FedRAMP 20x: Maintain a Policy and Procedure Reference Index

A FedRAMP 20x policy procedure reference index helps readers find the right document and understand its current version. For Class B and C package owners, keep the reference connected to the actual policies and procedures being supplied.

The operating problem is familiar: a policy changes, but the package still points to an old file, summary or version. Treat the reference as maintained information with a clear source and owner.

Supply the policies and their reference information

CDS-CSO-IRP requires all relevant policies and procedures in the Certification Data, including a human-readable and machine-readable reference explaining at least seven categories about each included document. FedRAMP Certification Data Sharing

Those categories are:

1. The policy or procedure name.
2. The file, document, webpage or equivalent name.
3. A brief summary.
4. The document's word count.
5. Its current version.
6. The date of its last update.
7. Related FedRAMP Practices, if applicable.

The requirement includes supplying the relevant policies and procedures themselves. An index alone does not replace that part of the rule. Keep the reference useful by connecting it to the controlled document rather than treating it as a standalone list of titles.

Refresh the reference when the document changes

As an implementation practice, use the document's revision process to refresh its reference entry. Recheck the summary, word count, version, update date and related practices after substantive edits. Confirm the displayed file or page name still leads to the intended material.

For example, a procedure may be split into two documents. Review whether the old entry should now lead to two current references and whether each new summary explains the resulting scope. Preserve a way to understand the change internally without leaving the reader to guess which document applies.

Assign an owner for each reference or document family. This is an editorial operating suggestion, not a fixed FedRAMP refresh interval or prescribed index schema.

Keep the human and machine views consistent

CDS-CSO-CBF requires automation to ensure consistency between human-readable and machine-readable information when Certification Data is provided in both formats. FedRAMP CDS-CSO-CBF

One implementation option is to maintain a single reference record and generate both views from it. Another is an automated comparison between maintained representations. Test that a version or word-count change appears consistently in the output your readers and tools consume.

The JSON validation workflow can support validation where your implementation uses JSON. Keep the reference-format obligation distinct from the format of every underlying policy document.

Test access and keep history understandable

As a practical retrieval exercise, choose several entries and open their source documents through the intended access path. Check that the current reference points to current content and that the reader can distinguish it from retained historical material.

The package history guide addresses report-aligned snapshots. Use the sensitive-data guide when reviewing what information is shared with recipients.

The CDS page lists July 4, 2026 for initial certification and January 1, 2027 for ongoing certification, with grace ending on the first independent assessment started after January 1, 2027. Keep the applicable Class B or C context with your implementation.

A useful index lets a reader identify the document, understand its purpose and retrieve the stated version, while automation keeps the two reference views aligned.