Controls and 20x Key Security Indicators, software vulnerabilities, misconfigurations, exposures, weak credentials, insecure services, and all other such potential weaknesses in protection (intentional or unintentional)."},"FRD-VLD":{"term":"Vulnerability Detection","definition":"The systematic process of discovering and identifying security vulnerabilities in information resources through assessment, scanning, threat intelligence, vulnerability disclosure mechanisms, bug bounties, supply chain monitoring, and other capabilities. This process includes the initial discovery of a vulnerability's existence and the determination of affected information resources within a cloud service offering."},"FRD-VLR":{"term":"Vulnerability Response","definition":"The systematic process of tracking, evaluating, mitigating, monitoring, remediating, assessing exploitation, reporting, and otherwise managing detected vulnerabilities."}},"source":{"repo":"https://github.com/FedRAMP/rules","commit":"a89d78477ddea98dc57eca24f5007794c2b4eeb6","sha256":"fb48d677a85d77fb72735a325de2c1945a1e0ceab1d2e655292fe9ebe3e4e0b4","licence":"US government work: not subject to copyright in the United States (17 U.S.C. 105)."},"schemas":{"accepted-vulnerability-info":{"$schema":"https://json-schema.org/draft/2020-12/schema","$id":"https://fedramp.gov/schemas/fedramp-accepted-vulnerability-info-schema-2026-06-24.json","$schemaVersion":"0.1.1","type":"object","title":"FedRAMP Accepted Vulnerability Info (VER-RPT-AVI)","description":"Accepted vulnerability information required when reporting vulnerability detection and response activity per VER-RPT-AVI.","required":["certificationPackageOverviewUri","reportPeriod","acceptedVulnerabilities"],"properties":{"certificationPackageOverviewUri":{"$ref":"https://fedramp.gov/schemas/fedramp-common-definitions-schema-2026-06-24.json#/$defs/certificationPackageOverviewUri"},"reportPeriod":{"$ref":"https://fedramp.gov/schemas/fedramp-common-definitions-schema-2026-06-24.json#/$defs/reportPeriodDateTime","title":"Report Period","description":"Period summarized by this report. Per VER-RPT-PER, must cover all activity since the previous report."},"acceptedVulnerabilities":{"type":"array","title":"Accepted Vulnerabilities","description":"Accepted vulnerabilities with activity in this period. Non-accepted vulnerabilities are reported under VER-RPT-VDT.","items":{"$ref":"https://fedramp.gov/schemas/fedramp-common-definitions-schema-2026-06-24.json#/$defs/acceptedVulnerabilityInfo"}}}},"certification-package-overview":{"$schema":"https://json-schema.org/draft/2020-12/schema","$id":"https://fedramp.gov/schemas/fedramp-certification-package-overview-schema-2026-06-24.json","$schemaVersion":"0.2.0","type":"object","title":"FedRAMP Certification Package Overview (FRC-CSO-PKG)","description":"Identification, service properties, contacts, and supporting documentation for a Cloud Service Offering per FRC-CSO-PKG.","required":["serviceIdentification","serviceProperties","contactInformation"],"properties":{"serviceIdentification":{"type":"object","title":"Service Identification","description":"Basic identification details for the Cloud Service Offering.","required":["providerName","serviceName","serviceAcronym","serviceDescription","certificationType","fedRampPackageId","website","logo"],"properties":{"fedRampPackageId":{"type":"string","title":"FedRAMP ID","description":"Unique identifier assigned to the CSP by FedRAMP. If no FedRAMP ID is available, use the CSP's name and acronym."},"ueiNumber":{"type":"string","title":"UEI Number","description":"Unique Entity Identifier (UEI) assigned to the CSP by SAM.gov. If no UEI is available leave this blank. (CDS-CSO-PUB)"},"providerName":{"type":"string","title":"Provider Name","description":"Name of the Cloud Service Provider."},"serviceName":{"type":"string","title":"Service Name","description":"Full name of the Cloud Service Offering."},"serviceAcronym":{"type":"string","title":"Service Acronym","description":"Short acronym or abbreviation for the Cloud Service Offering."},"serviceDescription":{"type":"string","title":"Service Description","description":"A detailed description of the Cloud Service Offering. May use Markdown for formatting (CDS-CSO-PUB)."},"certificationType":{"type":"string","title":"Certification Type","description":"The FedRAMP certification type for the Cloud Service Offering.","enum":["20x","Rev5"]},"website":{"type":"string","format":"uri","title":"Website","description":"Official website for the Cloud Service Offering (CDS-CSO-PUB)."},"logo":{"$ref":"https://fedramp.gov/schemas/fedramp-common-definitions-schema-2026-06-24.json#/$defs/logoUri","title":"Logo","description":"URL of the CSP logo. Must point to a PNG, JPEG, GIF, SVG, WebP, ICO, BMP, or TIFF file (CDS-CSO-PUB)."