October 8 fixes

[pete-gov]

This pull request updates the FedRAMP Consolidated Rules JSON file with several clarifications and policy adjustments, primarily relating to the handling and reporting of historical metrics for Key Security Indicators. The most significant change is the adjustment of requirements for Class B certifications, making the inclusion of historical metrics a "SHOULD" rather than a "MUST," and clarifying expectations around persistent validation and initial certification. Additionally, a redundant rule was removed, and a typo was fixed in the definitions section.

Policy and requirements updates:

• Changed the requirement for providers with 20x Class B Certifications to include historical metrics in their Security Decision Record from "MUST" to "SHOULD," and clarified that persistent validation status should be included for Class C. Added a note about expectations for initial certification and updated the relevant terms. [1] [2]

Structural and content clarifications:

• Removed the redundant FRC-CSX-MOT rule regarding "Metrics Over Time for Key Security Indicators," as its requirements are now reflected in the updated rules for the Security Decision Record.

Definitions and metadata corrections:

• Fixed a typo in the definition of "SHOULD NOT" (changed "understand" to "understood") and documented the correction.
• Updated the file version and last updated date in the metadata to reflect these changes.