Table Of Contents
REQUIREMENT ID: CDS-CSO-UTC | CATEGORY: CERTIFICATION DATA SHARING (CDS) | SUBSET: GENERAL PROVIDER RESPONSIBILITIES (CSO)
Source: FedRAMP Consolidated Rules for 2026, release 2026.10.13.01. Rule text unchanged since the 2026-06-24 launch.
The requirement
Providers MUST use a FedRAMP-compatible trust center to store and share FedRAMP Certification Data with all necessary parties. (force: MUST)
Source note: “Rules for FedRAMP-Compatible Trust Centers are explained in the Certification Data Sharing Rules under the FedRAMP-Compatible Trust Centers section (id: CDS-TRC).”
Who it applies to, and when
This rule sits in the General Provider Responsibilities subset, which applies to providers for FedRAMP Certifications of any type: 20x and Rev5, Program and Agency paths, Classes B, C and D. Class A providers must address it too, through FRC-CLA-MFR (Mandatory FedRAMP Rules for Class A).
| Path | Optional adoption | Required to obtain certification | Required to maintain certification |
|---|---|---|---|
| 20x | 2026-07-04 | 2026-07-04 | 2027-01-01 |
| Rev5 | 2026-07-04 | 2027-01-01 | 2027-08-01 |
What does this mean?
FedRAMP defines the terms:
Trust center. A secure repository or service used by cloud service providers to store and share FedRAMP Certification Data. Trust centers are the complete and definitive source for that data, and must follow the Certification Data Sharing rules to be FedRAMP-compatible. In FedRAMP documentation, “trust center” always means a FedRAMP-compatible one unless stated otherwise.
Certification Data. The collective information FedRAMP requires for initial and ongoing certification of a cloud service offering, including the Certification Package.
Certification Package. The meaning 44 USC § 3607(b)(8) gives to “authorization package”: the essential information an agency uses to decide whether to authorize the system.
All necessary parties. Every entity whose interests are directly affected by activity related to the offering. This always includes FedRAMP and any agency customer using the offering. It may include consultants or independent assessors under the provider’s agreements. Potential agency customers and third-party cloud service providers should be included in most cases, but FedRAMP does not mandate it, because the provider chooses who it does business with.
In short: the trust center is the one definitive source of the data, and all sharing goes through it.
This article is also a LinkedIn newsletter. If you would like to receive it straight to your inbox, subscribe here.
What “FedRAMP-compatible” means
A trust center is FedRAMP-compatible when it follows the six CDS-TRC rules:
| Rule | Name | Force | What it requires |
|---|---|---|---|
| CDS-TRC-USH | Uninterrupted Sharing | MUST | Parties get the data without interruption. They must not have to request manual approval each time. FedRAMP prefers on-demand just-in-time access. |
| CDS-TRC-PAC | Programmatic Access | MUST | Documented programmatic access to all Certification Data, including the human-readable materials. |
| CDS-TRC-AAI | Agency Access Inventory | MUST | An inventory and history of federal agency users or systems with access, available to FedRAMP on request. |
| CDS-TRC-ACL | Access Logging | MUST | Log access and keep access summaries for at least six months. A party’s own summaries SHOULD be available to that party on request. |
| CDS-TRC-HMR | Human and Machine-Readable | SHOULD | View and download in both formats. |
| CDS-TRC-SSM | Self-Service Access Management | SHOULD | Parties provision and manage access for their own users and services. |
Why does this matter?
FedRAMP lets providers store and share Certification Data on the platform they choose, as long as it follows FedRAMP’s rules for access, accuracy and transparency. The data usually stays the provider’s intellectual property and is not federal information. The trust center replaces the USDA Connect Community Portal secure folders as the place agencies obtain the data.
When certification information is scattered across email threads, shared drives and ad hoc file transfers, nobody knows which copy is current. Stakeholders act on stale or partial data, and sensitive material travels over insecure channels. One FedRAMP-compatible trust center gives every party a single controlled point of access and makes clear where the definitive version lives.
What could implementation look like?
