Certification data sharing

Official source: Certification Data Sharing (CDS), FedRAMP Consolidated Rules release 2026.10.14.01. This page is a plain-English summary. The official rule text governs.

In short

You may store and share your FedRAMP Certification Data on the platform you choose, as long as it follows FedRAMP rules for access, accuracy and transparency. The ruleset recognizes that this information is usually your intellectual property, not federal information. You must publish core information about your offering publicly in human-readable and JSON formats, and use a FedRAMP-compatible trust center to share Certification Data with all necessary parties. Trust centers must give uninterrupted and programmatic access, keep an inventory of agency access and log access. Rev5 providers moving off USDA Connect must notify FedRAMP and their agency customers.

Who it applies to

Subset	Type	Path	Class	Audience
General Provider Responsibilities	20x, Rev5	Program, Agency	B, C, D	Providers
FedRAMP-Compatible Trust Centers	20x, Rev5	Program, Agency	B, C, D	Providers
Using a Trust Center	20x, Rev5	Program, Agency	B, C, D	Providers
Rev5-Specific Provider Responsibilities	Rev5	Program, Agency	B, C, D	Providers

The FedRAMP-Compatible Trust Centers rules apply to trust centers that are FedRAMP-compatible.
The Using a Trust Center rules apply to providers using a FedRAMP-compatible trust center instead of USDA Connect. They don’t apply to providers using USDA Connect.

The subsets list Classes B, C and D, but CDS-CSO-AVR and CDS-CSO-PSM include Class A variants.

Key dates

	20x	Rev5
Status	Required (Consolidated Rules for 2026)	Required (Consolidated Rules for 2026)
Optional adoption allowed	2026-07-04	2026-07-04
Obtaining initial certification	2026-07-04	2027-01-01
Maintaining ongoing certification	2027-01-01	2027-08-01
Grace period ends	First FedRAMP independent assessment started after 2027-01-01	2028-02-01

The Rev5 grace period for CDS ends on a fixed date (2028-02-01), not on your next independent assessment.

What you need to do

General provider responsibilities (20x and Rev5)

Rule	Force	What it means for you
`CDS-CSO-PUB`	MUST	Publicly share up-to-date information about the offering in human-readable and JSON formats, including at least the available and applicable items listed below.
`CDS-CSO-SVC`	MUST	Publicly share a detailed list of the services in the offering and their security categories, using names that match your public marketing. It MUST let a potential customer tell what is and isn’t in the Minimum Assessment Scope without requesting access to Certification Data.
`CDS-CSO-FID`	MUST	Once assigned, include the offering’s FedRAMP ID in all Certification Data, including reports, notifications and other communication that results from FedRAMP rules. Use a placeholder until it is assigned.
`CDS-CSO-FRC`	MUST	Include FedRAMP Certification Reports in your Certification Data without inappropriate modification, within 2 weeks of receiving them from FedRAMP.
`CDS-CSO-AVR`	Varies by class (SHOULD for A, MUST for B, C, D)	Maintain a web service showing current and historical availability of core services over at least the past 30 days, including availability incidents, in human-readable and machine-readable formats. It SHOULD (Class A) or MUST (Classes B, C, D) stay available even if the offering is unavailable. It may be separate from the trust center.
`CDS-CSO-UTC`	MUST	Use a FedRAMP-compatible trust center to store and share Certification Data with all necessary parties.
`CDS-CSO-CBF`	MUST	Use automation to keep human-readable and machine-readable versions of Certification Data consistent.
`CDS-CSO-RIS`	MUST and SHOULD NOT	You MUST provide enough information to support agency authorization decisions. You SHOULD NOT include sensitive details likely to let a threat actor gain access, cause harm or disrupt operations.
`CDS-CSO-IRP`	MUST	Supply all relevant policies and procedures, with a human-readable and machine-readable reference listing, for each: name, file or page name, brief summary, word count, current version, date of last update, and related FedRAMP Practices (if applicable).
`CDS-CSO-HAD`	MUST	Supply snapshots of Certification Data aligned to each Ongoing Certification Report to all necessary parties, and keep them available for the duration of certification.
`CDS-CSO-PSM`	Varies by class (MAY for A, B, C; MUST for D)	Supply per-service certification materials. You decide what counts as a separate service.
`CDS-CSO-RPS`	MAY	You MAY responsibly share some or all of your Certification Package publicly or with others if you determine it will NOT likely have an adverse effect on the offering.

