FedRAMP 20x Class C Rules (FRR) 2026

fedramp_20x_frr_class_c_2026.09.13.02

FedRAMP-20x-FRR-Class-Cv2026.09.13.02

OfficialVerified

FedRAMP Rules (FRR) that cloud service providers must follow for a FedRAMP 20x Class C Certification, from the FedRAMP Consolidated Rules for 2026 (release 2026.09.13.02, https://github.com/FedRAMP/rules). Covers the 158 provider rules of the 15 rulesets on the 20x Class C reference page; rules that only bind FedRAMP, agencies, assessors or advisors are excluded, and class-varying rules use their Class C statement. Most rules are program and process obligations that need manual evidence. The Key Security Indicators of the same ruleset are in the fedramp_20x_ksi_2026 framework.

7requirements6checks

Prowler prowler-compliance-fedramp-20x-frr-class-c

Run this compliance with Prowler

Run in Prowler Cloud

Run

prowler azure --compliance fedramp_20x_frr_class_c_2026.09.13.02

Requirements (7)

VDR-CSO-DETProviders MUST systematically, persistently, and promptly discover and identify vulnerabilities within their cloud service offering using appropriate techniques such as assessment, scanning, threat intelligence, vulnerability disclosure mechanisms, bug bounties, penetration testing, incident response, automated control testing, supply chain monitoring, and other relevant capabilities; this process is called vulnerability detection. Vulnerability detection includes persistently verifying and validating that information resources and processes are operating as intended and documented for FedRAMP Practices.4

Attributes

Force: MUST
Subset: CSO: General Provider Responsibilities
Ruleset: VDR: Vulnerability Detection and Response

VDR-CSO-RESProviders MUST systematically, persistently, and promptly track, evaluate, monitor, mitigate, remediate, assess exploitation of, report, and otherwise manage all detected vulnerabilities within their cloud service offering; this process is called vulnerability response.1

Attributes

Force: MUST
Subset: CSO: General Provider Responsibilities
Ruleset: VDR: Vulnerability Detection and Response

VDR-CSO-ADTProviders SHOULD use automated services to improve and streamline vulnerability detection and response.3

Attributes

Force: SHOULD
Subset: CSO: General Provider Responsibilities
Ruleset: VDR: Vulnerability Detection and Response

VDR-CSO-DACProviders SHOULD automatically perform vulnerability detection on representative samples of new or significantly changed information resources.1

Attributes

Force: SHOULD
Subset: CSO: General Provider Responsibilities
Ruleset: VDR: Vulnerability Detection and Response

VDR-TFR-PDDProviders with Class C Certifications SHOULD persistently perform vulnerability detection on all information resources that are likely to drift, at least once every 14 days.1

Attributes

Force: SHOULD
Subset: TFR: Timeframes
Ruleset: VDR: Vulnerability Detection and Response

VDR-TFR-RMNProviders SHOULD mitigate or remediate remaining vulnerabilities during routine operations as determined necessary by the provider.1

Attributes

Force: SHOULD
Subset: TFR: Timeframes
Ruleset: VDR: Vulnerability Detection and Response

VDR-TFR-MVXProviders of FedRAMP 20x Class C offerings MUST verify and validate the status of machine-based information resources at least once every 3 days.1

Attributes

Force: MUST
Subset: TFR: Timeframes
Ruleset: VDR: Vulnerability Detection and Response