FedRAMP Consolidated Rules for 2026

FedRAMP Consolidated Rules: every rule, your scope, one answer.

Name: FedRAMP Consolidated Rules for 2026 — interactive obligation matrix
Creator: Boundera
License: https://github.com/FedRAMP/rules

The 2026 rules replace familiar FedRAMP vocabulary with 246 requirements across 17 rulesets, four service classes, two certification types, and two paths. This explorer collapses all of it into the only question that matters: what is mandatory, recommended, or optional for you— with the exact rule text, deadlines, and NIST control mappings one click away. Don't know your class yet? The free FedRAMP 20x gap assessment suggests one in about five minutes.

Reading from FedRAMP/rules 2026.07.14.01, published 2026-07-14 — the federal machine-readable source of truth.

cloud service provider · 20x · Program · Class B

158 / 246 in scope

91 MUST41 SHOULD17 MAY

See it on your cloud

Your scope

Show obligations for Party working toward a Certification type certification on the Certification path path with a Service class offering.

mandatory: 91
recommended: 41
optional: 17
prohibited: 9

Your scope is remembered on this device

Showing 158 of 158 in-scope requirements.

Scope & prepare

Draw the boundary and set the technical baseline

MAS

Minimum Assessment Scope

5 rules20x · In effect since Jul 4, 2026

Minimum Assessment Scope — force of each requirement by service class
Class A	Class BYOUR SCOPE	Class C	Class D
MUST	MUST	MUST	MUST
—	MUST	MUST	MUST
—	MUST	MUST	MUST
—	MUST	MUST	MUST
—	MAY	MAY	MAY

CMU

Cryptographic Module Use

3 rules20x · In effect since Jul 4, 2026

Cryptographic Module Use — force of each requirement by service class
Class A	Class BYOUR SCOPE	Class C	Class D
—	MUST	MUST	MUST
MAY	MAY	SHOULD	MUST
—	SHOULD	SHOULD	SHOULD

SCG

Secure Configuration Guide

9 rules20x · In effect since Mar 1, 2026

Secure Configuration Guide — force of each requirement by service class
Class A	Class BYOUR SCOPE	Class C	Class D
—	MUST	MUST	MUST
—	MUST	MUST	MUST
—	SHOULD	SHOULD	SHOULD
—	SHOULD	SHOULD	SHOULD
—	SHOULD	SHOULD	SHOULD
—	SHOULD	SHOULD	SHOULD
—	SHOULD	SHOULD	SHOULD
—	SHOULD	SHOULD	SHOULD
—	SHOULD	SHOULD	SHOULD

Assess & certify

Independent assessment through certification decision

FRC

FedRAMP Certification

15 rules20x · In effect since Jul 4, 2026

FedRAMP Certification — force of each requirement by service class
Class A	Class BYOUR SCOPE	Class C	Class D
MUST	MUST	MUST	MUST
MUST	MUST	MUST	MUST
MUST	MUST	MUST	MUST
MUST	MUST	MUST	MUST
MUST NOT	MUST NOT	MUST NOT	MUST NOT
MUST	MUST	MUST	MUST
MUST	MUST	MUST	MUST
MUST	MUST	MUST	MUST
MAY	MUST	MUST	MUST
MUST NOT	MUST NOT	MUST NOT	MUST NOT
MAY	MAY	MAY	MAY
MAY	SHOULD	MUST	MUST
MAY	SHOULD	MUST	MUST
MAY	SHOULD	SHOULD	SHOULD
—	SHOULD	SHOULD	SHOULD

IVV

Independent Verification and Validation

9 rules20x · In effect since Jul 4, 2026

Independent Verification and Validation — force of each requirement by service class
Class A	Class BYOUR SCOPE	Class C	Class D
MAY	MUST	MUST	MUST
—	MUST	MUST	MUST
—	MUST	MUST	MUST
—	MUST	MUST	MUST
—	MUST	MUST	MUST
—	SHOULD	SHOULD	SHOULD
—	MAY	MAY	MAY
—	MAY	MAY	MAY
MUST	MUST	MUST	MUST

