Class A

Providers MUST complete the required actions in Emergency or Emergency Test designated messages sent by FedRAMP within the timeframe included in the message.

Providers MUST establish and maintain an email address to receive messages from FedRAMP; this inbox is a FedRAMP Security Inbox (FSI). • Unless otherwise notified, FedRAMP will use the listed Security Email on the Marketplace for these notifications. • If a provider establishes a new inbox in reaction to this guidance that is different from the Security Email then they must follow the AFC-CSO-NOC (Notification of Changes) rules to notify FedRAMP.

Providers MUST immediately notify FedRAMP of any changes to the email address for their FedRAMP Security Inbox.

2026 SOC 2 over PDQ's products.

CSO

Class A Audit