Skip to content

Repository navigation

Commit bb56153

Browse files
pete-govpete-gov
authored
September 13 updates (#28)
* Rule fixes. * Updating instructions.
1 parent 58efbf3 commit bb56153

7 files changed

Lines changed: 644 additions & 487 deletions

File tree

‎AGENTS.md‎

Lines changed: 133 additions & 285 deletions
Large diffs are not rendered by default.

‎README.md‎

Lines changed: 42 additions & 22 deletions
Original file line numberDiff line numberDiff line change
@@ -1,36 +1,56 @@
11
# FedRAMP Consolidated Rules
22

33
This repository contains the machine-readable FedRAMP Consolidated Rules for
4-
the 2026.
4+
2026. Use it to read, analyze, and integrate structured definitions, process
5+
rules, and security indicators.
56

6-
The source of truth is:
7+
## Repository Contents
78

8-
- [fedramp-consolidated-rules.json](fedramp-consolidated-rules.json)
9+
- [fedramp-consolidated-rules.json](fedramp-consolidated-rules.json) is the
10+
canonical rules dataset. It contains dataset metadata (`info`), FedRAMP
11+
Definitions (`FRD`), FedRAMP Rules (`FRR`), Key Security Indicators (`KSI`),
12+
and control guidance and parameters (`CTL`, an optional schema section).
913
- [schemas/fedramp-consolidated-rules.schema.json](schemas/fedramp-consolidated-rules.schema.json)
14+
defines the dataset's expected structure, required fields, and allowed values.
1015

11-
Everything else in this repository supports those two files.
16+
The JSON defines the rule content; the schema defines its machine-readable
17+
shape. Other files in this repository provide supporting documentation and
18+
maintenance infrastructure.
1219

13-
## What Is Here
20+
## Using The Information
1421

15-
- [fedramp-consolidated-rules.json](fedramp-consolidated-rules.json)
16-
The canonical rules dataset.
17-
- [schemas/fedramp-consolidated-rules.schema.json](schemas/fedramp-consolidated-rules.schema.json)
18-
The schema for the dataset.
19-
- [AGENTS.md](AGENTS.md)
20-
Guidance for AI agents analyzing the dataset.
21-
- [tools](tools)
22-
Validation, normalization, tests, and export tooling.
22+
Start with the dataset and schema for structured analysis. Definitions explain
23+
terms used in the rules. Process rules describe requirements and recommendations;
24+
security indicators describe capabilities and evidence expectations. Account for
25+
framework applicability, service class, document status, and effective dates
26+
when interpreting the information.
27+
28+
**AI agents:** Read [AGENTS.md](AGENTS.md) before ingesting or analyzing the
29+
information. For maintenance tasks, also read
30+
[tools/AGENTS-TOOLS.md](tools/AGENTS-TOOLS.md).
31+
32+
## Related Resources
2333

24-
## Working With The Repository
34+
- [FedRAMP/2026](https://github.com/fedramp/2026) contains the narrative content
35+
and website project that accompanies the structured rules.
36+
- [FedRAMP/2026-markdown](https://github.com/fedramp/2026-markdown) provides
37+
generated Markdown combining the structured rules and narrative content for
38+
direct reading and AI ingestion. Its `_sources.json` records source commits.
39+
- [FedRAMP community discussions](https://github.com/FedRAMP/community/discussions/)
40+
and [FedRAMP 2026 discussions](https://github.com/FedRAMP/2026/discussions/)
41+
provide additional discussion and context.
42+
- [FedRAMP Help](https://help.fedramp.gov) provides help articles and support.
2543

26-
Use the JSON file and schema for analysis.
44+
Related resources can reflect different revisions. Check their source versions
45+
and dates when comparing them with this dataset.
2746

28-
From [tools](tools), the primary maintenance commands are:
47+
## Maintenance
2948

30-
```bash
31-
bun run check
32-
bun run fix
33-
```
49+
The [tools/](tools/) directory is internal maintenance infrastructure for
50+
FedRAMP developers. Most users and agents analyzing the information should
51+
ignore it; installing or running these tools is not required to consume the
52+
dataset.
3453

35-
See [tools/README.md](tools/README.md) for the tooling workflow and
36-
[AGENTS.md](AGENTS.md) for agent-focused analysis guidance.
54+
FedRAMP developers can use [tools/README.md](tools/README.md) for setup,
55+
validation, normalization, tests, exports, and Git hooks. Maintenance agents
56+
must also follow [tools/AGENTS-TOOLS.md](tools/AGENTS-TOOLS.md).

