> ## Documentation Index
> Fetch the complete documentation index at: /docs/llms.txt
> Use this file to discover all available pages before exploring further.

# What changed

> Upstream FedRAMP rule releases and updates to this knowledge base, newest first.

This page tracks two things: changes FedRAMP makes to the Consolidated Rules for 2026, and changes to this site. Each upstream entry summarizes FedRAMP's own [changelog](https://www.fedramp.gov/2026/changelog/) and links the official rules and our summaries. The official changelog governs if anything here differs. Each entry starts with its date. For an upstream release, that's the date FedRAMP published it.

**2026-11-01**

Site changes

**Date:** 2026-11-01

* **Site:** the knowledge base is now Sequencer Knowledge Docs, published by Sequencer Assurance at [sequencerassurance.com/docs](https://sequencerassurance.com/docs), with a new design. No rule summaries or digests changed.
* **Review:** nightly updates that pass automated checks are now published without a person reviewing them first. Anything else still waits for review. See [How this site stays current](/docs/index.md#how-this-site-stays-current).

**2026-10-30**

Discussions 2026-10-30

**Date:** 2026-10-30

* **Rules:** no upstream rule text changed since release `2026.10.14.01`. No rule summaries were edited.
* **Discussions:** [RFC-0035](https://github.com/FedRAMP/community/discussions/179) has a new community comment, which raises gaps about justifying non-CMVP-validated modules, a baseline for them, downgrade prevention and key management. It isn't a FedRAMP staff position, and there are still no staff answers in the thread. RFC-0035 remains a proposal. The published [`CMU-CSO-UVM`](https://www.fedramp.gov/2026/reference/cryptographic-module-use/#using-validated-cryptographic-modules) text governs. See [RFC history](/docs/discussions/rfc-history.md).

**2026-10-29**

Discussions 2026-10-27 to 2026-10-28

**Date:** 2026-10-29

* **Rules:** no upstream rule text changed since release `2026.10.14.01`. Staff notes were added to [Incident evaluation and communication](/docs/rules/incident-evaluation-and-communication.md), [VER](/docs/rules/vulnerability-evaluation-and-reporting.md) and [FedRAMP certification](/docs/rules/fedramp-certification.md).
* **Discussions:** new staff positions in [#146](https://github.com/FedRAMP/community/discussions/146) on the incident report notification oversight (`IEC-CSO-IIR`, `IEC-CSO-OIR` and `IEC-CSO-FIR`; FedRAMP plans to make notifying all necessary parties optional, and the published rule still governs until it changes), the `VER-EVA-EFA` evaluation factors and penetration tests for Ready Conversion. See the [Rev5 digest](/docs/discussions/rev5-cr26-questions.md).
* **RFCs:** [RFC-0033](https://github.com/FedRAMP/community/discussions/170) gained two late third-party comments that FedRAMP relayed. They are community input, not staff positions. See [RFC history](/docs/discussions/rfc-history.md).

**2026-10-28**

Discussions 2026-10-27

**Date:** 2026-10-28

* **Rules:** no upstream rule text changed since release `2026.10.14.01`. A staff note on N5 was added to [VER](/docs/rules/vulnerability-evaluation-and-reporting.md), which summarizes [`VER-EVA-EPA`](https://www.fedramp.gov/2026/reference/vulnerability-evaluation-and-reporting/#estimate-potential-agency-impact).
* **Discussions:** new staff positions in [#146](https://github.com/FedRAMP/community/discussions/146) on PAIN ratings (follow the final rules, not RFC-0031, and a non-mission-critical service isn't automatically N5) and on mixed legacy and CR26 packages during the transition. See the [Rev5 digest](/docs/discussions/rev5-cr26-questions.md).

**2026-10-27**

Discussion #146 update

**Date:** 2026-10-27

* **Rules:** no upstream rule text changed since release `2026.10.14.01`. Staff notes were added to [VER](/docs/rules/vulnerability-evaluation-and-reporting.md) and [Certification package overview](/docs/rules/certification-package-overview.md).
* **Discussions:** new `pete-gov` positions in [#146](https://github.com/FedRAMP/community/discussions/146) on what "full implementation" means for SHOULD rules, the December 2026 activity report, false-positive reporting, and mixed legacy and CR26 packages in 2027. See the [Rev5 digest](/docs/discussions/rev5-cr26-questions.md).

