Skip to main content
WhyHow It WorksFeaturesPricingBlog
Sign inRequest demo
CDS-CSO-HADMUSTAll frameworksImplementation guide coming soon

Historical FedRAMP Certification Data

Certification Data Sharing (CDS) · General Provider Responsibilities

Applies to: Providers
Who this applies to
Providers
Service class
All service classes
Force
MUST
Timeframe
No fixed timeframe

Reviewed implementation guidance for CDS-CSO-HAD is not published yet. The official source below remains complete and authoritative.

Expected evidence artifacts

  • Explanation of how to access this information.

Official FedRAMP source

Verbatim from FedRAMP/rules

Providers MUST make historical versions of FedRAMP Certification Data available for three years to all necessary parties UNLESS otherwise specified by applicable FedRAMP rules; deltas between versions MAY be consolidated quarterly.

Defined terms in this requirement

All Necessary PartiesCertification DataProviderQuarterly Review

Notes

  • Consolidating changes quarterly means that the historical status at the end of each quarter or at the time of the Ongoing Authorization Report or Quarterly Review is sufficient, instead of maintaining separate versions with every single change that took place throughout the quarter.

Change history

  • 2026-05-04Initial reset for the Consolidated Rules for 2026 Public Preview.

Content provenance

Official requirement text is sourced from FedRAMP/rules . Boundera implementation guidance has not been fully reviewed for this item.