2026/providers/20x/rules/minimum-assessment-scope/

[giscus[bot]]

2026/providers/20x/rules/minimum-assessment-scope/

This site contains FedRAMP's Consolidated Rules for 2026.

https://www.fedramp.gov/2026/providers/20x/rules/minimum-assessment-scope/

[ExtremoPenguin]

Is minimum assessment scope defined anywhere? Rules like FRC-CSX-MAS reference the minimum assessment scope, but I can not find a direct definition of it. It seems like MAS-CSO-IIR is meant to very closely align with the minimum assessment scope, but it defines the list of information resources as the cloud service offering, not the minimum assessment scope. If the list of information resources in MAS-CSO-IIR is meant to be the same as the minimum assessment scope, it gets confusing when considering rules like MAS-CSO-TPR which call for additional documentation for information resources where MAS-CSO-IIR applies, but are also third party resources and therefore not entirely within the minimum assessment scope.

A somewhat related question. For information resources that are explicitly outside the scope of MAS-CSO-IIR (like mobile apps), would MAS-CSO-SUP be a good place to document these?

[pete-gov]

The Minimum Assessment Scope and the cloud service offering for FedRAMP Certification are the same thing. The Minimum Assessment Scope ruleset explains how to scope the assessment of the cloud offering.

If the list of information resources in MAS-CSO-IIR is meant to be the same as the minimum assessment scope, it gets confusing when considering rules like MAS-CSO-TPR which call for additional documentation for information resources where MAS-CSO-IIR applies, but are also third party resources and therefore not entirely within the minimum assessment scope.

The simplest explanation here is that while you may not have control over many aspects of a third-party information resource, there's a good chance that you DO have SOME control over it. Did you set up authentication? Then your authentication configuration is part of your cloud service offering, not the third-party information resource. Or maybe you encrypt agency customer data in a specific way before sending it to a third-party information resource in a way that the third-party can't decrypt it (such as transit) then the encryption used and other compensating controls are still part of the cloud service offering / minimum assessment scope even though the transit service is outside your control.

A somewhat related question. For information resources that are explicitly outside the scope of MAS-CSO-IIR (like mobile apps), would MAS-CSO-SUP be a good place to document these?

This was originally added in an RFC due to feedback on that use case, yep! It can certainly apply to other supplemental information too.

[ExtremoPenguin]

Thank you. I think it would benefit clarity to have CSO = MAS explicitly documented, either in a definition or MAS-CSO-IIR.

[pete-gov]

The definition of cloud service offering does have this note:

Note: The FedRAMP Minimum Assessment Scope defines the full scope of the cloud service offering from the perspective of a FedRAMP Certification.

I can craft a definition for MAS that shows this from the other side though. Added FedRAMP/rules#41 to track this.