Provider deliverables

Official source: FedRAMP Complete Ruleset Reference, FedRAMP Consolidated Rules release 2026.10.14.01. This page is a plain-English index. The official rule text governs, so follow each link before you build anything.

In short

Across the 245 rules in the Consolidated Rules, 72 rules make a provider produce something: a document, report, dataset, published web data, form or notification with required content. Another 14 rules set deliverables for assessors, advisors, agencies and FedRAMP.

61 of the 72 provider deliverables are MUST in at least one class.
19 of them name a FedRAMP JSON schema. When a rule names a schema, your JSON MUST validate against it, and public JSON MUST work with standard web applications (FRC-CSO-JSN).
24 rules notify someone through a specific channel, such as a FedRAMP form or fedramp_security@fedramp.gov. They’re listed in Notification channels.

How this list was built

Included: a rule is listed when its statement (or a class-specific statement) requires you to create, supply, publish or maintain a defined output.
Force: a single value means the force is the same for every class. Otherwise each class is listed, for example “A: MAY, B: MUST, C: MUST, D: MUST”. Rev5-only rules have no Class A.
Deliverable column: a short summary written for this site. The Rule, Force and Schema columns come straight from the upstream rule text.

What’s not included, and why

Process and behavior rules. Examples: vulnerability detection and response (VDR-CSO-DET), vulnerability evaluation (VER-EVA-ELX, VER-EVA-EIR, VER-EVA-EPA), incident evaluation and rating (IEC-CSO-EFR, IEC-CSO-EFI) and change evaluation (SCN-CSO-EVA). The records they produce are captured by the reporting rules listed below.
Capability and infrastructure rules. Examples: the FedRAMP Security Inbox rules (AFC-CSO-INB), using a trust center (CDS-CSO-UTC) and the configuration comparison, export and API capabilities (SCG-ENH-CMP, SCG-ENH-EXP, SCG-ENH-API).
Package maintenance cadence. CPO-CSX-CPM and CPO-CSF-CPM set how often you refresh the package, not a new output. See Certification package overview.
Notifications without required content. AFC-CSO-NOC, CDS-UTC-AAD and FRC-CCL-DNP require you to notify someone but don’t specify the content. The first two have a named FedRAMP form, so they appear in Notification channels.
Schema-tagged activities. CDS-CSO-UTC, IEC-CSO-EFI and SCN-CSO-EVA name a JSON schema, but the rule is an activity. The schema shows where the result ends up (the package overview, incident reports and change notifications).
Judgment calls. MAS-CSO-IIR and MAS-CSO-FLO say “identify” and “document”, but CPO-CSO-OVR pulls both into the package overview, so they’re included. MAS-CSO-MDI (include metadata in scope) is a scoping rule, so it isn’t.

