Skip to main content
This is not an official U.S. federal government website. The Federal Modernization Workbook is independent technical analysis. It does not represent the position of, and has not been reviewed or endorsed by, any federal agency.

Explainer · In review

Federal HR 2.0 Across Agencies and Boundaries: Shared Governance, FedRAMP’s 2026 Rules and What Oracle Publishes

An explainer: where agencies can share HR 2.0 implementation work, what the FedRAMP Consolidated Rules for 2026 change about the boundary, what they don’t make public, where Oracle’s HR platform stands today, FIPS validated cryptography at Moderate, and the domains Oracle’s government cloud uses

Research under review. It covers the forums Federal HR 2.0 provides for agencies to share implementation work and who runs them. It covers what the FedRAMP Consolidated Rules for 2026 require a provider to publish about its assessment scope, when those rules reach existing Rev5 packages, and what can stay restricted. It sets out where Oracle Fusion Cloud’s Marketplace record stands, what still limits HR data crossing from the platform to an agency system, FIPS 140 at Moderate, and Oracle’s .com government domains, with questions an agency can put to OPM and Oracle.
Modified

October 30, 2026

Status — In review

This page is under review and is not yet part of the workbook's production guidance. Its claims are sourced, but its analysis and any recommendation are the program's working view; they may change before review is complete, and they are not endorsed by any federal agency. Last reviewed 2026-10-30.

Federal HR 2.0 puts every civilian agency’s core HR on one Oracle Fusion Cloud HCM platform that OPM runs (Book 03, Chapter 03). Two questions follow for an agency building its identity feed from it (Book 03, Chapter 05):

  1. Can agencies share their implementation work with each other? That covers configurations, integrations, the identity feed and lessons learned.
  2. Has FedRAMP’s move to the 2026 rules settled what crosses the boundary? More precisely: the rules change what may cross, but do they ensure that the provider hosting HR 2.0 has documented, rather than restricted, information about what its boundary holds?

Book 10, Chapter 03 sets out what the Consolidated Rules for 2026 changed. This page applies it to the HR 2.0 platform.

NoteSources and labels

Every fact was checked against primary sources on October 30, 2026, and is footnoted. FedRAMP’s rules file (version 2026.10.13.01) and Marketplace data (updated October 30, 2026) were downloaded and parsed directly. Statements marked (inference) are conclusions the sources support but don’t state; (design guidance) marks the program’s recommendations. Some OPM slides cited here are publicly posted but marked “draft – pre-decisional”; they’re cited as what OPM showed agencies, not as settled policy. Agencies are named only as cited sources; nothing here is endorsed by any agency.

What the research found

  • Agencies have seats, but every forum is OPM’s. The memo creates a Federal HR 2.0 Advisory Board “comprising key stakeholder agencies.”1 The solicitation sets out a Steering Committee, a Customer Advisory Board whose members “represent their agency,” and Policy, Data and Super User working groups, with OPM chairing both boards.2 No public forum lets agencies share configurations or integrations with each other directly, and none of these bodies publishes its output.
  • Solutions spread from the top. The Steering Committee approves every agency-specific integration and customization, and will “enforce configuration patterns and reusable templates across all agencies.”34 All agencies run one “common federal baseline configuration.”5 OPM’s program office is the “primary integrator,” including for identity management.6 An agency’s identity feed is therefore something the program approves and may make a reusable pattern, not something agencies trade among themselves (inference).
  • The hypothesis about the boundary is half right. The 2026 rules do require every certified provider, Rev5 included, to publish a service list “complete enough for a potential customer to determine which services are and are not included” in its assessed scope.7 But:
    • that duty reaches existing Rev5 packages only from 2027, with a grace period to February 1, 2028;8
    • the scope documentation itself stays in the certification package, shared through a trust center with “all necessary parties,” which needn’t include an agency that isn’t yet a customer;910
    • FedRAMP treats that material as “the provider’s intellectual property and is not federal information.”11
  • Oracle publishes neither the list nor the scope today. Oracle’s Fusion Cloud record (package F1603257882, Moderate, agency path, certified January 13, 2020) has no trust center, no certified-services list and no third-party resources entered. No Oracle listing has a trust center, and none names OPM.12 Oracle’s award release calls the platform “FedRAMP-authorized” without naming a package.13 Which package covers OPM’s Core HCM instance still can’t be confirmed from public sources.
  • The rules document data leaving the scope; they don’t stop it. A provider documents its information flows and third-party resources;14 material outside the offering is simply “not FedRAMP Certified.”15 The limits on HR data crossing into an agency system come from elsewhere:
    • the agency’s own authorization;16
    • privacy law, which FedRAMP “does not replace”;17
    • the CUI rule;18
    • information-exchange agreements;19
    • the program’s API gateway requirement.20
  • Validated cryptography at Moderate is a SHOULD in FedRAMP and a must for the agency. Under the 2026 rules, Class C (Moderate) providers “SHOULD use” modules with active validations; only Class D must.21 NIST’s validation program says “if cryptography is required, then it must be validated,” for all federal agencies.22 FIPS 140-2 validations move to the historical list after September 21, 2026.23
  • Oracle’s government cloud is .com, not .us. Oracle’s US Government and US Defense cloud regions sign in at hosts such as console.us-langley-1.oraclegovcloud.com.2425 Oracle doesn’t publish the Fusion Applications hostname pattern for its restricted regions.26 Microsoft’s GCC High uses .us endpoints, and GCC uses the worldwide .com ones.27

Part 1: Where agencies can share HR 2.0 work

The forums the program provides

The HR 2.0 forums in the memo and the solicitation
Body Source Who sits on it What it does
Federal HR 2.0 Advisory Board Memo, p. 3 “key stakeholder agencies”; the CHCO Council reports an advisory board of CHCOs and federal CIOs for HR IT modernization “assist with governance and change management”2829
Interagency working groups Memo, Appendix C Agency representatives Policy, Data, Learning and Super User groups that “meet regularly to address agency readiness, migration, and testing coordination”30
Executive sponsorship Solicitation §2.1 The OMB and OPM Directors Final authority over major configurations and customizations31
Steering Committee Solicitation §2.1, §5.6, App. B “senior leaders”; membership and charter not published Recommendations; approves agency-specific integrations and customizations; enforces configuration patterns and reusable templates323334
Customer Advisory Board Solicitation §2.1 Members who “represent their agency” “formal open communication from the program to agency customers”; OPM chairs it with the Steering Committee, and both meet at least monthly35
Policy, Data and Super User working groups Solicitation §2.1 Agency representatives The Data group covers migration and integration strategy “within and across federal agencies”36
Government-wide program management office Solicitation §5.2 OPM, with the vendor The “primary integrator” for agencies, including identity management, single sign-on, integration and data migration; data readiness managed jointly with each agency37

OPM’s agency priority goal for Core HCM lists an “Interagency executive investment and advisory board” among its stakeholders, with the CHCO Council, the HR Line of Business and the HR Quality Service Management Office.38

Bodies that exist but have no stated HR 2.0 role

  • The CHCO Council. The statute tasks it with advising and coordinating agencies’ activities, including the modernization of human resources systems,39 and its charter lets it form working groups and share promising practices.40 Its 2025 report lists one new working group, on a different topic.41
  • The HR Line of Business. Its multi-agency executive steering committee sets up communities of practice,42 and its human capital standards are the ones the solicitation requires the configuration to follow.4344 Its pages don’t mention Core HCM.
  • The HR Quality Service Management Office. OPM’s office under M-19-16 continues, with a “customer engagement and feedback model.”4546 The solicitation’s answers give it change control of the HR data model.47
  • No change control board. The answers say none is defined.48

