| A | B | C | D | E | F | G | H | I | J | K | L | M | N | O | P | Q | R | S | T | U | V | W | X | Y | Z | ||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
1 | Workstreet | ||||||||||||||||||||||||||
2 | R2: SOC 2 to FedRAMP 20x Class A crosswalk | ||||||||||||||||||||||||||
3 | Counts verified: 24 mandatory (incl. 7 KSIs), 10 recommended, 9 optional, plus the 3 core FRC-CLA rules. Status column is for your gap assessment (Phase 1). | ||||||||||||||||||||||||||
4 | Talk to us: https://www.workstreet.com/scheduler?cta=nav-desktop-talk-to-expert | ||||||||||||||||||||||||||
5 | Source: FedRAMP Consolidated Rules for 2026 (CR26) v2026.11.02.01, https://github.com/FedRAMP/rules . Rule text quoted from fedramp-consolidated-rules.json. SOC 2 mappings are typical starting points, not FedRAMP guidance; verify against your own report. | ||||||||||||||||||||||||||
6 | Tier | Rule ID | Rule name | Family | Class A statement (FedRAMP) | Source link | Typical SOC 2 evidence | Typical SOC 2 TSC | What SOC 2 usually does not cover / gap to test | Status | Owner (role) | Fix / notes | |||||||||||||||
7 | Core Class A rule (FRC-CLA) | FRC-CLA-ASF | Approved Alternative Security Frameworks | FedRAMP Certification | Providers seeking a FedRAMP Class A Certification MUST have completed a certification or equivalent process, including an independent assessment if applicable, from one of the following alternative security frameworks within the past 12 months: FedRAMP Rev5 (including FedRAMP Ready) at any historical Impact Level; SOC 2 Type II; GovRAMP at any Impact Level | https://www.fedramp.gov/2026/reference/20x/a/fedramp-certification/ | SOC 2 Type II report (completed within the past 12 months) | N/A (eligibility) | Rule doesn't say whether 12 months runs from report date or end of observation period; if borderline, plan on the next report. Type 1 does not qualify. | Compliance lead | |||||||||||||||||
8 | Core Class A rule (FRC-CLA) | FRC-CLA-EAM | External Assessment Materials | FedRAMP Certification | Providers seeking a FedRAMP Class A Certification MUST supply the following materials from their alternative security framework assessment to all necessary parties: SOC 2 Type II: Complete report, bridge or gap letter (if applicable), verified audit engagement documentation, estimated schedule for upcoming report, supplemental compliance evidence (if applicable); FedRAMP Ready: Readiness Assessment Report, Security Assessment Plan, and any other materials required by FedRAMP.; GovRAMP: Readiness Assessment Report, Security Assessment Plan, and any other materials required by GovRAMP. | https://www.fedramp.gov/2026/reference/20x/a/fedramp-certification/ | Complete SOC 2 Type II report, bridge/gap letter, audit engagement letter, next-report schedule | N/A (assessment materials) | Engagement docs must be verified; have the estimated next report date in writing. | Compliance lead | |||||||||||||||||
9 | Core Class A rule (FRC-CLA) | FRC-CLA-IVV | Optional Independent Verification and Validation | FedRAMP Certification | Providers seeking a FedRAMP Class A Certification MAY have the FedRAMP Certification Package independently verified and validated by a FedRAMP Recognized assessor before submission to FedRAMP. | https://www.fedramp.gov/2026/reference/20x/a/fedramp-certification/ | N/A | N/A | Optional. Decide whether to have a FedRAMP Recognized assessor review the package before submission. | Compliance lead | |||||||||||||||||
10 | Mandatory (FRC-CLA-MFR, MUST) | FRC-CSO-POP | Pick One Program Certification Type | FedRAMP Certification | Providers MUST NOT seek both FedRAMP Rev5 Program Certification and FedRAMP 20x Program Certification for the same cloud service offering; pick one type. | https://www.fedramp.gov/2026/providers/20x/rules/fedramp-certification/ | N/A | N/A | Decide 20x vs Rev5 Program Certification for this offering; you can't seek both. | Executive sponsor | |||||||||||||||||
11 | Mandatory (FRC-CLA-MFR, MUST) | MAS-CSO-IIR | Identify Information Resources | Minimum Assessment Scope | Providers MUST identify a set of information resources to assess for FedRAMP Certification that includes all information resources that are likely to handle federal customer data or likely to impact the confidentiality, integrity, or availability of federal customer data handled by the cloud service offering; this set of information resources is the cloud service offering. | https://www.fedramp.gov/2026/providers/20x/rules/minimum-assessment-scope/ | SOC 2 system description (Section III), asset inventory, network/data-flow diagrams | CC6.1, CC7.1, system description | Boundary must include every resource likely to handle or affect federal customer data, incl. backups, logs, analytics and subprocessors. Machine-readable output required. | Engineering lead | |||||||||||||||||
