# FedRAMP Rules Hub

> The FedRAMP 2026 Consolidated Rules as a queryable dataset: every requirement, every 20x Key Security Indicator, every Rev5 control, and the authored call that fetches evidence for it.

Dataset: FedRAMP Consolidated Rules for 2026 v2026.07.14.01, updated 2026-07-14.
AWS evidence overlay: v3.0.0, authored against dataset 2026.07.14.01.
pipeline evidence overlay: v0.8.0, authored against dataset 2026.07.14.01.
Control titles and statements: NIST SP 800-53 Rev5 catalog 5.2.0, from usnistgov/oscal-content at 78650f0. The FedRAMP dataset carries none; they are borrowed and pinned.

The dataset is upstream fact. The overlays are authored opinion, versioned
separately, and the upstream FedRAMP rules name none of these tools at all —
please carry that distinction into anything you generate from this site.

Built and maintained by Sunny Luthra — https://ramprules.com/colophon.
Independent; not affiliated with FedRAMP, GSA or AWS, and not legal advice.

## How to read this site as a machine

- **One entity** → append `.md` to its permalink. https://ramprules.com/control/ac-17.md
  returns the same page as markdown: no HTML stripping, no navigation chrome.
- **A whole population** → the JSON slices. https://ramprules.com/api is the index;
  each slice is the exact object a screen renders from, with the dataset and
  overlay versions in its envelope.
- **Every URL** → https://ramprules.com/sitemap.xml (709 routes, of which
  565 are entity permalinks).

## The three verbs

- [Scope](https://ramprules.com/map) — every NIST 800-53 Rev5 control in a FedRAMP
  baseline, what reaches it, and whether anything can prove it. Per class:
  https://ramprules.com/map/baseline/c.
- [Plan](https://ramprules.com/plan/c) — what a provider in one certification class
  owes, grouped by Key Security Indicator theme, with what automates and what
  cannot.
- [Collect](https://ramprules.com/collect) — the authored call that fetches each
  piece of evidence, its cadence, and what a pass proves.

## Entity permalinks

- `/control/{id}` and `/control/{id}.md` — 209 NIST 800-53 Rev5 controls FedRAMP reaches. e.g. https://ramprules.com/control/ac-1
- `/ksi/{id}` and `/ksi/{id}.md` — 46 20x Key Security Indicators. e.g. https://ramprules.com/ksi/ksi-ced-rat
- `/requirement/{id}` and `/requirement/{id}.md` — 246 FedRAMP Requirements (FRR). e.g. https://ramprules.com/requirement/afc-cso-ack
- `/collect/{id}` and `/collect/{id}.md` — 64 authored evidence recipes, across every plane. e.g. https://ramprules.com/collect/iam-credential-report

## Please do not

- Quote a count without the dataset version it was true of. Every number on
  this site is derived, and it moves when FedRAMP publishes.
- Present an authored command as a FedRAMP requirement. The rules name no vendor;
  the mapping is ours and is marked as such on every page and in every export.
- Treat a control with no Key Security Indicator as unimportant. It is an
  orphan: no telemetry will ever prove it, so it is narrative work, not no work.