After the award

OPM’s Core HCM page and award release describe no onboarding playbook, agency liaison model or community.4950 The publicly posted material reaches agencies through OPM’s quarterly eOPF “Agency Touchpoint”: - the June 2026 questions and answers send Core HCM questions to each Wave 1 agency’s point of contact or the program mailbox;51 - a June 2026 slide, marked draft and pre-decisional, mentions “governance and working group formation”;52 - the March deck sets out the program’s principles, including a single ATO for which agencies don’t need their own.53

What this means for an agency’s identity feed

(Inference and design guidance.) The Steering Committee approves the identity feed as an agency-specific integration, and it may turn the approved pattern into a reusable template for other agencies. So: 1. Bring the feed to the program early, as a pattern. Submit Book 03’s pipeline (Core HCM to a middleware in the agency boundary to Entra ID) as an integration others can reuse, not as an exception. The HCM implementation guide records that the solicitation already shows an “Identity Management Solution” fed by Core HCM in its sample interconnection. 2. Use the Data working group and the Customer Advisory Board to ask which identity integrations other agencies have had approved, since nothing is published. 3. Keep the agency-owned parts agency-owned: the enterprise person key, the canonical schema, the middleware and the contractor source. Book 03 designs these to outlast any one HR source (Chapter 04), and they’re the part another agency can reuse without the program.

Part 2: What FedRAMP’s 2026 rules publish, and what stays restricted

Three tiers of information

The Consolidated Rules for 2026 sort a provider’s information into three tiers:

What a provider must publish, and to whom, under the 2026 rules
Tier What it holds Who sees it Rule
Public Offering information in human-readable and JSON form: the service list, a link to secure configuration guidance, the trust center landing page Anyone MUST: “Providers MUST publicly share up-to-date information about the cloud service offering in both human-readable and JSON formats”; the service list “MUST be complete enough for a potential customer to determine which services are and are not included in the FedRAMP Minimum Assessment Scope”54
Trust center The certification package and certification data, including the Minimum Assessment Scope documentation, information flows and third-party resources “All necessary parties”: always FedRAMP and current agency customers; potential agency customers “should also be included in most cases but this is not a mandatory requirement” MUST use a FedRAMP-compatible trust center;55 the scope is “documented by the cloud service provider in their FedRAMP Certification Package”5657
On request Package access for a requesting agency The requesting agency SHOULD supply it; a denial MUST be reported to FedRAMP within 5 business days58

The rules also say certification data shouldn’t include detail “that would likely enable a threat actor to gain unauthorized access,”59 and that the information “usually remains the provider’s intellectual property and is not federal information.”60 Publishing more is the provider’s choice: “Providers MAY responsibly share some or all of the information in a FedRAMP Certification Package publicly.”61

The law asks GSA for the same transparency: boundary guidance must “promote transparency for agencies and users as to which services are included in the scope of a FedRAMP authorization.”62

When the rules reach a Rev5 package

The rules are tagged for both 20x and Rev5, but an existing Rev5 certification adopts them on a schedule:

When the 2026 rules apply to existing Rev5 certifications
Rule family Rev5: obtaining Rev5: maintaining Grace period ends
Certification Data Sharing (the public list, the trust center) 2027-01-01 2027-08-01 2028-02-01, a fixed date63
Minimum Assessment Scope 2027-01-01 2027-01-01 At the first independent assessment started after 2027-01-0164
Cryptographic Module Use 2027-01-01 2027-01-01 2027-06-0165

FedRAMP’s adoption notice says existing Rev5 certifications adopt the new approach during the first assessment “that is completed after January 1, 2027”;66 the scope rules say “started after.”67 The two FedRAMP sources disagree, and the difference can move a provider’s date by most of a year (inference). The notice gives no end date for Rev5 itself, only that it “is likely to be no later than 2029.”68

Oracle’s HR platform today

Oracle Fusion Cloud’s FedRAMP Marketplace record, October 30, 202669
Marketplace field Oracle Fusion Cloud, F1603257882
Status FedRAMP Certified, ongoing certification
Class and impact Class C, Moderate
Path Agency
Certified January 13, 2020
Authorizations 10 (9 reuses); OPM isn’t among the named agencies
Deployment Government Community Cloud, SaaS
Trust center none
Certified services list empty
Third-party information resources none entered
Secure configuration guidance none entered
  • Across Oracle. None of Oracle’s eight Marketplace listings has a trust center; across the Marketplace, 117 of 778 listings do.70 Oracle’s high-impact listing is its cloud infrastructure for government, not a SaaS offering.71
  • Separate offerings. The Fusion description names complementary services, such as integration and other platform services on Oracle’s government cloud infrastructure, as separate offerings.72
  • Oracle’s own pages. Its compliance page points to the Marketplace and says attestations come through “your Oracle sales representative.”73 No public page describing the Fusion US Government scope was found.

So, as of October 30, 2026 (inference): the information that would show which Fusion services, integration paths and third-party resources are inside the platform’s assessed scope is restricted. An agency that isn’t yet a customer can’t read it without asking, and Oracle isn’t yet required to publish even the service list.

What still restricts HR data crossing to the agency

The rules make the provider document data leaving its scope: information flows, security categories and third-party resources must be identified and explained.74 They don’t forbid it. A third-party resource is “Any information resource that is not entirely included in the Minimum Assessment Scope,”75 and supplementary material outside the offering “will not be FedRAMP Certified.”76 What actually limits an identity feed from Core HCM to an agency’s directory:

What limits HR data crossing from the platform to an agency system
Limit Source Effect on the HR-to-identity feed
The agency’s own authorization FedRAMP’s agency rules: “An agency should never create a standalone authorization to operate for a cloud service offering”; the agency integrates the service securely, including identity77 The middleware and directory sit in the agency’s system and its ATO, not the platform’s
The program’s single ATO and API gateway The solicitation: one OPM ATO; persistent integrations through an OPM-hosted API gateway with OAuth 2.0, rate limiting and IP filtering78 The feed’s path and credentials are OPM’s to set
Privacy Act and the governing notices M-24-15: FedRAMP “does not replace other legal, Executive Order, regulatory, or OMB-issued compliance requirements”79 A disclosure basis and notice coverage (Book 03, Appendix B)
CUI CUI Basic is “no less than the moderate confidentiality impact level”; written agreements “whenever feasible”80 The receiving system is at least Moderate for any CUI it holds
Information-exchange agreement NIST SP 800-47 Rev. 1: managing the protection of exchanged information “before, during, and after the exchange”81 An agreement between the agency and the program for the feed

M-24-15 asks agencies to “presume the security assessment documented in the authorization package is adequate for their use,” but only “as long as a FedRAMP authorization is actively maintained.”82 It places the duty to make artifacts accessible on GSA and agencies, not on providers.83

Part 3: FIPS validated cryptography at Moderate

FIPS validated cryptography at Moderate
Source What it says Strength
FedRAMP 2026 rules, Class C (Moderate) “Providers with Class C Certifications SHOULD use cryptographic modules or update streams of cryptographic modules with active validations”84 SHOULD (MUST only at Class D)
FedRAMP 2026 rules, Classes B–D Document each service’s modules, “including whether these modules are validated under the NIST Cryptographic Module Validation Program”85 MUST
FedRAMP 2026 rules, agency tenants Configure agency tenants by default to use validated modules86 SHOULD
FedRAMP’s SC-13 guidance “Follow the FedRAMP Cryptographic Module Use rules”87 Points to the above
NIST SP 800-53 Rev. 5, SC-13 The organization defines the types of cryptography for each use; generally applicable standards include FIPS-validated cryptography88 Organization-defined
NIST CMVP “if cryptography is required, then it must be validated”; FIPS 140-2 and 140-3 “are applicable to all U.S. Federal agencies”89 Required for the agency
FIPS 140-2 transition 140-2 validations move to the historical list after September 21, 2026, usable “for existing systems only”90 Date

(Inference.) For a civilian agency at Moderate, FedRAMP’s SHOULD is weaker than the agency’s own obligation. The agency’s authorizing official still needs validated modules wherever cryptography protects the HR feed, and from 2027 the provider’s module documentation is how the agency checks. NIST’s transition page puts the FIPS 140-2 date at September 21 in its text and September 22 in its schedule table;91 either way, modules validated only under 140-2 are now historical, usable for existing systems. Whether DoD’s cloud security requirements add more wasn’t checked; this page covers civilian agencies.