12 | Mandatory (FRC-CLA-MFR, MUST) | CDS-CSO-PUB | Public Information | Certification Data Sharing | Providers MUST publicly share up-to-date information about the cloud service offering in both human-readable and JSON formats, including at least the following information that is available and applicable: FedRAMP ID; Service Model; Deployment Model; Business Category; UEI Number; Sales Contact Information; Security Contact Information; Product Website Link; Link to Product Logo (must be a valid image link, properly named, that will display in a browser without processing - transparent PNG preferred); Overall Service Description; Detailed list of specific services and their security categories (see CDS-CSO-SVC (Public Service List) (Service List)); Link to Secure Configuration Guidance; Overview of documentation supplied by the provider for the cloud service offering; Link to Trust Center landing page that includes instructions on accessing information in the trust center; Next Ongoing Certification Report date (see CCM-OCR-NRD (Next Report Date)); Current FedRAMP Recognized independent assessment service | https://www.fedramp.gov/2026/providers/20x/rules/certification-data-sharing/ | Public product pages, security page, sales/security contacts | CC2.3 | 16 public fields in BOTH human-readable and JSON form (incl. FedRAMP ID, UEI, service list, next OCR date). Usually new. | Marketing + Compliance lead | |||||||||||||||||
13 | Mandatory (FRC-CLA-MFR, MUST) | CDS-CSO-UTC | Use Trust Centers | Certification Data Sharing | Providers MUST use a FedRAMP-compatible trust center to store and share FedRAMP Certification Data with all necessary parties. | https://www.fedramp.gov/2026/providers/20x/rules/certification-data-sharing/ | Existing trust center / NDA-gated document portal | CC2.3 | Must be FedRAMP-compatible: agency access without manual approval each time, programmatic access, access inventory, access logs kept 6+ months (CDS-TRC rules). | Compliance lead | |||||||||||||||||
14 | Mandatory (FRC-CLA-MFR, MUST) | CDS-UTC-AAD | Agency Access Denial | Certification Data Sharing | Providers MUST notify FedRAMP within 5 business days of denying an agency access request for FedRAMP Certification Data. | https://www.fedramp.gov/2026/providers/20x/rules/certification-data-sharing/ | Customer access-request procedure for security documents | CC2.3 | New: notify FedRAMP within 5 business days of denying an agency access request. | Compliance lead | |||||||||||||||||
15 | Mandatory (FRC-CLA-MFR, MUST) | AFC-CSO-INB | Maintain a FedRAMP Security Inbox | Addressing FedRAMP Communication | Providers MUST establish and maintain an email address to receive messages from FedRAMP; this inbox is a FedRAMP Security Inbox (FSI). | https://www.fedramp.gov/2026/providers/20x/rules/addressing-fedramp-communication/ | Security contact / security@ address in IR policy | CC2.3, CC7.3 | Dedicated FedRAMP Security Inbox; role address, not a personal one. | Security lead | |||||||||||||||||
16 | Mandatory (FRC-CLA-MFR, MUST) | AFC-CSO-RCV | Receive Email Without Disruption | Addressing FedRAMP Communication | Providers MUST receive and react to email messages from FedRAMP without disruption and without requiring additional actions from FedRAMP. | https://www.fedramp.gov/2026/providers/20x/rules/addressing-fedramp-communication/ | Email monitoring/on-call procedures | CC2.3, CC7.3 | No CAPTCHA, ticket portal or filter may block FedRAMP mail; must react without FedRAMP taking extra steps. Test it. | Security lead | |||||||||||||||||
17 | Mandatory (FRC-CLA-MFR, MUST) | AFC-CSO-CRA | Complete Required Actions | Addressing FedRAMP Communication | Providers MUST complete the required actions in Emergency or Emergency Test designated messages sent by FedRAMP within the timeframe included in the message. | https://www.fedramp.gov/2026/providers/20x/rules/addressing-fedramp-communication/ | Incident/escalation procedures | CC7.4 | New: complete required actions in Emergency and Emergency Test messages within the timeframe each message sets. | Security lead | |||||||||||||||||
