Collaborative Continuous Monitoring¶
The Collaborative Continuous Monitoring rules help agencies use shared, current authorization information from providers as part of each agency's own Information Security Continuous Monitoring strategy. These rules reduce unnecessary manual burden by encouraging automated monitoring and review while allowing each agency to make its own risk-based decisions about ongoing authorization.
Effective Date(s) & Overall Applicability for 20x
- Required (Consolidated Rules for 2026)
- Optional Adoption: 2026-07-04
- Obtain: 2026-07-04
- Maintain: 2027-01-01
- Grace Ends: On the first FedRAMP independent assessment completed after 2027-01-01
Effective Date(s) & Overall Applicability for Rev5
- Required (Consolidated Rules for 2026)
- Optional Adoption: 2026-07-04
- Obtain: 2027-01-01
- Maintain: 2027-04-02
- Grace Ends: 2027-10-01
Agency Guidance¶
These rules for agencies apply to all agencies using a FedRAMP Certification.
Path: ProgramAgency
Class: Class BClass CClass D
Audience: Agencies
Review Ongoing Reports¶
CCM-AGM-ROR
Changelog:
- 2026-06-24: Official launch of the FedRAMP Consolidated Rules for 2026.
Agencies MUST review each Ongoing Certification Report to understand how changes to the cloud service offering may impact the previously agreed-upon risk tolerance documented in the agency's Authorization to Operate of a federal information system that includes the cloud service offering in its boundary.
Note: This is required by 44 USC § 35, OMB A-130, FIPS-200, and M-24-15.
Terms: Cloud Service Offering, FedRAMP Certification Report, Ongoing Certification, Ongoing Certification Report (OCR)
Notify FedRAMP After Requests¶
CCM-AGM-NFA
Changelog:
- 2026-06-24: Official launch of the FedRAMP Consolidated Rules for 2026.
This FRR includes a notification requirement!
Agencies MUST notify FedRAMP after requesting any additional information or materials from a cloud service provider beyond those FedRAMP requires by sending an email to info@fedramp.gov.
Note: Agencies are required to notify FedRAMP by OMB Memorandum M-24-15 section IV (a).
No Additional Requirements¶
CCM-AGM-NAR
Changelog:
- 2026-06-24: Official launch of the FedRAMP Consolidated Rules for 2026.
This FRR includes a notification requirement!
Agencies MUST NOT place additional security requirements on cloud service providers beyond those required by FedRAMP UNLESS the head of the agency or an authorized delegate makes a determination that there is a demonstrable need for such; this does not apply to seeking clarification or asking general questions about FedRAMP Certification Data.
Note: This is a statutory requirement in 44 USC § 3613 (e) related to the Presumption of Adequacy for a FedRAMP Certification.
Terms: Certification Data, FedRAMP Certified
Consider Security Category¶
CCM-AGM-CSC
Changelog:
- 2026-06-24: Official launch of the FedRAMP Consolidated Rules for 2026.
Agencies SHOULD consider the Security Category noted in their Authorization to Operate of the federal information system that includes the cloud service offering in its boundary and assign appropriate information security resources for reviewing Ongoing Certification Reports, attending Quarterly Reviews, and other ongoing FedRAMP Certification Data.
Terms: Certification Data, Cloud Service Offering, Ongoing Certification, Quarterly Review, Security Category