# CPO-CSF-CPM — Certification Package Maintenance for Rev5

> FedRAMP Consolidated Rules for 2026 v2026.07.14.01 · updated 2026-07-14
> Canonical page: /requirement/cpo-csf-cpm

Certification Package Overview (`CPO`) · group rev5 · subset CSF
Force: none stated

## Statement

_No statement text is recorded for this requirement._

## Who it binds

- Providers

## Certification classes

- class B
- class C
- class D

## Which certifications it binds

Certification type: 20x, Rev5 (this subset states no type restriction)
Path: Program, Agency (this subset states no path restriction)

## Machine-readable form

_This requirement names no JSON schema. FRC-CSO-JSN binds a provider to a schema only where a rule contains one._

## Artifacts

_No requirement-specific artifact is named._

## Timeframes

- {"requirementId":"CPO-CSF-CPM","documentKey":"CPO","documentName":"Certification Package Overview","group":"rev5","subset":"CSF","name":"Certification Package Maintenance for Rev5","statement":"Providers with Rev5 Class D Certifications MUST persistently maintain their FedRAMP Certification Package to ensure it is up to date and complete at least once every six months.","force":"MUST","affects":["Providers"],"class":"d","num":6,"type":"months","sortKey":4383}
- {"requirementId":"CPO-CSF-CPM","documentKey":"CPO","documentName":"Certification Package Overview","group":"rev5","subset":"CSF","name":"Certification Package Maintenance for Rev5","statement":"Providers with Rev5 Class B Certifications MUST persistently maintain their FedRAMP Certification Package to ensure it is up to date and complete at least once every year.","force":"MUST","affects":["Providers"],"class":"b","num":1,"type":"years","sortKey":8766}
- {"requirementId":"CPO-CSF-CPM","documentKey":"CPO","documentName":"Certification Package Overview","group":"rev5","subset":"CSF","name":"Certification Package Maintenance for Rev5","statement":"Providers with Rev5 Class C Certifications MUST persistently maintain their FedRAMP Certification Package to ensure it is up to date and complete at least once every year.","force":"MUST","affects":["Providers"],"class":"c","num":1,"type":"years","sortKey":8766}

## Notifications

_This requirement demands no notification._