Certification package: core documents

Rule	Name	Force	Deliverable	JSON schema
`FRC-CSO-PKG`	FedRAMP Certification Package	MUST	Complete package for initial certification: package overview, Security Decision Record information, and a real or example Ongoing Certification Report	Certification Package Overview
`CPO-CSO-OVR`	Overview of the Cloud Service Offering	MUST	Certification Package Overview in human-readable and JSON formats	Certification Package Overview
`CPO-CSO-MTD`	Certification Package Overview Metadata	MUST	Overview metadata: accountable official’s name, title and contact details, version, date and time of last update, source of update
`CPO-CSO-OSA`	Overall Summary of Assessment in Certification Package	A: MAY, B: MUST, C: MUST, D: MUST	The assessor’s overall assessment summary, included in the package overview
`SDR-CSO-FRR`	FedRAMP Rules	MUST	Security Decision Record in human-readable and JSON formats: explanation, verification, validation, independent verification and validation, responses and artifacts for each applicable rule	Security Decision Record
`SDR-CSO-MTD`	Security Decision Record Metadata	MUST	Record metadata: version, date and time of last update, source of update
`SDR-CSX-KSI`	Key Security Indicators	MUST	20x: a summary for each applicable Key Security Indicator in the Security Decision Record	Security Decision Record
`SDR-CSX-KMT`	Key Security Indicator Metrics	A: MAY, B: SHOULD, C: MUST, D: MUST	20x: historical metrics in the Security Decision Record. B and C: 30-day and up-to-one-year summaries. C adds all daily data, including persistent validation status. D: requirements that significantly exceed lower classes, to be set during the 20x Phase 4 Pilot	Security Decision Record
`SDR-CSF-CTF`	Rev5 Controls	MUST	Rev5: a summary for each applicable control (parameters, implementation status, mechanisms, verification, validation, independent verification and validation)
`FRC-CSF-BSL`	FedRAMP Rev5 Baselines	B: MUST, C: MUST, D: MUST	Rev5: the Security Decision Record covers at least the class baseline (155, 322 or 409 controls for B, C or D)
`FRC-CSF-ACP`	Assign Control Parameters	MUST	Rev5: every organization-defined parameter assignment, documented in the Security Decision Record
`FRC-CLA-MFR`	Mandatory FedRAMP Rules for Class A	MUST	Class A: artifacts or an information mapping in the package for every mandatory Class A rule
`FRC-CLA-EAM`	External Assessment Materials	MUST	Class A: materials from your alternative framework. SOC 2 Type II: full report, bridge or gap letter, audit engagement documentation, schedule for the next report. FedRAMP Ready or GovRAMP: Readiness Assessment Report, Security Assessment Plan and other required materials
`FRC-APP-FCP`	Fresh FedRAMP Certification Package	MUST	Initial package verified and validated by you within the previous 7 days
`FRC-APP-FIA`	Fresh Independent Assessment	A: MAY, B: MUST, C: MUST, D: MUST	Initial independent assessment by a FedRAMP Recognized assessor, completed within the previous 3 months
`FRC-APP-AFC`	Applying for FedRAMP Certification	MUST	FedRAMP Certification Application Form, completed in full

Certification package: scope, cryptography, policies, configuration and assessment evidence

Rule	Name	Force	Deliverable	JSON schema
`MAS-CSO-IIR`	Identify Information Resources	MUST	The set of information resources in your cloud service offering
`MAS-CSO-FLO`	Information Flows and Security Categories	MUST	Documentation of information flows and security categories for all resources
`MAS-CSO-TPR`	Third-Party Information Resources	MUST	For each third-party resource: usage and configuration, justification, mitigations, compensating controls	Certification Package Overview
`MAS-CSO-SUP`	Supplemental Information	MAY	Optional supplement about resources outside the offering, clearly marked and separated
`CMU-CSO-CMD`	Cryptographic Module Documentation	MUST	The cryptographic modules used per service, including NIST CMVP validation status
`CDS-CSO-IRP`	Include Relevant Policies	MUST	All relevant policies and procedures, plus a human- and machine-readable index (name, file, summary, word count, version, last update, related practices)
`SCG-CSO-RSC`	Recommended Secure Configuration	MUST	Secure Configuration Guide: top-level administrative account instructions and security settings	Certification Package Overview
`SCG-CSO-AUP`	Use Instructions	MUST	Instructions in the package for getting and using the Secure Configuration Guide
`SCG-CSO-PUB`	Public Secure Configuration Guidance	SHOULD	A public version of the Secure Configuration Guide
`SCG-ENH-MRG`	Machine-Readable Guidance	SHOULD	A machine-readable Secure Configuration Guide
`SCG-ENH-VRH`	Versioning and Release History	SHOULD	Versioning and release history for recommended secure defaults
`IVV-CSO-ICP`	Inclusion in Certification Package	MUST	Independent assessment results in the package, without inappropriate modification
`IVV-CSO-SEI`	Supply Evidence of Implementation	MUST	Evidence of implementation for assessors (the result of verification)
`IVV-CSO-SEE`	Supply Evidence of Effectiveness	MUST	Evidence of effectiveness for assessors (the result of validation)
`IVV-CSO-DUS`	Document Use of Representative Samples	MUST	An explanation of any representative sampling
`IVV-CSO-STE`	Supply Technical Explanations	SHOULD	Technical explanations and demonstrations for assessors