}}},"serviceProperties":{"type":"object","title":"Service Properties","description":"Technical and operational properties of the Cloud Service Offering.","required":["serviceType","deploymentModel"],"properties":{"serviceType":{"type":"array","title":"Service Model","description":"Cloud service model(s). Select all that apply (CDS-CSO-PUB).","items":{"type":"string","enum":["SaaS","PaaS","IaaS"]},"minItems":1},"deploymentModel":{"type":"string","title":"Deployment Model","description":"Deployment model of the system (CDS-CSO-PUB).","enum":["Public Cloud","Government-Only Cloud","Hybrid Cloud","Community Cloud","Government Community Cloud"]},"businessCategory":{"type":"array","title":"Business Category","description":"Business Category(s) supported by the service (CDS-CSO-PUB).","items":{"type":"string","enum":["Accounting","Analytics","Artificial Intelligence (AI)","Collaboration","Communication","Construction","Contact Center","Content Management System (CMS)","Customer Relations Management (CRM)","Customer Service","Cybersecurity & Risk Management","Data Management","Design & Multimedia","Development Tools","Education & Training","Finance","Fleet Management","Governance, Risk, and Compliance (GRC)","Grant Management","Health & Wellness","Human Resources","Law Enforcement","Learning Management","Legal & Policy","Marketing & Sales","Media","Mobile Device Management (MDM)","Network Management","Operations Management","Research","Storage","System Administration","Talent Development","Talent Management","Travel Management","Virtual Private Network (VPN)"]},"minItems":1,"maxItems":10},"trustCenter":{"$ref":"#/$defs/repository","title":"Trust Center","description":"The URL and any access instructions needed for the Cloud Service Provider's FedRAMP Trust Center (CDS-CSO-UTC). Note: Rules for FedRAMP-Compatible Trust Centers are explained in the Certification Data Sharing Rules under the FedRAMP-Compatible Trust Centers section (id: CDS-TRC)."},"secureConfigurationGuidance":{"$ref":"#/$defs/repository","title":"Secure Configuration Guidance","description":"The URL and any access instructions needed for the Cloud Service Provider's Secure Configuration Guide (SCG-CSO-RSC)."},"additionalRepositories":{"type":"array","title":"Repositories","description":"Repository locations for system authorization documentation, policies, procedures, and assessment reports.","items":{"$ref":"#/$defs/repository"}},"nextOngoingCertificationReportDate":{"type":"string","format":"date","title":"Next Ongoing Certification Report Date","description":"The date of the next ongoing certification report for the Cloud Service Provider (CDS-CSO-PUB)."}}},"contactInformation":{"type":"array","title":"Contact Information","description":"Key contacts for the Cloud Service Provider. Must include at least one Security Contact and one Sales Contact (CDS-CSO-PUB).","items":{"$ref":"#/$defs/contactInfo"},"allOf":[{"contains":{"required":["contactType"],"properties":{"contactType":{"title":"Contact Type","description":"The role or category of this contact.","const":"Security"}}}},{"contains":{"required":["contactType"],"properties":{"contactType":{"title":"Contact Type","description":"The role or category of this contact.","const":"Sales"}}}}]},"assessor":{"type":"object","title":"Independent Assessor","description":"The Independent Assessment Service that performs verification and validation for the Cloud Service Offering (CDS-CSO-PUB).","required":["name","assessorID"],"properties":{"name":{"type":"string","title":"Assessor Name","description":"Name of the independent assessor."},"assessorID":{"type":"string","title":"Assessor's FedRAMP ID","description":"Unique identifier assigned to the assessor by FedRAMP.","pattern":"^\\d{6}$"}}},"advisors":{"type":"array","title":"Advisors","description":"Optional list of advisors associated with the Cloud Service Offering or organization. Multiple advisors may be provided if needed.","items":{"type":"object","title":"Advisor","description":"An advisor who provides guidance, support, or subject matter expertise.","required":["name"],"properties":{"name":{"type":"string","title":"Advisor Name","description":"Name of the advisor."}}}},"certifiedServices":{"type":"array","title":"Certified Services","description":"List of services offered by the provider that are included in this certification (CDS-CSO-SVC).","items":{"type":"object","title":"Certified Service","description":"A service offered by the provider that is included in this certification.","required":["serviceName","serviceDescription"],"properties":{"serviceName":{"type":"string","title":"Service Name","description":"Name of the service as it appears on the provider's website and in marketing materials."},"serviceDescription":{"type":"string","title":"Service Description","description":"Description of the service. May use Markdown for formatting."},"dateAvailable":{"type":"string","format":"date","title":"Date Available","description":"Date the service became available or was certified."}}}},"thirdPartyInformationResources":{"type":"object","title":"Third-Party Information Resources","description":"Third-party information resources within the Minimum Assessment Scope for the Cloud Service Offering (MAS-CSO-TPR).","properties":{"certified":{"type":"array","title":"FedRAMP Certified","description":"FedRAMP Certified third-party information resources.","items":{"type":"object","required":["fedRampCertifiedThirdPartyInformationResource","useCase"],"properties":{"fedRampCertifiedThirdPartyInformationResource":{"type":"string","title":"FedRAMP ID","description":"Unique FedRAMP ID of the third-party information resource."},"useCase":{"type":"string","title":"Use Case","description":"How this resource is used in the context of this offering."}}}},"nonCertified":{"type":"array","title":"Non-FedRAMP Certified","description":"Non-FedRAMP Certified third-party information resources.","items":{"type":"object","required":["name","provider","useCase"],"properties":{"name":{"type":"string","title":"Name","description":"Name of the third-party information resource."},"provider":{"type":"string","title":"Provider","description":"Name of the provider of the third-party information resource."