FedRAMP Consolidated Rules for 2026

Every rule. Your scope. One answer.

Name: FedRAMP Consolidated Rules for 2026 — interactive obligation matrix
Creator: Boundera
License: https://github.com/FedRAMP/rules

The 2026 rules replace familiar FedRAMP vocabulary with 246 requirements across 17 rulesets, four service classes, two certification types, and two paths. This explorer collapses all of it into the only question that matters: what is mandatory, recommended, or optional for you— with the exact rule text, deadlines, and NIST control mappings one click away. Don't know your class yet? The free FedRAMP 20x gap assessment suggests one in about five minutes.

Reading from FedRAMP/rules 2026.07.06.01, published 2026-07-06 — the federal machine-readable source of truth.

Show obligations for Party working toward a Certification type certification on the Certification path path with a Service class offering.

158 of 246 requirements are in this scope.

Showing 158 of 158 in-scope requirements.

Scope & prepare

Draw the boundary and set the technical baseline

MAS

Minimum Assessment Scope

5 rules20x: obtain by Jul 4, 2026

Minimum Assessment Scope — force of each requirement by service class
Class A	Class B	Class C	Class D
—	MUST	MUST	MUST
—	MUST	MUST	MUST
—	MUST	MUST	MUST
—	MUST	MUST	MUST
—	MAY	MAY	MAY

CMU

Cryptographic Module Use

3 rules20x: obtain by Jul 4, 2026

Cryptographic Module Use — force of each requirement by service class
Class A	Class B	Class C	Class D
—	MUST	MUST	MUST
MAY	MAY	SHOULD	MUST
—	SHOULD	SHOULD	SHOULD

SCG

Secure Configuration Guide

9 rules20x: obtain by Mar 1, 2026

Secure Configuration Guide — force of each requirement by service class
Class A	Class B	Class C	Class D
—	MUST	MUST	MUST
—	MUST	MUST	MUST
—	SHOULD	SHOULD	SHOULD
—	SHOULD	SHOULD	SHOULD
—	SHOULD	SHOULD	SHOULD
—	SHOULD	SHOULD	SHOULD
—	SHOULD	SHOULD	SHOULD
—	SHOULD	SHOULD	SHOULD
—	SHOULD	SHOULD	SHOULD

Assess & certify

Independent assessment through certification decision

FRC

FedRAMP Certification

15 rules20x: obtain by Jul 4, 2026

FedRAMP Certification — force of each requirement by service class
Class A	Class B	Class C	Class D
MUST	MUST	MUST	MUST
MUST	MUST	MUST	MUST
MUST	MUST	MUST	MUST
MUST	MUST	MUST	MUST
MUST NOT	MUST NOT	MUST NOT	MUST NOT
MUST	MUST	MUST	MUST
MUST	MUST	MUST	MUST
MUST	MUST	MUST	MUST
MAY	MUST	MUST	MUST
MUST NOT	MUST NOT	MUST NOT	MUST NOT
MAY	MAY	MAY	MAY
MAY	SHOULD	MUST	MUST
MAY	SHOULD	MUST	MUST
MAY	SHOULD	SHOULD	SHOULD
—	SHOULD	SHOULD	SHOULD

IVV

Independent Verification and Validation

9 rules20x: obtain by Jul 4, 2026

Independent Verification and Validation — force of each requirement by service class
Class A	Class B	Class C	Class D
MAY	MUST	MUST	MUST
—	MUST	MUST	MUST
—	MUST	MUST	MUST
—	MUST	MUST	MUST
—	MUST	MUST	MUST
—	SHOULD	SHOULD	SHOULD
—	MAY	MAY	MAY
—	MAY	MAY	MAY
MUST	MUST	MUST	MUST

SDR

Security Decision Record

4 rules20x: obtain by Jul 4, 2026

Security Decision Record — force of each requirement by service class
Class A	Class B	Class C	Class D
—	MUST	MUST	MUST
—	MUST	MUST	MUST
—	MUST	MUST	MUST
MAY	MUST	MUST	MUST

CPO

Certification Package Overview

4 rules20x: obtain by Jul 4, 2026

Certification Package Overview — force of each requirement by service class
Class A	Class B	Class C	Class D
—	MUST	MUST	MUST
—	MUST	MUST	MUST
MAY	MUST	MUST	MUST
SHOULD	MUST	MUST	MUST

List & share

Marketplace listing and sharing certification data

MKT

Marketplace Listing

5 rules20x: obtain by Jul 4, 2026

Marketplace Listing — force of each requirement by service class
Class A	Class B	Class C	Class D
MUST	MUST	MUST	MUST
MUST	MUST	MUST	MUST
MUST	MUST	MUST	MUST
MUST	MUST	MUST	MUST
MUST	MUST	MUST	MUST

CDS

Certification Data Sharing

20 rules20x: obtain by Jul 4, 2026

Certification Data Sharing — force of each requirement by service class
Class A	Class B	Class C	Class D
—	MUST	MUST	MUST
—	MUST	MUST	MUST
—	MUST	MUST	MUST
—	MUST	MUST	MUST
SHOULD	MUST	MUST	MUST
—	MUST	MUST	MUST
—	MUST	MUST	MUST
—	MUST	MUST	MUST
—	MUST	MUST	MUST
—	MUST	MUST	MUST
MAY	MAY	MAY	MUST
—	MAY	MAY	MAY
—	MUST	MUST	MUST
—	MUST	MUST	MUST
—	MUST	MUST	MUST
—	MUST	MUST	MUST
—	SHOULD	SHOULD	SHOULD
—	SHOULD	SHOULD	SHOULD
—	MUST	MUST	MUST
—	SHOULD	SHOULD	SHOULD

