Skip to main content
Official source: Minimum Assessment Scope (MAS), FedRAMP Consolidated Rules release 2026.10.14.01. This page is a plain-English summary. The official rule text governs.

​
In short

The Minimum Assessment Scope (MAS) rules set your FedRAMP boundary. Your cloud service offering is the set of information resources likely to handle federal customer data, or likely to affect its confidentiality, integrity or availability. Everything else stays out of scope, so you avoid assessing components that don’t affect the offering’s security. You must document information flows and security categories for everything in scope and explain how you manage third-party information resources. You may add out-of-scope material as a clearly marked supplement.

​
Who it applies to

​
Key dates

​
What you need to do

​
General provider responsibilities (20x and Rev5)

MAS-CSO-IIR, MAS-CSO-FLO and MAS-CSO-TPR are among the rules whose information must appear in your Certification Package Overview under CPO-CSO-OVR.

​
Notes on scope from the rules

  • Out of scope by OMB direction. Certain categories of cloud products and services are entirely outside the scope of FedRAMP as specified by the Director of OMB, so they aren’t part of the offering. See fedramp.gov/scope.
  • Separately delivered software. Software you deliver separately for installation on agency systems, and don’t operate in a shared responsibility model (typically agents, application clients and mobile apps not fully managed by you), isn’t a cloud computing product or service. It is entirely outside the scope of FedRAMP under the FedRAMP Certification Act.
  • You decide and document the offering. You determine and maintain all aspects of the offering under the related rules and document them in your Certification Package.
  • Security categories may vary. Information resources, including third-party ones, MAY vary by security category based on the information they handle or affect.
  • Supplements. MAS-CSO-SUP is meant for things like security materials for apps and supplemental marketing collateral that may be useful to agencies.

​
What FedRAMP staff have said

Is a trust center in scope? On 2026-09-03, pete-gov said “it depends” on what you put in it. Apply both halves of MAS-CSO-IIR. A trust center may not handle federal customer data, but if its contents are sensitive enough that a compromise is likely to expose data in the offering, it is in scope. If you share information responsibly, it may be reasonable to conclude it isn’t. Either way, pete-gov said to make sure it is secure. Discussion #168 comment
Locally installed software. On 2026-10-05, pete-gov said MAS scoping occurs within the data boundary of the cloud service. If you have command and control, accept telemetry, or otherwise control deployed software (such as updates), that part of the cloud service is in scope. The software itself, and deploying and operating it inside an agency enclave or device, is outside FedRAMP scope. MAS-CSO-SUP lets you include information about it in the package, but FedRAMP won’t assess it. Discussion #147 comment
Features of a larger product. On 2026-09-09, emu-gov said a feature that can’t be bought on its own can’t have its own Marketplace listing. When you certify the parent product, you can list the feature as a service, as long as the components it relies on are in the minimum assessment scope. emu-gov also cautioned that listing a parent product as a resource under MAS-CSO-IIR for a dependent standalone product stretches the spirit of the rules. pete-gov added that a standalone product with its own team, package and continuous monitoring is a separate offering. Discussion #147 comment (emu-gov), Discussion #147 comment (pete-gov)
Metadata such as IP addresses, URLs and server names. On 2026-10-21, pete-gov confirmed that everything in the minimum assessment scope is subject to the rest of Rev5/CR26. MAS-CSO-MDI is the path for deciding, and the answer varies by architecture. In general, IP addresses, URLs and server names are unlikely to affect federal customer data if you manage them responsibly, so they wouldn’t be in the scope. Metadata that contains federal customer data, or an allow-list of IPs that could bypass controls, could be in scope. Discussion #183 comment
Class A boundary and third parties. On 2026-10-21, pete-gov said a Class A SOC 2 Type II boundary doesn’t have to match the offering exactly, but it should cover all the information resources you list under MAS-CSO-IIR. FedRAMP doesn’t expect a federal-specific boundary. Documenting carved-out subservice organizations under MAS-CSO-TPR is enough, even if none has FedRAMP status. Document the information flows, the risk, any compensating controls and whether the service can be disabled. Discussion #184 comment
Scoping before you have an agency customer. On 2026-10-16, pete-gov said that if you intend agencies to use the offering, an initial Marketplace listing is fine. Scope it to the parts you expect to make available to agencies that are likely to handle or affect confidentiality, integrity or availability of federal customer data. For agency data in agency-managed storage, everything handling it, and everything likely to affect its confidentiality, integrity or availability, is in play. Staff said FedRAMP can’t provide architecture advice. Discussion #147 comment
Using other cloud services. On 2026-09-11, answering a VER question, pete-gov said cloud service offerings that use other cloud services should address the risks in their MAS. Discussion #146 comment