},"website":{"type":"string","format":"uri","title":"Website","description":"Website of the third-party information resource."},"useCase":{"type":"string","title":"Use Case","description":"How this resource is used in the context of this offering."}}}}}}},"$defs":{"repository":{"type":"object","title":"Repository","description":"A repository location for system authorization documentation, policies, procedures, assessment reports, etc.","required":["repositoryType","url","repositoryDescription","authenticationRequired"],"properties":{"repositoryType":{"type":"array","title":"Repository Type","description":"The type(s) or categories of this repository. A single repository may satisfy multiple type requirements.","items":{"type":"string"},"minItems":1,"examples":[["Secure Configuration Guidance"],["Trust Center","Assessment Reports"]]},"url":{"type":"string","format":"uri","title":"Repository URL","description":"URL of the repository."},"repositoryDescription":{"type":"string","title":"Repository Description","description":"Description of the repository contents."},"authenticationRequired":{"type":"boolean","title":"Authentication Required","description":"Whether authentication is required to access the repository."},"accessRequestInstructions":{"type":"string","title":"Access Request Instructions","description":"Instructions for requesting access to the repository. May use Markdown for formatting."}},"if":{"required":["authenticationRequired"],"properties":{"authenticationRequired":{"title":"Authentication Required","description":"Whether authentication is required to access the repository.","const":true}}},"then":{"required":["accessRequestInstructions"]}},"contactInfo":{"type":"object","title":"Contact","description":"A contact for the Cloud Service Provider.","required":["contactType"],"properties":{"contactType":{"type":"string","title":"Contact Type","description":"The role or category of this contact.","examples":["Primary","Security","Sales"]},"contactName":{"type":"string","title":"Name","description":"Name of the contact. May be a specific person or the role of the contact."},"contactEmail":{"type":"string","format":"email","title":"Email","description":"Email address of the contact."},"contactPhone":{"type":"string","title":"Phone Number","description":"US phone number, including toll-free numbers (800, 888, etc.), with an optional +1 country code and extension. Digits may be separated by dashes, dots, or spaces, and the area code may be in parentheses (e.g. 202-555-0123, (800) 555-0199, 1-888-555-0123, +1 202.555.0123 ext. 42).","pattern":"^(\\+?1[-. ]?)?(\\([0-9]{3}\\)|[0-9]{3})[-. ]?[0-9]{3}[-. ]?[0-9]{4}( ?([xX]|[eE][xX][tT]\\.?|[eE][xX][tT][eE][nN][sS][iI][oO][nN]) ?[0-9]{1,6})?$"}}}}},"common-definitions":{"$schema":"https://json-schema.org/draft/2020-12/schema","$id":"https://fedramp.gov/schemas/fedramp-common-definitions-schema-2026-06-24.json","$schemaVersion":"0.4.1","title":"FedRAMP Common Definitions","description":"Shared type definitions referenced by other FedRAMP schemas.","$defs":{"certificationPackageOverviewUri":{"type":"string","format":"uri","title":"Certification Package Overview","description":"Full URI of the provider's Certification Package Overview document."},"logoUri":{"type":"string","format":"uri","title":"Logo","description":"URL of an organization logo. Must point to a PNG, JPEG, GIF, SVG, WebP, ICO, BMP, or TIFF file.","pattern":"\\.(png|jpe?g|gif|svg|webp|ico|bmp|tiff?)([?#].*)?$"},"contactInformation":{"type":"object","title":"Contact Information","description":"Point of contact and website for an organization.","required":["pointOfContactName","jobTitle","email","phone","companyWebsite"],"properties":{"pointOfContactName":{"type":"string","title":"Point of Contact Name","description":"Full name of the point of contact for the organization."},"jobTitle":{"type":"string","title":"Job Title","description":"Job title of the point of contact."},"email":{"type":"string","format":"email","title":"Email","description":"Email address for the point of contact."},"phone":{"type":"string","title":"Phone","description":"Phone number for the point of contact."},"companyWebsite":{"type":"string","format":"uri","title":"Company Website","description":"Official website URL for the organization."}}},"nRating":{"type":"integer","title":"Potential Agency Impact N-Rating","description":"See VER-EVA-EPA or IEC-CSO-EFI for N1–N5 definitions.","enum":[0,1,2,3,4,5]},"detection":{"type":"object","title":"Detection","description":"Required information for a single detected vulnerability per VER-RPT-VDT.","required":["detectedAt","detectionSource"],"properties":{"detectedAt":{"type":"string","format":"date-time","title":"Detected At","description":"When the vulnerability was detected."},"detectionSource":{"type":"string","title":"Detection Source","description":"Tool or activity that identified the vulnerability (e.g., scanner, penetration test, bug bounty)."}}},"painReductionEvent":{"type":"object","title":"PAIN Reduction Event","description":"Required information for a single PAIN reduction event per VER-RPT-VDT.","required":["reducedAt","rating"],"properties":{"reducedAt":{"type":"string","format":"date-time","title":"Reduced At","description":"When the PAIN reduction was completed."},"rating":{"$ref":"#/$defs/nRating","title":"Rating After Reduction","description":"N-rating after the PAIN reduction."