Operate & monitor

Continuous monitoring, vulnerabilities, changes, incidents

CCM

Collaborative Continuous Monitoring

17 rules20x: obtain by Jul 4, 2026

Collaborative Continuous Monitoring — force of each requirement by service class
Class A	Class B	Class C	Class D
—	MUST	MUST	MUST
—	MUST	MUST	MUST
—	MUST	MUST	MUST
—	MUST	MUST	MUST
—	MUST NOT	MUST NOT	MUST NOT
—	SHOULD	SHOULD	SHOULD
—	MAY	MAY	MAY
MAY	SHOULD	MUST	MUST
—	MUST	MUST	MUST
—	MUST	MUST	MUST
—	MUST NOT	MUST NOT	MUST NOT
—	SHOULD	SHOULD	SHOULD
—	SHOULD	SHOULD	SHOULD
—	SHOULD	SHOULD	SHOULD
—	SHOULD NOT	SHOULD NOT	SHOULD NOT
—	MAY	MAY	MAY
—	MAY	MAY	MAY

VDR

Vulnerability Detection and Response

17 rules20x: obtain by Dec 7, 2026

Vulnerability Detection and Response — force of each requirement by service class
Class A	Class B	Class C	Class D
—	MUST	MUST	MUST
—	MUST	MUST	MUST
—	MUST	MUST	MUST
—	SHOULD	SHOULD	SHOULD
—	SHOULD	SHOULD	SHOULD
—	SHOULD	SHOULD	SHOULD
—	SHOULD NOT	SHOULD NOT	SHOULD NOT
—	SHOULD NOT	SHOULD NOT	SHOULD NOT
—	MAY	MAY	MAY
—	MUST	MUST	MUST
SHOULD	SHOULD	SHOULD	SHOULD
SHOULD	SHOULD	SHOULD	SHOULD
SHOULD	SHOULD	SHOULD	SHOULD
—	SHOULD	SHOULD	SHOULD
—	SHOULD	SHOULD	SHOULD
SHOULD	SHOULD	SHOULD	SHOULD
SHOULD	MUST	MUST	—

VER

Vulnerability Evaluation and Reporting

19 rules20x: obtain by Dec 7, 2026

Vulnerability Evaluation and Reporting — force of each requirement by service class
Class A	Class B	Class C	Class D
—	MUST	MUST	MUST
—	MUST	MUST	MUST
—	MUST	MUST	MUST
—	MUST	MUST	MUST
—	SHOULD	SHOULD	SHOULD
—	SHOULD	SHOULD	SHOULD
—	SHOULD	SHOULD	SHOULD
—	MUST	MUST	MUST
—	MUST	MUST	MUST
—	MUST	MUST	MUST
—	MUST NOT	MUST NOT	MUST NOT
—	SHOULD	SHOULD	SHOULD
—	MAY	MAY	MAY
—	MUST	MUST	MUST
—	MUST	MUST	MUST
MAY	SHOULD	SHOULD	SHOULD
SHOULD	SHOULD	SHOULD	SHOULD
MAY	MAY	SHOULD	SHOULD
MAY	MAY	MAY	SHOULD

SCN

Significant Change Notification

16 rules20x: obtain by Jul 4, 2026

Significant Change Notification — force of each requirement by service class
Class A	Class B	Class C	Class D
—	MUST	MUST	MUST
—	MUST	MUST	MUST
—	MUST	MUST	MUST
—	MUST	MUST	MUST
—	MUST	MUST	MUST
—	MAY	MAY	MAY
—	MAY	MAY	MAY
—	MAY	MAY	MAY
—	MUST	MUST	MUST
—	SHOULD NOT	SHOULD NOT	SHOULD NOT
—	MUST	MUST	MUST
—	MUST	MUST	MUST
—	MUST	MUST	MUST
—	MUST	MUST	MUST
—	MUST	MUST	MUST
—	SHOULD	SHOULD	SHOULD

IEC

Incident Evaluation and Communication

7 rules20x: obtain by Jul 4, 2026

Incident Evaluation and Communication — force of each requirement by service class
Class A	Class B	Class C	Class D
—	MUST	MUST	MUST
—	MUST	MUST	MUST
SHOULD	MUST	MUST	MUST
SHOULD	MUST	MUST	MUST
MUST	MUST	MUST	MUST
—	SHOULD	SHOULD	SHOULD
—	SHOULD	SHOULD	SHOULD

AFC

Addressing FedRAMP Communication

8 rules20x: obtain by Jan 5, 2026

Addressing FedRAMP Communication — force of each requirement by service class
Class A	Class B	Class C	Class D
—	MUST	MUST	MUST
—	MUST	MUST	MUST
—	MUST	MUST	MUST
—	MUST	MUST	MUST
—	MUST	MUST	MUST
—	MUST	MUST	MUST
—	SHOULD	SHOULD	SHOULD
—	SHOULD	SHOULD	SHOULD

Lifecycle stages are Boundera's navigational grouping of the official rule families, not FedRAMP doctrine. Force values (MUST / SHOULD / MAY), statements, applicability, and dates are read verbatim from FedRAMP/rules 2026.07.06.01. Dimmed pills show how the same rule behaves at classes outside your selection.

From reading rules to passing them

Turn these 158 requirements into live, evidence-backed status.

Boundera continuously checks your AWS, Azure, and GCP environments against the 2026 rules — what's passing, what's failing, and the exact evidence behind each answer.

See it on your cloud

The rules keep changing

Know before your assessor does.

Recent FedRAMP releases renamed six rule families and rewrote nearly every Key Security Indicator. Get a plain-English alert when the canonical rules change — nothing else.