18 | Mandatory (FRC-CLA-MFR, MUST) | IEC-CSO-EFR | Evaluate FedRAMP Reportability | Incident Evaluation and Communication | Providers MUST promptly evaluate incidents to determine if they affect confidentiality or integrity of federal customer data or are likely to affect confidentiality or integrity of federal customer data; such incidents are FedRAMP Reportable Incidents and must be reported following the FedRAMP Incident Evaluation and Communication rules. | https://www.fedramp.gov/2026/providers/20x/rules/incident-evaluation-and-communication/ | Incident response plan, incident log, severity classification | CC7.3, CC7.4 | Add a documented FedRAMP-reportability decision step (affects confidentiality/integrity of federal customer data). Artifact: incident log showing evaluations (real or simulated). | Security lead | |||||||||||||||||
19 | Mandatory (FRC-CLA-MFR, MUST) | IEC-CSO-FIR | Final Incident Report | Incident Evaluation and Communication | Providers with Class A Certifications MUST responsibly notify all affected parties by providing a Final Incident Report once the incident has been resolved and recovery is complete, including final updates to all previously reported information. | https://www.fedramp.gov/2026/providers/20x/rules/incident-evaluation-and-communication/ | Post-incident reviews, customer notification procedure | CC7.4, CC7.5, CC2.3 | Final Incident Report to all affected parties once resolved; FedRAMP's timeframe is 3 business days at every N-rating. Artifact: an FIR (real or simulated). | Security lead | |||||||||||||||||
20 | Mandatory (FRC-CLA-MFR, MUST) | VDR-CSO-DET | Vulnerability Detection | Vulnerability Detection and Response | Providers MUST systematically, persistently, and promptly discover and identify vulnerabilities within their cloud service offering using appropriate techniques such as assessment, scanning, threat intelligence, vulnerability disclosure mechanisms, bug bounties, penetration testing, incident response, automated control testing, supply chain monitoring, and other relevant capabilities; this process is called vulnerability detection. Vulnerability detection includes persistently verifying and validating that information resources and processes are operating as intended and documented for FedRAMP Practices. | https://www.fedramp.gov/2026/providers/20x/rules/vulnerability-detection-and-response/ | Vulnerability scans, pen test reports, bug bounty/VDP, threat intel | CC7.1, CC4.1 | Detection is not limited to scanning; also persistent verification that resources/processes operate as documented. A stale SDR statement counts as a vulnerability. | Security lead | |||||||||||||||||
21 | Mandatory (FRC-CLA-MFR, MUST) | CCM-OCR-AVL | Report Availability | Collaborative Continuous Monitoring | Providers MUST supply an Ongoing Certification Report to all necessary parties every 3 months, covering the entire period since the previous summary, in a consistent format that is human readable; this report MUST include high-level summaries of at least the following information (if applicable): Changes to FedRAMP Certification Data; Planned changes to FedRAMP Certification Data during at least the next 3 months; Accepted vulnerabilities; Transformative changes; Updated recommendations or best practices for security, configuration, usage, or similar aspects of the cloud service offering; A list of all agencies that are directly using the product; FedRAMP Reportable Incidents or an attestation that no such incidents occurred; Lessons learned and changes planned or made as a result of FedRAMP Reportable Incidents (if such occurred) | https://www.fedramp.gov/2026/providers/20x/rules/collaborative-continuous-monitoring/ | Internal security metrics, management reviews | CC4.1, CC4.2, CC2.3 | New: Ongoing Certification Report every 3 months to all necessary parties, covering required topics (changes, planned changes, accepted vulns, transformative changes, agencies using it, reportable incidents or attestation of none, lessons learned). Sample report needed at application. | Compliance lead | |||||||||||||||||
