🔒 Closed beta: four products · 📉 Corrections record: AI mistakes, counted by class and fed back into the next run · 📢 New post: FedRAMP Release 2026.10.13.01 Added 279 Control Mappings and Has No Changelog Entry · 📝 Also fresh: Atlassian CVE-2026-21589 Added to KEV; CVE Record Rejected the Next Day · 🚦 Beacon — the FedRAMP 20x KSI emitter — see what it emits ✨ · 🆕 20x Hub: program reference, kept current · 🧪 KSI Quick Check: KSI Quick Check — paste, run, get the verdict
← Blog
FedRAMPComplianceGRC

FedRAMP Release 2026.10.13.01 Added 279 Control Mappings and Has No Changelog Entry

Most of FedRAMP's 2026 rules site carries no feed, so we watch the pages that matter by hashing their rendered text and comparing against the last run. On October 15 that job flagged the 20x Class B and 20x Class C ruleset reference pages. The Class A page had not moved. A hash tells you a page changed and nothing more, so the next stop is the datafile.

The cause is release 2026.10.13.01 of the Consolidated Rules for 2026, and it is bigger than the ruleset tables suggest. It changed 76 of the 291 rules and Key Security Indicators in the corpus — 40 of the 46 indicators, and 36 of the 245 requirements and recommendations. Every one of those changes is a NIST SP 800-53 control mapping. We diffed every field of every rule between 2026.10.08.01 and 2026.10.13.01: the only keys that differ anywhere are controls and the updated history that records the mapping change. No statement moved, no force word changed, no note or timeframe was touched.

It is the largest change to the mappings since the June 24 launch. The changelog does not mention it. The page runs from 2026.10.14.01 back to 2026.10.08.01 without stopping, and the string "2026.10.13.01" appears on it zero times. The entry for 2026.10.14.01, the release that does have one, opens "No rules were harmed in the marking of this update" and describes a search-indexing change.

What the release actually did

The Consolidated Rules ship as a single machine-readable JSON file under version control, which means the arithmetic is available rather than estimated. Between the two releases:

  • Rules and indicators carrying at least one control mapping went from 44 to 80. Thirty-six of them had none at all before.
  • Individual rule-to-control mappings went from 373 to 652.
  • Distinct 800-53 controls referenced anywhere in the corpus went from 209 to 318. A hundred and twelve controls are named for the first time; AC-01, MA-02 and SI-12 are named nowhere at all now.

Some single indicators moved a long way. KSI-IAM-ELP (Ensuring Least Privilege) went from 34 mappings to 52. KSI-IAM-JIT (Authorizing Just-in-Time) went from 38 to 51. KSI-SCR-MIT (Mitigating Supply Chain Risk) went from 12 to 31, picking up most of the SA family and SR-02 and SR-03 along the way. KSI-IAM-SUS (Responding to Suspicious Activity) went from 7 to 20. On the requirements side, VDR-CSO-DET (Vulnerability Detection) went from nothing to sixteen, including the whole CA-08 penetration-testing cluster.

Two hundred and eleven rules still carry no mapping. Four rulesets carry none at any rule: Certification Data Sharing, Marketplace Listing, Security Decision Record, and FedRAMP Recognition of Independent Assessment Services. Those govern program process rather than the security of a service, so the absence reads as deliberate.

The three removals finish a boundary 20x was already keeping

Additions are the easy half. Three mappings were removed, and they are the interesting part, because each one was the last of its kind.

Removed From
ac-1 KSI-SVC-SIN — Securing Information
ma-2 KSI-CMT-LMC — Logging Changes, and KSI-SVC-EIS — Evaluating and Improving Security
si-12 KSI-RPL-ABO — Aligning Backups with Objectives

The Rev5 Class C baseline named in the rules contains eighteen family policy-and-procedures controls — AC-01 through SR-01, one per family. Before October 13, exactly one of them was mapped to any 20x rule or indicator: AC-01, on Securing Information. After October 13, none of them are. The release did not open a gap there; it closed the one exception to a gap that already ran eighteen controls wide.

MA-02 is the same shape. The Class C baseline carries 36 controls across Physical and Environmental Protection, Media Protection, and Maintenance. MA-02 was the only one of the 36 with a 20x mapping. That block is now mapped at zero, which is what you would expect of a program whose rules are about a cloud service offering rather than a building.

SI-12 is the loose thread. Information Management and Retention lost its mapping from Aligning Backups with Objectives, but si-12.3 — the Information Disposal enhancement — stayed exactly where it was, on KSI-SVC-RUD (Removing Unwanted Data). An enhancement mapped without its base control is not wrong, but it is the one place in this release where the pattern does not explain itself.

