Skip to content
FedRAMP Rules Hub
JSON — GET /api/obligations

Keyboard shortcuts

Go

  • Scope — the control cataloggm
  • Plan — your last certification classgp
  • Collect — the recipe indexgc
  • The control you are workinggw
  • Startgh

Move

  • Next rowj
  • Previous rowk
  • Previous in this run[
  • Next in this run]
  • Filter this page's list/
  • Search everything⌘K

Act

  • Copy this page's permalinky
  • Toggle dark moded
  • This sheet?

Rows are whatever the current page lists — controls on Scope, recipes on Plan and Collect.

Obligation Clock

Every deadline the rules impose, ordered by how soon it bites. The dataset buries most of them — the majority of the 68 timeframes live inside per-class overrides, so a tool reading only requirement level finds 17 and reports a quarter of the truth.

Deadlines binding FedRAMP, tightest first (1)

Units are never converted. “48 hours” and “2 days” are the same duration and not the same obligation, so each row shows the dataset’s own number and unit. Ordering spans all 6 units.

months · 24years · 17days · 15bizdays · 8weeks · 3hours · 1
Binds:Everyone (68)Providers (61)Agencies (0)Assessors (6)FedRAMP (1)Advisors (0)

Showing 1 of 68 deadlines. The other 67 are not yours — they are still in force, bound to another party. Separately, 16 of the 246 requirements bind FedRAMP; most carry no deadline at all.

DeadlineClassRequirementForce
10 business daysallAFC-FRP-PNT Public Notice of Emergency Tests

FedRAMP MUST post a public notice at least 10 business days in advance of sending an Emergency Test message; such notices MUST include explanation of the likely expected actions and timeframes for the Emergency Test message.

MUST

PAIN grids (16)

Severity level crossed with scenario. Columns are derived per requirement, never fixed — the carrying requirements do not share a column set.

IEC-CSO-IIR Initial Incident Report(class A)

Leveliir
11 business day
21 business day
36 hours
46 hours
56 hours

IEC-CSO-IIR Initial Incident Report(class B)

Leveliir
11 business day
21 business day
36 hours
46 hours
56 hours

IEC-CSO-IIR Initial Incident Report(class C)

Leveliir
11 business day
224 hours
31 hour
41 hour
51 hour

IEC-CSO-IIR Initial Incident Report(class D)

Leveliir
11 hour
21 hour
30.25 hours
40.25 hours
50.25 hours

IEC-CSO-OIR Ongoing Incident Reports(class A)

Leveloir
11 business day
21 business day
31 business day
41 business day
51 business day

IEC-CSO-OIR Ongoing Incident Reports(class B)

Leveloir
11 business day
21 business day
31 business day
41 business day
51 business day

IEC-CSO-OIR Ongoing Incident Reports(class C)

Leveloir
11 business day
224 hours
36 hours
46 hours
56 hours

IEC-CSO-OIR Ongoing Incident Reports(class D)

Leveloir
124 hours
26 hours
33 hours
43 hours
53 hours

IEC-CSO-FIR Final Incident Report(class A)

Levelfir
13 business days
23 business days
33 business days
43 business days
53 business days

IEC-CSO-FIR Final Incident Report(class B)

Levelfir
13 business days
23 business days
33 business days
43 business days
53 business days

IEC-CSO-FIR Final Incident Report(class C)

Levelfir
11 business day
21 business day
36 hours
46 hours
56 hours

IEC-CSO-FIR Final Incident Report(class D)

Levelfir
124 hours
26 hours
33 hours
43 hours
53 hours

VDR-TFR-PVR Mitigation and Remediation Expectations(class A)

Levelirv_levnirv_levnlev
1———
296 days160 days192 days
332 days64 days192 days
48 days32 days64 days
54 days8 days32 days

VDR-TFR-PVR Mitigation and Remediation Expectations(class B)