}}},"vulnerabilityDetail":{"type":"object","title":"Vulnerability Detail","description":"Required information for a single detected vulnerability per VER-RPT-VDT.","required":["providerTrackingId","detection","vulnerabilityDescription"],"properties":{"providerTrackingId":{"type":"string","title":"Provider Tracking ID","description":"Provider's internally assigned identifier for this vulnerability."},"detection":{"$ref":"#/$defs/detection"},"vulnerabilityDescription":{"type":"string","title":"Vulnerability Description","description":"Description of the vulnerability."},"potentialAgencyImpact":{"type":"string","title":"Potential Agency Impact","description":"Description of the potential impact."},"evaluationCompletedAt":{"type":"string","format":"date-time","title":"Evaluation Completed At","description":"When evaluation was completed. The clock for VER-TFR-MAV runs from this date."},"isInternetReachable":{"type":"boolean","title":"Is Internet-Reachable","description":"IRV classification per VER-EVA-EIR."},"isLikelyExploitable":{"type":"boolean","title":"Is Likely Exploitable","description":"LEV classification per VER-EVA-ELX and VER-EVA-AIA."},"currentRating":{"$ref":"#/$defs/nRating","title":"Current Rating","description":"Currently estimated Potential Agency Impact N-rating."},"projectedNextReduction":{"type":"object","title":"Projected Next Reduction","description":"Next planned mitigation step. Omit if fully mitigated or none planned.","required":["estimatedAt","targetRating"],"properties":{"estimatedAt":{"type":"string","format":"date-time","title":"Estimated At","description":"When the next reduction is expected."},"targetRating":{"$ref":"#/$defs/nRating","title":"Target Rating","description":"Next Potential Agency Impact N-rating."}}},"overdueStatus":{"type":"object","title":"Overdue Status","description":"See VER-TFR-EVU and VER-TFR-MAV for overdue definitions.","required":["isOverdue"],"properties":{"isOverdue":{"type":"boolean","title":"Is Overdue","description":"True if the vulnerability is overdue."},"explanation":{"type":"string","title":"Explanation","description":"Reason for the overdue status."}},"if":{"required":["isOverdue"],"properties":{"isOverdue":{"title":"Is Overdue","description":"True if the vulnerability is overdue.","const":true}}},"then":{"required":["explanation"]}},"supplementaryRiskInformation":{"type":"string","title":"Supplementary Risk Information","description":"Per VER-RPT-VDT field 11 and VER-RPT-NID."},"painReductionEvents":{"type":"array","title":"PAIN Reduction Events","description":"History of completed PAIN-rating reductions for this vulnerability per VER-RPT-VDT.","items":{"$ref":"#/$defs/painReductionEvent"}},"finalDisposition":{"type":"string","title":"Final Disposition","description":"Omit if still active.","enum":["Fully Mitigated","Partially Mitigated","Remediated","False Positive"]}}},"acceptedVulnerabilityInfo":{"type":"object","title":"Accepted Vulnerability Info","description":"Required information for a single accepted vulnerability per VER-RPT-AVI.","required":["vulnerabilityDetail","acceptanceRationale"],"properties":{"vulnerabilityDetail":{"$ref":"#/$defs/vulnerabilityDetail"},"acceptanceRationale":{"type":"string","title":"Acceptance Rationale","description":"Explanation of why this is an accepted vulnerability."}}},"reportPeriodDateTime":{"type":"object","title":"Report Period","description":"From and To dates for the report period.","required":["from","to"],"properties":{"from":{"type":"string","format":"date-time","title":"From","description":"Start date for the report period."},"to":{"type":"string","format":"date-time","title":"To","description":"End date for the report period."}}},"reportPeriodDate":{"type":"object","title":"Report Period","description":"From and To dates for the report period.","required":["from","to"],"properties":{"from":{"type":"string","format":"date","title":"From","description":"Start date for the report period."},"to":{"type":"string","format":"date","title":"To","description":"End date for the report period."}}}}},"historical-ver-activity":{"$schema":"https://json-schema.org/draft/2020-12/schema","$id":"https://fedramp.gov/schemas/fedramp-historical-ver-activity-schema-2026-06-24.json","$schemaVersion":"0.1.1","type":"object","title":"FedRAMP Historical Vulnerability Evaluation and Reporting Activity (VER-TFR-MRH)","description":"Machine-readable historical Vulnerability Evaluation and Reporting activity for automated retrieval per VER-TFR-MRH.","required":["certificationPackageOverviewUri","generatedAt","activeVulnerabilities","acceptedVulnerabilities"],"properties":{"certificationPackageOverviewUri":{"$ref":"https://fedramp.gov/schemas/fedramp-common-definitions-schema-2026-06-24.json#/$defs/certificationPackageOverviewUri"},"generatedAt":{"type":"string","format":"date-time","title":"Generated At","description":"When this snapshot was generated."