Skip to content
FedRAMP Rules Hub
JSON — GET /api/obligations

Keyboard shortcuts

Go

  • Scope — the control cataloggm
  • Plan — your last certification classgp
  • Collect — the recipe indexgc
  • The control you are workinggw
  • Startgh

Move

  • Next rowj
  • Previous rowk
  • Previous in this run[
  • Next in this run]
  • Filter this page's list/
  • Search everything⌘K

Act

  • Copy this page's permalinky
  • Toggle dark moded
  • This sheet?

Rows are whatever the current page lists — controls on Scope, recipes on Plan and Collect.

Control index

MAS-CSO-TPRThird-Party Information Resources

JSON — GET /api/obligationsMD — /requirement/mas-cso-tpr.md — this page as markdown, for pasting into an agent
allMUST
Providers MUST address the potential impact to federal customer data from third-party information resources used by the cloud service offering, ONLY IF MAS-CSO-IIR (Identify Information Resources) APPLIES, by documenting the following information about each applicable third-party information resource:

Who it binds

Providers

Controls whose FedRAMP guidance points at MAS (2)

Their guidance names the Minimum Assessment Scope rules as a whole, not this requirement — so this is where to read from, not a mapping to this clause. Controls no KSI reaches have no page and are not listed.

CM-12CM-12 (01)

Which certifications it binds

Certification type
20x · Rev5
Path
Program · Agency

Machine-readable form

FedRAMP Certification Package Overview (FRC-CSO-PKG)

https://fedramp.gov/schemas/fedramp-certification-package-overview-schema-2026-06-24.json

Evidence this requirement demands

  • A machine readable output containing all required data of the third-party information resources of the cloud service offering that are likely to handle federal customer data or likely to impact the confidentiality, integrity, or availability of federal customer data handled by the cloud service offering.
  • A human readable explanation of how the machine readable output is derived.
  • The code for the automated process used to generate the machine readable output.
5 default artifacts owed by every FRR requirement
  • Explanation of how the rule is followed, or an explanation of the reason and resulting risk to customers for not following the rule.
  • Verification that the implementation is appropriate for the rule, or that the reason for not implementing is accepted by a senior official.
  • Validation that the implementation is in place and working as intended, or that the reason for not implementing is accepted by a senior official.
  • Independent verification.
  • Independent validation.

Group all, subset CSO of Minimum Assessment Scope. See all obligations on /obligations or the full evidence plan on /evidence.