**2026-10-26**

Discussion #186 staff answer

**Date:** 2026-10-26

* **Rules:** no upstream rule text changed since release `2026.10.14.01`.
* **Discussions:** `pete-gov` answered [#186](https://github.com/FedRAMP/community/discussions/186) on 2026-10-25: the FedRAMP Marketplace is the only official source of FedRAMP status, and FedRAMP can't stop other claims unless they say "FedRAMP Certified" or "FedRAMP Authorized." Added to [Notable staff answers](/docs/discussions/notable-staff-answers.md).

**2026-10-25**

Discussions 2026-10-24 to 2026-10-25

**Date:** 2026-10-25

* **Rules:** no upstream rule text changed since release `2026.10.14.01`. No rule pages changed.
* **Discussions:** [RFC-0035](https://github.com/FedRAMP/community/discussions/179) gained two community comments. It still has no staff comments, so [RFC history](/docs/discussions/rfc-history.md) only notes the comment status. A new thread, [#186](https://github.com/FedRAMP/community/discussions/186), asks whether a "FedRAMP Compliant" logo is allowed for providers not on the Marketplace. It has no staff answer, so no page was added.

**2026-10-24**

Discussions 2026-10-15 to 2026-10-22, and staff flags corrected

**Date:** 2026-10-24

* **Rules:** no upstream rule text changed since release `2026.10.14.01`. Staff notes were added to [VDR](/docs/rules/vulnerability-detection-and-response.md), [VER](/docs/rules/vulnerability-evaluation-and-reporting.md), [Minimum assessment scope](/docs/rules/minimum-assessment-scope.md), [FedRAMP certification](/docs/rules/fedramp-certification.md), [Certification data sharing](/docs/rules/certification-data-sharing.md) and [Incident evaluation and communication](/docs/rules/incident-evaluation-and-communication.md).
* **Discussions:** new staff positions in [#146](https://github.com/FedRAMP/community/discussions/146) and [#147](https://github.com/FedRAMP/community/discussions/147), covering VDR timing and KEVs, user interaction as `VER-EVA-AIA` evidence, Ready Conversion grace, incident report routes, trust center vendors and how FedRAMP will check VDR by 2026-12-07. See the [Rev5 digest](/docs/discussions/rev5-cr26-questions.md) and [20x digest](/docs/discussions/20x-cr26-questions.md). New threads in [Notable staff answers](/docs/discussions/notable-staff-answers.md): [#182](https://github.com/FedRAMP/community/discussions/182) (no rule requires 90 days of ConMon data), [#183](https://github.com/FedRAMP/community/discussions/183) (metadata and `MAS-CSO-MDI`), [#184](https://github.com/FedRAMP/community/discussions/184) (Class A SOC 2 Type II boundary) and [#181](https://github.com/FedRAMP/community/discussions/181) (RFC side thread).
* **RFCs:** [RFC-0035](https://github.com/FedRAMP/community/discussions/179) has community comments but no staff answers, and the new [RFC-0036](https://github.com/FedRAMP/community/discussions/180) (20x Class D pilot) is open until 2026-11-19. Both are proposals, not rules. See [RFC history](/docs/discussions/rfc-history.md).
* **Staff flags:** the sync re-flagged posts by `emu-gov`, a FedRAMP staff login that hid its org membership, as official. This affects 33 threads. Pages already treated `emu-gov` as staff, so most needed no change. [Notable staff answers](/docs/discussions/notable-staff-answers.md) now covers four 2026 threads that were missing: [#167](https://github.com/FedRAMP/community/discussions/167) (Class B and C submission rejection reasons), [#161](https://github.com/FedRAMP/community/discussions/161) (no NDAs for Trust Center access), [#155](https://github.com/FedRAMP/community/discussions/155) (Class A submission steps) and [#141](https://github.com/FedRAMP/community/discussions/141) (event announcement).

**2026-10-23**

Site correction

**Date:** 2026-10-23

* **Discussions:** in [Rev5 CR26 questions](/docs/discussions/rev5-cr26-questions.md), the `IVV-IAS-VIP` staff position now links `pete-gov`'s 2026-10-15 [repost](https://github.com/FedRAMP/community/discussions/146#discussioncomment-18957818). The 2026-10-14 comment it linked before was removed from GitHub. The guidance didn't change.