Public and trust center data

Rule	Name	Force	Deliverable	JSON schema
`CDS-CSO-PUB`	Public Information	MUST	Public offering information in human-readable and JSON formats (16 items, including FedRAMP ID, contacts, a browser-displayable logo image link, next report date and assessor)	Certification Package Overview
`CDS-CSO-SVC`	Public Service List	MUST	A public list of services and their security categories	Certification Package Overview
`CDS-CSO-FRC`	FedRAMP Certification Reports	MUST	FedRAMP Certification Reports added to your certification data within 2 weeks of receipt
`CDS-CSO-AVR`	Availability Reporting	A: SHOULD, B: MUST, C: MUST, D: MUST	An availability web service: current status and at least the past 30 days, in human- and machine-readable formats, available even when the offering is down
`CDS-CSO-HAD`	Historical FedRAMP Certification Data	MUST	Snapshots of certification data aligned to each Ongoing Certification Report, kept for the life of the certification
`CDS-CSO-PSM`	Per-Service Certification Materials	A: MAY, B: MAY, C: MAY, D: MUST	Per-service certification materials
`CDS-TRC-PAC`	Programmatic Access	MUST	Documented programmatic access to all certification data
`CDS-TRC-AAI`	Agency Access Inventory	MUST	Inventory and history of agency users and systems with access, available to FedRAMP on request
`CDS-TRC-ACL`	Access Logging	MUST	Access logs, with summaries kept for at least 6 months
`CDS-CSF-TCM`	Trust Center Migration	MUST	Rev5: a migration notice to all necessary parties, and instructions in your USDA Connect folders for using the trust center
`CCM-OCR-NRD`	Next Report Date	MUST	Target date of the next Ongoing Certification Report, with your public data
`CCM-QTR-NRD`	Next Review Date	MUST	Target date of the next Quarterly Review, with your public data
`MKT-IIP-DCP`	Demonstrating Continuous Progress	MUST	Progress against your goals and milestones, in your trust center or website, updated at least quarterly
`MKT-CSO-PML`	Provider Marketplace Listing Requests	MUST	The FedRAMP Marketplace listing request form

Continuous monitoring and vulnerability reports

Rule	Name	Force	Deliverable	JSON schema
`CCM-OCR-AVL`	Report Availability	MUST	Ongoing Certification Report every 3 months, covering (if applicable) changes, planned changes, accepted vulnerabilities, transformative changes, updated recommendations, agencies using the product, reportable incidents (or an attestation of none) and lessons learned	Ongoing Certification Report
`CCM-OCR-AFS`	Anonymized Feedback Summary	MUST	An anonymized summary of feedback and questions on each Ongoing Certification Report
`CCM-QTR-REG`	Meeting Registration Info	MUST	A Quarterly Review registration link or calendar file
`CCM-QTR-RTR`	Record/Transcribe Reviews	SHOULD	A Quarterly Review recording or transcript
`VER-RPT-PER`	Persistent Reporting	MUST	Persistent vulnerability detection and response reports covering all activity since the last report	Vulnerability Detail Report
`VER-RPT-VDT`	Vulnerability Details	MUST	The required fields for each detected vulnerability in those reports	Vulnerability Detail Report
`VER-RPT-AVI`	Accepted Vulnerability Info	MUST	The required fields for each accepted vulnerability in those reports	Accepted Vulnerability Info
`VER-TFR-MHR`	Monthly Activity Report	MUST	A human-readable vulnerability activity report, at least monthly
`VER-TFR-MRH`	Historical Activity	A: MAY, B: SHOULD, C: SHOULD, D: SHOULD	Recent historical vulnerability activity in JSON for automated retrieval, updated every month (A and B), 14 days (C) or 7 days (D)	Historical VER Activity
`VER-RPT-HLO`	High-Level Overviews	SHOULD	High-level overviews of all detection activity, such as disclosure programs, bug bounties and penetration tests