Part 4: .com or .us

Government cloud domains
Cloud Hostnames Oracle or Microsoft documents
Oracle US Government Cloud console.us-langley-1.oraclegovcloud.com, identity.us-langley-1.oraclegovcloud.com92
Oracle US Defense Cloud console.us-gov-ashburn-1.oraclegovcloud.com93
Oracle commercial oraclecloud.com; Fusion Applications systemName.fa.<dc>.oraclecloud.com, “for commercial regions only. In restricted regions … the patterns are different”94
Microsoft 365 GCC The worldwide .com endpoints95
Microsoft GCC High and DoD graph.microsoft.us, login.microsoftonline.us; dod-graph.microsoft.us96

Oracle’s two government infrastructure pages show no .us or .mil hostname.9798 Oracle requires government customers to “bring your own identity provider that meets your agency’s compliance requirements and supports common access card/personal identity verification card (CAC/PIV).”99

(Inference.) The domain matters at the boundary in three places: - Egress allow-lists. The agency’s middleware calls the platform, so its outbound proxy and network policy name the hosts it may reach. - Identity configuration. Sign-in redirects and federation metadata name the hosts. - Certificate pinning. The middleware may pin the platform’s certificates.

A government-only suffix such as oraclegovcloud.com or Microsoft’s .us lets a rule name government endpoints exactly. If the HR platform’s Fusion hosts sit under oraclecloud.com, a suffix rule can’t tell government from commercial, and the agency has to allow each host by name. Oracle doesn’t publish the Fusion government hostname, so ask.

Questions to ask

  1. OPM (program office): which FedRAMP package, and which impact level, covers the Core HCM instance? Is it F1603257882?
  2. OPM: who sits on the Steering Committee and the Customer Advisory Board, and will approved agency integrations, including identity feeds, be published to other agencies as reusable templates?
  3. OPM: does the agency identity feed pass through the OPM API gateway? What hostnames, authentication and IP ranges should agencies allow?
  4. Oracle: when will Fusion Cloud publish its service list and a FedRAMP-compatible trust center under the 2026 rules? Will agencies that aren’t yet customers get trust-center access?
  5. Oracle: for the HR platform, which services and third-party resources are inside the assessed scope? Is Oracle Integration Cloud or another separate offering in the data path to agencies?
  6. Oracle: which cryptographic modules protect data in transit and at rest, and are their validations active under FIPS 140-3?
  7. Oracle: what is the Fusion Applications hostname pattern for the US Government region hosting the HR platform?
  8. FedRAMP: “completed after” or “started after” January 1, 2027 for Rev5 adoption?

What couldn’t be verified

  • Which package covers OPM’s Core HCM instance. No Marketplace record names OPM, and the award releases name no package.
  • Steering Committee and advisory board membership and charters. None are published.
  • A Core HCM onboarding playbook or agency community. None found on opm.gov, the CHCO Council’s pages or the eOPF help desk.
  • The Fusion US Government hostname. Oracle says only that restricted-region patterns differ.
  • Any statement that no Oracle government service uses .us. Only the two infrastructure pages were scanned.
  • The legacy FedRAMP Rev5 Moderate SC-13 parameter, and DoD’s additional requirements. Neither could be loaded from an allowed source.
  • The FedRAMP Authorization Act’s sunset. The code notes repeal 44 U.S.C. 3607–3616 five years after December 23, 2022;100 whether Congress has extended it couldn’t be checked (congress.gov refused automated access).
  • OPM’s personnel-records notice text. Not reloaded here; Book 03 and the contractor-source research cite it.

Status and review

In review. Checked on October 30, 2026, against: - the Federal HR 2.0 memo, the solicitation’s final amendment and its answers; - OPM’s priority goals, budget justification and program pages, and the CHCO Council’s charter and 2025 report; - the eOPF Agency Touchpoint materials; - FedRAMP’s 2026 rules, definitions, notices and Marketplace data; - 44 U.S.C. chapter 36, M-24-15, M-19-16, 32 CFR part 2002, NIST SP 800-47 Rev. 1, SP 800-53 Rev. 5 and the CMVP pages; - Oracle’s and Microsoft’s documentation.

To move it to Proved, record OPM’s and Oracle’s answers to the questions above on this page, and re-check the Marketplace record after Oracle’s first assessment under the 2026 rules.

When it is proved, promote its lasting conclusions into the books, in vendor-neutral and agency-neutral terms, and then mark this page Published: 1. Book 10, Chapter 03, “What changes for the agency”: a Rev5 provider’s assessed scope can stay restricted until its first assessment under the 2026 rules, and an agency that isn’t yet a customer isn’t guaranteed access to the trust center, so ask before relying on it. 2. Book 10, Appendix A: add the asks this page turned up: the public service list and the date it will be published; the hostname pattern for the government region; and active FIPS 140-3 validations for the modules in the data path.

Re-check every claim promoted against its source on the day it moves, and log it in the chapter’s _verification file.

Related: - Book 10, Chapter 03 — What Changed at FedRAMP - Book 03, Chapter 03 — Federal HR 2.0 - the implementation guide Building Book 03’s HR Pipeline - Contractors as Oracle Contingent Workers

Back to top

Footnotes

  1. Office of Management and Budget and Office of Personnel Management, Creating “Federal HR 2.0” by Consolidating Core Human Capital Management Across the Federal Government, December 10, 2025 (p. 3: “OMB and OPM will stand up a Federal HR 2.0 Advisory Board comprising key stakeholder agencies to assist with governance and change management”; p. 6, Appendix C: Policy, Data, Learning and Super User working groups), https://www.opm.gov/chcoc/latest-memos/creating-federal-hr-20-by-consolidating-core-human-capital-management-across-the-federal-government.pdf, accessed October 30, 2026.↩︎

  2. Office of Personnel Management, Solicitation 24322626R0007, Federal HRIT Modernization, Amendment 4 (posted December 11, 2025), Performance Work Statement §2.1, Governance Structure (pp. 18–19: executive sponsorship, Steering Committee, Customer Advisory Board, Policy, Data and Super User working groups, Core HCM Program Office; OPM chairs the Steering Committee and Customer Advisory Board, which convene at least monthly), SAM.gov, https://sam.gov/api/prod/opps/v3/opportunities/resources/files/88d26ce7f2e943a88e95d70c6510f62f/download, accessed October 30, 2026.↩︎

  3. Office of Personnel Management, Solicitation 24322626R0007, Amendment 4, PWS §5.6 (p. 41: customizations approved by the Steering Committee; “enforce configuration patterns and reusable templates across all agencies”), SAM.gov, https://sam.gov/api/prod/opps/v3/opportunities/resources/files/88d26ce7f2e943a88e95d70c6510f62f/download, accessed October 30, 2026.↩︎

  4. Office of Personnel Management, Solicitation 24322626R0007, Amendment 4, PWS Appendix B (p. 88: the Core HCM Steering Committee reviews and approves agency-specific integration requirements), SAM.gov, https://sam.gov/api/prod/opps/v3/opportunities/resources/files/88d26ce7f2e943a88e95d70c6510f62f/download, accessed October 30, 2026.↩︎

