2026/responsibilities/rules/

[giscus[bot]]

2026/responsibilities/rules/

This site contains FedRAMP's Consolidated Rules for 2026.

https://www.fedramp.gov/2026/responsibilities/rules/

[ul7]

Pardon the silly question but for this section, it states: "This FRR includes a notification requirement!" What does FRR refer to in this context? I wasn't able to find this anywhere else on the page. Thanks!

[ul7]

Actually...now that I think about it, it's probably "FedRAMP's Responsibilities in the Rules"...

[pete-gov]

FRR = FedRAMP Rule :)

These are explained in the machine-readable JSON data but I don't think I added a note to the human-readable generated version of the site. I'll add that to my to-do list!

https://github.com/FedRAMP/rules

fedramp-consolidated-rules.json is the canonical rules dataset. It contains dataset metadata (info), FedRAMP Definitions (FRD), FedRAMP Rules (FRR), Key Security Indicators (KSI), and control guidance and parameters (CTL, an optional schema section).

[tnnrjmsn-eit]

There appears to be a typo in SHOULD NOT:

...but the full implications must be understand and carefully weighed.

I would expect this to read (and match the SHOULD verbiage):

... but the full implications must be understood and carefully weighed.

[emphasis added]

[pete-gov]

Thank you. I've created issues to track and fix this:

FedRAMP/rules#38

#143

Cheers!