},"activeVulnerabilities":{"type":"array","title":"Active Vulnerabilities","description":"All non-accepted vulnerabilities. Each record follows the fields required by VER-RPT-VDT.","items":{"$ref":"https://fedramp.gov/schemas/fedramp-common-definitions-schema-2026-06-24.json#/$defs/vulnerabilityDetail"}},"acceptedVulnerabilities":{"type":"array","title":"Accepted Vulnerabilities","description":"All accepted vulnerabilities. Each record follows the fields required by VER-RPT-AVI.","items":{"$ref":"https://fedramp.gov/schemas/fedramp-common-definitions-schema-2026-06-24.json#/$defs/acceptedVulnerabilityInfo"}}}},"incident-report":{"$schema":"https://json-schema.org/draft/2020-12/schema","$id":"https://fedramp.gov/schemas/fedramp-incident-report-schema-2026-06-24.json","$schemaVersion":"0.2.1","type":"object","title":"FedRAMP Incident Report (IEC-CSO-IIR / IEC-CSO-OIR / IEC-CSO-FIR)","description":"Unified schema for the three incident report types in the IEC-CSO lifecycle: Initial (IEC-CSO-IIR), Ongoing (IEC-CSO-OIR), and Final (IEC-CSO-FIR).","required":["certificationPackageOverviewUri","reportType","providerTrackingId"],"properties":{"certificationPackageOverviewUri":{"$ref":"https://fedramp.gov/schemas/fedramp-common-definitions-schema-2026-06-24.json#/$defs/certificationPackageOverviewUri"},"reportType":{"type":"string","title":"Report Type","description":"Initial = IEC-CSO-IIR; Ongoing = IEC-CSO-OIR; Final = IEC-CSO-FIR.","enum":["Initial","Ongoing","Final"]},"providerTrackingId":{"type":"string","title":"Provider Tracking ID","description":"Provider's internally assigned identifier for this incident. Must be consistent across IIR, OIR, and FIR reports for the same incident."},"federalIncidentCoordinator":{"type":"string","title":"Federal Incident Response Coordinator","description":"Contact information for the provider's federal incident response coordinator."},"incidentDescription":{"type":"string","title":"Incident Description","description":"Description of the incident."},"timeline":{"type":"object","title":"Timeline","description":"Timeline of the incident per IEC-CSO-IIR field 4.","properties":{"startedAt":{"type":"string","format":"date-time","title":"Started At","description":"When the incident started."},"detectedAt":{"type":"string","format":"date-time","title":"Detected At","description":"When the incident was detected."},"detectionSource":{"type":"string","title":"Detection Source","description":"Source of the incident detection."},"evaluationCompletedAt":{"type":"string","format":"date-time","title":"FedRAMP Reportable Incident Evaluation Completed At","description":"When the FedRAMP reportable incident evaluation was completed."},"milestones":{"type":"array","title":"Milestones","description":"Major events in the incident lifecycle.","items":{"$ref":"#/$defs/milestone"}}}},"potentialImpact":{"type":"object","title":"Potential Impact","description":"Describe the current and historical potential impact to your system.","properties":{"historicalRating":{"type":"array","title":"Historical Rating","description":"Historical rating of the incident.","items":{"$ref":"https://fedramp.gov/schemas/fedramp-common-definitions-schema-2026-06-24.json#/$defs/nRating"}},"currentRating":{"$ref":"https://fedramp.gov/schemas/fedramp-common-definitions-schema-2026-06-24.json#/$defs/nRating","title":"Current Rating","description":"Current rating of the incident."},"evaluationNotes":{"type":"string","title":"Evaluation Notes","description":"Explanation of the PAIN evaluation per IEC-CSO-EFI. Required if applicable."}}},"functionalImpact":{"type":"string","title":"Functional Impact","description":"Describe the actual or potential impact to federal agency customers."},"recoveryPlan":{"type":"string","title":"Recovery Plan","description":"Estimated recovery plan, milestones, and timelines."},"affectedAgencies":{"type":"array","title":"Likely Affected Customer Agencies","description":"List of customer agencies that may be affected by the incident.","items":{"type":"string"}},"observedActivity":{"type":"string","title":"Observed Incident Activity","description":"Per IEC-CSO-OIR."},"indicatorsOfCompromise":{"type":"array","title":"Indicators of Compromise","description":"Per IEC-CSO-OIR.","items":{"type":"string"}},"relatedCveIds":{"type":"array","title":"Related CVE Identifiers","description":"Per IEC-CSO-OIR. Include if applicable.","items":{"type":"string","pattern":"^CVE-[0-9]{4}-[0-9]{4,}$"}},"rootCause":{"type":"string","title":"Root Cause","description":"Per IEC-CSO-OIR."},"responseAndRecoveryActivities":{"type":"string","title":"Response and Recovery Activities","description":"Per IEC-CSO-OIR."},"resolvedAt":{"type":"string","format":"date-time","title":"Resolved At","description":"When the incident was resolved and recovery completed. Required for Final reports (IEC-CSO-FIR)."}},"if":{"required":["reportType"],"properties":{"reportType":{"title":"Report Type","description":"Initial = IEC-CSO-IIR; Ongoing = IEC-CSO-OIR; Final = IEC-CSO-FIR.","const":"Final"}}},"then":{"required":["resolvedAt"]},"$defs":{"milestone":{"type":"object","title":"Incident Milestone","description":"Major events in the incident lifecycle.","required":["occurredAt","milestoneDescription"],"properties":{"occurredAt":{"type":"string","format":"date-time","title":"Occurred At","description":"When the milestone occurred."},"milestoneDescription":{"type":"string","title":"Description","description":"Description of the milestone."}}}}},"ongoing-certification-report":{"$schema":"https://json-schema.org/draft/2020-12/schema","$id":"https://fedramp.gov/schemas/fedramp-ongoing-certification-report-schema-2026-06-24.json","$schemaVersion":"0.2.1","type":"object","title":"FedRAMP Ongoing Certification Report (CCM-OCR-AVL)","description":"Quarterly Ongoing Certification Report (OCR) per CCM-OCR-AVL, covering the entire period since the previous report.","required":["certificationPackageOverviewUri","reportPeriod","certificationDataChanges","plannedCertificationDataChanges","acceptedVulnerabilities","transformativeChanges","updatedRecommendations","activeAgencies","reportableIncidents"],"properties":{"certificationPackageOverviewUri":{"$ref":"https://fedramp.gov/schemas/fedramp-common-definitions-schema-2026-06-24.json#/$defs/certificationPackageOverviewUri"},"reportPeriod":{"$ref":"https://fedramp.gov/schemas/fedramp-common-definitions-schema-2026-06-24.json#/$defs/reportPeriodDate","title":"Report Period","description":"The 3-month period covered by this report."