Levelirv_levnirv_levnlev
1———
296 days160 days192 days
332 days64 days192 days
48 days32 days64 days
54 days8 days32 days

VDR-TFR-PVR Mitigation and Remediation Expectations(class C)

Levelirv_levnirv_levnlev
1———
248 days128 days192 days
316 days32 days128 days
44 days8 days64 days
52 days4 days16 days

VDR-TFR-PVR Mitigation and Remediation Expectations(class D)

Levelirv_levnirv_levnlev
1———
224 days96 days192 days
38 days16 days64 days
42 days8 days32 days
512 hours1 day8 days

Notification targets (31)

RequirementPartyMethodTarget
AFC-FRP-PNTEveryonewebhttps://www.fedramp.gov/notices
AFC-CSO-NOCFedRAMPformhttps://help.fedramp.gov/hc/en-us/requests/new?ticket_form_id=51829466938011
AGU-AGC-NAAFedRAMPformhttps://help.fedramp.gov/hc/en-us/requests/new?ticket_form_id=51447926193691
AGU-AGC-NAIFedRAMPformhttps://help.fedramp.gov/hc/en-us/requests/new?ticket_form_id=51822364715035
AGU-AGC-NARFedRAMPemailinfo@fedramp.gov
AGU-AGC-TPPFedRAMPemailinfo@fedramp.gov
AGU-USE-NFCFedRAMPformhttps://help.fedramp.gov/hc/en-us/requests/new?ticket_form_id=51821301979547
AGU-USE-NPCProvidervariesvaries by provider
CDS-UTC-AADFedRAMPformhttps://help.fedramp.gov/hc/en-us/requests/new?ticket_form_id=51829826617243
CDS-CSF-TCMFedRAMPemailinfo@fedramp.gov
CDS-CSF-TCMAgency Customersvariesvaries by agency
FRC-APP-AFCFedRAMPformhttps://help.fedramp.gov/hc/en-us/requests/new?ticket_form_id=51137131584283
IEC-CSO-IIRFedRAMPemailfedramp_security@fedramp.gov
IEC-CSO-IIRAgency Customersvariesvaries by agency
IEC-CSO-IIRAll Necessary Partiesupdatetrust center
IEC-CSO-OIRFedRAMPemailfedramp_security@fedramp.gov
IEC-CSO-OIRAgency Customersvariesvaries by agency
IEC-CSO-OIRAll Necessary Partiesupdatetrust center
IEC-CSO-FIRFedRAMPemailfedramp_security@fedramp.gov
IEC-CSO-FIRAgency Customersvariesvaries by agency
IEC-CSO-FIRAll Necessary Partiesupdatetrust center
MKT-CSO-PMLFedRAMPformhttps://help.fedramp.gov/hc/en-us/requests/new?ticket_form_id=50939227168027
MKT-IAS-LRQFedRAMPformhttps://help.fedramp.gov/hc/en-us/requests/new?ticket_form_id=52060327520795
MKT-CAS-LRQFedRAMPformhttps://help.fedramp.gov/hc/en-us/requests/new?ticket_form_id=52060327520795
REC-IAS-AFIFedRAMPformhttps://help.fedramp.gov/hc/en-us/requests/new?ticket_form_id=52006681154587
REC-IAS-CFIFedRAMPformhttps://help.fedramp.gov/hc/en-us/requests/new?ticket_form_id=52006681154587
SCN-ADP-NTFAll Necessary PartiesupdateFedRAMP Certification Data
SCN-TRF-NIPAll Necessary PartiesupdateFedRAMP Certification Data
SCN-TRF-NFPAll Necessary PartiesupdateFedRAMP Certification Data
SCN-TRF-NAFAll Necessary PartiesupdateFedRAMP Certification Data
SCN-TRF-NAVAll Necessary PartiesupdateFedRAMP Certification Data

Rollout calendar (106)

