Skip to main content
Pricing
Sign inRequest demo
FRC-CSO-POPMUST NOTAll frameworksImplementation guide coming soon

Pick One Program Certification Type

FedRAMP Certification (FRC) · General Provider Responsibilities

Applies to: Providers
Who this applies to
Providers
Service class
All service classes
Force
MUST NOT
Timeframe
No fixed timeframe

Reviewed implementation guidance for FRC-CSO-POP is not published yet. The official source below remains complete and authoritative.

Official FedRAMP source

Verbatim from FedRAMP/rules

Providers MUST NOT seek both FedRAMP Rev5 Program Certification and FedRAMP 20x Program Certification for the same cloud service offering; pick one type.

Defined terms in this requirement

AgencyCloud Service OfferingProvider

Operationalize this rule

Boundera turns FedRAMP 20x requirements like FRC-CSO-POP into assigned evidence, remediation work, and validation workflows.

Request demo

Notes

  • This rule does not prevent a provider from seeking and maintaining a FedRAMP Rev5 Agency Certification and a FedRAMP 20x Program Certification for the same cloud service offering, however, doing so is strongly discouraged due to the increased complexity and risk of confusion for all parties.

Change history

  • 2026-06-24Official launch of the FedRAMP Consolidated Rules for 2026.

Content provenance

Official requirement text is sourced from FedRAMP/rules . Boundera implementation guidance has not been fully reviewed for this item.