22 | Mandatory (FRC-CLA-MFR, MUST) | CCM-OCR-NRD | Next Report Date | Collaborative Continuous Monitoring | Providers MUST supply the target date for their next Ongoing Certification Report with other public FedRAMP Certification Data. | https://www.fedramp.gov/2026/providers/20x/rules/collaborative-continuous-monitoring/ | N/A | N/A | Publish the target date of the next OCR with public certification data. | Compliance lead | |||||||||||||||||
23 | Mandatory (FRC-CLA-MFR, MUST) | IVV-CSX-AIA | Annual Independent Assessments for 20x | Independent Verification and Validation | Providers with 20x Class A Certifications MUST meet the expectations of their underlying alternative security framework as part of their persistent independent verification and validation assessment. | https://www.fedramp.gov/2026/providers/20x/rules/independent-verification-and-validation/ | SOC 2 audit cycle, auditor engagement | CC4.1 | At Class A: keep meeting the expectations of your SOC 2 program as part of ongoing independent verification and validation (IVV-CSX-AIA). | Compliance lead | |||||||||||||||||
24 | Mandatory (FRC-CLA-MFR, MUST) | FRC-CSO-PKG | FedRAMP Certification Package | FedRAMP Certification | Providers seeking a Certification MUST supply a complete FedRAMP Certification Package to FedRAMP for initial certification; the FedRAMP Certification Package MUST include at least the following information: Information about the Cloud Service Offering following CPO-CSO-OVR (Overview of the Cloud Service Offering); Implementation, Validation, and Assessment information for each relevant FedRAMP requirement/control/ksi as defined in SDR-CSO-FRR (FedRAMP Rules); A real or example Ongoing Certification Report following CCM-OCR-AVL (Report Availability) | https://www.fedramp.gov/2026/providers/20x/rules/fedramp-certification/ | System description, control narratives | N/A | Package = Certification Package Overview (CPO) + Security Decision Record (SDR) + real or example OCR. Replaces the SSP. | Compliance lead | |||||||||||||||||
25 | Mandatory (FRC-CLA-MFR, MUST) | FRC-CSO-JSN | FedRAMP JSON Schemas | FedRAMP Certification | Providers MUST supply machine-readable information in JSON documents that are valid against the corresponding JSON schema when a rule contains a FedRAMP JSON schema, UNLESS otherwise specified in the rule; public JSON data MUST be supplied in a manner compatible with modern web frameworks, including: Cross-Origin Resource Sharing (CORS) should allow web applications running on a different domain to access the public JSON data directly.; Proper web application headers should be supplied for public JSON data, including at least setting Content-Type to application/json and X-Content-Type-Options: nosniff. | https://www.fedramp.gov/2026/providers/20x/rules/fedramp-certification/ | N/A | N/A | JSON valid against FedRAMP schemas; public JSON served with CORS, Content-Type: application/json, X-Content-Type-Options: nosniff. | Engineering lead | |||||||||||||||||
26 | Mandatory (FRC-CLA-MFR, MUST) | SDR-CSX-KSI | Key Security Indicators | Security Decision Record | Providers MUST also include short and simple high-level summaries of at least the following for each applicable Key Security Indicator: Explanation of measures (and their objectives) that demonstrate the Key Security Indicator, or an explanation of the reason and resulting risk to customers for not having measures available for that Key Security Indicator.; Explanation of the cycle for any measures that are implemented persistently (if applicable).; Verification that the measures demonstrate the Key Security Indicator, or that the reason for not having them is accepted.; Verification that the automation in place is accurate and sufficient to demonstrate appropriate measures for the Key Security Indicator, or that automation is not necessary for each measure.; Validation that the measures are accurately produced and are in place and working as intended, or that the reason for not having them is valid. | https://www.fedramp.gov/2026/providers/20x/rules/security-decision-record/ | Control narratives for related SOC 2 criteria | N/A | Short high-level summary for each applicable KSI: measures and objectives, cycle, verification, automation check, validation. 'See SOC 2 report' is not enough. | Compliance lead + Engineering lead | |||||||||||||||||
