2026/reference/minimum-assessment-scope/

[giscus[bot]]

2026/reference/minimum-assessment-scope/

This site contains FedRAMP's Consolidated Rules for 2026.

https://www.fedramp.gov/2026/reference/minimum-assessment-scope/

[cprestegard]

Does MAS-CSO-FLO limit its flows to those that that handle or impact the confidentiality, integrity, or availability of federal customer data? Or would flows between a providers other information resources or third party services and the cloud offering that were deemed to not handle or impact federal customer data need to be documented and explained here.

[cprestegard]

To further clarify, if information resources are evaluated and considered to not meet the minimum assessment scope, is any documentation required around describing out of scope information resources? For MAS-CSO-FLO would the connections and flows from the in scope information resources to these out of scope services be omitted?

[pete-gov]

Sorry we missed the original question - you only need to document information flows between information resources that are in the MAS. If something in the MAS is sending information to an information resource where MAS-CSO-IIR (Identify Information Resources) doesn't apply, then it's not necessary to document it because it's unlikely to affect CIA of customer data. Say you're collecting a tiny bit of browser analytics from users inside your MAS and shipping it somewhere else - that information flow probably wouldn't need to be included because it's unlikely to handle or affect CIA of customer data.

The purpose of the MAS is to reduce the things that are inside the scope of assurance to things that actually need to be inside the scope of assurance. MAS-CSO-SUP allows you to document related resources if you want to because you think it would be useful or interesting for customers to know though, just has to be filterable so folks know they aren't handling or affecting CIA of customer data.

[cbiggsrun]

What about Corporate systems that a CSP uses, such as centralized billing systems, entitlement / subscription services, CRM services, etc.? In the old boundary guidance, it said that Corporate systems were considered external systems but they don't impact the CIA of the federal CSO so were not in scope for FedRAMP. Could you add a section on this page or the MAS ruleset clarifying whether any of those systems / services would ever be in scope?

[pete-gov]

We do not provide system specific guidance because it varies from architecture to architecture. The test is very simple - is it likely to handle or affect the confidentiality, integrity, or availability of federal customer data?

The answer to that question for something like a CRM service may vary wildly. Is it just basic customer support? Probably not in the MAS. Can a federal customer use the CRM to automatically provision supervisor-level accounts on the service? Definitely in the MAS. etc.

What is in the MAS is a case-by-case determination by the cloud service provider.