**2026-10-14**

Upstream 2026.10.14.01 and site launch

**Date:** 2026-10-14

* **Rules:** no rule text changed. FedRAMP improved search on its site: machine-generated rulesets are now excluded from search except the [Ruleset Reference](https://www.fedramp.gov/2026/reference/), and per-rule changelogs are hidden from search results.
* **Control mappings:** the per-rule changelogs in this release record control-mapping updates dated 2026-10-13 on 35 FRR rules and 40 Key Security Indicators. FedRAMP's release notes don't mention them. See [FRR and KSI](/docs/rules/frr-and-ksi.md#2-both-now-map-to-nist-sp-800-53) and the official [Key Security Indicators](https://www.fedramp.gov/2026/reference/key-security-indicators/) page.
* **Site:** launched this knowledge base, checked against upstream release `2026.10.14.01`. It published the [Rule summaries](/docs/rules.md), including a provider's step-by-step path through every ruleset, [Provider deliverables](/docs/rules/provider-deliverables.md), [FRR and KSI](/docs/rules/frr-and-ksi.md) and a summary page for each ruleset, and the [discussion digests](/docs/discussions.md), which separate FedRAMP staff positions from community comments.

**2026-10-08**

Upstream 2026.10.08.01

**Date:** 2026-10-08

* **Rules:** FedRAMP described this release as typos and convenience only, but it includes two rule changes for 20x providers:
  * Removed `FRC-CSX-MOT` (Metrics Over Time for Key Security Indicators) as duplicative of [`SDR-CSX-KMT`](https://www.fedramp.gov/2026/reference/security-decision-record/#key-security-indicator-metrics). See [FedRAMP certification](/docs/rules/fedramp-certification.md).
  * Changed [`SDR-CSX-KMT`](https://www.fedramp.gov/2026/reference/security-decision-record/#key-security-indicator-metrics) (Key Security Indicator Metrics) from MUST to SHOULD for Class B, and clarified that Class C daily metric data includes the status of persistent validation. The forces are now A: MAY, B: SHOULD, C: MUST, D: MUST. See [Security decision record](/docs/rules/security-decision-record.md).
* **Content:** added the [FedRAMP Trigrams](https://www.fedramp.gov/2026/trigrams/) page, which explains the three-letter codes used in rule IDs.
* **Content:** fixed "understand" to "understood" in the SHOULD NOT explanation on the [Rules page](https://www.fedramp.gov/2026/rules/#force-of-the-rule) and in the definition, after a community report in [FedRAMP/2026 discussion #124](https://github.com/FedRAMP/2026/discussions/124#discussioncomment-18818629).

**2026-10-05**

Upstream 2026.10.05.01

**Date:** 2026-10-05

* **Rules:** clarifications to seven rules. FedRAMP now tracks rule improvements as [issues in the FedRAMP Rules repository](https://github.com/FedRAMP/rules/issues).
  * [`VER-EVA-EPA`](https://www.fedramp.gov/2026/reference/vulnerability-evaluation-and-reporting/#estimate-potential-agency-impact) (Estimate Potential Agency Impact): added PAIN N0 for vulnerabilities whose exploitation is extremely unlikely to have any adverse effect on agencies. See [Vulnerability evaluation and reporting](/docs/rules/vulnerability-evaluation-and-reporting.md).
  * [`FRC-CSO-JSN`](https://www.fedramp.gov/2026/reference/fedramp-certification/#fedramp-json-schemas) (FedRAMP JSON Schemas): public JSON MUST work with modern web frameworks, including CORS access from other domains and headers such as `Content-Type: application/json`. See [FedRAMP certification](/docs/rules/fedramp-certification.md).
  * [`CDS-CSO-PUB`](https://www.fedramp.gov/2026/reference/certification-data-sharing/#public-information) (Public Information): the logo link must be a valid, properly named image that displays in a browser without processing. See [Certification data sharing](/docs/rules/certification-data-sharing.md).
  * [`CMU-CSO-UVM`](https://www.fedramp.gov/2026/reference/cryptographic-module-use/#using-validated-cryptographic-modules) (Using Validated Cryptographic Modules): added a note that new algorithms added in a module's update stream aren't covered as validated. See [Cryptographic module use](/docs/rules/cryptographic-module-use.md).
  * [`MKT-CAS-LRQ`](https://www.fedramp.gov/2026/reference/marketplace-listing/#listing-requests-for-advisors) and [`MKT-IAS-LRQ`](https://www.fedramp.gov/2026/reference/marketplace-listing/#listing-requests-for-assessors): updated the listing form names and URLs. See [Marketplace listing](/docs/rules/marketplace-listing.md).
  * [`FRC-CSF-RDY`](https://www.fedramp.gov/2026/reference/fedramp-certification/#fedramp-ready-conversion) (FedRAMP Ready Conversion): grammar fix only.
* **Discussions:** the `FRC-CSO-JSN` change follows FedRAMP staff comments by `pete-gov` on 2026-09-17 in [discussion #175](https://github.com/FedRAMP/community/discussions/175#discussioncomment-18480627), which said FedRAMP planned to make clear that JSON must be directly consumable by web applications.
* **Content:** adopted new social cards on the official site.

