Skip to content

Security Decision Record

The Security Decision Record replaced a traditional System Security Plan with a persistently maintained, verified, and validated record of the security decisions made by the cloud service provider over the lifecycle of their cloud service offering.

Subsets

Effective Date(s) & Overall Applicability for 20x

  • Required (Consolidated Rules for 2026)
  • Optional Adoption: 2026-07-04
  • Obtain: 2026-07-04
  • Maintain: 2027-01-01
  • Grace Ends: On the first FedRAMP independent assessment completed after 2027-01-01

Effective Date(s) & Overall Applicability for Rev5

  • Required (Consolidated Rules for 2026)
  • Optional Adoption: 2026-07-04
  • Obtain: 2027-01-01
  • Maintain: 2027-08-01
  • Grace Ends: On the first FedRAMP independent assessment completed after 2027-08-01

General Provider Responsibilities

These rules apply to providers for FedRAMP Certifications of any type.

Type: 20xRev5
Path: ProgramAgency
Class: Class BClass CClass D
Audience: Providers

FedRAMP Rules

SDR-CSO-FRR

Changelog:

  • 2026-06-24: Official launch of the FedRAMP Consolidated Rules for 2026.

Related JSON Schema: FedRAMP Security Decision Record Schema

Providers MUST supply a Security Decision Record, in both human-readable and JSON formats, that includes at least all of the following information for each applicable FedRAMP rule:

  1. Explanation of how the rule is followed, or an explanation of the reason and resulting risk to customers for not following the rule.
  2. Verification that the implementation is appropriate for the rule, or that the reason for not implementing is accepted by a senior official.
  3. Validation that the implementation is in place and working as intended, or that the reason for not implementing is accepted by a senior official.
  4. Independent verification.
  5. Independent validation.
  6. Any responses or clarifications to the comments in the independent verification or validation.
  7. Rule-specific artifacts (if applicable).

Terms: Artifacts, Security Decision Record (SDR), Validation, Verification

Security Decision Record Metadata

SDR-CSO-MTD

Changelog:

  • 2026-06-24: Official launch of the FedRAMP Consolidated Rules for 2026.

Providers MUST also include the following basic metadata in their Security Decision Record:

  1. Version
  2. Date and time of last update
  3. Source of update

Terms: Security Decision Record (SDR)

20x-Specific Provider Responsibilities

These rules apply to providers for FedRAMP 20x Certifications.

Type: 20x
Path: Program
Class: Class BClass CClass D
Audience: Providers

Key Security Indicators

SDR-CSX-KSI

Changelog:

  • 2026-06-24: Official launch of the FedRAMP Consolidated Rules for 2026.

Related JSON Schema: FedRAMP Security Decision Record Schema

Providers MUST also include short and simple high-level summaries of at least the following for each applicable Key Security Indicator:

  1. Explanation of measures (and their objectives) that demonstrate the Key Security Indicator, or an explanation of the reason and resulting risk to customers for not having measures available for that Key Security Indicator.
  2. Explanation of the cycle for any measures that are implemented persistently (if applicable).
  3. Verification that the measures demonstrate the Key Security Indicator, or that the reason for not having them is accepted.
  4. Verification that the automation in place is accurate and sufficient to demonstrate appropriate measures for the Key Security Indicator, or that automation is not necessary for each measure.
  5. Validation that the measures are accurately produced and are in place and working as intended, or that the reason for not having them is valid.

Terms: Persistently, Validation, Verification

Key Security Indicator Metrics

SDR-CSX-KMT

Changelog:

  • 2026-06-24: Official launch of the FedRAMP Consolidated Rules for 2026.

Related JSON Schema: FedRAMP Security Decision Record Schema

Providers with 20x Class A Certifications MAY also include historical metrics in their Security Decision Record.

Providers with 20x Class B Certifications MUST also include historical metrics in their Security Decision Record, supplying at least the following information for each applicable Key Security Indicator:

  1. Summary of each metric over the past 30 days
  2. Summary of metric up to the past year (where available)

Providers with 20x Class C Certifications MUST also include historical metrics in their Security Decision Record, supplying at least the following information for each applicable Key Security Indicator:

  1. Summary of each metric over the past 30 days
  2. Summary of metric up to the past year (where available)
  3. All daily metric data up to the past year (where available)

Providers with 20x Class D Certifications MUST significantly supersede the minimum requirements for lower Classes, with specifics to be set during the 20x Phase 4 Pilot.

Terms: Security Decision Record (SDR)

Rev5-Specific Provider Responsibilities

These rules apply to providers for FedRAMP Rev5 Certifications.

Type: Rev5
Path: ProgramAgency
Class: Class BClass CClass D
Audience: Providers

Rev5 Controls

SDR-CSF-CTF

Changelog:

  • 2026-06-24: Official launch of the FedRAMP Consolidated Rules for 2026.

Providers MUST also include short and simple high-level summaries of at least the following for each applicable Rev5 Control:

  1. Any organization-defined parameter values.
  2. Implementation status, one of Implemented, Partially Implemented, Planned, Alternative Implementation, or Not Applicable.
  3. The mechanisms or activities that address the control, including inheritance from another cloud service offering if applicable.
  4. The verification that is in place to ensure the implementation is appropriate for the control.
  5. The validation that is in place to ensure the implementation is working as intended.
  6. Independent verification.
  7. Independent validation.
  8. Any responses or clarifications to the comments in the independent verification or validation.
  9. Control-specific artifacts (if applicable).

Terms: Artifacts, Cloud Service Offering, Validation, Verification

Comments