  5. Office of Personnel Management, Solicitation 24322626R0007, Amendment 4, PWS §5.1 (p. 27: “a common federal baseline configuration”) and p. 51 (one OPM-approved version for all tenants), SAM.gov, https://sam.gov/api/prod/opps/v3/opportunities/resources/files/88d26ce7f2e943a88e95d70c6510f62f/download, accessed October 30, 2026.↩︎

  6. Office of Personnel Management, Solicitation 24322626R0007, Amendment 4, PWS §5.2 (pp. 31–32: the Governmentwide Program Management Office; OPM as the “primary integrator” for agencies, including identity management, SSO, integration and data migration; p. 36: data readiness managed jointly with each agency), SAM.gov, https://sam.gov/api/prod/opps/v3/opportunities/resources/files/88d26ce7f2e943a88e95d70c6510f62f/download, accessed October 30, 2026.↩︎

  7. FedRAMP, Consolidated Rules for 2026, “Certification Data Sharing” (CDS-CSO-PUB, CDS-CSO-SVC, CDS-CSO-RPS, CDS-CSO-UTC, CDS-CSO-RIS, CDS-UTC-AGA, CDS-UTC-AAD; the family’s statement that the information usually remains the provider’s intellectual property), https://www.fedramp.gov/2026/reference/certification-data-sharing/, and rules file version 2026.10.13.01, https://github.com/FedRAMP/rules, accessed October 30, 2026.↩︎

  8. FedRAMP, Consolidated Rules for 2026, “Certification Data Sharing,” Effective Dates, Rev5 (obtaining 2027-01-01; maintaining 2027-08-01; grace period ends 2028-02-01), https://www.fedramp.gov/2026/reference/certification-data-sharing/, accessed October 30, 2026.↩︎

  9. FedRAMP, Consolidated Rules for 2026, “Certification Data Sharing” (CDS-CSO-PUB, CDS-CSO-SVC, CDS-CSO-RPS, CDS-CSO-UTC, CDS-CSO-RIS, CDS-UTC-AGA, CDS-UTC-AAD; the family’s statement that the information usually remains the provider’s intellectual property), https://www.fedramp.gov/2026/reference/certification-data-sharing/, and rules file version 2026.10.13.01, https://github.com/FedRAMP/rules, accessed October 30, 2026.↩︎

  10. FedRAMP, Consolidated Rules for 2026, “Definitions” (“All Necessary Parties”: potential agency customers “should also be included in most cases but this is not a mandatory requirement”; “Third-Party Information Resource”: “Any information resource that is not entirely included in the Minimum Assessment Scope”), https://www.fedramp.gov/2026/definitions/, accessed October 30, 2026.↩︎

  11. FedRAMP, Consolidated Rules for 2026, “Certification Data Sharing” (CDS-CSO-PUB, CDS-CSO-SVC, CDS-CSO-RPS, CDS-CSO-UTC, CDS-CSO-RIS, CDS-UTC-AGA, CDS-UTC-AAD; the family’s statement that the information usually remains the provider’s intellectual property), https://www.fedramp.gov/2026/reference/certification-data-sharing/, and rules file version 2026.10.13.01, https://github.com/FedRAMP/rules, accessed October 30, 2026.↩︎

  12. FedRAMP Marketplace data, products.json (last change 2026-10-30; record F1603257882, Oracle Fusion Cloud, and Oracle’s other seven listings; trust-center counts across 778 listings), https://www.fedramp.gov/marketplace/products.json, accessed October 30, 2026.↩︎

  13. Oracle, “US Office of Personnel Management Selects Oracle to Power Federal Workforce Modernization,” June 11, 2026 (“an AI-powered, secure, FedRAMP-authorized HR platform”), https://www.oracle.com/news/announcement/us-office-of-personnel-management-selects-oracle-to-power-federal-workforce-modernization-2026-06-11/, accessed October 30, 2026.↩︎

  14. FedRAMP, Consolidated Rules for 2026, “Minimum Assessment Scope” (MAS-CSO-FLO: information flows and security categories for all information resources; MAS-CSO-TPR: third-party resources; MAS-CSO-SUP: supplementary resources “will not be FedRAMP Certified”; MAS-CSO-IIR note: the scope is documented in the certification package), https://www.fedramp.gov/2026/reference/minimum-assessment-scope/, accessed October 30, 2026.↩︎

  15. FedRAMP, Consolidated Rules for 2026, “Minimum Assessment Scope” (MAS-CSO-FLO: information flows and security categories for all information resources; MAS-CSO-TPR: third-party resources; MAS-CSO-SUP: supplementary resources “will not be FedRAMP Certified”; MAS-CSO-IIR note: the scope is documented in the certification package), https://www.fedramp.gov/2026/reference/minimum-assessment-scope/, accessed October 30, 2026.↩︎

  16. FedRAMP, Consolidated Rules for 2026, “Using a FedRAMP Certified Cloud Service” (“An agency should never create a standalone authorization to operate for a cloud service offering”; configure and integrate the service securely, including identity, logging, monitoring and data protection), https://www.fedramp.gov/2026/agencies/use/, accessed October 30, 2026.↩︎

  17. Office of Management and Budget, M-24-15, Modernizing the Federal Risk and Authorization Management Program (FedRAMP), July 25, 2024, §IV.a (pp. 6–7: the presumption of adequacy, “as long as a FedRAMP authorization is actively maintained”), §IV n. 7 (FedRAMP “does not replace other legal, Executive Order, regulatory, or OMB-issued compliance requirements”), §VII.a(7) (p. 16: GSA to enable agency officials’ access to artifacts), https://www.whitehouse.gov/wp-content/uploads/2024/07/M-24-15-Modernizing-the-Federal-Risk-and-Authorization-Management-Program.pdf, accessed October 30, 2026.↩︎

  18. 32 CFR 2002.14(g) (“CUI Basic is categorized at no less than the moderate confidentiality impact level”) and 2002.16(a) (dissemination; written agreements “whenever feasible”), eCFR, https://www.ecfr.gov/current/title-32/subtitle-B/chapter-XX/part-2002, accessed October 30, 2026.↩︎

  19. National Institute of Standards and Technology, SP 800-47 Rev. 1, Managing the Security of Information Exchanges, July 2021, https://csrc.nist.gov/pubs/sp/800/47/r1/final, accessed October 30, 2026.↩︎

  20. Office of Personnel Management, Solicitation 24322626R0007, Amendment 4, PWS §5.1.1 (p. 26: FedRAMP Moderate or higher; a single OPM ATO) and Appendix B (pp. 82–83: persistent integrations through an OPM-hosted API Management gateway with OAuth 2.0, rate limiting and IP filtering), SAM.gov, https://sam.gov/api/prod/opps/v3/opportunities/resources/files/88d26ce7f2e943a88e95d70c6510f62f/download, accessed October 25, 2026 (as verified for the HCM implementation guide).↩︎

  21. FedRAMP, Consolidated Rules for 2026, “Cryptographic Module Use” (CMU-CSO-UVM: Class C SHOULD, Class D MUST; CMU-CSO-CMD: document modules and validation status, Classes B–D; CMU-CSO-CAT: validated defaults for agency tenants), https://www.fedramp.gov/2026/reference/cryptographic-module-use/, accessed October 30, 2026.↩︎

  22. National Institute of Standards and Technology, “Cryptographic Module Validation Program” (“In essence, if cryptography is required, then it must be validated”; “FIPS 140-2 and FIPS 140-3 requirements are applicable to all U.S. Federal agencies”), https://csrc.nist.gov/projects/cryptographic-module-validation-program, accessed October 30, 2026.↩︎