27 | Mandatory (FRC-CLA-MFR, MUST) | KSI-CMT-LMC | Logging Changes | KSI: Change Management | Modifications to the cloud service offering are logged and monitored. | https://www.fedramp.gov/2026/reference/20x/a/key-security-indicators/ | Change tickets, deployment logs, CI/CD approvals | CC8.1, CC7.1 | Show every production change is logged and monitored, incl. infrastructure and config changes, not just code. | Engineering lead | |||||||||||||||||
28 | Mandatory (FRC-CLA-MFR, MUST) | KSI-CNA-RNT | Restricting Network Traffic | KSI: Cloud Native Architecture | Machine-based information resources are persistently reviewed to ensure they are appropriately configured to limit inbound and outbound network traffic. | https://www.fedramp.gov/2026/reference/20x/a/key-security-indicators/ | Firewall rules, security group reviews, network diagrams | CC6.6, CC6.1 | Outbound restriction as well as inbound; evidence of persistent review, not just a diagram. | Engineering lead | |||||||||||||||||
29 | Mandatory (FRC-CLA-MFR, MUST) | KSI-CED-RAT | Reviewing All Training | KSI: Cybersecurity Education | The effectiveness of relevant cybersecurity education and training is persistently reviewed, including at least general training for all employees, role-specific training for employees in high risk roles, training for development and engineering staff on secure software delivery, and training for staff involved with incident response or disaster recovery. | https://www.fedramp.gov/2026/reference/20x/a/key-security-indicators/ | Training completion records | CC1.4, CC2.2 | Completion is not effectiveness. Measure results; role-specific training for high-risk roles, engineers (secure software delivery) and IR/DR staff. | People/HR lead + Security lead | |||||||||||||||||
30 | Mandatory (FRC-CLA-MFR, MUST) | KSI-IAM-AAM | Automating Account Management | KSI: Identity and Access Management | The lifecycle and privileges of all accounts, roles, and groups are securely managed using automation. | https://www.fedramp.gov/2026/reference/20x/a/key-security-indicators/ | Access reviews, onboarding/offboarding tickets | CC6.1, CC6.2, CC6.3 | Lifecycle and privileges of all accounts, roles and groups managed with automation, not ticket-driven. | IT/Identity lead | |||||||||||||||||
31 | Mandatory (FRC-CLA-MFR, MUST) | KSI-INR-RIR | Reviewing Incident Response Procedures | KSI: Incident Response | The effectiveness of documented incident response procedures is persistently reviewed. | https://www.fedramp.gov/2026/reference/20x/a/key-security-indicators/ | IR plan, tabletop records, post-incident reviews | CC7.4, CC7.5 | Persistent review of IR procedure effectiveness, incl. FedRAMP reporting steps and timeframes. | Security lead | |||||||||||||||||
32 | Mandatory (FRC-CLA-MFR, MUST) | KSI-SVC-SIN | Securing Information | KSI: Service Configuration | Information is encrypted or otherwise secured from unwanted access or modification. | https://www.fedramp.gov/2026/reference/20x/a/key-security-indicators/ | Encryption at rest/in transit, key management evidence | CC6.1, CC6.7, C1.1 | Show it for every location federal data could sit, incl. backups and logs. | Engineering lead | |||||||||||||||||
33 | Mandatory (FRC-CLA-MFR, MUST) | KSI-IAM-APM | Adopting Passwordless Methods | KSI: Identity and Access Management | Secure passwordless methods are used for user authentication and authorization when feasible, otherwise strong passwords with phishing-resistant MFA is used. | https://www.fedramp.gov/2026/reference/20x/a/key-security-indicators/ | MFA policy, enforcement screenshots | CC6.1 | Passwordless where feasible, otherwise strong passwords + phishing-resistant MFA. SMS/push may not meet the bar. | IT/Identity lead | |||||||||||||||||
34 | Recommended (FRC-CLA-RFR, SHOULD) | CDS-CSO-AVR | Availability Reporting | Certification Data Sharing | Providers with Class A Certifications SHOULD maintain a web service, available to all necessary parties, that indicates current and historical availability of core services within the cloud service offering over at least the past 30 days, including availability incidents, in both human-readable and machine-readable formats; this service SHOULD be available even if the primary cloud service offering is unavailable. | https://www.fedramp.gov/2026/providers/20x/rules/certification-data-sharing/ | Status page, uptime monitoring | A1.1 | Web service showing current AND historical availability of core services. | Engineering lead | |||||||||||||||||
