Generated from the official FedRAMP/rules GitHub repo. Source path: fedramp-consolidated-rules.json on main at blob 7d628b63fdd9. Consolidated Rules version: 2026.07.02.02 · upstream last_updated: 2026-07-02. Supporting narrative documentation is available from the official FedRAMP/2026-markdown repository.

FedRAMP Processes

• Addressing FedRAMP Communication — AFC · applies to both · requirements: both 16, 20x 0, rev5 0
• Agency Use of FedRAMP Certified Cloud Services — AGU · applies to both · requirements: both 20, 20x 0, rev5 0
• Collaborative Continuous Monitoring — CCM · applies to both · requirements: both 21, 20x 0, rev5 0
• Certification Data Sharing — CDS · applies to both, rev5 · requirements: both 20, 20x 0, rev5 1
• Cryptographic Module Use — CMU · applies to both · requirements: both 3, 20x 0, rev5 0
• Certification Package Overview — CPO · applies to both, 20x, rev5 · requirements: both 2, 20x 1, rev5 1
• FedRAMP Certification — FRC · applies to both, 20x, rev5 · requirements: both 21, 20x 4, rev5 4
• Incident Evaluation and Communication — IEC · applies to both · requirements: both 8, 20x 0, rev5 0
• Independent Verification and Validation — IVV · applies to both, 20x, rev5 · requirements: both 15, 20x 1, rev5 4
• Minimum Assessment Scope — MAS · applies to both · requirements: both 5, 20x 0, rev5 0
• Marketplace Listing — MKT · applies to both · requirements: both 12, 20x 0, rev5 0
• FedRAMP Recognition of Independent Assessment Services — REC · applies to both · requirements: both 16, 20x 0, rev5 0
• Secure Configuration Guide — SCG · applies to both · requirements: both 9, 20x 0, rev5 0
• Significant Change Notification — SCN · applies to both · requirements: both 17, 20x 0, rev5 0
• Security Decision Record — SDR · applies to both, 20x, rev5 · requirements: both 2, 20x 2, rev5 1
• Vulnerability Detection and Response — VDR · applies to both, 20x, rev5 · requirements: both 16, 20x 1, rev5 1
• Vulnerability Evaluation and Reporting — VER · applies to both · requirements: both 25, 20x 0, rev5 0