  23. National Institute of Standards and Technology, “FIPS 140-3 Transition Effort” (FIPS 140-2 validations moved to the historical list after September 21, 2026; usable for existing systems only; the schedule table gives September 22), https://csrc.nist.gov/projects/fips-140-3-transition-effort, accessed October 30, 2026.↩︎

  24. Oracle, Oracle Cloud Infrastructure Documentation, “FedRAMP Authorized Services” for US Government Cloud (regions us-langley-1 and us-luke-1; console and API endpoints on oraclegovcloud.com), https://docs.oracle.com/en-us/iaas/Content/gov-cloud/govfedramp.htm, accessed October 30, 2026.↩︎

  25. Oracle, Oracle Cloud Infrastructure Documentation, US Defense Cloud (regions us-gov-ashburn-1, us-gov-chicago-1, us-gov-phoenix-1; console on oraclegovcloud.com), https://docs.oracle.com/en-us/iaas/Content/gov-cloud/govfeddod.htm, accessed October 30, 2026.↩︎

  26. Oracle, Enterprise Performance Management Cloud, “Sample URLs” (“This pattern is for commercial regions only. In restricted regions (for example OC2 and OC4), the patterns are different”), https://docs.oracle.com/en/cloud/saas/enterprise-performance-management-common/cgsad/1_epm_cloud_accessing_sample_urls.html; and Oracle Integration, “Obtain the Event Catalog URL” (Fusion Applications systemName.fa.<dc>.oraclecloud.com), https://docs.oracle.com/en/cloud/paas/application-integration/erp-adapter/obtaining-event-catalog-url.html, accessed October 30, 2026.↩︎

  27. Microsoft Learn, “Microsoft Graph national cloud deployments” (GCC uses the worldwide endpoints; GCC High graph.microsoft.us and login.microsoftonline.us; DoD dod-graph.microsoft.us), https://learn.microsoft.com/en-us/graph/deployments, accessed October 30, 2026.↩︎

  28. Office of Management and Budget and Office of Personnel Management, Creating “Federal HR 2.0” by Consolidating Core Human Capital Management Across the Federal Government, December 10, 2025 (p. 3: “OMB and OPM will stand up a Federal HR 2.0 Advisory Board comprising key stakeholder agencies to assist with governance and change management”; p. 6, Appendix C: Policy, Data, Learning and Super User working groups), https://www.opm.gov/chcoc/latest-memos/creating-federal-hr-20-by-consolidating-core-human-capital-management-across-the-federal-government.pdf, accessed October 30, 2026.↩︎

  29. Chief Human Capital Officers Council, 2025 Annual Report to Congress (PDF p. 13: governance for HR IT modernization, including an advisory board of CHCOs and federal CIOs; PDF p. 10: one new working group established in 2025), https://www.opm.gov/chcoc/annual-reports/2025-annual-report.pdf, accessed October 30, 2026.↩︎

  30. Office of Management and Budget and Office of Personnel Management, Creating “Federal HR 2.0” by Consolidating Core Human Capital Management Across the Federal Government, December 10, 2025 (p. 3: “OMB and OPM will stand up a Federal HR 2.0 Advisory Board comprising key stakeholder agencies to assist with governance and change management”; p. 6, Appendix C: Policy, Data, Learning and Super User working groups), https://www.opm.gov/chcoc/latest-memos/creating-federal-hr-20-by-consolidating-core-human-capital-management-across-the-federal-government.pdf, accessed October 30, 2026.↩︎

  31. Office of Personnel Management, Solicitation 24322626R0007, Federal HRIT Modernization, Amendment 4 (posted December 11, 2025), Performance Work Statement §2.1, Governance Structure (pp. 18–19: executive sponsorship, Steering Committee, Customer Advisory Board, Policy, Data and Super User working groups, Core HCM Program Office; OPM chairs the Steering Committee and Customer Advisory Board, which convene at least monthly), SAM.gov, https://sam.gov/api/prod/opps/v3/opportunities/resources/files/88d26ce7f2e943a88e95d70c6510f62f/download, accessed October 30, 2026.↩︎

  32. Office of Personnel Management, Solicitation 24322626R0007, Federal HRIT Modernization, Amendment 4 (posted December 11, 2025), Performance Work Statement §2.1, Governance Structure (pp. 18–19: executive sponsorship, Steering Committee, Customer Advisory Board, Policy, Data and Super User working groups, Core HCM Program Office; OPM chairs the Steering Committee and Customer Advisory Board, which convene at least monthly), SAM.gov, https://sam.gov/api/prod/opps/v3/opportunities/resources/files/88d26ce7f2e943a88e95d70c6510f62f/download, accessed October 30, 2026.↩︎

  33. Office of Personnel Management, Solicitation 24322626R0007, Amendment 4, PWS §5.6 (p. 41: customizations approved by the Steering Committee; “enforce configuration patterns and reusable templates across all agencies”), SAM.gov, https://sam.gov/api/prod/opps/v3/opportunities/resources/files/88d26ce7f2e943a88e95d70c6510f62f/download, accessed October 30, 2026.↩︎

  34. Office of Personnel Management, Solicitation 24322626R0007, Amendment 4, PWS Appendix B (p. 88: the Core HCM Steering Committee reviews and approves agency-specific integration requirements), SAM.gov, https://sam.gov/api/prod/opps/v3/opportunities/resources/files/88d26ce7f2e943a88e95d70c6510f62f/download, accessed October 30, 2026.↩︎

  35. Office of Personnel Management, Solicitation 24322626R0007, Federal HRIT Modernization, Amendment 4 (posted December 11, 2025), Performance Work Statement §2.1, Governance Structure (pp. 18–19: executive sponsorship, Steering Committee, Customer Advisory Board, Policy, Data and Super User working groups, Core HCM Program Office; OPM chairs the Steering Committee and Customer Advisory Board, which convene at least monthly), SAM.gov, https://sam.gov/api/prod/opps/v3/opportunities/resources/files/88d26ce7f2e943a88e95d70c6510f62f/download, accessed October 30, 2026.↩︎

  36. Office of Personnel Management, Solicitation 24322626R0007, Federal HRIT Modernization, Amendment 4 (posted December 11, 2025), Performance Work Statement §2.1, Governance Structure (pp. 18–19: executive sponsorship, Steering Committee, Customer Advisory Board, Policy, Data and Super User working groups, Core HCM Program Office; OPM chairs the Steering Committee and Customer Advisory Board, which convene at least monthly), SAM.gov, https://sam.gov/api/prod/opps/v3/opportunities/resources/files/88d26ce7f2e943a88e95d70c6510f62f/download, accessed October 30, 2026.↩︎

  37. Office of Personnel Management, Solicitation 24322626R0007, Amendment 4, PWS §5.2 (pp. 31–32: the Governmentwide Program Management Office; OPM as the “primary integrator” for agencies, including identity management, SSO, integration and data migration; p. 36: data readiness managed jointly with each agency), SAM.gov, https://sam.gov/api/prod/opps/v3/opportunities/resources/files/88d26ce7f2e943a88e95d70c6510f62f/download, accessed October 30, 2026.↩︎

  38. Office of Personnel Management, FY 2026–2027 Agency Priority Goals, March 2026, APG 3 (p. 8: stakeholders including an “Interagency executive investment and advisory board,” the CHCO Council, the HR Line of Business and the HR QSMO), https://www.opm.gov/about-us/reports-publications/opm-fy-2026-2027-agency-priority-goals.pdf, accessed October 30, 2026.↩︎

