Sign in Get started

What Keel scores in FedRAMP's Consolidated Rules, and what it does not

FedRAMP publishes 200+ rules for 2026. Keel scores 150+ of them: every rule that states a duty a cloud service provider can actually carry out. The rest are named below, one by one, with the reason.

Out of scope is not the same as irrelevant. A rule addressed to your assessor still shapes what you have to hand them. What it does not do is give you something to implement, so scoring you against it would put a permanent gap in your readiness figure with no action behind it.

150+rules scored
50+bind someone else

Rules that grant a permission

FedRAMP writes these with the force MAY. They tell a provider it is allowed to do something, not that it has to. Keel has no notion of an optional requirement, so scoring these would mark you incomplete for declining a permission FedRAMP explicitly gave you. These are the calls most worth contesting, which is why they come first.

Rules addressed to someone other than the provider

FedRAMP's rules bind agencies, independent assessors, advisors and FedRAMP itself as well as providers. Each rule below states its own audience, and none of them names providers.

Addressing FedRAMP Communication

Agency Use of FedRAMP Certified Cloud Services

Collaborative Continuous Monitoring

FedRAMP Recognition of Independent Assessment Services

Incident Evaluation and Communication

Independent Verification and Validation

Marketplace Listing

Significant Change Notification

Vulnerability Evaluation and Reporting

Where the inventory came from

FedRAMP publishes its rules as structured data rather than as a document, and asks automation to read that rather than the rendered site. This register is built from fedramp-consolidated-rules.json v2026.07.14.01, retrieved 2026-09-05, and every audience and force above is FedRAMP's own field rather than a Keel reading of prose. The groups are asserted to partition the published set, so a rule cannot fall into none of them and quietly disappear from this page.

Think one of these belongs in scope? That is the point of publishing it, so tell us which rule. The full framework is at FedRAMP Consolidated Rules.