Incident reports

Rule	Name	Force	Deliverable	JSON schema
`IEC-CSO-IIR`	Initial Incident Report	A: SHOULD, B: MUST, C: MUST, D: MUST	Initial Incident Report with 8 listed items, due within PAIN-based timeframes that vary by class	Incident Report
`IEC-CSO-OIR`	Ongoing Incident Reports	A: SHOULD, B: MUST, C: MUST, D: MUST	Ongoing reports with updates plus incident activity, indicators of compromise, related CVEs, root cause and response activities	Incident Report
`IEC-CSO-FIR`	Final Incident Report	A: MUST, B: MUST, C: MUST, D: MUST	Final Incident Report once the incident is resolved and recovery is complete	Incident Report

Significant change notifications

Rule	Name	Force	Deliverable	JSON schema
`SCN-CSO-INF`	Required Information	MUST	Notification content: 10 required items, including the impact analysis and the approver’s name and title	Significant Change Notification
`SCN-CSO-HRM`	Human and Machine-Readable Notifications	MUST	All notifications and related audit records in human-readable and JSON formats	Significant Change Notification
`SCN-CSO-MAR`	Maintain Audit Records	MUST	Auditable records of your change evaluations, available to FedRAMP on request
`SCN-CSO-HIS`	Historical Notifications	MUST	12 months of notifications kept with your certification data
`SCN-ADP-NTF`	Notification Requirements	MUST	Adaptive change notice within 10 business days of finishing, with any new risks
`SCN-TRF-NIP`	Notification of Initial Plans	MUST	Transformative change: initial plans at least 30 business days before starting
`SCN-TRF-NFP`	Notification of Final Plans	MUST	Transformative change: final plans at least 10 business days before starting
`SCN-TRF-NAF`	Notification After Finishing	MUST	Transformative change: notice within 5 business days after finishing
`SCN-TRF-NAV`	Notification After Verification	MUST	Transformative change: notice within 5 business days after verification, with new risks and the security assessment report if applicable
`SCN-TRF-UPD`	Update Documentation	MUST	Updated service documentation within 30 business days after finishing
`SCN-TRF-TPR`	Third-Party Review	SHOULD	A third-party assessor’s review of a planned transformative change, when human validation is needed
`SCN-CSO-EMG`	Emergency Changes	MAY	After an emergency change: all notification materials, supplied retroactively. The rule is MAY, but the follow-up steps inside it are MUST
`SCN-CSO-NOM`	Notification Mechanisms	MAY	Your notification mechanism, documented in the package

Deliverables for other parties

Assessors

Rule	Name	Force	Deliverable	JSON schema
`IVV-IAS-SUM`	Assessment Summary	MUST	A summary of the assessment process and findings for each FedRAMP practice, for your Security Decision Record
`IVV-IAS-OSA`	Overall Summary of Assessment	MUST	An overall summary of results, including failures and disputes, for your package overview
`MKT-IAS-WEB`	Website Requirements for Assessors	MUST	A public website in human-readable and JSON formats	Assessor Information
`MKT-IAS-LRQ`	Listing Requests for Assessors	MUST	The Assessor Listing Request Form
`REC-IAS-AFI`	Annual Foreign Interest Reports	MUST	An annual foreign interest report
`REC-IAS-CFI`	Changes in Foreign Interest	MUST	An updated foreign interest report within 48 hours of a change
`REC-IAS-CAP`	Corrective Action Plan	MUST	A corrective action plan, when FedRAMP requires one

Advisors

Rule	Name	Force	Deliverable	JSON schema
`MKT-CAS-WEB`	Website Requirements for Advisors	MUST	A public website in consistent human- and machine-readable formats	Advisor Information
`MKT-CAS-LRQ`	Listing Requests for Advisors	MUST	The Advisor Listing Request Form

Agencies

Rule	Name	Force	Deliverable
`AGU-AGC-NAA`	Notify FedRAMP After Authorization	MUST	A copy of the ATO letter plus the information on the Submit an ATO Letter form
`AGU-AGC-AIP`	Agency Internal Policies	MUST	Agency-wide policy aligned with OMB M-24-15
`VER-AGM-MAP`	Maintain Agency Plans of Action and Milestones	SHOULD	Agency Plans of Action and Milestones built from your vulnerability information, when relevant

FedRAMP

Rule	Name	Force	Deliverable	JSON schema
`AFC-FRP-PNT`	Public Notice of Emergency Tests	MUST	A public notice at least 10 business days before an Emergency Test
`AFC-FRP-RPM`	Reaction Metrics	MAY	Public metrics on how fast providers act on elevated messages

Notification channels

These rules carry an official “notification requirement” block that names where the notice goes.

