Generated from the official FedRAMP/rules GitHub repo. Source path: fedramp-consolidated-rules.json on main at blob 7d628b63fdd9. Consolidated Rules version: 2026.07.02.02 · upstream last_updated: 2026-07-02. Supporting narrative documentation is available from the official FedRAMP/2026-markdown repository.

FedRAMP Recognition of Independent Assessment Services

Short name: REC · Process ID: REC · Web slug: fedramp-recognition

Applies to: both Status: stable

Official page: https://www.fedramp.gov/2026/reference/fedramp-recognition/

Effective Status

• 20x: required · Consolidated Rules for 2026 · obtain 2026-07-04 · grace through 2026-07-04
• Rev5: required · Consolidated Rules for 2026 · obtain 2026-07-04 · grace through 2026-07-04
• Shared requirements: 16

Purpose

The FedRAMP Recognition of independent assessment services rules explain the requirements for assessors to obtain and maintain FedRAMP Recognition in order to support the FedRAMP Certification process.

Rule Subsets

• FRP — FedRAMP Responsibilities: These rules apply to FedRAMP when evaluating independent assessment services for initial or ongoing FedRAMP Recognition.
• IAS — General Independent Assessor Responsibilities: These rules apply to independent assessment services seeking to obtain or maintain FedRAMP Recognition.

Requirements and Recommendations

BOTH

REC-FRP-DRD MUST NOT — Double Revocation Disqualification

FedRAMP MUST NOT restore FedRAMP Recognition for an assessor after FedRAMP has revoked that assessor’s FedRAMP Recognition 2 times.

Terms: Assessor, FedRAMP Recognized

Affects: FedRAMP

Recent update: 2026-06-24 — Official launch of the FedRAMP Consolidated Rules for 2026.

REC-FRP-FOC MUST — Foreign Ownership Collection

FedRAMP MUST maintain a process to collect foreign ownership, control, or influence declarations from FedRAMP Recognized assessors and updates to those declarations.

Terms: Assessor, FedRAMP Recognized

Affects: FedRAMP

Recent update: 2026-06-24 — Official launch of the FedRAMP Consolidated Rules for 2026.

REC-FRP-RAO MUST NOT — Recognized Assessors Only

FedRAMP MUST NOT accept verification, validation, or other attestations from independent assessors who are not FedRAMP Recognized.

Terms: Assessor, FedRAMP Recognized, Validation, Verification

Affects: FedRAMP

Recent update: 2026-06-24 — Official launch of the FedRAMP Consolidated Rules for 2026.

REC-IAS-ACC MUST — A2LA Accreditation

Assessors MUST obtain and maintain accreditation through the American Association for Laboratory Accreditation (A2LA) Cybersecurity Inspection Body Program to qualify for FedRAMP Recognition.

Terms: Assessor, FedRAMP Recognized

Affects: Assessors

Note: FedRAMP will remove FedRAMP Recognition immediately after the American Association for Laboratory Accreditation notifies FedRAMP that an assessor’s accreditation has lapsed.

Recent update: 2026-06-24 — Official launch of the FedRAMP Consolidated Rules for 2026.

REC-IAS-ADA MUST — Actually Do Assessments

Assessors MUST complete at least 2 initial or ongoing assessments for Class B, C, or D FedRAMP Certifications every 2 years to maintain FedRAMP Recognition.

Terms: Assessor, FedRAMP Recognized

Affects: Assessors

Structured timeframe: 2 years

Note: For a newly FedRAMP Recognized Assessor, this rule applies beginning on the initial date of FedRAMP Recognition if that date is later than 2026-06-01.

Recent update: 2026-06-24 — Official launch of the FedRAMP Consolidated Rules for 2026.

REC-IAS-AFI MUST — Annual Foreign Interest Reports

Assessors MUST report information relating to any foreign interest, foreign influence, or foreign control of the independent assessment service to FedRAMP annually.

Terms: Assessor

Affects: Assessors

Structured timeframe: 1 years

Recent update: 2026-06-24 — Official launch of the FedRAMP Consolidated Rules for 2026.

REC-IAS-ANR MUST — Annual Surveillance Assessment

Assessors MUST achieve a favorable annual surveillance assessment by the American Association for Laboratory Accreditation (A2LA) to maintain FedRAMP Recognition.

Terms: Assessor, FedRAMP Recognized

Affects: Assessors

Structured timeframe: 1 years

Recent update: 2026-06-24 — Official launch of the FedRAMP Consolidated Rules for 2026.

