01
Authorization status: a FedRAMP package ID or a 3PAO body of evidence
02
In-scope services and the region they run in
03
A customer responsibility matrix mapped to NIST SP 800-171 Rev 2 and Rev 3
04
Annual revalidation, or sooner if the boundary changes