FedRAMP 20x Class C Rules (FRR) 2026

fedramp_20x_frr_class_c_2026.09.13.02

FedRAMP-20x-FRR-Class-Cv2026.09.13.02

OfficialVerified

FedRAMP Rules (FRR) that cloud service providers must follow for a FedRAMP 20x Class C Certification, from the FedRAMP Consolidated Rules for 2026 (release 2026.09.13.02, https://github.com/FedRAMP/rules). Covers the 158 provider rules of the 15 rulesets on the 20x Class C reference page; rules that only bind FedRAMP, agencies, assessors or advisors are excluded, and class-varying rules use their Class C statement. Most rules are program and process obligations that need manual evidence. The Key Security Indicators of the same ruleset are in the fedramp_20x_ksi_2026 framework.

5requirements2checks

Prowler prowler-compliance-fedramp-20x-frr-class-c

Run this compliance with Prowler

Run in Prowler Cloud

Run

prowler gcp --compliance fedramp_20x_frr_class_c_2026.09.13.02

Requirements (5)

MAS-CSO-IIRProviders MUST identify a set of information resources to assess for FedRAMP Certification that includes all information resources that are likely to handle federal customer data or likely to impact the confidentiality, integrity, or availability of federal customer data handled by the cloud service offering; this set of information resources is the cloud service offering.1

Attributes

Force: MUST
Subset: CSO: General Provider Responsibilities
Ruleset: MAS: Minimum Assessment Scope

VDR-CSO-DETProviders MUST systematically, persistently, and promptly discover and identify vulnerabilities within their cloud service offering using appropriate techniques such as assessment, scanning, threat intelligence, vulnerability disclosure mechanisms, bug bounties, penetration testing, incident response, automated control testing, supply chain monitoring, and other relevant capabilities; this process is called vulnerability detection. Vulnerability detection includes persistently verifying and validating that information resources and processes are operating as intended and documented for FedRAMP Practices.1

Attributes

Force: MUST
Subset: CSO: General Provider Responsibilities
Ruleset: VDR: Vulnerability Detection and Response

VDR-CSO-ADTProviders SHOULD use automated services to improve and streamline vulnerability detection and response.1

Attributes

Force: SHOULD
Subset: CSO: General Provider Responsibilities
Ruleset: VDR: Vulnerability Detection and Response

VDR-CSO-DACProviders SHOULD automatically perform vulnerability detection on representative samples of new or significantly changed information resources.1

Attributes

Force: SHOULD
Subset: CSO: General Provider Responsibilities
Ruleset: VDR: Vulnerability Detection and Response

VDR-TFR-MVXProviders of FedRAMP 20x Class C offerings MUST verify and validate the status of machine-based information resources at least once every 3 days.1

Attributes

Force: MUST
Subset: TFR: Timeframes
Ruleset: VDR: Vulnerability Detection and Response