Notice 0012: FedRAMP providers report incidents to agencies and FedRAMP, not CISA, and no longer have to email about outages

▶ Play the video: FedRAMP Public Notice-0012: Initial Outcome of RFC-0031 - Updated Incident Communications Procedures

On June 10, 2026, the Federal Risk and Authorization Management Program (FedRAMP) posted a video about FedRAMP Notice 0012, issued June 3, 2026. The notice gives the outcome of RFC-0031, a request for comment (RFC) on updated incident communication procedures. The rules are part of the FedRAMP Consolidated Rules for 2026 (CR26), which call FedRAMP's approval a "FedRAMP Certification."

In short:

• What FedRAMP said. A provider reports an incident to FedRAMP and to its agency customers. Each agency then decides whether to report it to the Cybersecurity and Infrastructure Security Agency (CISA). Outage notices go to necessary parties, and a speaker in the video said a status page can replace outage emails.
• Who it affects. Every cloud service provider that holds or seeks a FedRAMP Certification, and the agencies that use those services.
• What they must do. Notify customers early, with what they know, within set time frames. FedRAMP recommends automating those notices.
• By when. The notice took effect July 4, 2026. It is mandatory on July 4, 2026, for providers seeking a 20x Certification, and on January 1, 2027, for providers seeking or keeping a Rev5 Certification or keeping a pilot 20x Certification.

Do providers still report incidents to CISA?

Not for FedRAMP. The notice says: "FedRAMP will no longer expect private companies to report incidents regarding agency customers directly to CISA." The agency reports to CISA when its own impact calls for it. The notice adds that some older contracts may still require direct reports, and a provider must still meet any other law that applies to it.

In the video, a FedRAMP speaker explained why. The provider does not know how a breach affects each agency. The same stolen data could be a serious problem for one agency and of no concern to another whose data was already public. So the provider estimates the effect on its customers, notifies them, and each agency decides the impact. The speaker said FedRAMP has the overall view and can coordinate with CISA.

What changes in how providers notify?

• Outages. Availability reporting moves to the Certification Data Sharing rules. The provider shares it with all necessary parties; it does not have to be public, as the RFC had proposed. In the video, a speaker said nobody needs to send emails about outages; a provider may still send them, or post outages on its status page.
• Early notice. A provider must send timely notice with whatever information it has. A speaker in the video said a message that an incident is ongoing, that the provider does not yet know what is affected, and that it is reviewing the incident would meet the rules.
• Automation. A new SHOULD rule recommends automated notices. The notice says providers "should not be hand-crafting artisanal incident notifications."
• New terms. "Potential Adverse Impact" becomes "Potential Agency Impact." "Adverse Effects" becomes "Customer Effects," rated minimal, narrow, disruptive, or debilitating. "Federal reportable incidents" becomes "FedRAMP reportable incidents."
• Optional impact rating. A provider that does not estimate an incident's Potential Agency Impact (PAIN) rating must report it at the highest level, PAIN 5.

Is the one-hour report new?

No. In the video, a FedRAMP speaker said many commenters called one-hour response times unreasonable, although that has been the de facto requirement for FedRAMP's whole life. Under the notice, Class C (Moderate) services send the first report within 1 hour and ongoing and final reports within 6 hours. Class D (High) services send the first report within 15 minutes and the others within 3 hours. The reporting clock starts once the provider has promptly decided the incident is reportable.

In CR26 these rules are now called Incident Evaluation and Communication. FedRAMP's Rev5 reference page lists them as required from January 1, 2027, with a grace period that ends June 1, 2027.

Sources

• FedXchange tracker: FedRAMP Public Notice-0012 video (June 10, 2026)
• YouTube: FedRAMP Public Notice-0012: Initial Outcome of RFC-0031
• FedRAMP Notice 0012: Initial Outcome of RFC-0031 (FedRAMP's page)
• FedRAMP RFC-0031: Updated Incident Communications Procedures (FedRAMP's page)
• FedRAMP Consolidated Rules for 2026
• FedRAMP: Incident Evaluation and Communication (Rev5, Class C)