FedRAMP 20x for cloud service providers

Know what is required. Build it. Prove it.

Search every KSI and the 168 rules addressed to providers. See the requirement, implementation guidance, and evidence context without sorting through obligations owned by agencies, assessors, or FedRAMP. Not sure where you stand? Take the free FedRAMP 20x gap assessment to find your certification class and KSI readiness first.

Understand the 46 KSIs Browse CSP rules Find implementation guidance Find automated checks

Based on FedRAMP/rules 2026.07.06.01, updated 2026-07-06

CSP implementation explorer

Showing 168 of 284 CSP resources

CSP implementation explorer

Acknowledge Receipt

Complete Required Actions

Emergency Message Routing

Important Message Actions

Maintain a FedRAMP Security Inbox

Notification of Changes

Receive Email Without Disruption

Trust @fedramp.gov and @gsa.gov

Anonymized Feedback Summary

Report Availability

Feedback Mechanism

Limit Sensitive Information

Next Report Date

Responsible Public Certification Report Sharing

Spread Out Reports

Additional Content

Quarterly Review Meeting

No Irresponsible Disclosure

Next Review Date

Meeting Registration Info

Restrict Third Parties

Record/Transcribe Reviews

Schedule Around Reports

Share Content Responsibly

Share Recordings Responsibly

Availability Reporting

Consistency Between Formats

Always Include FedRAMP ID

FedRAMP Certification Reports

Historical FedRAMP Certification Data

Include Relevant Policies

Per-Service Certification Materials

Public Information

Responsible Information Sharing

Responsible Public Package Sharing

Public Service List

Use Trust Centers

Agency Access Inventory

Access Logging

Human and Machine-Readable Certification Data

Programmatic Access

Self-Service Access Management

Uninterrupted Sharing

Agency Access Denial

Agency Access

Configuration of Agency Tenants

Cryptographic Module Documentation

Using Validated Cryptographic Modules

Certification Package Overview Metadata

Overall Summary of Assessment in Certification Package

Overview of the Cloud Service Offering

Certification Package Maintenance for 20x

Applying for FedRAMP Certification

Fresh FedRAMP Certification Package

Fresh Independent Assessment

Marketplace Listing First

No Third-Party Applicants

Updating Stale Assessments

Agency Authorization to Operate

Downgrading Certification Class

Downgrade Notification Period

Upgrading Certification Class

Approved Alternative Security Frameworks

External Assessment Materials

Optional Independent Verification and Validation

Mandatory FedRAMP Rules for Class A

Address Optional FedRAMP Rules for Class A

Recommended FedRAMP Rules for Class A

FedRAMP Certification Profile

FedRAMP JSON Schemas

Maintain Responsibility and Accountability

FedRAMP Certification Package

Pick One Program Certification Type

Application within MAS

Metrics Over Time for Key Security Indicators

Automated Verification and Validation of Key Security Indicators

Automated Verification and Validation of FedRAMP Rules

Automated Incident Reporting

Default PAIN Rating