35 | Recommended (FRC-CLA-RFR, SHOULD) | CPO-CSX-CPM | Certification Package Maintenance for 20x | Certification Package Overview | Providers with 20x Class A Certifications SHOULD persistently maintain their FedRAMP Certification Package to ensure it is up to date and complete at least once every 3 months. | https://www.fedramp.gov/2026/providers/20x/rules/certification-package-overview/ | N/A | N/A | Keep the Certification Package up to date and complete at least every 3 months. | Compliance lead | |||||||||||||||||
36 | Recommended (FRC-CLA-RFR, SHOULD) | IEC-CSO-IIR | Initial Incident Report | Incident Evaluation and Communication | Providers with Class A Certifications SHOULD responsibly notify all affected parties after identifying FedRAMP Reportable Incidents by providing an Initial Incident Report with as much of the following information that is available at the time of reporting and/or the current relevant status for each item: Contact information for the federal incident response coordinator; Provider's internally assigned tracking identifier; Description of the incident; Timeline of the incident, including start time, time and source of detection, time of completed FedRAMP Reportable Incident evaluation, and other major incident milestones determined by the provider; Historically and currently estimated Potential Agency Impact N-rating (PAIN) of the incident, including an explanation of the evaluation following the requirements in IEC-CSO-EFI (Estimate Federal Impact) (if applicable); Functional impact to federal agency customers (include impact to confidentiality and/or integrity and the impacted federal customer data types); Estimated recovery plan, milestones, and timelines; List of likely affected customer agencies | https://www.fedramp.gov/2026/providers/20x/rules/incident-evaluation-and-communication/ | Customer incident notification procedure | CC7.4, CC2.3 | Initial Incident Report with listed fields (coordinator contact, tracking ID, timeline, PAIN rating, functional impact, recovery plan, affected agencies). SHOULD at A. | Security lead | |||||||||||||||||
37 | Recommended (FRC-CLA-RFR, SHOULD) | IEC-CSO-OIR | Ongoing Incident Reports | Incident Evaluation and Communication | Providers with Class A Certifications SHOULD responsibly notify all affected parties of ongoing activity as new information becomes available during incident response for FedRAMP Reportable Incidents, including updates (or lack of updates) to all previously reported information and as much of the following additional information that is available and/or the current relevant status for each item: Observed incident activity; Indicators of compromise; Related Common Vulnerabilities and Exposures (CVE) identifier (if applicable); Root cause; Response and recovery activities | https://www.fedramp.gov/2026/providers/20x/rules/incident-evaluation-and-communication/ | Incident status update procedure | CC7.4, CC2.3 | Ongoing Incident Reports as information emerges (activity, IOCs, CVEs, root cause, response). SHOULD at A. | Security lead | |||||||||||||||||
38 | Recommended (FRC-CLA-RFR, SHOULD) | VDR-TFR-MVX | Persistent Machine Verification and Validation for 20x | Vulnerability Detection and Response | Providers of FedRAMP 20x Class A offerings SHOULD verify and validate the status of machine-based information resources at least once every month. | https://www.fedramp.gov/2026/providers/20x/rules/vulnerability-detection-and-response/ | Config management / CSPM output | CC7.1 | Verify and validate status of machine-based resources at least monthly. | Engineering lead | |||||||||||||||||
39 | Recommended (FRC-CLA-RFR, SHOULD) | VDR-TFR-PCD | Persistently Complete Detection | Vulnerability Detection and Response | Providers with Class A Certifications SHOULD persistently perform vulnerability detection on all information resources that are NOT likely to drift, at least once every 6 months. | https://www.fedramp.gov/2026/providers/20x/rules/vulnerability-detection-and-response/ | Scan schedules | CC7.1 | Detection on resources NOT likely to drift at least every 6 months. | Security lead | |||||||||||||||||
40 | Recommended (FRC-CLA-RFR, SHOULD) | VDR-TFR-PDD | Persistent Drift Detection | Vulnerability Detection and Response | Providers with Class A Certifications SHOULD persistently perform vulnerability detection on all information resources that are likely to drift, at least once every 3 months. | https://www.fedramp.gov/2026/providers/20x/rules/vulnerability-detection-and-response/ | Scan schedules | CC7.1 | Detection on resources likely to drift at least every 3 months. | Security lead | |||||||||||||||||
