Skip to main content
WhyHow It WorksFeaturesPricingBlog
Sign inRequest demo
ICP-CSO-DPRMUSTAll frameworksImplementation guide coming soon

Default PAIN Rating

Incident Communications Procedures (ICP) · General Provider Responsibilities

Applies to: Providers
Who this applies to
Providers
Service class
All service classes
Force
MUST
Timeframe
No fixed timeframe

Reviewed implementation guidance for ICP-CSO-DPR is not published yet. The official source below remains complete and authoritative.

Official FedRAMP source

Verbatim from FedRAMP/rules

Providers MUST treat FedRAMP Reportable Incidents as if they have a Potential Agency Impact N-rating (PAIN) of 5 UNLESS they promptly estimate the PAIN rating following the rule in ICP-CSO-EFI (Estimate Federal Impact).

Defined terms in this requirement

AgencyFedRAMP Reportable IncidentIncidentPotential Agency ImpactPromptlyProvider

Change history

  • 2026-05-04Initial reset for the Consolidated Rules for 2026 Public Preview.

Content provenance

Official requirement text is sourced from FedRAMP/rules . Boundera implementation guidance has not been fully reviewed for this item.