Skip to main content
WhyHow It WorksFeaturesPricingBlog
Sign inRequest demo
ICP-CSO-EFISHOULDAll frameworksImplementation guide coming soon

Estimate Federal Impact

Incident Communications Procedures (ICP) · General Provider Responsibilities

Applies to: Providers
Who this applies to
Providers
Service class
All service classes
Force
SHOULD
Timeframe
No fixed timeframe

Reviewed implementation guidance for ICP-CSO-EFI is not published yet. The official source below remains complete and authoritative.

Information required

  • N1 for a likely minimal customer effect on 1 or more agencies.
  • N2 for a likely narrow customer effect on 1 or more agencies.
  • N3 for a likely disruptive customer effect on 1 agency.
  • N4 for a likely debilitating customer effect on 1 agency or a likely disruptive customer effect on more than 1 agency.
  • N5 for a likely debilitating customer effect on more than 1 agency.

Official FedRAMP source

Verbatim from FedRAMP/rules

Providers SHOULD promptly estimate the likely adverse impact of an incident on agency customers to assign a Potential Agency Impact N-rating; this step is called Incident Rating.

Defined terms in this requirement

AgencyDebilitating Customer EffectDisruptive Customer EffectIncidentLikelyMinimal Customer EffectNarrow Customer EffectPotential Agency ImpactPromptlyProvider

Notes

  • All incidents must be assigned a default PAIN-5 as required by ICP-CSO-DPR (Default PAIN Rating) if this step is not completed.

Change history

  • 2026-05-04Initial reset for the Consolidated Rules for 2026 Public Preview.

Content provenance

Official requirement text is sourced from FedRAMP/rules . Boundera implementation guidance has not been fully reviewed for this item.