41 | Recommended (FRC-CLA-RFR, SHOULD) | VDR-TFR-PSD | Persistent Sample Detection | Vulnerability Detection and Response | Providers with Class A Certifications SHOULD persistently perform vulnerability detection on representative samples of similar machine-based information resources, at least once every 14 days. | https://www.fedramp.gov/2026/providers/20x/rules/vulnerability-detection-and-response/ | Scan schedules | CC7.1 | Detection on representative samples of similar machine resources at least every 14 days. | Security lead | |||||||||||||||||
42 | Recommended (FRC-CLA-RFR, SHOULD) | VDR-TFR-PVR | Mitigation and Remediation Expectations | Vulnerability Detection and Response | Providers with Class A Certifications SHOULD partially mitigate vulnerabilities, fully mitigate vulnerabilities, or remediate vulnerabilities to a lower potential agency impact within the timeframes from evaluation shown below, factoring for the current Potential Agency Impact N-rating as defined in VER-EVA-EPA (Estimate Potential Agency Impact), internet reachability, and likely exploitability. | https://www.fedramp.gov/2026/providers/20x/rules/vulnerability-detection-and-response/ | Remediation SLAs in vulnerability management policy | CC7.1, CC7.4 | FedRAMP recommends (SHOULD) its PAIN-based timeframes at Class A; map your SLA table to them or document why yours differ. | Security lead | |||||||||||||||||
43 | Recommended (FRC-CLA-RFR, SHOULD) | VER-TFR-EVU | Evaluate Vulnerabilities Quickly | Vulnerability Evaluation and Reporting | Providers with Class A Certifications SHOULD evaluate ALL vulnerabilities as required by VER-EVA (Evaluation) within 14 days of detection. | https://www.fedramp.gov/2026/providers/20x/rules/vulnerability-evaluation-and-reporting/ | Vulnerability triage records | CC7.1, CC3.2 | Evaluate ALL vulnerabilities (per VER-EVA) within 14 days of detection at Class A. | Security lead | |||||||||||||||||
44 | Optional (FRC-CLA-OFR, MAY) | CCM-QTR-MTG | Quarterly Review Meeting | Collaborative Continuous Monitoring | Providers with Class A Certifications MAY host a synchronous Quarterly Review every 3 months, open to all necessary parties, to review aspects of the most recent Ongoing Certification Reports that the provider determines are of the most relevance to agencies. | https://www.fedramp.gov/2026/providers/20x/rules/collaborative-continuous-monitoring/ | N/A | N/A | Optional quarterly synchronous review meeting open to all necessary parties. | Compliance lead | |||||||||||||||||
45 | Optional (FRC-CLA-OFR, MAY) | CDS-CSO-PSM | Per-Service Certification Materials | Certification Data Sharing | Providers with Class A Certifications MAY supply per-service FedRAMP Certification materials. | https://www.fedramp.gov/2026/providers/20x/rules/certification-data-sharing/ | N/A | N/A | Optional per-service certification materials. | Compliance lead | |||||||||||||||||
46 | Optional (FRC-CLA-OFR, MAY) | CMU-CSO-UVM | Using Validated Cryptographic Modules | Cryptographic Module Use | Providers with Class A Certifications MAY use cryptographic modules or update streams of cryptographic modules with active validations under the NIST Cryptographic Module Validation Program when using cryptographic services to protect federal customer data. | https://www.fedramp.gov/2026/providers/20x/rules/cryptographic-module-use/ | Encryption standards, crypto library inventory | CC6.1, CC6.7 | Optional at A: CMVP-validated modules. Artifact if addressed: list of modules and validation status. | Engineering lead | |||||||||||||||||
47 | Optional (FRC-CLA-OFR, MAY) | FRC-APP-FIA | Fresh Independent Assessment | FedRAMP Certification | Providers seeking Class A Certification MAY supply a fresh initial FedRAMP independent assessment that was completed by a FedRAMP Recognized independent assessment service within the previous 3 months. | https://www.fedramp.gov/2026/providers/20x/rules/fedramp-certification/ | N/A | N/A | Optional: fresh FedRAMP independent assessment by a FedRAMP Recognized assessor within previous 3 months. | Compliance lead | |||||||||||||||||