SDR

Security Decision Record

4 rules20x · In effect since Jul 4, 2026

Security Decision Record — force of each requirement by service class
Class A	Class BYOUR SCOPE	Class C	Class D
—	MUST	MUST	MUST
—	MUST	MUST	MUST
—	MUST	MUST	MUST
MAY	MUST	MUST	MUST

CPO

Certification Package Overview

4 rules20x · In effect since Jul 4, 2026

Certification Package Overview — force of each requirement by service class
Class A	Class BYOUR SCOPE	Class C	Class D
—	MUST	MUST	MUST
—	MUST	MUST	MUST
MAY	MUST	MUST	MUST
SHOULD	MUST	MUST	MUST

List & share

Marketplace listing and sharing certification data

MKT

Marketplace Listing

5 rules20x · In effect since Jul 4, 2026

Marketplace Listing — force of each requirement by service class
Class A	Class BYOUR SCOPE	Class C	Class D
MUST	MUST	MUST	MUST
MUST	MUST	MUST	MUST
MUST	MUST	MUST	MUST
MUST	MUST	MUST	MUST
MUST	MUST	MUST	MUST

CDS

Certification Data Sharing

20 rules20x · In effect since Jul 4, 2026

Certification Data Sharing — force of each requirement by service class
Class A	Class BYOUR SCOPE	Class C	Class D
MUST	MUST	MUST	MUST
—	MUST	MUST	MUST
—	MUST	MUST	MUST
—	MUST	MUST	MUST
SHOULD	MUST	MUST	MUST
MUST	MUST	MUST	MUST
—	MUST	MUST	MUST
—	MUST	MUST	MUST
—	MUST	MUST	MUST
—	MUST	MUST	MUST
MAY	MAY	MAY	MUST
—	MAY	MAY	MAY
—	MUST	MUST	MUST
—	MUST	MUST	MUST
—	MUST	MUST	MUST
—	MUST	MUST	MUST
—	SHOULD	SHOULD	SHOULD
—	SHOULD	SHOULD	SHOULD
MUST	MUST	MUST	MUST
—	SHOULD	SHOULD	SHOULD

Operate & monitor

Continuous monitoring, vulnerabilities, changes, incidents

CCM

Collaborative Continuous Monitoring

17 rules20x · In effect since Jul 4, 2026

Collaborative Continuous Monitoring — force of each requirement by service class
Class A	Class BYOUR SCOPE	Class C	Class D
MUST	MUST	MUST	MUST
MUST	MUST	MUST	MUST
—	MUST	MUST	MUST
—	MUST	MUST	MUST
—	MUST NOT	MUST NOT	MUST NOT
—	SHOULD	SHOULD	SHOULD
—	MAY	MAY	MAY
MAY	SHOULD	MUST	MUST
—	MUST	MUST	MUST
—	MUST	MUST	MUST
—	MUST NOT	MUST NOT	MUST NOT
—	SHOULD	SHOULD	SHOULD
—	SHOULD	SHOULD	SHOULD
—	SHOULD	SHOULD	SHOULD
—	SHOULD NOT	SHOULD NOT	SHOULD NOT
—	MAY	MAY	MAY
—	MAY	MAY	MAY

VDR

Vulnerability Detection and Response

17 rules20x · Obtain by Dec 7, 2026

Vulnerability Detection and Response — force of each requirement by service class
Class A	Class BYOUR SCOPE	Class C	Class D
MUST	MUST	MUST	MUST
—	MUST	MUST	MUST
—	MUST	MUST	MUST
—	SHOULD	SHOULD	SHOULD
—	SHOULD	SHOULD	SHOULD
—	SHOULD	SHOULD	SHOULD
—	SHOULD NOT	SHOULD NOT	SHOULD NOT
—	SHOULD NOT	SHOULD NOT	SHOULD NOT
—	MAY	MAY	MAY
—	MUST	MUST	MUST
SHOULD	SHOULD	SHOULD	SHOULD
SHOULD	SHOULD	SHOULD	SHOULD
SHOULD	SHOULD	SHOULD	SHOULD
—	SHOULD	SHOULD	SHOULD
—	SHOULD	SHOULD	SHOULD
SHOULD	SHOULD	SHOULD	SHOULD
SHOULD	MUST	MUST	—