CDS-CSO-PUB requires at least the following, where available and applicable:

FedRAMP ID
Service model
Deployment model
Business category
UEI number
Sales contact information
Security contact information
Product website link
Link to product logo: a valid, properly named image link that displays in a browser without processing (transparent PNG preferred)
Overall service description
Detailed list of specific services and their security categories (see CDS-CSO-SVC)
Link to secure configuration guidance
Overview of documentation you supply for the offering
Link to your trust center landing page, with instructions for accessing information in it
Next Ongoing Certification Report date (see CCM-OCR-NRD)
Current FedRAMP Recognized independent assessment service

The CDS-CSO-PUB notes say this information should generally be on a public web page or shared publicly in a FedRAMP-compatible trust center. FedRAMP and agency GRC tools will consume the JSON with web-based automation, so don’t expect them to download it. FedRAMP strongly recommends involving application engineers to make the public JSON work with web-based applications. See also FRC-CSO-JSN.

FedRAMP-compatible trust centers

Rule	Force	What it means for you
`CDS-TRC-USH`	MUST	Share Certification Data with all necessary parties without interruption: no manual approval for each access and no complicated process. The preferred approach is on-demand, just-in-time access provisioning.
`CDS-TRC-PAC`	MUST	Provide documented programmatic access to all Certification Data, including human-readable materials.
`CDS-TRC-AAI`	MUST	Keep an inventory and history of federal agency users or systems with access, and make it available to FedRAMP on request.
`CDS-TRC-ACL`	MUST and SHOULD	You MUST log access and store access summaries for at least six months. You SHOULD make a party’s own access information available to that party on request.
`CDS-TRC-HMR`	SHOULD	Make Certification Data available to view and download in human-readable and machine-readable formats.
`CDS-TRC-SSM`	SHOULD	Offer features that encourage all necessary parties to provision and manage access for their own users and services.

Using a trust center (instead of USDA Connect)

Rule	Force	What it means for you
`CDS-UTC-AAD`	MUST	Notify FedRAMP within 5 business days of denying an agency’s request for access to Certification Data, using the [CSP] Agency Access Denial form.
`CDS-UTC-AGA`	SHOULD	Give agencies access to your Certification Package on request.

Rev5-specific provider responsibilities

Rule	Force	What it means for you
`CDS-CSF-TCM`	MUST	When you migrate to a trust center, notify all necessary parties (FedRAMP at info@fedramp.gov, and agency customers through each agency’s security contact). Also post instructions in your existing USDA Connect Community Portal secure folders on how to get Certification Data from the trust center.

Differences by class

Rule	Class A	Class B	Class C	Class D
`CDS-CSO-AVR` availability reporting web service	SHOULD maintain; SHOULD stay available during outages	MUST maintain; MUST stay available during outages	MUST maintain; MUST stay available during outages	MUST maintain; MUST stay available during outages
`CDS-CSO-PSM` per-service materials	MAY	MAY	MAY	MUST

The CDS-CSO-PSM notes encourage one comprehensive set of materials for shared aspects, with separate materials only for what is unique to each service.

What FedRAMP staff have said

A public landing page can count as a basic trust center. On 2026-09-02, pete-gov said that for the Marketplace Initial Implementation phase no rule applies the FedRAMP-compatible trust center requirements. The rules require you to publish CDS-CSO-PUB information publicly in human-readable and JSON formats, and much of it won’t yet be available or applicable. A FedRAMP landing page that publishes all of that information would be considered “a basic FedRAMP-compatible Trust Center.” Discussion #147 comment