‎fedramp-consolidated-rules.json‎

Lines changed: 37 additions & 12 deletions
Original file line numberDiff line numberDiff line change
@@ -2,8 +2,8 @@
22
"info": {
33
"title": "FedRAMP Consolidated Rules for 2026",
44
"description": "This datafile contains the Consolidated Rules for FedRAMP in structured machine-readable text. It includes definitions, requirements, recommendations, and key security indicators.",
5-
"version": "2026.07.14.01",
6-
"last_updated": "2026-07-14",
5+
"version": "2026.09.13.01",
6+
"last_updated": "2026-09-13",
77
"default_artifacts": {
88
"FRR": [
99
"Explanation of how the rule is followed, or an explanation of the reason and resulting risk to customers for not following the rule.",
@@ -1654,11 +1654,15 @@
16541654
"name": "Agency Liaison Program",
16551655
"statement": "Agencies SHOULD assign at least 1 federal employee to be an active participant in the FedRAMP Agency Liaison program.",
16561656
"reference": "Agency Liaison Program",
1657-
"reference_url": "https://www.fedramp.gov/preview/2026/agencies/support/liaisons",
1657+
"reference_url": "https://www.fedramp.gov/2026/agencies/support/liaisons",
16581658
"force": "SHOULD",
16591659
"affects": ["Agencies"],
16601660
"terms": ["Agency"],
16611661
"updated": [
1662+
{
1663+
"date": "2026-09-13",
1664+
"comment": "Fixed broken reference URL for the Agency Liaison Program."
1665+
},
16621666
{
16631667
"date": "2026-06-24",
16641668
"comment": "Official launch of the FedRAMP Consolidated Rules for 2026."
@@ -1686,7 +1690,7 @@
16861690
"statement": "Agencies MUST complete the Authorization to Operate process for federal information systems that use FedRAMP Certified cloud service offerings.",
16871691
"note": "FedRAMP provides technical assistance to help agencies navigate this process.",
16881692
"reference": "Using a FedRAMP Certified Cloud Service Offering",
1689-
"reference_url": "https://fedramp.gov/preview/2026/agencies/use",
1693+
"reference_url": "https://www.fedramp.gov/2026/agencies/use",
16901694
"force": "MUST",
16911695
"affects": ["Agencies"],
16921696
"terms": [
@@ -2014,7 +2018,7 @@
20142018
"OCR": {
20152019
"CCM-OCR-AVL": {
20162020
"name": "Report Availability",
2017-
"statement": "Providers MUST supply an Ongoing Certification Report to all necessary parties every 3 months, covering the entire period since the previous summary, in a consistent format that is human readable; this report MUST include high-level summaries of at least the following information:",
2021+
"statement": "Providers MUST supply an Ongoing Certification Report to all necessary parties every 3 months, covering the entire period since the previous summary, in a consistent format that is human readable; this report MUST include high-level summaries of at least the following information (if applicable):",
20182022
"following_information": [
20192023
"Changes to FedRAMP Certification Data",
20202024
"Planned changes to FedRAMP Certification Data during at least the next 3 months",
@@ -2037,6 +2041,8 @@
20372041
"name": "FedRAMP Ongoing Certification Report (CCM-OCR-AVL)",
20382042
"url": "https://fedramp.gov/schemas/fedramp-ongoing-certification-report-schema-2026-06-24.json"
20392043
},
2044+
"timeframe_type": "months",
2045+
"timeframe_num": 3,
20402046
"terms": [
20412047
"Accepted Vulnerability",
20422048
"Agency",
@@ -2053,6 +2059,10 @@
20532059
"Vulnerability"
20542060
],
20552061
"updated": [
2062+
{
2063+
"date": "2026-09-13",
2064+
"comment": "Added (if applicable) to clarify that some of these items are not always required depending on the FedRAMP Certification Type or Class."
2065+
},
20562066
{
20572067
"date": "2026-06-24",
20582068
"comment": "Official launch of the FedRAMP Consolidated Rules for 2026."
@@ -2305,6 +2315,9 @@
23052315
"statement": "Providers SHOULD regularly schedule Quarterly Reviews to occur at least 3 business days after releasing an Ongoing Certification Report AND within 10 business days of such release.",
23062316
"force": "SHOULD",
23072317
"affects": ["Providers"],
2318+
"timeframe_type": "bizdays",
2319+
"timeframe_num_min": 3,
2320+
"timeframe_num_max": 10,
23082321
"terms": [
23092322
"FedRAMP Certification Report",
23102323
"Ongoing Certification",
@@ -3260,7 +3273,7 @@
32603273
"maintain": "2027-07-01",
32613274
"optional_adoption": "2026-07-04",
32623275
"grace": {
3263-
"default": "2027-01-01",
3276+
"default": "2027-07-01",
32643277
"until_next_assessment": true
32653278
}
32663279
}
@@ -3272,7 +3285,7 @@
32723285
"applicability": {
32733286
"types": ["Rev5"],
32743287
"paths": ["Program", "Agency"],
3275-
"classes": ["A", "B", "C", "D"],
3288+
"classes": ["B", "C", "D"],
32763289
"affects": ["Providers"]
32773290
}
32783291
}
@@ -3543,7 +3556,7 @@
35433556
"applicability": {
35443557
"types": ["Rev5"],
35453558
"paths": ["Agency"],
3546-
"classes": ["A", "B", "C", "D"],
3559+
"classes": ["B", "C", "D"],
35473560
"affects": ["Providers"]
35483561
}
35493562
}
@@ -5828,7 +5841,7 @@
58285841
"name": "Ongoing Incident Reports",
58295842
"varies_by_class": {
58305843
"a": {
5831-
