2026-09-29 · fedramp.gov
FedRAMP Marketplace remains the public certified list
A listing still starts with the current package, not a brochure.
Intel
What changed the inheritance argument.
2024-10-15 · 32 CFR Part 170
32 CFR 170 keeps FedRAMP Moderate as the cloud authorization floor for CUI
OSCs inherit only what the CRM maps. The CSO authorization is not a CMMC certificate.
2026-09-01 · DoD Cloud Computing SRG
DoD SRG PA catalog is a separate track from FedRAMP Moderate
IL4/IL5 PA can outrank Moderate. Do not mix the offering names in the SSP.
2026-09-01 · DoD CIO CMMC
CMMC Phase 2 puts Level 2 on a growing set of DoD contracts
Cloud in the CUI boundary needs a current CRM before the C3PAO arrives.
2026-09-18 · Vendor 3PAO letters (public)
Announced equivalents still need a body of evidence
Treat equivalent rows as claims until the letter and CRM are in the package.
2026-09-01 · Microsoft public compliance docs
GCC High is a community, not a certificate
Name the CSO and the license. Do not write CMMC certified Microsoft cloud.
2026-09-01 · AWS compliance
AWS US East/West Moderate is not GovCloud
Export-controlled CUI usually needs GovCloud. Confirm the service list.
2026-09-29 · CSP Collective
Customer Responsibility Matrices are the inheritance artifact
If the vendor cannot produce a CRM mapped to 800-171, the row stays public record.