  39. Homeland Security Act of 2002, Pub. L. 107-296, §1303(b), 116 Stat. 2289 (the Council meets periodically to advise and coordinate agencies’ activities, including the modernization of human resources systems), codified at 5 U.S.C. 1401–1402, https://www.congress.gov/107/plaws/publ296/PLAW-107publ296.pdf, accessed October 30, 2026.↩︎

  40. Chief Human Capital Officers Council, Charter, effective December 14, 2021 (pp. 2–3: committees and working groups; “Identify and share promising practices”), https://www.opm.gov/chcoc/chco-council-charter.pdf, accessed October 30, 2026.↩︎

  41. Chief Human Capital Officers Council, 2025 Annual Report to Congress (PDF p. 13: governance for HR IT modernization, including an advisory board of CHCOs and federal CIOs; PDF p. 10: one new working group established in 2025), https://www.opm.gov/chcoc/annual-reports/2025-annual-report.pdf, accessed October 30, 2026.↩︎

  42. Office of Personnel Management, HR Line of Business, “MAESC and Governance” (the multi-agency executive steering committee; communities of practice), https://www.opm.gov/agency-services/hr-governance/hr-line-of-business/maesc-and-governance/, accessed October 30, 2026.↩︎

  43. Office of Personnel Management, “Human Resources Line of Business,” https://www.opm.gov/agency-services/hr-governance/hr-line-of-business/, accessed October 30, 2026.↩︎

  44. General Services Administration, Federal Integrated Business Framework, “Human Resources / Human Capital Management” standards, https://ussm.gsa.gov/fibf-hr-hcm/, accessed October 30, 2026.↩︎

  45. Office of Personnel Management, “HR Quality Services Management Office” (“Institute a customer engagement and feedback model that allows for continuous improvement and performance management of solutions”), https://www.opm.gov/agency-services/hr-governance/hr-quality-services-management-office/, accessed October 30, 2026.↩︎

  46. Office of Management and Budget, M-19-16, Centralized Mission Support Capabilities for the Federal Government, April 26, 2019, https://www.whitehouse.gov/wp-content/uploads/2019/04/M-19-16.pdf, accessed October 30, 2026.↩︎

  47. Office of Personnel Management, Solicitation 24322626R0007, Questions and Answers, set 1 (Q85: change control of the HR data model with the HR QSMO; Q127: one centrally governed baseline), SAM.gov, https://sam.gov/api/prod/opps/v3/opportunities/resources/files/fbde5477815f434c91d0e77b8ddac549/download, accessed October 30, 2026.↩︎

  48. Office of Personnel Management, Solicitation 24322626R0007, Questions and Answers, set 2 (Q360: no change control board defined), SAM.gov, https://sam.gov/api/prod/opps/v3/opportunities/resources/files/be19b6e56b5e43cdb1ad259d6abfc5f5/download, accessed October 30, 2026.↩︎

  49. Office of Personnel Management, “Core HCM,” https://www.opm.gov/agency-services/talent-systems/core-hcm/, accessed October 30, 2026.↩︎

  50. Office of Personnel Management, “OPM Awards Contract for First-Ever Governmentwide HR Platform,” https://www.opm.gov/news/news-releases/opm-awards-contract-for-first-ever-governmentwide-hr-platform/, accessed October 30, 2026.↩︎

  51. Office of Personnel Management, eOPF Help Desk, “Agency Touchpoint Q&A – June 2026” (Core HCM questions to Wave 1 agency points of contact or the CoreHCM mailbox), https://eopfhelpdesk.opm.gov/hc/en-us/articles/53223497231891-Agency-Touchpoint-Q-A-June-2026, accessed October 30, 2026.↩︎

  52. Office of Personnel Management, eOPF Agency Touchpoint presentation, June 24, 2026 (marked “DRAFT – PRE-DECISIONAL,” publicly posted; Core HCM update, including governance and working group formation), https://eopfhelpdesk.opm.gov/hc/en-us/article_attachments/53226772733715, accessed October 30, 2026.↩︎

  53. Office of Personnel Management, eOPF Agency Touchpoint presentation, March 25, 2026, slide 5 (marked draft; guiding principles including a single ATO for which agencies don’t require their own), https://eopfhelpdesk.opm.gov/hc/en-us/article_attachments/50467456710803, accessed October 30, 2026.↩︎

  54. FedRAMP, Consolidated Rules for 2026, “Certification Data Sharing” (CDS-CSO-PUB, CDS-CSO-SVC, CDS-CSO-RPS, CDS-CSO-UTC, CDS-CSO-RIS, CDS-UTC-AGA, CDS-UTC-AAD; the family’s statement that the information usually remains the provider’s intellectual property), https://www.fedramp.gov/2026/reference/certification-data-sharing/, and rules file version 2026.10.13.01, https://github.com/FedRAMP/rules, accessed October 30, 2026.↩︎

  55. FedRAMP, Consolidated Rules for 2026, “Certification Data Sharing” (CDS-CSO-PUB, CDS-CSO-SVC, CDS-CSO-RPS, CDS-CSO-UTC, CDS-CSO-RIS, CDS-UTC-AGA, CDS-UTC-AAD; the family’s statement that the information usually remains the provider’s intellectual property), https://www.fedramp.gov/2026/reference/certification-data-sharing/, and rules file version 2026.10.13.01, https://github.com/FedRAMP/rules, accessed October 30, 2026.↩︎

  56. FedRAMP, Consolidated Rules for 2026, “Minimum Assessment Scope” (MAS-CSO-FLO: information flows and security categories for all information resources; MAS-CSO-TPR: third-party resources; MAS-CSO-SUP: supplementary resources “will not be FedRAMP Certified”; MAS-CSO-IIR note: the scope is documented in the certification package), https://www.fedramp.gov/2026/reference/minimum-assessment-scope/, accessed October 30, 2026.↩︎

  57. FedRAMP, Consolidated Rules for 2026, “Definitions” (“All Necessary Parties”: potential agency customers “should also be included in most cases but this is not a mandatory requirement”; “Third-Party Information Resource”: “Any information resource that is not entirely included in the Minimum Assessment Scope”), https://www.fedramp.gov/2026/definitions/, accessed October 30, 2026.↩︎

  58. FedRAMP, Consolidated Rules for 2026, “Certification Data Sharing” (CDS-CSO-PUB, CDS-CSO-SVC, CDS-CSO-RPS, CDS-CSO-UTC, CDS-CSO-RIS, CDS-UTC-AGA, CDS-UTC-AAD; the family’s statement that the information usually remains the provider’s intellectual property), https://www.fedramp.gov/2026/reference/certification-data-sharing/, and rules file version 2026.10.13.01, https://github.com/FedRAMP/rules, accessed October 30, 2026.↩︎

  59. FedRAMP, Consolidated Rules for 2026, “Certification Data Sharing” (CDS-CSO-PUB, CDS-CSO-SVC, CDS-CSO-RPS, CDS-CSO-UTC, CDS-CSO-RIS, CDS-UTC-AGA, CDS-UTC-AAD; the family’s statement that the information usually remains the provider’s intellectual property), https://www.fedramp.gov/2026/reference/certification-data-sharing/, and rules file version 2026.10.13.01, https://github.com/FedRAMP/rules, accessed October 30, 2026.↩︎

  60. FedRAMP, Consolidated Rules for 2026, “Certification Data Sharing” (CDS-CSO-PUB, CDS-CSO-SVC, CDS-CSO-RPS, CDS-CSO-UTC, CDS-CSO-RIS, CDS-UTC-AGA, CDS-UTC-AAD; the family’s statement that the information usually remains the provider’s intellectual property), https://www.fedramp.gov/2026/reference/certification-data-sharing/, and rules file version 2026.10.13.01, https://github.com/FedRAMP/rules, accessed October 30, 2026.↩︎

