---
title: "20x Ruleset Reference"
description: "This section contains the FedRAMP 20x rulesets as standalone references."
purpose: "This content allows folks to see the 20x rules together without them broken apart by stakeholder."
google_doc: ""
tags:
  - 20x
  - Federal Agencies
  - Cloud Service Providers
  - Independent Assessors
  - Advisors
  - FedRAMP
  - Rules
picto:
  source: machine
---

<span class="picto">:lucide-computer:{ .machine title="This content is machine-generated from FedRAMP Machine-Readable Rules." }</span>

# 20x Ruleset Reference

This section contains the FedRAMP 20x rulesets with content that applies to one or more 20x classes.

| Acronym | Ruleset | Status | Counts | Most Recently Updated |
| --- | --- | --- | --- | --- |
| AFC | Addressing FedRAMP Communication<br>[Class B](b/addressing-fedramp-communication.md)<br>[Class C](c/addressing-fedramp-communication.md) | Stable | Subsets: 2<br>Rules: 16 | 2026-06-24 |
| CCM | Collaborative Continuous Monitoring<br>[Class B](b/collaborative-continuous-monitoring.md)<br>[Class C](c/collaborative-continuous-monitoring.md) | Stable | Subsets: 3<br>Rules: 19 | 2026-06-24 |
| CDS | Certification Data Sharing<br>[Class B](b/certification-data-sharing.md)<br>[Class C](c/certification-data-sharing.md) | Stable | Subsets: 3<br>Rules: 20 | 2026-06-24 |
| CMU | Cryptographic Module Use<br>[Class B](b/cryptographic-module-use.md)<br>[Class C](c/cryptographic-module-use.md) | Stable | Subsets: 1<br>Rules: 3 | 2026-06-24 |
| CPO | Certification Package Overview<br>[Class A](a/certification-package-overview.md)<br>[Class B](b/certification-package-overview.md)<br>[Class C](c/certification-package-overview.md) | Stable | Subsets: 2<br>Rules: 4 | 2026-06-25 |
| FRC | FedRAMP Certification<br>[Class A](a/fedramp-certification.md)<br>[Class B](b/fedramp-certification.md)<br>[Class C](c/fedramp-certification.md) | Stable | Subsets: 4<br>Rules: 21 | 2026-07-14 |
| IEC | Incident Evaluation and Communication<br>[Class B](b/incident-evaluation-and-communication.md)<br>[Class C](c/incident-evaluation-and-communication.md) | Stable | Subsets: 2<br>Rules: 8 | 2026-07-02 |
| IVV | Independent Verification and Validation<br>[Class B](b/independent-verification-and-validation.md)<br>[Class C](c/independent-verification-and-validation.md) | Stable | Subsets: 3<br>Rules: 16 | 2026-06-24 |
| MAS | Minimum Assessment Scope<br>[Class B](b/minimum-assessment-scope.md)<br>[Class C](c/minimum-assessment-scope.md) | Stable | Subsets: 1<br>Rules: 5 | 2026-06-24 |
| MKT | Marketplace Listing<br>[Class A](a/marketplace-listing.md)<br>[Class B](b/marketplace-listing.md)<br>[Class C](c/marketplace-listing.md) | Stable | Subsets: 5<br>Rules: 12 | 2026-06-24 |
| SCG | Secure Configuration Guide<br>[Class B](b/secure-configuration-guide.md)<br>[Class C](c/secure-configuration-guide.md) | Stable | Subsets: 2<br>Rules: 9 | 2026-06-24 |
| SCN | Significant Change Notification<br>[Class B](b/significant-change-notification.md)<br>[Class C](c/significant-change-notification.md) | Stable | Subsets: 5<br>Rules: 17 | 2026-06-24 |
| SDR | Security Decision Record<br>[Class B](b/security-decision-record.md)<br>[Class C](c/security-decision-record.md) | Stable | Subsets: 2<br>Rules: 4 | 2026-06-24 |
| VDR | Vulnerability Detection and Response<br>[Class B](b/vulnerability-detection-and-response.md)<br>[Class C](c/vulnerability-detection-and-response.md) | Stable | Subsets: 2<br>Rules: 17 | 2026-07-01 |
| VER | Vulnerability Evaluation and Reporting<br>[Class B](b/vulnerability-evaluation-and-reporting.md)<br>[Class C](c/vulnerability-evaluation-and-reporting.md) | Stable | Subsets: 5<br>Rules: 23 | 2026-06-24 |