"statement": "Providers with Class A Certifications SHOULD responsibly notify all affected parties of ongoing activity as new information becomes available during incident response for FedRAMP Reportable Incidents, including updates (or lack of updates) to all previously reported information and as much of the the following additional information that is available and/or the current relevant status for each item:",
5844+
"statement": "Providers with Class A Certifications SHOULD responsibly notify all affected parties of ongoing activity as new information becomes available during incident response for FedRAMP Reportable Incidents, including updates (or lack of updates) to all previously reported information and as much of the following additional information that is available and/or the current relevant status for each item:",
58325845
"following_information": [
58335846
"Observed incident activity",
58345847
"Indicators of compromise",
@@ -5881,7 +5894,7 @@
58815894
}
58825895
},
58835896
"b": {
5884-
"statement": "Providers with Class B Certifications MUST responsibly notify all affected parties of ongoing activity as new information becomes available during incident response for FedRAMP Reportable Incidents, including updates (or lack of updates) to all previously reported information and as much of the the following additional information that is available and/or the current relevant status for each item:",
5897+
"statement": "Providers with Class B Certifications MUST responsibly notify all affected parties of ongoing activity as new information becomes available during incident response for FedRAMP Reportable Incidents, including updates (or lack of updates) to all previously reported information and as much of the following additional information that is available and/or the current relevant status for each item:",
58855898
"following_information": [
58865899
"Observed incident activity",
58875900
"Indicators of compromise",
@@ -5934,7 +5947,7 @@
59345947
}
59355948
},
59365949
"c": {
5937-
"statement": "Providers with Class C Certifications MUST responsibly notify all affected parties of ongoing activity as new information becomes available during incident response for FedRAMP Reportable Incidents, including updates (or lack of updates) to all previously reported information and as much of the the following additional information that is available and/or the current relevant status for each item:",
5950+
"statement": "Providers with Class C Certifications MUST responsibly notify all affected parties of ongoing activity as new information becomes available during incident response for FedRAMP Reportable Incidents, including updates (or lack of updates) to all previously reported information and as much of the following additional information that is available and/or the current relevant status for each item:",
59385951
"following_information": [
59395952
"Observed incident activity",
59405953
"Indicators of compromise",
@@ -5987,7 +6000,7 @@
59876000
}
59886001
},
59896002
"d": {
5990-
"statement": "Providers with Class D Certifications MUST responsibly notify all affected parties of ongoing activity as new information becomes available during incident response for FedRAMP Reportable Incidents, including updates (or lack of updates) to all previously reported information and as much of the the following additional information that is available and/or the current relevant status for each item:",
6003+
"statement": "Providers with Class D Certifications MUST responsibly notify all affected parties of ongoing activity as new information becomes available during incident response for FedRAMP Reportable Incidents, including updates (or lack of updates) to all previously reported information and as much of the following additional information that is available and/or the current relevant status for each item:",
59916004
"following_information": [
59926005
"Observed incident activity",
59936006
"Indicators of compromise",
@@ -6074,6 +6087,10 @@
60746087
"Vulnerability Response"
60756088
],
60766089
"updated": [
6090+
{
6091+
"date": "2026-09-13",
6092+
"comment": "Removed the extra the in all statements."
6093+
},
60776094
{
60786095
"date": "2026-06-24",
60796096
"comment": "Official launch of the FedRAMP Consolidated Rules for 2026."
@@ -7101,6 +7118,8 @@
71017118
"related": ["IVV-CSF-PCA"],
71027119
"force": "MUST",
71037120
"affects": ["Providers"],
7121+
"timeframe_type": "years",
7122+
"timeframe_num": 3,
71047123
"terms": ["FedRAMP Independent Assessment", "Provider"],
71057124
"updated": [
71067125
{
@@ -7604,6 +7623,8 @@
76047623
],
76057624
"force": "MUST",
76067625
"affects": ["Advisors"],
7626+
"timeframe_type": "bizdays",
7627+
"timeframe_num": 5,
76077628
"terms": ["Advisor"],
76087629
"updated": [
76097630
{
@@ -7664,6 +7685,8 @@
76647685
],
76657686
"force": "MUST",
76667687
"affects": ["Providers"],
7688+
"timeframe_type": "years",
7689+
"timeframe_num": 2,
76677690
"terms": ["Certification Class", "Provider"],
76687691
"updated": [
76697692
{
@@ -9383,6 +9406,8 @@
93839406
"statement": "Providers MUST verify and validate the status of non-machine-based information resources at least once every 3 months.",
93849407
"force": "MUST",
93859408
"affects": ["Providers"],
9409+
"timeframe_type": "months",
9410+
"timeframe_num": 3,
93869411
"terms": [
93879412
"Information Resource",
93889413
"Machine-Based (Information Resources)",

