Skip to main content
WhyHow It WorksFeaturesPricingBlog
Sign inRequest demo
FSI-CSO-INBMUSTAll frameworksImplementation guide coming soon

Maintain a FedRAMP Security Inbox

FedRAMP Security Inbox (FSI) · General Provider Responsibilities

Applies to: Providers
Who this applies to
Providers
Service class
All service classes
Force
MUST
Timeframe
No fixed timeframe

Reviewed implementation guidance for FSI-CSO-INB is not published yet. The official source below remains complete and authoritative.

Official FedRAMP source

Verbatim from FedRAMP/rules

Providers MUST establish and maintain an email address to receive messages from FedRAMP; this inbox is a FedRAMP Security Inbox (FSI).

Be careful using a personal email tied to an individual for this inbox due to the significant risk to future communications after a change in personnel!

Defined terms in this requirement

FedRAMP Security InboxProvider

Notes

  • Unless otherwise notified, FedRAMP will use the listed Security Email on the Marketplace for these notifications.
  • If a provider establishes a new inbox in reaction to this guidance that is different from the Security Email then they must follow the FSI-CSO-NOC (Notification of Changes) rules to notify FedRAMP.

Change history

  • 2026-05-04Initial reset for the Consolidated Rules for 2026 Public Preview.

Content provenance

Official requirement text is sourced from FedRAMP/rules . Boundera implementation guidance has not been fully reviewed for this item.