},"certificationDataChanges":{"type":"array","title":"Changes to FedRAMP Certification Data","description":"High-level summaries of changes to FedRAMP Certification Data since the previous report.","items":{"type":"string"}},"plannedCertificationDataChanges":{"type":"object","title":"Planned Changes to FedRAMP Certification Data","description":"High-level summaries of planned changes to FedRAMP Certification Data for at least the next 3 months.","required":["planningHorizonThrough","changes"],"properties":{"planningHorizonThrough":{"type":"string","format":"date","title":"Planning Horizon Through","description":"Date through which planned changes are covered (at least 3 months from report end)."},"changes":{"type":"array","title":"Changes","description":"Summary of planned changes to FedRAMP Certification Data.","items":{"type":"string"}}}},"acceptedVulnerabilities":{"type":"string","title":"Accepted Vulnerabilities","description":"Summary of accepted vulnerabilities. Full records are reported per VER-RPT-AVI."},"transformativeChanges":{"type":"array","title":"Transformative Changes","description":"High-level summaries of transformative changes during this period.","items":{"type":"string"}},"updatedRecommendations":{"type":"array","title":"Updated Recommendations","description":"Updated recommendations or best practices for security, configuration, usage, or similar aspects of the cloud service offering.","items":{"type":"string"}},"activeAgencies":{"type":"array","title":"Active Agencies","description":"List of all agencies directly using the product.","items":{"type":"string","title":"Agency"}},"reportableIncidents":{"type":"object","title":"FedRAMP Reportable Incidents","description":"FedRAMP Reportable Incidents during this period. An empty `incidents` array attests that none occurred.","required":["incidents"],"properties":{"incidents":{"type":"array","title":"Incidents","description":"Summary of each incident. Provide an empty array to attest that no FedRAMP Reportable Incidents occurred during this period.","items":{"$ref":"#/$defs/incidentSummary"}}}}},"$defs":{"incidentSummary":{"type":"object","title":"Incident Summary","description":"Summary of a FedRAMP Reportable Incident.","properties":{"summary":{"type":"string","title":"Summary","description":"Brief description of the incident."},"occurredAt":{"type":"string","format":"date-time","title":"Occurred At","description":"Date and time the incident occurred."},"resolvedAt":{"type":"string","format":"date-time","title":"Resolved At","description":"Date and time the incident was resolved."},"incidentLessonsLearned":{"type":"array","title":"Incident Lessons Learned","description":"Lessons learned and changes planned or made as a result of FedRAMP Reportable Incidents.","items":{"type":"string"}}}}}},"security-decision-record":{"$schema":"https://json-schema.org/draft/2020-12/schema","$id":"https://fedramp.gov/schemas/fedramp-security-decision-record-schema-2026-06-24.json","$schemaVersion":"1.1.1","type":"object","title":"FedRAMP Security Decision Record (SDR-CSO-FRR)","description":"JSON Schema for Cloud Service Provider (CSP) system submission for FedRAMP certification per SDR-CSO-FRR.","required":["certificationPackageOverviewUri","fedRampRequirements"],"properties":{"certificationPackageOverviewUri":{"$ref":"https://fedramp.gov/schemas/fedramp-common-definitions-schema-2026-06-24.json#/$defs/certificationPackageOverviewUri"},"metadata":{"type":"object","title":"Security Decision Record Metadata","description":"Basic metadata about this Security Decision Record, per SDR-CSO-MTD.","required":["version","lastUpdated","updateSource"],"properties":{"version":{"type":"string","title":"Version","description":"Version of this Security Decision Record."},"lastUpdated":{"type":"string","format":"date-time","title":"Last Updated","description":"Date and time this Security Decision Record was last updated."},"updateSource":{"type":"string","title":"Update Source","description":"Source of the update (e.g., person, team, or automated process)."}}},"portsAndProtocols":{"type":"array","title":"Ports and Protocols","description":"Ports and protocols used by the Cloud Service Offering","items":{"type":"object","title":"Port and Protocol","description":"Port and protocol exposed by the Cloud Service Offering","properties":{"serviceName":{"type":"string","title":"Service Name","description":"Name of the service exposed on this port."},"portNumber":{"type":"string","title":"Port Number","description":"Port number used by the service. For services that operate on a range of ports, provide the range in the format 'start-end'."},"transportProtocol":{"type":"string","title":"Transport Protocol","description":"Transport protocol used by the service"},"encryption":{"type":"string","title":"Encryption","description":"Encryption method used by the service (e.g., TLS, SSL, None)."},"purpose":{"type":"string","title":"Purpose","description":"Provide a general description of how the port and protocol are used in the Cloud Service Offering (e.g., Web access, database connection)."