Before the FedRAMP Consolidated Rules were released in 2026, the list of services a FedRAMP authorization actually covered wasn't always easy to map. Some providers listed their authorized services on a website, but most only covered the detailed list within their System Security Plan (SSP). In that model, agencies had to request access to a provider's SSP just to see which FedRAMP-authorized services they could actually use.
CDS-CSO-SVC changes that. It requires providers to publish a detailed list of every authorized service, along with the corresponding security category for each one. That list has to live somewhere an agency can read it without logging in or requesting access — a public website or a trust center both work.
| Before CDS-CSO-SVC | After CDS-CSO-SVC | |
|---|---|---|
| Where the service list lived | Buried inside the System Security Plan (SSP) | Published on a public website or trust center |
| How agencies accessed it | Requested access from the provider | Read it directly, no login required |
| Security category visibility | Not disclosed per service | Listed for every authorized service |
What CDS-CSO-SVC Requires
Publish a detailed list of the specific services included in the authorized cloud service offering, with the security category for each service.
Use clear service names that align with your standard public marketing materials.
Make sure the list is complete enough that a potential customer can determine which services are and are not in the FedRAMP Minimum Assessment Scope, without requesting access to underlying FedRAMP Certification Data.
Where Security Categories Come From
The security category is taken from NIST FIPS 199: Low, Moderate, or High — the same three values the compliance community has long called impact levels. If you need a refresher on how to calculate these ratings for your own services, our guide FIPS 199 Security Categorization Explained walks through the process step by step, including a full worked example.
CDS-CSO-SVC asks for one category per service, not one per offering, because of MAS-CSO-FLO — the Minimum Assessment Scope rule covering information flows and security categories. MAS-CSO-FLO allows information resources to carry different categories depending on the information they handle, so a single blanket rating for your whole offering wouldn't reflect reality. Our FIPS 199 guide includes a worked example of exactly this — a platform where individual services land at different categories depending on the information each one handles.
Where to Start: Scoping Your Service List
If you're scoping this work, start with your pricing page. Write down every service a customer can buy, then assign each one a security category and an in-or-out-of-scope status — pulled from a system of record, not from memory. Whichever names you can't resolve are the ones that will go stale, and catching that drift is exactly what CDS-CSO-SVC is designed to measure.
How NYLE Handles This
NYLE implements every CDS requirement for FedRAMP. Providers add a complete service entry once — its public-facing name, its security category, and its Minimum Assessment Scope status — and both the human-readable list and the machine-readable output are rendered from that same record. Nothing is maintained twice, so the two versions can't diverge, which satisfies CDS-CSO-CBF as well.