**2026-09-22**

Upstream 2026.09.22.01

**Date:** 2026-09-22

* **Rules:** no rule text changed.
* **Content:** the [Rev5 Deadlines](https://www.fedramp.gov/2026/providers/updating/deadlines/rev5/) and [20x Deadlines](https://www.fedramp.gov/2026/providers/updating/deadlines/20x/) pages now explain how to apply each date. The labels on every ruleset changed: "Obtain" is now "Obtaining Initial Certification", "Maintain" is now "Maintaining Ongoing Certification", and "Grace Ends" is now "Grace Period Ends". See [Key dates](/docs/rules.md#key-dates).

**2026-09-13**

Upstream 2026.09.13.02

**Date:** 2026-09-13

* **Rules:** readability and metadata updates, several contributed by the community (including [discussion #164](https://github.com/FedRAMP/community/discussions/164)):
  * [`CCM-OCR-AVL`](https://www.fedramp.gov/2026/reference/collaborative-continuous-monitoring/#report-availability): report contents are required "if applicable", depending on type or class. See [Collaborative continuous monitoring](/docs/rules/collaborative-continuous-monitoring.md).
  * [`CPO-CSO-OVR`](https://www.fedramp.gov/2026/reference/certification-package-overview/#overview-of-the-cloud-service-offering), [`CPO-CSO-MTD`](https://www.fedramp.gov/2026/reference/certification-package-overview/#certification-package-overview-metadata), [`CPO-CSO-OSA`](https://www.fedramp.gov/2026/reference/certification-package-overview/#overall-summary-of-assessment-in-certification-package) and [`CPO-CSF-CPM`](https://www.fedramp.gov/2026/reference/certification-package-overview/#certification-package-maintenance-for-rev5): the Rev5 grace period moved from January 1 to July 1, 2027 (still tied to the next independent assessment). `CPO-CSF-CPM` now applies to Rev5 Classes B to D only. See [Certification package overview](/docs/rules/certification-package-overview.md).
  * [`FRC-CCL-UCC`](https://www.fedramp.gov/2026/reference/fedramp-certification/#upgrading-certification-class), [`FRC-CCL-DCC`](https://www.fedramp.gov/2026/reference/fedramp-certification/#downgrading-certification-class) and [`FRC-CCL-DNP`](https://www.fedramp.gov/2026/reference/fedramp-certification/#downgrade-notification-period): the class-change subset now applies to Classes B to D. See [FedRAMP certification](/docs/rules/fedramp-certification.md).
  * [`IEC-CSO-OIR`](https://www.fedramp.gov/2026/reference/incident-evaluation-and-communication/#ongoing-incident-reports): removed a duplicated word. See [Incident evaluation and communication](/docs/rules/incident-evaluation-and-communication.md).
  * [`AGU-AGC-LIA`](https://www.fedramp.gov/2026/reference/agency-use/#agency-liaison-program) and [`AGU-USE-ABU`](https://www.fedramp.gov/2026/reference/agency-use/#authorization-before-use): updated reference URLs. See [Agency use](/docs/rules/agency-use.md).
  * Structured timeframe metadata added to existing timeframes in [`CCM-QTR-SAR`](https://www.fedramp.gov/2026/reference/collaborative-continuous-monitoring/#schedule-around-reports), [`IVV-CSF-MCA`](https://www.fedramp.gov/2026/reference/independent-verification-and-validation/#mandatory-control-assessment), [`MKT-CAS-RFR`](https://www.fedramp.gov/2026/reference/marketplace-listing/#advisor-responses-to-fedramp), [`MKT-IIP-DLA`](https://www.fedramp.gov/2026/reference/marketplace-listing/#deadline-for-assessment) and [`VDR-TFR-NMV`](https://www.fedramp.gov/2026/reference/vulnerability-detection-and-response/#non-machine-verification-and-validation). The requirements themselves didn't change.
* **Definitions:** added [FedRAMP Definitions](https://www.fedramp.gov/2026/definitions/) for each force keyword: `FRD-MST` (MUST), `FRD-MNT` (MUST NOT), `FRD-SHD` (SHOULD), `FRD-SNT` (SHOULD NOT) and `FRD-MAY` (MAY). See [How to read the force of a rule](/docs/rules.md#how-to-read-the-force-of-a-rule).
* **Content:** the force keyword in each rule statement now links to its definition, and the [Force of the Rule](https://www.fedramp.gov/2026/rules/#force-of-the-rule) section moved from a table to separate callouts.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.