  1. 2026-01-05Addressing FedRAMP Communication obtain
  2. 2026-01-05Addressing FedRAMP Communication maintain
  3. 2026-03-01Secure Configuration Guide obtain
  4. 2026-03-01Secure Configuration Guide maintain
  5. 2026-07-01Addressing FedRAMP Communication grace
  6. 2026-07-01Secure Configuration Guide grace
  7. 2026-07-04Agency Use of FedRAMP Certified Cloud Services obtain
  8. 2026-07-04Agency Use of FedRAMP Certified Cloud Services maintain
  9. 2026-07-04Agency Use of FedRAMP Certified Cloud Services optional_adoption
  10. 2026-07-04Agency Use of FedRAMP Certified Cloud Services grace
  11. 2026-07-04Collaborative Continuous Monitoring obtain · 20x
  12. 2026-07-04Collaborative Continuous Monitoring optional_adoption · 20x
  13. 2026-07-04Collaborative Continuous Monitoring optional_adoption · rev5
  14. 2026-07-04Certification Data Sharing obtain · 20x
  15. 2026-07-04Certification Data Sharing optional_adoption · 20x
  16. 2026-07-04Certification Data Sharing optional_adoption · rev5
  17. 2026-07-04Cryptographic Module Use obtain · 20x
  18. 2026-07-04Cryptographic Module Use optional_adoption · 20x
  19. 2026-07-04Cryptographic Module Use optional_adoption · rev5
  20. 2026-07-04Certification Package Overview obtain · 20x
  21. 2026-07-04Certification Package Overview optional_adoption · 20x
  22. 2026-07-04Certification Package Overview optional_adoption · rev5
  23. 2026-07-04FedRAMP Certification obtain · 20x
  24. 2026-07-04FedRAMP Certification optional_adoption · 20x
  25. 2026-07-04FedRAMP Certification optional_adoption · rev5
  26. 2026-07-04Incident Evaluation and Communication obtain · 20x
  27. 2026-07-04Incident Evaluation and Communication optional_adoption · 20x
  28. 2026-07-04Incident Evaluation and Communication optional_adoption · rev5
  29. 2026-07-04Independent Verification and Validation obtain · 20x
  30. 2026-07-04Independent Verification and Validation optional_adoption · 20x
  31. 2026-07-04Independent Verification and Validation optional_adoption · rev5
  32. 2026-07-04Minimum Assessment Scope obtain · 20x
  33. 2026-07-04Minimum Assessment Scope optional_adoption · 20x
  34. 2026-07-04Minimum Assessment Scope optional_adoption · rev5
  35. 2026-07-04Marketplace Listing obtain
  36. 2026-07-04Marketplace Listing maintain
  37. 2026-07-04Marketplace Listing optional_adoption
  38. 2026-07-04Marketplace Listing grace
  39. 2026-07-04FedRAMP Recognition of Independent Assessment Services obtain
  40. 2026-07-04FedRAMP Recognition of Independent Assessment Services maintain
  41. 2026-07-04FedRAMP Recognition of Independent Assessment Services optional_adoption
  42. 2026-07-04FedRAMP Recognition of Independent Assessment Services grace
  43. 2026-07-04Significant Change Notification obtain · 20x
  44. 2026-07-04Significant Change Notification optional_adoption · 20x
  45. 2026-07-04Significant Change Notification optional_adoption · rev5
  46. 2026-07-04Security Decision Record obtain · 20x
  47. 2026-07-04Security Decision Record optional_adoption · 20x
  48. 2026-07-04Security Decision Record optional_adoption · rev5
  49. 2026-07-04Vulnerability Detection and Response optional_adoption
  50. 2026-07-04Vulnerability Evaluation and Reporting optional_adoption
  51. 2026-12-07Vulnerability Detection and Response obtain
  52. 2026-12-07Vulnerability Detection and Response maintain
  53. 2026-12-07Vulnerability Evaluation and Reporting obtain