}}}},"securityControls":{"type":"array","title":"NIST 800-53 Security Controls","description":"Describe the security controls for the system.","items":{"type":"object","title":"NIST 800-53 Security Control","description":"NIST 800-53 Security Control","properties":{"controlId":{"type":"string","title":"NIST 800-53 Control ID","description":"NIST 800-53 Control ID","examples":["AC-1","AC-2","AC-3"]},"parameterValues":{"type":"array","title":"Parameter Values","description":"Parameter values for the control","items":{"type":"object","title":"Parameter Value","description":"Parameter value for the control","required":["parameterId","parameterValue"],"properties":{"parameterId":{"type":"string","title":"Parameter ID","description":"The parameter ID as defined in the NIST 800-53 Control Implementation Guide."},"parameterValue":{"type":"string","title":"Parameter Value","description":"The parameter value selected by the Cloud Service Provider. If the parameter is a boolean, provide 'true' or 'false'. If the parameter is a list, provide a comma-separated list of values."}}}},"controlImplementationStatus":{"type":"string","title":"Control Implementation Status","description":"Status of the control implementation","enum":["Implemented","Not Implemented","Partially Implemented"]},"controlImplementationDescription":{"type":"string","title":"Control Implementation Description","description":"Description of the control implementation. May use Markdown for formatting."}}}},"fedRampRequirements":{"type":"array","title":"FedRAMP Requirements","description":"Describe how any applicable FedRAMP required processes are met.","items":{"type":"object","title":"FedRAMP Requirement","description":"FedRAMP requirement","required":["frrID","frrImplementation"],"properties":{"frrID":{"type":"string","title":"FedRAMP Requirement ID","description":"FedRAMP requirement ID"},"frrImplementationStatus":{"type":"string","title":"Requirement Implementation Status","description":"Status of the requirement implementation.","enum":["Implemented","Not Implemented","Partially Implemented"]},"frrImplementation":{"type":"array","title":"Requirement Implementation Statements","description":"Description of the requirement implementation. May use Markdown for formatting.","items":{"$ref":"#/$defs/implementationStatement"}},"frrValidation":{"type":"array","title":"Requirement Validation Statements","description":"Description of the requirement validation. May use Markdown for formatting.","items":{"$ref":"#/$defs/validationStatement"}},"frrAssessment":{"type":"array","title":"Requirement Assessment Statements","description":"Description of the requirement assessment. May use Markdown for formatting.","items":{"$ref":"#/$defs/assessmentStatement"}}}}},"keySecurityIndicators":{"type":"array","title":"FedRAMP Key Security Indicators","description":"Describe how the system meets the FedRAMP Key Security Indicators (KSI).","items":{"type":"object","title":"FedRAMP Key Security Indicator","description":"How the Key Security Indicator objective is achieved and monitored","required":["ksiId","ksiImplementation","ksiValidation","ksiAssessment","ksiTests","ksiEvidence"],"properties":{"ksiId":{"type":"string","title":"FedRAMP KSI ID","description":"FedRAMP KSI ID"},"ksiImplementationStatus":{"type":"string","title":"KSI Implementation Status","description":"Status of the KSI implementation.","enum":["Implemented","Not Implemented","Partially Implemented"]},"ksiImplementation":{"type":"array","title":"KSI Implementation Statements","description":"Description of the Key Security Indicator implementation. May use Markdown for formatting.","items":{"$ref":"#/$defs/implementationStatement"}},"ksiValidation":{"type":"array","title":"KSI Validation Statements","description":"Description of the Key Security Indicator validation. May use Markdown for formatting.","items":{"$ref":"#/$defs/validationStatement"}},"ksiAssessment":{"type":"array","title":"KSI Assessment Statements","description":"Description of the Key Security Indicator assessment. May use Markdown for formatting.","items":{"$ref":"#/$defs/assessmentStatement"}},"ksiTests":{"type":"array","title":"KSI Tests","description":"List of tests used to validate the KSI implementation.","items":{"type":"string"}},"ksiEvidence":{"type":"array","title":"KSI Evidence","description":"Results of the security test used to validate the KSI implementation.","items":{"$ref":"#/$defs/evidence"}}}}}},"$defs":{"evidence":{"type":"object","title":"Evidence","description":"Results of the security test","properties":{"evidenceType":{"type":"string","title":"Evidence Type","description":"Type of evidence provided","enum":["Log","Report","Screenshot","Configuration","Policy","Procedure","Audit Record"]},"evidenceDescription":{"type":"string","title":"Evidence Description","description":"Detailed description of the evidence."},"evidenceLocation":{"type":"string","format":"uri","title":"Evidence Location","description":"URI to the evidence document"},"evidenceText":{"type":"string","title":"Evidence Content (Text)","description":"Evidence included as plain text such as the output of a command or log."},"lastUpdated":{"type":"string","format":"date","title":"Last Updated","description":"Date when the evidence was last updated"}}},"implementationStatement":{"type":"string","title":"Implementation","description":"Description of how the control/requirement/ksi is implemented. May use Markdown for formatting."},"validationStatement":{"type":"string","title":"Validation","description":"Description of the how the control/requirement/ksi is validated by the CSP internally. May use Markdown for formatting."