Skip to main content
Pricing
Sign inRequest demo
CDS-CSO-SVCMUSTAll frameworksImplementation guide coming soon

Public Service List

Certification Data Sharing (CDS) · General Provider Responsibilities

Applies to: Providers
Who this applies to
Providers
Service class
All service classes
Force
MUST
Timeframe
No fixed timeframe
See this rule in your scope

Reviewed implementation guidance for CDS-CSO-SVC is not published yet. The official source below remains complete and authoritative.

Expected evidence artifacts

  • URL to the human-readable data.
  • URL to the machine-readable data (if applicable).

Official FedRAMP source

Verbatim from FedRAMP/rules

Providers MUST publicly share a detailed list of specific services and their security categories that are included in the cloud service offering using clear feature or service names that align with standard public marketing materials; this list MUST be complete enough for a potential customer to determine which services are and are not included in the FedRAMP Minimum Assessment Scope without requesting access to underlying FedRAMP Certification Data.

Defined terms in this requirement

Certification DataCloud Service OfferingProviderSecurity Category

Operationalize this rule

Boundera turns FedRAMP 20x requirements like CDS-CSO-SVC into assigned evidence, remediation work, and validation workflows.

See it on your cloud

Change history

  • 2026-06-24Official launch of the FedRAMP Consolidated Rules for 2026.

Content provenance

Official requirement text is sourced from FedRAMP/rules . Boundera implementation guidance has not been fully reviewed for this item.