2026.11.02.01

For additional information on this release, please review the FedRAMP Consolidated Rules for 2026 Changelog.

2026.11.02.01

Rules Changes

• FRD-MAS (Minimum Assessment Scope): Added to support the explanation in the rule. #41 (flagged by @ExtremoPenguin in 2026/145).
• FRC-CLA-MFR (Mandatory FedRAMP Rules for Class A): Added SDR-CSX-KSI to list of requirements because folks need a rule that explains how to document the key security indicators! #45 (flagged by @tnnrjmsn-eit in 2026/131).
• FRC-CLA-RFR (Recommended FedRAMP Rules for Class A): CPO-CSF-CPM (Certification Package Maintenance for Rev5) was removed. #44 (flagged by @tnnrjmsn-eit in 2026/158).
• FRC-CCL-DCC (Downgrading Certification Class): Fixed a typo in the note to clarify that downgrade should not happen WITHOUT providing advance notification. #50 (flagged by @StevenCh99 in 2026/158).
• FRC-CCL-UCC (Upgrading Certification Class): Updated wording and added a note to more explicitly clarify that upgrading is obtaining a new FedRAMP Certification. #46 (flagged by @tnnrjmsn-eit in 2026/118).
• IEC-CSO-IIR (Initial Incident Report): Marked the Trust Center or USDA Connect update to All Necessary Parties as optional in notification metadata in #47 (flagged by @zeesharfcspab community/146 - the updated array was not updated for this change).
• IEC-CSO-OIR (Ongoing Incident Reports): Marked the Trust Center or USDA Connect update to All Necessary Parties as optional in notification metadata. #47 (flagged by @zeesharfcspab community/146 - the updated array was not updated for this change).
• IEC-CSO-FIR (Final Incident Report): Marked the Trust Center or USDA Connect update to All Necessary Parties as optional in notification metadata. #47 (flagged by @zeesharfcspab community/146 - the updated array was not updated for this change).
• MKT-CSO-PML (Provider Marketplace Listing Requests): Corrected the name of the form. #48 (flagged by @tnnrjmsn-eit in 2026/160).
• KSI-SCR-MIT (Mitigating Supply Chain Risk): Changed wording order without any material impact to align with KSI standard language. Was: Persistently identify, review, and mitigate potential supply chain risks. #42.

Schema And Structure Changes

• Added optional issue URI fields to update-history entries and populated them for six changed definitions, requirements, and indicators.
• Added optional boolean notification[].optional fields.
• Extended the shared class_key and class_name enums with g and G.
• Clarified that the normative-force enum describes requirements.

Contributors

@tnnrjmsn-eit, @ExtremoPenguin, @zeesharfcspab, @StevenCh99