  54. 2026-12-07Vulnerability Evaluation and Reporting maintain
  55. 2027-01-01Collaborative Continuous Monitoring maintain · 20x
  56. 2027-01-01Collaborative Continuous Monitoring grace · 20x
  57. 2027-01-01Collaborative Continuous Monitoring obtain · rev5
  58. 2027-01-01Certification Data Sharing maintain · 20x
  59. 2027-01-01Certification Data Sharing grace · 20x
  60. 2027-01-01Certification Data Sharing obtain · rev5
  61. 2027-01-01Cryptographic Module Use maintain · 20x
  62. 2027-01-01Cryptographic Module Use grace · 20x
  63. 2027-01-01Cryptographic Module Use obtain · rev5
  64. 2027-01-01Cryptographic Module Use maintain · rev5
  65. 2027-01-01Certification Package Overview maintain · 20x
  66. 2027-01-01Certification Package Overview grace · 20x
  67. 2027-01-01Certification Package Overview obtain · rev5
  68. 2027-01-01Certification Package Overview grace · rev5
  69. 2027-01-01FedRAMP Certification maintain · 20x
  70. 2027-01-01FedRAMP Certification grace · 20x
  71. 2027-01-01FedRAMP Certification obtain · rev5
  72. 2027-01-01FedRAMP Certification maintain · rev5
  73. 2027-01-01FedRAMP Certification grace · rev5
  74. 2027-01-01Incident Evaluation and Communication maintain · 20x
  75. 2027-01-01Incident Evaluation and Communication grace · 20x
  76. 2027-01-01Incident Evaluation and Communication obtain · rev5
  77. 2027-01-01Incident Evaluation and Communication maintain · rev5
  78. 2027-01-01Independent Verification and Validation maintain · 20x
  79. 2027-01-01Independent Verification and Validation grace · 20x
  80. 2027-01-01Independent Verification and Validation obtain · rev5
  81. 2027-01-01Independent Verification and Validation maintain · rev5
  82. 2027-01-01Independent Verification and Validation grace · rev5
  83. 2027-01-01Minimum Assessment Scope maintain · 20x
  84. 2027-01-01Minimum Assessment Scope grace · 20x
  85. 2027-01-01Minimum Assessment Scope obtain · rev5
  86. 2027-01-01Minimum Assessment Scope maintain · rev5
  87. 2027-01-01Minimum Assessment Scope grace · rev5
  88. 2027-01-01Significant Change Notification maintain · 20x
  89. 2027-01-01Significant Change Notification grace · 20x
  90. 2027-01-01Significant Change Notification obtain · rev5
  91. 2027-01-01Significant Change Notification maintain · rev5
  92. 2027-01-01Security Decision Record maintain · 20x
  93. 2027-01-01Security Decision Record grace · 20x
  94. 2027-01-01Security Decision Record obtain · rev5
  95. 2027-03-07Vulnerability Detection and Response grace
  96. 2027-03-07Vulnerability Evaluation and Reporting grace
  97. 2027-04-02Collaborative Continuous Monitoring maintain · rev5
  98. 2027-06-01Cryptographic Module Use grace · rev5
  99. 2027-06-01Incident Evaluation and Communication grace · rev5
  100. 2027-06-01Significant Change Notification grace · rev5
  101. 2027-07-01Certification Package Overview maintain · rev5
  102. 2027-08-01Certification Data Sharing maintain · rev5
  103. 2027-08-01Security Decision Record maintain · rev5
  104. 2027-08-01Security Decision Record grace · rev5
  105. 2027-10-01Collaborative Continuous Monitoring grace · rev5
  106. 2028-02-01Certification Data Sharing grace · rev5

Force distribution

Both totals, side by side and labelled (D7). They differ because forces also live inside per-class overrides; quoting either alone without saying which it is has already caused one wrong number.

ForceRequirement levelIncl. per-class
MUST136189
MUST NOT1111
SHOULD4584
SHOULD NOT55
MAY2039