FedRAMP 20x Class C Rules (FRR) 2026

fedramp_20x_frr_class_c_2026.09.13.02

FedRAMP-20x-FRR-Class-Cv2026.09.13.02

OfficialVerified

FedRAMP Rules (FRR) that cloud service providers must follow for a FedRAMP 20x Class C Certification, from the FedRAMP Consolidated Rules for 2026 (release 2026.09.13.02, https://github.com/FedRAMP/rules). Covers the 158 provider rules of the 15 rulesets on the 20x Class C reference page; rules that only bind FedRAMP, agencies, assessors or advisors are excluded, and class-varying rules use their Class C statement. Most rules are program and process obligations that need manual evidence. The Key Security Indicators of the same ruleset are in the fedramp_20x_ksi_2026 framework.

17requirements16checks

Prowler prowler-compliance-fedramp-20x-frr-class-c

Run this compliance with Prowler

Run in Prowler Cloud

Run

prowler aws --compliance fedramp_20x_frr_class_c_2026.09.13.02

Requirements (17)

CMU-CSO-UVMProviders with Class C Certifications SHOULD use cryptographic modules or update streams of cryptographic modules with active validations under the NIST Cryptographic Module Validation Program when using cryptographic services to protect federal customer data.2

Attributes

Force: SHOULD
Subset: CSO: Cloud Service Provider Responsibilities
Ruleset: CMU: Cryptographic Module Use

MAS-CSO-IIRProviders MUST identify a set of information resources to assess for FedRAMP Certification that includes all information resources that are likely to handle federal customer data or likely to impact the confidentiality, integrity, or availability of federal customer data handled by the cloud service offering; this set of information resources is the cloud service offering.2

Attributes

Force: MUST
Subset: CSO: General Provider Responsibilities
Ruleset: MAS: Minimum Assessment Scope

VDR-CSO-DETProviders MUST systematically, persistently, and promptly discover and identify vulnerabilities within their cloud service offering using appropriate techniques such as assessment, scanning, threat intelligence, vulnerability disclosure mechanisms, bug bounties, penetration testing, incident response, automated control testing, supply chain monitoring, and other relevant capabilities; this process is called vulnerability detection. Vulnerability detection includes persistently verifying and validating that information resources and processes are operating as intended and documented for FedRAMP Practices.4

Attributes

Force: MUST
Subset: CSO: General Provider Responsibilities
Ruleset: VDR: Vulnerability Detection and Response

VDR-CSO-RESProviders MUST systematically, persistently, and promptly track, evaluate, monitor, mitigate, remediate, assess exploitation of, report, and otherwise manage all detected vulnerabilities within their cloud service offering; this process is called vulnerability response.2

Attributes

Force: MUST
Subset: CSO: General Provider Responsibilities
Ruleset: VDR: Vulnerability Detection and Response

VDR-CSO-FAVProviders MUST treat problems or failures with their vulnerability detection and response processes as vulnerabilities.1

Attributes

Force: MUST
Subset: CSO: General Provider Responsibilities
Ruleset: VDR: Vulnerability Detection and Response

VDR-CSO-ADTProviders SHOULD use automated services to improve and streamline vulnerability detection and response.3

Attributes

Force: SHOULD
Subset: CSO: General Provider Responsibilities
Ruleset: VDR: Vulnerability Detection and Response

VDR-CSO-DACProviders SHOULD automatically perform vulnerability detection on representative samples of new or significantly changed information resources.2

Attributes

Force: SHOULD
Subset: CSO: General Provider Responsibilities
Ruleset: VDR: Vulnerability Detection and Response

VDR-CSO-AKEProviders SHOULD NOT deploy or otherwise activate new machine-based information resources with Known Exploited Vulnerabilities.1

Attributes

Force: SHOULD NOT
Subset: CSO: General Provider Responsibilities
Ruleset: VDR: Vulnerability Detection and Response

VDR-TFR-PDDProviders with Class C Certifications SHOULD persistently perform vulnerability detection on all information resources that are likely to drift, at least once every 14 days.3

Attributes

Force: SHOULD
Subset: TFR: Timeframes
Ruleset: VDR: Vulnerability Detection and Response

VDR-TFR-PCDProviders with Class C Certifications SHOULD persistently perform vulnerability detection on all information resources that are NOT likely to drift, at least once every month.1

Attributes

Force: SHOULD
Subset: TFR: Timeframes
Ruleset: VDR: Vulnerability Detection and Response

VDR-TFR-RMNProviders SHOULD mitigate or remediate remaining vulnerabilities during routine operations as determined necessary by the provider.1

Attributes

Force: SHOULD
Subset: TFR: Timeframes
Ruleset: VDR: Vulnerability Detection and Response

VDR-TFR-KEVProviders SHOULD remediate Known Exploited Vulnerabilities according to the due dates in the CISA Known Exploited Vulnerabilities Catalog (even if the vulnerability has been fully mitigated) as required by CISA Binding Operational Directive (BOD) 26-04 or any successor guidance from CISA.1

Attributes

Force: SHOULD
Subset: TFR: Timeframes
Ruleset: VDR: Vulnerability Detection and Response

VDR-TFR-PSDProviders with Class C Certifications SHOULD persistently perform vulnerability detection on representative samples of similar machine-based information resources, at least once every 3 days.1

Attributes

Force: SHOULD
Subset: TFR: Timeframes
Ruleset: VDR: Vulnerability Detection and Response

VDR-TFR-MVXProviders of FedRAMP 20x Class C offerings MUST verify and validate the status of machine-based information resources at least once every 3 days.3

Attributes

Force: MUST
Subset: TFR: Timeframes
Ruleset: VDR: Vulnerability Detection and Response

VER-EVA-ELXProviders MUST evaluate detected vulnerabilities, considering the context of the cloud service offering, to determine if they are likely exploitable vulnerabilities.1

Attributes

Force: MUST
Subset: EVA: Evaluation
Ruleset: VER: Vulnerability Evaluation and Reporting

VER-EVA-EIRProviders MUST evaluate detected vulnerabilities, considering the context of the cloud service offering, to determine if they are internet-reachable vulnerabilities.1

Attributes

Force: MUST
Subset: EVA: Evaluation
Ruleset: VER: Vulnerability Evaluation and Reporting

VER-TFR-MAVProviders MUST categorize any vulnerability that is not or will not be fully mitigated or remediated within 192 days of evaluation as an accepted vulnerability.1

Attributes

Force: MUST
Subset: TFR: Timeframes
Ruleset: VER: Vulnerability Evaluation and Reporting