CDS-CSO-UTCMUST
Use a compatible trust center
Store and share FedRAMP Certification Data through a FedRAMP-compatible trust center.
A trust center agencies can actually use
Under the 2026 rules, providers must store and share FedRAMP Certification Data through a FedRAMP-compatible trust center (Rev5 offerings by their CDS deadline) that meets the CDS rules. The NISTcompliance.ai Trust Center publishes your package, KSI status, VER reports and Ongoing Certification Reports to the agencies that use you, with access logged and data available to people and to machines.
Runs inside Quzara Cybertorch: FedRAMP Certified, Rev5 Class D (High)SOC 2 Type 2
Certification Data Sharing
What a trust center has to do
CDS-TRC-USHMUST
Share without interruption
Give all necessary parties access without manual approval each time.
CDS-TRC-PACMUST
Programmatic access
Provide documented programmatic access to all certification data, including human-readable materials.
CDS-CSO-CBFMUST
Keep formats consistent
Use automation to keep human-readable and machine-readable versions consistent.
CDS-TRC-ACLMUST
Log access
Log access to certification data and keep access summaries for at least six months.
CDS-TRC-AAIMUST
Know who has access
Keep an inventory and history of federal agency users or systems with access, and supply it to FedRAMP on request.
Sources: CDS rules. FedRAMP Consolidated Rules for 2026, checked Oct 23, 2026. Not a substitute for the official rules.
The platform
What agencies see
Current certification data
Package materials, secure configuration guidance and KSI status, always the latest version.
Packages →OCRs and VER history
Ongoing Certification Reports every 3 months and monthly VER reports, with JSON history for retrieval.
VER →Access you can account for
Built around the CDS rules for logging access and keeping an inventory of the agency users and systems that can see your data.
Questions
Common questions
Is a trust center required for FedRAMP 20x?
Yes. CDS-CSO-UTC requires providers to use a FedRAMP-compatible trust center to store and share FedRAMP Certification Data. It is on the mandatory rule list for every Class, Class A included.
Does the trust center need an API?
Yes. CDS-TRC-PAC requires documented programmatic access to all FedRAMP Certification Data, and CDS-TRC-HMR recommends that data be viewable and downloadable in both human-readable and machine-readable formats.
How long must access logs be kept?
CDS-TRC-ACL requires trust centers to log access to certification data and keep summaries of that access for at least six months.
Book a demo
See your trust center
We will show the agency view of your package, reports and access logs.