‎schemas/fedramp-consolidated-rules.schema.json‎

Lines changed: 22 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -607,6 +607,8 @@
607607
},
608608
"timeframe_type": { "$ref": "#/$defs/timeframe_type" },
609609
"timeframe_num": { "$ref": "#/$defs/positive_number" },
610+
"timeframe_num_min": { "$ref": "#/$defs/positive_number" },
611+
"timeframe_num_max": { "$ref": "#/$defs/positive_number" },
610612
"notification": {
611613
"type": "array",
612614
"items": {
@@ -631,8 +633,26 @@
631633
"updated": { "$ref": "#/$defs/updated_list" }
632634
},
633635
"dependentRequired": {
634-
"timeframe_type": ["timeframe_num"],
635-
"timeframe_num": ["timeframe_type"]
636+
"timeframe_num": ["timeframe_type"],
637+
"timeframe_num_min": ["timeframe_type", "timeframe_num_max"],
638+
"timeframe_num_max": ["timeframe_type", "timeframe_num_min"]
639+
},
640+
"dependentSchemas": {
641+
"timeframe_type": {
642+
"oneOf": [
643+
{
644+
"properties": { "timeframe_num": {} },
645+
"required": ["timeframe_num"]
646+
},
647+
{
648+
"properties": {
649+
"timeframe_num_min": {},
650+
"timeframe_num_max": {}
651+
},
652+
"required": ["timeframe_num_min", "timeframe_num_max"]
653+
}
654+
]
655+
}
636656
},
637657
"additionalProperties": false
638658
},

0 commit comments

Comments
 (0)