Rule	Who notifies	Channel
`AFC-CSO-NOC`	Provider	FedRAMP form: [CSP] Notification of Changes
`CDS-UTC-AAD`	Provider	FedRAMP form: [CSP] Agency Access Denial
`CDS-CSF-TCM`	Provider (Rev5)	`info@fedramp.gov`, and each agency customer’s security contact
`FRC-APP-AFC`	Provider	FedRAMP form: [For CSPs] FedRAMP Certification Application Form
`MKT-CSO-PML`	Provider	FedRAMP form: FedRAMP Marketplace Provider Listing Request Form
`IEC-CSO-IIR`, `IEC-CSO-OIR`, `IEC-CSO-FIR`	Provider	`fedramp_security@fedramp.gov`; each agency’s incident reporting procedure; an update in your trust center (or USDA Connect)
`SCN-ADP-NTF`, `SCN-TRF-NIP`, `SCN-TRF-NFP`, `SCN-TRF-NAF`, `SCN-TRF-NAV`	Provider	An update to your FedRAMP Certification Data for all necessary parties
`REC-IAS-AFI`, `REC-IAS-CFI`	Assessor	FedRAMP form: Foreign Ownership, Control, or Influence Declaration Form
`MKT-IAS-LRQ`	Assessor	FedRAMP form: [For Assessors] Marketplace Listing Request Form
`MKT-CAS-LRQ`	Advisor	FedRAMP form: [For Advisors] Marketplace Listing Request Form
`AGU-AGC-NAA`	Agency	FedRAMP form: Submit an ATO Letter
`AGU-AGC-NAI`	Agency	FedRAMP form for additional information or security requirement requests
`AGU-AGC-NAR`, `AGU-AGC-TPP`	Agency	`info@fedramp.gov`
`AGU-USE-NFC`	Agency	FedRAMP form: Report Concerns on Ongoing Certifications
`AGU-USE-NPC`	Agency	The provider’s security contact
`AFC-FRP-PNT`	FedRAMP	FedRAMP Public Notices

The forms themselves are linked from each rule on the official pages and from FedRAMP Help.

FedRAMP JSON schemas named in the rules

Every schema is published at https://fedramp.gov/schemas/fedramp-NAME-schema-2026-06-24.json.

Schema	Rules that name it
Certification Package Overview	`FRC-CSO-PKG`, `CPO-CSO-OVR`, `CDS-CSO-PUB`, `CDS-CSO-SVC`, `CDS-CSO-UTC`, `MAS-CSO-TPR`, `SCG-CSO-RSC`
Security Decision Record	`SDR-CSO-FRR`, `SDR-CSX-KSI`, `SDR-CSX-KMT`
Ongoing Certification Report	`CCM-OCR-AVL`
Incident Report	`IEC-CSO-IIR`, `IEC-CSO-OIR`, `IEC-CSO-FIR`, `IEC-CSO-EFI`
Significant Change Notifications	`SCN-CSO-EVA`, `SCN-CSO-INF`, `SCN-CSO-HRM`
Vulnerability Detail Report	`VER-RPT-PER`, `VER-RPT-VDT`
Accepted Vulnerability Info	`VER-RPT-AVI`
Historical VER Activity	`VER-TFR-MRH`
Assessor Information	`MKT-IAS-WEB`
Advisor Information	`MKT-CAS-WEB`

That’s 24 rules in total. Since release 2026.10.05.01, FRC-CSO-JSN also says public JSON MUST be usable by web applications on other domains, with CORS allowing access and headers such as Content-Type: application/json and X-Content-Type-Options: nosniff.

Start here

Rule summaries

Discussion digests

Provider deliverables

In short

How this list was built

What’s not included, and why