REC-IAS-CAP MUST — Corrective Action Plan

Assessors MUST supply a corrective action plan when FedRAMP requires one for performance standards deficiencies or organizational risks.

Terms: Assessor

Affects: Assessors

Recent update: 2026-06-24 — Official launch of the FedRAMP Consolidated Rules for 2026.

REC-IAS-CFI MUST — Changes in Foreign Interest

Assessors MUST report updated information relating to any foreign interest, foreign influence, or foreign control of the independent assessment service within 48 hours of any change in foreign ownership or control.

Terms: Assessor

Affects: Assessors

Structured timeframe: 48 hours

Recent update: 2026-06-24 — Official launch of the FedRAMP Consolidated Rules for 2026.

REC-IAS-INV MUST — Invalid Deliverables

Assessors MUST treat deliverables prepared, performed, or submitted by personnel who do not meet required role qualifications as invalid for FedRAMP purposes.

Terms: Assessor

Affects: Assessors

Recent update: 2026-06-24 — Official launch of the FedRAMP Consolidated Rules for 2026.

REC-IAS-PSC MUST — Policy and Standards Compliance

Assessors MUST maintain compliance with the latest American Association for Laboratory Accreditation (A2LA) R311 - Specific Requirements - Federal Risk and Authorization Management Program to maintain FedRAMP Recognition.

Terms: Assessor, FedRAMP Recognized

Affects: Assessors

Recent update: 2026-06-24 — Official launch of the FedRAMP Consolidated Rules for 2026.

REC-IAS-PST MUST — Performance Standards

Assessors MUST meet FedRAMP performance standards for assessor deliverables to support independent, risk-based reviews by FedRAMP and federal agencies, including at least:

Checklist items:

• Complete Assessment Packages: Supplies complete and thoroughly prepared documents on the first submission.
• Deliverable Quality: Ensures documentation content is clear, complete, concise, and consistent.
• Deliverable Format: Follows applicable FedRAMP rules.
• Timeliness and Responsiveness: Delivers documents on time according to the schedule agreed to by the federal government, provider, and assessor.
• Testing Accuracy and Completeness: Ensures accurate and complete testing of a cloud service offering in accordance with ISO 17020 and FedRAMP security rules.
• Assessment Integrity: Submits independent assessments of provider security implementations that are not influenced by provider demands.
• Chain of Custody: Preserves the integrity and chain of custody of assessor-authored documents and provider-supplied evidence used in FedRAMP assessments.

Terms: Agency, Assessor, Cloud Service Offering, Provider

Affects: Assessors

Recent update: 2026-06-24 — Official launch of the FedRAMP Consolidated Rules for 2026.

REC-IAS-RAR MUST — Re-entry after Revocation

Assessors MUST satisfy all American Association for Laboratory Accreditation (A2LA) re-entry conditions before regaining FedRAMP Recognition after revocation.

Terms: Assessor, FedRAMP Recognized

Affects: Assessors

Note: A revocation may require extended time in revoked status while the assessor demonstrates acceptable performance in the A2LA Cybersecurity Inspection Body Program before seeking FedRAMP Recognition again.

Recent update: 2026-06-24 — Official launch of the FedRAMP Consolidated Rules for 2026.

REC-IAS-RAS MUST — Full A2LA Reassessment

Assessors MUST achieve a favorable full reassessment by the American Association for Laboratory Accreditation (A2LA) at least once every 2 years to maintain FedRAMP Recognition.

Terms: Assessor, FedRAMP Recognized

Affects: Assessors

Structured timeframe: 2 years

Recent update: 2026-06-24 — Official launch of the FedRAMP Consolidated Rules for 2026.

REC-IAS-RQU MUST — Roles and Qualifications

Assessors MUST staff FedRAMP assessments with all roles required by the American Association for Laboratory Accreditation (A2LA) R311, including personnel who meet the qualifications for each role, unless FedRAMP publishes a specific exception for a limited pilot or other explicitly scoped process.

Terms: Assessor

Affects: Assessors

Recent update: 2026-06-24 — Official launch of the FedRAMP Consolidated Rules for 2026.

REC-IAS-SEP MUST NOT — Advisory Separation

Assessors MUST NOT perform a FedRAMP independent assessment of the same cloud service offering within 2 years after supplying advisory or consulting services for that offering, unless FedRAMP publishes a specific exception for a limited pilot or other explicitly scoped process.

Terms: Assessor, Cloud Service Offering, FedRAMP Independent Assessment

Affects: Assessors

Structured timeframe: 2 years

Recent update: 2026-06-24 — Official launch of the FedRAMP Consolidated Rules for 2026.