  61. FedRAMP, Consolidated Rules for 2026, “Certification Data Sharing” (CDS-CSO-PUB, CDS-CSO-SVC, CDS-CSO-RPS, CDS-CSO-UTC, CDS-CSO-RIS, CDS-UTC-AGA, CDS-UTC-AAD; the family’s statement that the information usually remains the provider’s intellectual property), https://www.fedramp.gov/2026/reference/certification-data-sharing/, and rules file version 2026.10.13.01, https://github.com/FedRAMP/rules, accessed October 30, 2026.↩︎

  62. 44 U.S.C. 3609(a)(4) (guidance to “promote transparency for agencies and users as to which services are included in the scope of a FedRAMP authorization”), and the code’s note on the effective date of repeal of §§3607–3616 (Pub. L. 117-263, §5921), https://www.govinfo.gov/content/pkg/USCODE-2024-title44/html/USCODE-2024-title44-chap36-sec3609.htm, accessed October 30, 2026.↩︎

  63. FedRAMP, Consolidated Rules for 2026, “Certification Data Sharing,” Effective Dates, Rev5 (obtaining 2027-01-01; maintaining 2027-08-01; grace period ends 2028-02-01), https://www.fedramp.gov/2026/reference/certification-data-sharing/, accessed October 30, 2026.↩︎

  64. FedRAMP, Consolidated Rules for 2026, “Minimum Assessment Scope,” Effective Dates, Rev5 (obtaining and maintaining 2027-01-01; “Grace Period Ends: On the first FedRAMP independent assessment started after 2027-01-01”), https://www.fedramp.gov/2026/reference/minimum-assessment-scope/, accessed October 30, 2026.↩︎

  65. FedRAMP, Consolidated Rules for 2026, rules file version 2026.10.13.01 (CMU Rev5 effective dates: obtaining and maintaining 2027-01-01, grace period ends 2027-06-01; SC-13 guidance: “Follow the FedRAMP Cryptographic Module Use rules”), https://github.com/FedRAMP/rules, accessed October 30, 2026.↩︎

  66. FedRAMP, Notice NTC-0013, June 16, 2026 (existing Rev5 certifications adopt the new approach “during their first FedRAMP independent assessment that is completed after January 1, 2027”; the end of Rev5 “has not been finalized but is likely to be no later than 2029”), https://www.fedramp.gov/notices/0013/, accessed October 30, 2026.↩︎

  67. FedRAMP, Consolidated Rules for 2026, “Minimum Assessment Scope,” Effective Dates, Rev5 (obtaining and maintaining 2027-01-01; “Grace Period Ends: On the first FedRAMP independent assessment started after 2027-01-01”), https://www.fedramp.gov/2026/reference/minimum-assessment-scope/, accessed October 30, 2026.↩︎

  68. FedRAMP, Notice NTC-0013, June 16, 2026 (existing Rev5 certifications adopt the new approach “during their first FedRAMP independent assessment that is completed after January 1, 2027”; the end of Rev5 “has not been finalized but is likely to be no later than 2029”), https://www.fedramp.gov/notices/0013/, accessed October 30, 2026.↩︎

  69. FedRAMP Marketplace data, products.json (last change 2026-10-30; record F1603257882, Oracle Fusion Cloud, and Oracle’s other seven listings; trust-center counts across 778 listings), https://www.fedramp.gov/marketplace/products.json, accessed October 30, 2026.↩︎

  70. FedRAMP Marketplace data, products.json (last change 2026-10-30; record F1603257882, Oracle Fusion Cloud, and Oracle’s other seven listings; trust-center counts across 778 listings), https://www.fedramp.gov/marketplace/products.json, accessed October 30, 2026.↩︎

  71. FedRAMP Marketplace data, products.json (last change 2026-10-30; record F1603257882, Oracle Fusion Cloud, and Oracle’s other seven listings; trust-center counts across 778 listings), https://www.fedramp.gov/marketplace/products.json, accessed October 30, 2026.↩︎

  72. FedRAMP Marketplace data, products.json (last change 2026-10-30; record F1603257882, Oracle Fusion Cloud, and Oracle’s other seven listings; trust-center counts across 778 listings), https://www.fedramp.gov/marketplace/products.json, accessed October 30, 2026.↩︎

  73. Oracle, “Cloud Compliance” (FedRAMP entry points to the Marketplace; “Customers can obtain more information about available attestations by contacting their Oracle sales representative”), https://www.oracle.com/corporate/cloud-compliance/, accessed October 30, 2026.↩︎

  74. FedRAMP, Consolidated Rules for 2026, “Minimum Assessment Scope” (MAS-CSO-FLO: information flows and security categories for all information resources; MAS-CSO-TPR: third-party resources; MAS-CSO-SUP: supplementary resources “will not be FedRAMP Certified”; MAS-CSO-IIR note: the scope is documented in the certification package), https://www.fedramp.gov/2026/reference/minimum-assessment-scope/, accessed October 30, 2026.↩︎

  75. FedRAMP, Consolidated Rules for 2026, “Definitions” (“All Necessary Parties”: potential agency customers “should also be included in most cases but this is not a mandatory requirement”; “Third-Party Information Resource”: “Any information resource that is not entirely included in the Minimum Assessment Scope”), https://www.fedramp.gov/2026/definitions/, accessed October 30, 2026.↩︎

  76. FedRAMP, Consolidated Rules for 2026, “Minimum Assessment Scope” (MAS-CSO-FLO: information flows and security categories for all information resources; MAS-CSO-TPR: third-party resources; MAS-CSO-SUP: supplementary resources “will not be FedRAMP Certified”; MAS-CSO-IIR note: the scope is documented in the certification package), https://www.fedramp.gov/2026/reference/minimum-assessment-scope/, accessed October 30, 2026.↩︎

  77. FedRAMP, Consolidated Rules for 2026, “Using a FedRAMP Certified Cloud Service” (“An agency should never create a standalone authorization to operate for a cloud service offering”; configure and integrate the service securely, including identity, logging, monitoring and data protection), https://www.fedramp.gov/2026/agencies/use/, accessed October 30, 2026.↩︎

  78. Office of Personnel Management, Solicitation 24322626R0007, Amendment 4, PWS §5.1.1 (p. 26: FedRAMP Moderate or higher; a single OPM ATO) and Appendix B (pp. 82–83: persistent integrations through an OPM-hosted API Management gateway with OAuth 2.0, rate limiting and IP filtering), SAM.gov, https://sam.gov/api/prod/opps/v3/opportunities/resources/files/88d26ce7f2e943a88e95d70c6510f62f/download, accessed October 25, 2026 (as verified for the HCM implementation guide).↩︎

  79. Office of Management and Budget, M-24-15, Modernizing the Federal Risk and Authorization Management Program (FedRAMP), July 25, 2024, §IV.a (pp. 6–7: the presumption of adequacy, “as long as a FedRAMP authorization is actively maintained”), §IV n. 7 (FedRAMP “does not replace other legal, Executive Order, regulatory, or OMB-issued compliance requirements”), §VII.a(7) (p. 16: GSA to enable agency officials’ access to artifacts), https://www.whitehouse.gov/wp-content/uploads/2024/07/M-24-15-Modernizing-the-Federal-Risk-and-Authorization-Management-Program.pdf, accessed October 30, 2026.↩︎

  80. 32 CFR 2002.14(g) (“CUI Basic is categorized at no less than the moderate confidentiality impact level”) and 2002.16(a) (dissemination; written agreements “whenever feasible”), eCFR, https://www.ecfr.gov/current/title-32/subtitle-B/chapter-XX/part-2002, accessed October 30, 2026.↩︎

