Official source: Secure Configuration Guide (
SCG), FedRAMP Consolidated Rules release 2026.10.14.01. This page is a plain-English summary. The official rule text governs.In short
You must write, maintain and make available a Secure Configuration Guide for your cloud service offering. It must explain how customers securely handle top-level administrative accounts and the security settings only those accounts can change. Your certification package must tell customers how to get and use the guide. Everything else in this ruleset, including public access, secure defaults and machine-readable or API access to settings, is a SHOULD. These rules are already in force. Per the FedRAMP staff comment noted below, the grace period ended on2026-07-01.
Who it applies to
The upstream text describes both subsets as applying to “providers with FedRAMP Certifications of any type.”
Key dates
The same dates apply to 20x and Rev5.What you need to do
Key terms: top-level administrative account, privileged account, machine-readable and certification package.General provider responsibilities
Notes from the official text for
SCG-CSO-RSC:
- The guide doesn’t have to be a single document called a “Secure Configuration Guide.” You can deliver it in whatever form gives customers the best experience.
- The guide should explain how top-level administrative accounts and privileged accounts are named in your service.
SCG-CSO-AUP, the official note says you decide how best to present the instructions for your customers.
Enhanced capabilities
What FedRAMP staff have said
The grace period has ended. On
2026-07-10, emu-gov said Addressing FedRAMP Communication and Secure Configuration Guide rules “are required now” and that the grace period ended on 2026-07-01, including for new Rev5 submissions. Discussion #146 commentThe guide is for customer configuration, not your internal OS hardening. On
2026-09-03, dan-fedramp said the guide required by SCG-CSO-RSC is meant to tell an agency customer how to configure your service. Unless you expect agency customers to configure the operating system on your system components, OS configuration doesn’t need to be in the guide. Discussion #147 commentLinking to the guide during transition assessments. On
2026-09-22, answering a question about Rev5 annual assessments that span late 2026, pete-gov said providers and assessors can be flexible and “roll your own supplement,” adding that for SCG FedRAMP “just asked folks to link us to it.” Discussion #146 commentRelated
- Agency use:
AGU-USE-RSGrequires agencies to review your Secure Configuration Guide and configure relevant security settings. - Certification package overview
- Key Security Indicators
- Rev5 questions on the 2026 rules and 20x questions on the 2026 rules