VER

Vulnerability Evaluation and Reporting

19 rules20x · Obtain by Dec 7, 2026

Vulnerability Evaluation and Reporting — force of each requirement by service class
Class A	Class BYOUR SCOPE	Class C	Class D
—	MUST	MUST	MUST
—	MUST	MUST	MUST
—	MUST	MUST	MUST
—	MUST	MUST	MUST
—	SHOULD	SHOULD	SHOULD
—	SHOULD	SHOULD	SHOULD
—	SHOULD	SHOULD	SHOULD
—	MUST	MUST	MUST
—	MUST	MUST	MUST
—	MUST	MUST	MUST
—	MUST NOT	MUST NOT	MUST NOT
—	SHOULD	SHOULD	SHOULD
—	MAY	MAY	MAY
—	MUST	MUST	MUST
—	MUST	MUST	MUST
MAY	SHOULD	SHOULD	SHOULD
SHOULD	SHOULD	SHOULD	SHOULD
MAY	MAY	SHOULD	SHOULD
MAY	MAY	MAY	SHOULD

SCN

Significant Change Notification

16 rules20x · In effect since Jul 4, 2026

Significant Change Notification — force of each requirement by service class
Class A	Class BYOUR SCOPE	Class C	Class D
—	MUST	MUST	MUST
—	MUST	MUST	MUST
—	MUST	MUST	MUST
—	MUST	MUST	MUST
—	MUST	MUST	MUST
—	MAY	MAY	MAY
—	MAY	MAY	MAY
—	MAY	MAY	MAY
—	MUST	MUST	MUST
—	SHOULD NOT	SHOULD NOT	SHOULD NOT
—	MUST	MUST	MUST
—	MUST	MUST	MUST
—	MUST	MUST	MUST
—	MUST	MUST	MUST
—	MUST	MUST	MUST
—	SHOULD	SHOULD	SHOULD

IEC

Incident Evaluation and Communication

7 rules20x · In effect since Jul 4, 2026

Incident Evaluation and Communication — force of each requirement by service class
Class A	Class BYOUR SCOPE	Class C	Class D
MUST	MUST	MUST	MUST
—	MUST	MUST	MUST
SHOULD	MUST	MUST	MUST
SHOULD	MUST	MUST	MUST
MUST	MUST	MUST	MUST
—	SHOULD	SHOULD	SHOULD
—	SHOULD	SHOULD	SHOULD

AFC

Addressing FedRAMP Communication

8 rules20x · In effect since Jan 5, 2026

Addressing FedRAMP Communication — force of each requirement by service class
Class A	Class BYOUR SCOPE	Class C	Class D
MUST	MUST	MUST	MUST
—	MUST	MUST	MUST
—	MUST	MUST	MUST
MUST	MUST	MUST	MUST
MUST	MUST	MUST	MUST
—	MUST	MUST	MUST
—	SHOULD	SHOULD	SHOULD
—	SHOULD	SHOULD	SHOULD

Lifecycle stages are Boundera's navigational grouping of the official rule families, not FedRAMP doctrine. Force values (MUST / SHOULD / MAY), statements, applicability, and dates are read verbatim from FedRAMP/rules 2026.07.14.01. Dimmed pills show how the same rule behaves at classes outside your selection.

From reading rules to passing them

Turn these 158 requirements into live, evidence-backed status.

Boundera continuously checks your AWS, Azure, and GCP environments against the 2026 rules — what's passing, what's failing, and the exact evidence behind each answer.

See it on your cloud Get rules-change alerts

From reading to passing

Turn these 158 requirements into evidence-backed status.

Automated checks across AWS, Azure, and GCP where your cloud can answer — guided workflows where it can't.

Request a demo

AWS · AZURE · GCP

Deadline radar

Jul 4, 2026Core 20x rulesets take effectIN EFFECT
Dec 7, 2026VDR & VER vulnerability rulesets take effect109 DAYS
Jan 1, 2027Consolidated Rules become mandatory134 DAYS
Jun 11, 2027Rev5 certification path closes295 DAYS

Meet these deadlines with Boundera

Not sure of your class?

Find your class in 5 minutes.

The free FedRAMP 20x gap assessment suggests a service class and shows your biggest gaps.

Start the free assessment

The rules keep changing

Know before your assessor does.

One plain-English email per FedRAMP rules release. Nothing else.

Keep reading