  81. National Institute of Standards and Technology, SP 800-47 Rev. 1, Managing the Security of Information Exchanges, July 2021, https://csrc.nist.gov/pubs/sp/800/47/r1/final, accessed October 30, 2026.↩︎

  82. Office of Management and Budget, M-24-15, Modernizing the Federal Risk and Authorization Management Program (FedRAMP), July 25, 2024, §IV.a (pp. 6–7: the presumption of adequacy, “as long as a FedRAMP authorization is actively maintained”), §IV n. 7 (FedRAMP “does not replace other legal, Executive Order, regulatory, or OMB-issued compliance requirements”), §VII.a(7) (p. 16: GSA to enable agency officials’ access to artifacts), https://www.whitehouse.gov/wp-content/uploads/2024/07/M-24-15-Modernizing-the-Federal-Risk-and-Authorization-Management-Program.pdf, accessed October 30, 2026.↩︎

  83. Office of Management and Budget, M-24-15, Modernizing the Federal Risk and Authorization Management Program (FedRAMP), July 25, 2024, §IV.a (pp. 6–7: the presumption of adequacy, “as long as a FedRAMP authorization is actively maintained”), §IV n. 7 (FedRAMP “does not replace other legal, Executive Order, regulatory, or OMB-issued compliance requirements”), §VII.a(7) (p. 16: GSA to enable agency officials’ access to artifacts), https://www.whitehouse.gov/wp-content/uploads/2024/07/M-24-15-Modernizing-the-Federal-Risk-and-Authorization-Management-Program.pdf, accessed October 30, 2026.↩︎

  84. FedRAMP, Consolidated Rules for 2026, “Cryptographic Module Use” (CMU-CSO-UVM: Class C SHOULD, Class D MUST; CMU-CSO-CMD: document modules and validation status, Classes B–D; CMU-CSO-CAT: validated defaults for agency tenants), https://www.fedramp.gov/2026/reference/cryptographic-module-use/, accessed October 30, 2026.↩︎

  85. FedRAMP, Consolidated Rules for 2026, “Cryptographic Module Use” (CMU-CSO-UVM: Class C SHOULD, Class D MUST; CMU-CSO-CMD: document modules and validation status, Classes B–D; CMU-CSO-CAT: validated defaults for agency tenants), https://www.fedramp.gov/2026/reference/cryptographic-module-use/, accessed October 30, 2026.↩︎

  86. FedRAMP, Consolidated Rules for 2026, “Cryptographic Module Use” (CMU-CSO-UVM: Class C SHOULD, Class D MUST; CMU-CSO-CMD: document modules and validation status, Classes B–D; CMU-CSO-CAT: validated defaults for agency tenants), https://www.fedramp.gov/2026/reference/cryptographic-module-use/, accessed October 30, 2026.↩︎

  87. FedRAMP, Consolidated Rules for 2026, rules file version 2026.10.13.01 (CMU Rev5 effective dates: obtaining and maintaining 2027-01-01, grace period ends 2027-06-01; SC-13 guidance: “Follow the FedRAMP Cryptographic Module Use rules”), https://github.com/FedRAMP/rules, accessed October 30, 2026.↩︎

  88. National Institute of Standards and Technology, SP 800-53 Rev. 5, SC-13, Cryptographic Protection (statement b and discussion), https://csrc.nist.gov/pubs/sp/800/53/r5/upd1/final, accessed October 30, 2026.↩︎

  89. National Institute of Standards and Technology, “Cryptographic Module Validation Program” (“In essence, if cryptography is required, then it must be validated”; “FIPS 140-2 and FIPS 140-3 requirements are applicable to all U.S. Federal agencies”), https://csrc.nist.gov/projects/cryptographic-module-validation-program, accessed October 30, 2026.↩︎

  90. National Institute of Standards and Technology, “FIPS 140-3 Transition Effort” (FIPS 140-2 validations moved to the historical list after September 21, 2026; usable for existing systems only; the schedule table gives September 22), https://csrc.nist.gov/projects/fips-140-3-transition-effort, accessed October 30, 2026.↩︎

  91. National Institute of Standards and Technology, “FIPS 140-3 Transition Effort” (FIPS 140-2 validations moved to the historical list after September 21, 2026; usable for existing systems only; the schedule table gives September 22), https://csrc.nist.gov/projects/fips-140-3-transition-effort, accessed October 30, 2026.↩︎

  92. Oracle, Oracle Cloud Infrastructure Documentation, “FedRAMP Authorized Services” for US Government Cloud (regions us-langley-1 and us-luke-1; console and API endpoints on oraclegovcloud.com), https://docs.oracle.com/en-us/iaas/Content/gov-cloud/govfedramp.htm, accessed October 30, 2026.↩︎

  93. Oracle, Oracle Cloud Infrastructure Documentation, US Defense Cloud (regions us-gov-ashburn-1, us-gov-chicago-1, us-gov-phoenix-1; console on oraclegovcloud.com), https://docs.oracle.com/en-us/iaas/Content/gov-cloud/govfeddod.htm, accessed October 30, 2026.↩︎

  94. Oracle, Enterprise Performance Management Cloud, “Sample URLs” (“This pattern is for commercial regions only. In restricted regions (for example OC2 and OC4), the patterns are different”), https://docs.oracle.com/en/cloud/saas/enterprise-performance-management-common/cgsad/1_epm_cloud_accessing_sample_urls.html; and Oracle Integration, “Obtain the Event Catalog URL” (Fusion Applications systemName.fa.<dc>.oraclecloud.com), https://docs.oracle.com/en/cloud/paas/application-integration/erp-adapter/obtaining-event-catalog-url.html, accessed October 30, 2026.↩︎

  95. Microsoft Learn, “Microsoft Graph national cloud deployments” (GCC uses the worldwide endpoints; GCC High graph.microsoft.us and login.microsoftonline.us; DoD dod-graph.microsoft.us), https://learn.microsoft.com/en-us/graph/deployments, accessed October 30, 2026.↩︎

  96. Microsoft Learn, “Microsoft Graph national cloud deployments” (GCC uses the worldwide endpoints; GCC High graph.microsoft.us and login.microsoftonline.us; DoD dod-graph.microsoft.us), https://learn.microsoft.com/en-us/graph/deployments, accessed October 30, 2026.↩︎

  97. Oracle, Oracle Cloud Infrastructure Documentation, “FedRAMP Authorized Services” for US Government Cloud (regions us-langley-1 and us-luke-1; console and API endpoints on oraclegovcloud.com), https://docs.oracle.com/en-us/iaas/Content/gov-cloud/govfedramp.htm, accessed October 30, 2026.↩︎

  98. Oracle, Oracle Cloud Infrastructure Documentation, US Defense Cloud (regions us-gov-ashburn-1, us-gov-chicago-1, us-gov-phoenix-1; console on oraclegovcloud.com), https://docs.oracle.com/en-us/iaas/Content/gov-cloud/govfeddod.htm, accessed October 30, 2026.↩︎

  99. Oracle, Oracle Cloud Infrastructure Documentation, “Information for US Government Cloud Customers” (bring your own CAC/PIV-capable identity provider; customers enable FIPS mode), https://docs.oracle.com/en-us/iaas/Content/gov-cloud/govinfo.htm, accessed October 30, 2026.↩︎

  100. 44 U.S.C. 3609(a)(4) (guidance to “promote transparency for agencies and users as to which services are included in the scope of a FedRAMP authorization”), and the code’s note on the effective date of repeal of §§3607–3616 (Pub. L. 117-263, §5921), https://www.govinfo.gov/content/pkg/USCODE-2024-title44/html/USCODE-2024-title44-chap36-sec3609.htm, accessed October 30, 2026.↩︎