This is illustrative, not a mandated method. Select or stand up a trust center that meets the six CDS-TRC rules, then move the Certification Package and related data into it as the authoritative source. Record the trust center’s URL and access instructions in the Certification Package Overview (the rule’s schema, FRC-CSO-PKG). Give FedRAMP, agency customers and any assessors or consultants under agreement standing access, so nobody waits on a manual approval per request. Publish each update through the trust center, keep a snapshot aligned to each Ongoing Certification Report (CDS-CSO-HAD), and use automation to keep the human-readable and machine-readable copies consistent (CDS-CSO-CBF).
Example scenario
A mid-sized provider offers a FedRAMP-certified SaaS platform. It used to email parts of its Certification Package to each agency customer and post files to a general folder for its assessor.
It adopts a FedRAMP-compatible trust center, loads its Certification Data there, and records the trust center in its Certification Package Overview. Its two agency customers, its independent assessor and FedRAMP get standing access with no per-request approval. Agencies can also pull the data programmatically. When it revises a system document during continuous monitoring, it updates the trust center copy, and the next Ongoing Certification Report gets its own snapshot. Everyone reads the same authoritative version.
What evidence could demonstrate implementation?
The rule names no custom artifacts, so FedRAMP’s default rule artifacts apply: an explanation of how the rule is followed; verification the implementation fits the rule; validation it is in place and working; independent verification; independent validation. Concrete items:
- The trust center entry (URL and access instructions) in the published Certification Package Overview.
- Programmatic access documentation (CDS-TRC-PAC).
- The agency access inventory and access-log summaries (CDS-TRC-AAI, CDS-TRC-ACL).
- Access configuration showing standing, not per-request, access (CDS-TRC-USH).
- Snapshot and version records tied to Ongoing Certification Reports (CDS-CSO-HAD).
- The procedure that publishes updates through the trust center.
Common pitfall
Treating the trust center as one of several places the data lives, while still emailing key files or using separate drives. A second pitfall: a trust center that gates every access behind a manual approval. The data is “in” the trust center, but CDS-TRC-USH is not met. And if you deny an agency access request, you must notify FedRAMP within 5 business days (CDS-UTC-AAD).
Question for your team
Do all necessary parties obtain our Certification Data through one FedRAMP-compatible trust center, with no side channels? Does that trust center meet the four CDS-TRC MUSTs?
Key takeaway
Keep Certification Data in, and share it through, one FedRAMP-compatible trust center that meets the CDS-TRC rules. Every stakeholder then has one authoritative, secure source.
Related requirements
| Rule | Force | One line |
|---|---|---|
| CDS-TRC-USH, PAC, AAI, ACL | MUST | What makes a trust center FedRAMP-compatible. |
| CDS-TRC-HMR, SSM | SHOULD | Both formats; self-service access management. |
| CDS-UTC-AGA | SHOULD | Supply access to the Certification Package to agencies on request. Applies to providers using a trust center instead of USDA Connect. |
| CDS-UTC-AAD | MUST | Notify FedRAMP within 5 business days of denying an agency access request. Same applicability as CDS-UTC-AGA. |
| CDS-CSO-HAD | MUST | Snapshots of Certification Data aligned to Ongoing Certification Reports, kept for the duration of certification. |
| CDS-CSO-CBF | MUST | Automation keeps human-readable and machine-readable formats consistent. |
| CDS-CSF-TCM | MUST (Rev5 only) | Notify all necessary parties when migrating to a trust center; leave instructions in the existing USDA Connect secure folders. |
| FRC-CSO-PKG | Schema | The Certification Package Overview; its trustCenter entry holds the URL and access instructions. |
| FRC-CLA-MFR | MUST | Makes CDS-CSO-UTC mandatory for Class A. |
Have a question about putting this requirement into practice?
38North Security can help you turn the requirements into an operating model that works in practice. Talk to us →
The quoted requirement, note, definitions, applicability and dates are from the FedRAMP Consolidated Rules for 2026, release 2026.10.13.01. The implementation ideas, scenario and evidence examples are guidance and should be validated against official FedRAMP guidance.
About the Authors