Coverage against the one 800-53 requirement CR26 does impose

Only one rule in the entire corpus attaches a force word to 800-53, and it is not about mappings. FRC-CSF-BSL (FedRAMP Rev5 Baselines) says providers seeking a Rev5 certification MUST include at least the listed controls in their Security Decision Record, and then lists them: 155 at Class B, 322 at Class C, 409 at Class D. That makes it the honest denominator for asking how much of the control world the 20x rules currently reach.

Rev5 baseline Controls Mapped before Mapped after Still unmapped
Class B 155 95 (61.3%) 109 (70.3%) 46
Class C 322 199 (61.8%) 254 (78.9%) 68
Class D 409 199 (48.7%) 308 (75.3%) 101

Class D gained the most because it was starting furthest back — before this release, the Class D baseline and the Class C baseline were covered by the same 199 controls, so every enhancement that Class D adds on top of Class C was unmapped by construction.

The 68 controls still unmapped at Class C decompose almost entirely into the two patterns above: eighteen are the family policy controls, 33 more are the remainder of Physical and Environmental Protection, Media Protection, and Maintenance. That leaves seventeen scattered across the rest, among them AC-22 (Publicly Accessible Content), CA-06 (Authorization), SC-15 (Collaborative Computing Devices), and SR-12 (Component Disposal).

The mapping also runs the other way in ten places. Ten controls referenced by 20x rules are not in the Rev5 Class D baseline at all, including PM-03, PM-07, PL-09 and AT-03(05). A Rev5 provider reading a mapping as a crosswalk to their own obligations will find a handful that point somewhere their baseline never went.

"Related" is doing a lot of work

On the rendered rule pages the field is labelled Related SP 800-53 Controls. That word is load-bearing and worth respecting. No rule in the Consolidated Rules says a provider must address a rule's mapped controls, says an assessor must test them, or gives the mapping any force at all — the four appearances of "800-53" in the datafile are all inside FRC-CSF-BSL's baseline lists. The rules overview, which is where the force words and the rule anatomy are explained, does not mention them.

So a mapping is a pointer, not an equivalence. Satisfying VDR-CSO-DET does not discharge RA-05, and nothing in CR26 claims it does. What the mapping is genuinely good for is the direction that was hard before: starting from a control you already have evidence for and finding which 20x rule or indicator that evidence belongs to. After October 13 that lookup succeeds for 254 of the 322 Class C baseline controls instead of 199, which is a real change in how much of a Rev5 package can be pointed at a 20x rule without a judgment call.

Where the record lives

The change is documented, just not where a release-watcher looks. Each affected rule carries a dated per-rule changelog entry naming the controls added and removed, rendered on its reference page and stored in the datafile's updated array. VDR-CSO-DET's reads "Updated control mappings: added au-5.2, au-6, ca-8, ca-8.1, ca-8.2, ra-5, ra-5.2, ra-5.3, ra-5.4, si-2, si-3, si-4.1, si-4.12, si-4.18, si-4.22, si-5.1." That is complete and checkable, and it is the thing the next release, 2026.10.14.01, removed from site search so that result snippets would show rule text instead.

The other copy is the commit, which carries the full before-and-after of every rule that moved and needs no credentials to read. Its message says "Merge revised controls arrays from control-mapping review; no other content changes" — and unlike the October 8 release's claim about itself, that one holds up under the diff. We checked every other field and found nothing.

The commit also carries a Co-Authored-By trailer naming a model, which is the first thing worth saying plainly rather than archly: a 279-mapping revision of a federal ruleset was done with AI assistance, in public, in a repository where anyone can diff it, with a per-rule history entry generated for each change. That is the shape we argue for — the work is reviewable because the artifact is reviewable. The release has one bookkeeping miss out of 76 rules, and it is cosmetic: IVV-IAS-VEF gained an empty controls array where the key had simply been absent, and is the only changed object without an October 13 history entry. An empty array is not a mapping, so the omission is defensible; it does show the history entries were generated from a slightly different predicate than the diff.

For us the practical consequence is unglamorous. Novaprospect's audit engine ships a browsable Rev5-and-KSI catalog with the mappings wired up, and a release like this is exactly why that catalog is rebuilt from the published datafile on every run rather than transcribed once. Eighty rules now carry mappings where 44 did, and the version string in the file is the only thing that tells you to go look.

Which leaves the question we keep landing on from a different direction each time. If a program publishes the full text of a change, per rule, in a diffable artifact, and omits it from the one page built for people tracking changes — is it published? The record says yes, and everybody watching the changelog says no, and the gap between those answers is where compliance surprises live.

Reference