48 | Optional (FRC-CLA-OFR, MAY) | IVV-CSO-FIA | FedRAMP Independent Assessments | Independent Verification and Validation | Providers with Class A Certifications MAY persistently complete an independent verification and validation assessment of all applicable FedRAMP rules with a FedRAMP Recognized independent assessment service OR FedRAMP at least once per year; this is a FedRAMP independent assessment. | https://www.fedramp.gov/2026/providers/20x/rules/independent-verification-and-validation/ | N/A | N/A | Optional at A: annual independent V&V of all applicable rules by a FedRAMP Recognized assessor or FedRAMP. | Compliance lead | |||||||||||||||||
49 | Optional (FRC-CLA-OFR, MAY) | SDR-CSX-KMT | Key Security Indicator Metrics | Security Decision Record | Providers with 20x Class A Certifications MAY also include historical metrics in their Security Decision Record. | https://www.fedramp.gov/2026/providers/20x/rules/security-decision-record/ | Security metrics dashboards | CC4.1 | Optional at A: historical KSI metrics in the SDR (SHOULD at B, MUST at C). | Engineering lead | |||||||||||||||||
50 | Optional (FRC-CLA-OFR, MAY) | VER-TFR-IRI | Internet-Reachable Incidents | Vulnerability Evaluation and Reporting | Providers with Class A Certifications MAY treat internet-reachable likely exploitable vulnerabilities where Potential Agency Impact N-rating > 3 as a FedRAMP Reportable Incident until they are partially mitigated vulnerabilities at N3 or below. | https://www.fedramp.gov/2026/providers/20x/rules/vulnerability-evaluation-and-reporting/ | N/A | CC7.3 | Optional at A: treat internet-reachable likely exploitable vulns with PAIN > N3 as reportable incidents. | Security lead | |||||||||||||||||
51 | Optional (FRC-CLA-OFR, MAY) | VER-TFR-MRH | Historical Activity | Vulnerability Evaluation and Reporting | Providers with Class A Certifications MAY make all recent historical vulnerability detection and response activity available in JSON format for automated retrieval by all necessary parties (e.g. using an API service or similar); this information MAY be updated persistently, at least once every month. | https://www.fedramp.gov/2026/providers/20x/rules/vulnerability-evaluation-and-reporting/ | N/A | CC7.1 | Optional at A: historical VDR activity in JSON for automated retrieval (schema: Historical VER Activity). | Engineering lead | |||||||||||||||||
52 | Optional (FRC-CLA-OFR, MAY) | VER-TFR-NRI | Non-Internet-Reachable Incidents | Vulnerability Evaluation and Reporting | Providers with Class A Certifications MAY treat likely exploitable vulnerabilities that are NOT internet-reachable where Potential Agency Impact N-rating = 5 as a FedRAMP Reportable Incident until they are partially mitigated vulnerabilities at N4 or below. | https://www.fedramp.gov/2026/providers/20x/rules/vulnerability-evaluation-and-reporting/ | N/A | CC7.3 | Optional at A: treat non-internet-reachable likely exploitable vulns with PAIN = N5 as reportable incidents. | Security lead | |||||||||||||||||
53 | |||||||||||||||||||||||||||
54 | |||||||||||||||||||||||||||
55 | |||||||||||||||||||||||||||
56 | |||||||||||||||||||||||||||
57 | |||||||||||||||||||||||||||
58 | |||||||||||||||||||||||||||
59 | |||||||||||||||||||||||||||
60 | |||||||||||||||||||||||||||
61 | |||||||||||||||||||||||||||
62 | |||||||||||||||||||||||||||
63 | |||||||||||||||||||||||||||
64 | |||||||||||||||||||||||||||
65 | |||||||||||||||||||||||||||
66 | |||||||||||||||||||||||||||
67 | |||||||||||||||||||||||||||
68 | |||||||||||||||||||||||||||
69 | |||||||||||||||||||||||||||
70 | |||||||||||||||||||||||||||
71 | |||||||||||||||||||||||||||
72 | |||||||||||||||||||||||||||
73 | |||||||||||||||||||||||||||
74 | |||||||||||||||||||||||||||
75 | |||||||||||||||||||||||||||
76 | |||||||||||||||||||||||||||
77 | |||||||||||||||||||||||||||
78 | |||||||||||||||||||||||||||
79 | |||||||||||||||||||||||||||
80 | |||||||||||||||||||||||||||
81 | |||||||||||||||||||||||||||
82 | |||||||||||||||||||||||||||
83 | |||||||||||||||||||||||||||
84 | |||||||||||||||||||||||||||
85 | |||||||||||||||||||||||||||
86 | |||||||||||||||||||||||||||
87 | |||||||||||||||||||||||||||
88 | |||||||||||||||||||||||||||
89 | |||||||||||||||||||||||||||
90 | |||||||||||||||||||||||||||
91 | |||||||||||||||||||||||||||
92 | |||||||||||||||||||||||||||
93 | |||||||||||||||||||||||||||
94 | |||||||||||||||||||||||||||
95 | |||||||||||||||||||||||||||
96 | |||||||||||||||||||||||||||
97 | |||||||||||||||||||||||||||
98 | |||||||||||||||||||||||||||
99 | |||||||||||||||||||||||||||
100 |