},"assessmentStatement":{"type":"string","title":"Assessment","description":"Description of how the control/requirement/ksi is assessed by an independent validator. May use Markdown for formatting."}}},"significant-change-notifications":{"$schema":"https://json-schema.org/draft/2020-12/schema","$id":"https://fedramp.gov/schemas/fedramp-significant-change-notifications-schema-2026-06-24.json","$schemaVersion":"0.1.3","type":"object","title":"FedRAMP Significant Change Notification (SCN-CSO-INF)","description":"Required information for a Significant Change Notification per SCN-CSO-INF. Note per the rule: structure of the information may vary depending on how the provider tracks this internally.","required":["certificationPackageOverviewUri","changeType","changeDescription"],"properties":{"certificationPackageOverviewUri":{"$ref":"https://fedramp.gov/schemas/fedramp-common-definitions-schema-2026-06-24.json#/$defs/certificationPackageOverviewUri"},"assessorName":{"type":"string","title":"Assessor Name","description":"Name of the assessor involved in this change, if applicable."},"relatedVulnerability":{"type":"string","title":"Related Vulnerability","description":"Identifier or description of any related vulnerability driving this change, if applicable."},"changeType":{"type":"string","title":"Type","description":"Significant change type per SCN-CSO-EVA. Routine recurring changes (SCN-RTR) do not require a Significant Change Notification.","enum":["Adaptive","Transformative"]},"changeTypeExplanation":{"type":"string","title":"Categorization Explanation","description":"Explanation of why this change was categorized as the selected type."},"changeDescription":{"type":"string","title":"Description","description":"Short description of the change."},"reason":{"type":"string","title":"Reason for Change","description":"Reason for the change."},"customerImpact":{"type":"string","title":"Customer Impact","description":"Summary of customer impact, including changes to services and customer configuration responsibilities."},"planAndTimeline":{"type":"object","title":"Plan and Timeline","description":"Plan and timeline for the change, including verification, assessment, and/or validation of impacted Key Security Indicators (KSIs) or Rev5 Controls.","required":["summary"],"properties":{"summary":{"type":"string","title":"Summary","description":"Human readable summary of the timeline and plan for the change. May use Markdown for formatting."},"plannedStart":{"type":"string","format":"date","title":"Planned Start","description":"The first date on which changes will be made to the system."},"plannedCompletion":{"type":"string","format":"date","title":"Planned Completion","description":"The date on which the changes will be considered complete. This should include any planned testing and monitoring activities."},"milestones":{"type":"array","title":"Milestones","description":"Milestones for the change, including dates and descriptions.","items":{"type":"object","required":["milestoneDescription"],"properties":{"milestoneDescription":{"type":"string","title":"Description","description":"Human readable description of the milestone."},"targetDate":{"type":"string","format":"date","title":"Target Date","description":"The date on which the milestone is expected to be completed."}}}}}},"impactedControls":{"type":"array","title":"Impacted KSIs or Rev5 Controls","description":"KSI or control identifiers that will be verified, assessed, or validated as part of this change.","items":{"type":"string"}},"impactAnalysis":{"type":"string","title":"Business or Security Impact Analysis","description":"Copy or summary of the business or security impact analysis. May be the full text or a URI referencing the document."}}},"vulnerability-detail-report":{"$schema":"https://json-schema.org/draft/2020-12/schema","$id":"https://fedramp.gov/schemas/fedramp-vulnerability-detail-report-schema-2026-06-24.json","$schemaVersion":"0.1.1","type":"object","title":"FedRAMP Vulnerability Detail Report (VER-RPT-VDT)","description":"Vulnerability detection and response activity report per VER-RPT-VDT. Covers non-accepted vulnerabilities only; see VER-RPT-AVI for accepted vulnerabilities.","required":["certificationPackageOverviewUri","reportPeriod","vulnerabilities"],"properties":{"certificationPackageOverviewUri":{"$ref":"https://fedramp.gov/schemas/fedramp-common-definitions-schema-2026-06-24.json#/$defs/certificationPackageOverviewUri"},"reportPeriod":{"$ref":"https://fedramp.gov/schemas/fedramp-common-definitions-schema-2026-06-24.json#/$defs/reportPeriodDateTime","title":"Report Period","description":"Period summarized by this report. Per VER-RPT-PER, must cover all activity since the previous report."},"vulnerabilities":{"type":"array","title":"Vulnerabilities","description":"Non-accepted vulnerabilities with activity in this period.","items":{"$ref":"https://fedramp.gov/schemas/fedramp-common-definitions-schema-2026-06-24.json#/$defs/vulnerabilityDetail"}}}}},"schemaRules":{"accepted-vulnerability-info":["VER-RPT-AVI"],"certification-package-overview":["CDS-CSO-PUB","CDS-CSO-SVC","CDS-CSO-UTC","CPO-CSO-OVR","FRC-CSO-PKG","MAS-CSO-TPR","SCG-CSO-RSC"],"historical-ver-activity":["VER-TFR-MRH"],"incident-report":["IEC-CSO-EFI","IEC-CSO-FIR","IEC-CSO-IIR","IEC-CSO-OIR"],"ongoing-certification-report":["CCM-OCR-AVL"],"security-decision-record":["SDR-CSO-FRR","SDR-CSX-KMT","SDR-CSX-KSI"],"significant-change-notifications":["SCN-CSO-EVA","SCN-CSO-HRM","SCN-CSO-INF"],"vulnerability-detail-report":["VER-RPT-PER","VER-RPT-VDT"]},"built":"2026-10-14"}