# SDR-CSO-FRR — FedRAMP Rules

> FedRAMP Consolidated Rules for 2026 v2026.07.14.01 · updated 2026-07-14
> Canonical page: /requirement/sdr-cso-frr

Security Decision Record (`SDR`) · group all · subset CSO
Force: MUST

## Statement

Providers MUST supply a Security Decision Record, in both human-readable and JSON formats, that includes at least all of the following information for each applicable FedRAMP rule:

## Who it binds

- Providers

## Certification classes

_Applies regardless of certification class._

## Which certifications it binds

Certification type: 20x, Rev5
Path: Program, Agency

## Machine-readable form

FedRAMP Security Decision Record Schema — https://fedramp.gov/schemas/fedramp-security-decision-record-schema-2026-06-24.json

## Artifacts

_No requirement-specific artifact is named._

## Timeframes

_This requirement states no deadline._

## Notifications

_This requirement demands no notification._