Public JSON must work in web apps. On 2026-09-17, pete-gov said FedRAMP needs to read machine-readable JSON directly from web-based applications, which means a CORS allow and an appropriate content type. pete-gov said FedRAMP would strictly require this for JSON that must be public, such as CDS-CSO-PUB and CDS-CSO-SVC, and would hold an RFC before applying it to JSON behind a trust center login. pete-gov also suggested planning for API requirements in a future ruleset. Upstream later updated CDS-CSO-PUB and FRC-CSO-JSN (2026-10-05). Discussion #175 comment, earlier comment

Why publish it yourself. On 2026-10-07, pete-gov said FedRAMP wants providers to own the CDS-CSO-PUB information, which FedRAMP then imports into the Marketplace. Agencies can also pull the latest information programmatically from you. Discussion #146 comment

Uninterrupted access in practice. On 2026-07-31, asked about CDS-TRC-USH, pete-gov said the trust center rules are deliberately minimal. If agencies routinely tell FedRAMP they lack the access they need, FedRAMP would likely conclude the rules aren’t being met. pete-gov also noted that trust centers requiring identity providers an agency can’t use create a poor customer experience. Discussion #146 comment

Sharing packages with other companies. On 2026-07-24, pete-gov said Certification Packages are the intellectual property of the company that creates them. FedRAMP asserts no ownership and won’t penalize responsible sharing under CDS-CSO-RPS. Discussion #154 comment

Rev5 transition notice. On 2026-07-23, paulagosta said moving to the CDS ruleset requires notifying FedRAMP at info@fedramp.gov under CDS-CSF-TCM. On 2026-08-19, paulagosta said CDS is the only Rev5 ruleset that requires you to inform FedRAMP, since it usually needs action on FedRAMP’s side for providers in USDA Connect. Discussion #147 comment, Discussion #146 comment

Before you move to a trust center. On 2026-10-02, paulagosta said Rev5 providers that haven’t transitioned to a CDS trust center should keep using their current mechanism for continuous monitoring materials (for most Class B and C, USDA Connect). Interim arrangements should be documented through the significant change process or monthly continuous monitoring meetings. Discussion #146 comment, follow-up

Dates, and a third-party trust center vendor. On 2026-10-21, pete-gov confirmed that for an active Rev5 provider, 2027-08-01 is when a cloud service goes into remediation and needs corrective action, though staff strongly discourage waiting. A third-party trust center vendor doesn’t need a FedRAMP certification at any class, because the Minimum Assessment Scope doesn’t require FedRAMP Certified third-party resources. You are expected to address their potential impact on federal customer data. If you manage the certification package information responsibly, the trust center could be outside the Minimum Assessment Scope entirely. Discussion #146 comment

Is the trust center in scope? On 2026-09-03, pete-gov said it depends on what you put in it, applying MAS-CSO-IIR. If you share information responsibly, it may be reasonable to conclude the trust center is out of scope. Either way, pete-gov said to make sure it is secure. Discussion #168 comment

Certification package overview: CPO-CSO-OVR pulls in CDS-CSO-PUB, CDS-CSO-SVC and CDS-CSO-IRP.
Minimum assessment scope
FedRAMP certification
Collaborative continuous monitoring
Marketplace listing
Rev5 questions on the Consolidated Rules for 2026
20x questions on the Consolidated Rules for 2026

Start here

Rule summaries

Discussion digests

In short

Who it applies to

Key dates

What you need to do

General provider responsibilities (20x and Rev5)

FedRAMP-compatible trust centers

Using a trust center (instead of USDA Connect)

Rev5-specific provider responsibilities

Differences by class

What FedRAMP staff have said

​In short

​Who it applies to

​Key dates

​What you need to do

​General provider responsibilities (20x and Rev5)

​FedRAMP-compatible trust centers

​Using a trust center (instead of USDA Connect)

​Rev5-specific provider responsibilities

​Differences by class

​What FedRAMP staff have said

​Related

In short

Who it applies to

Key dates

What you need to do

General provider responsibilities (20x and Rev5)

FedRAMP-compatible trust centers

Using a trust center (instead of USDA Connect)

Rev5-specific provider responsibilities

Differences by class

What FedRAMP staff have said

Related