Sign in Get started

What Keel scores in FedRAMP's Consolidated Rules, and what it does not

FedRAMP publishes 246 rules for 2026. Keel scores 165 of them: every rule that states a duty a cloud service provider can actually carry out. The other 81 are named below, one by one, with the reason.

Out of scope is not the same as irrelevant. A rule addressed to your assessor still shapes what you have to hand them. What it does not do is give you something to implement, so scoring you against it would put a permanent gap in your readiness figure with no action behind it.

165rules scored
66bind someone else
15grant a permission

Rules that grant a permission

FedRAMP writes these with the force MAY. They tell a provider it is allowed to do something, not that it has to. Keel has no notion of an optional requirement, so scoring these would mark you incomplete for declining a permission FedRAMP explicitly gave you. These are the calls most worth contesting, which is why they come first.

Rules addressed to someone other than the provider

FedRAMP's rules bind agencies, independent assessors, advisors and FedRAMP itself as well as providers. Each rule below states its own audience, and none of them names providers.

Addressing FedRAMP Communication 8

Agency Use of FedRAMP Certified Cloud Services 20

Collaborative Continuous Monitoring 2

FedRAMP Recognition of Independent Assessment Services 16

Incident Evaluation and Communication 1

Independent Verification and Validation 7

Marketplace Listing 7

Significant Change Notification 1

Vulnerability Evaluation and Reporting 4

Where the inventory came from

FedRAMP publishes its rules as structured data rather than as a document, and asks automation to read that rather than the rendered site. This register is built from fedramp-consolidated-rules.json v2026.07.14.01, retrieved 2026-09-05, and every audience and force above is FedRAMP's own field rather than a Keel reading of prose. The three groups are asserted to partition the published set, so a rule cannot fall into none of them and quietly disappear from this page.

Think one of these belongs in scope? That is the point of publishing it, so tell us which rule. The full framework is at FedRAMP Consolidated Rules.