What does FedRAMP’s FY26 Q2 Security Inbox test require of cloud service providers?

FedRAMP’s FY26 Q2 Security Inbox test is a compliance check tied to the agency’s mandatory Security Inbox requirements, which the notice says took effect on January 5, 2026. FedRAMP will trigger the emergency test during normal business hours between March 2 and March 13, 2026. The test email will come from fedramp_security@gsa.gov and will include the FedRAMP ID, a unique three-word code, and a Google Form link. Providers must submit the FedRAMP ID, the unique code, and the name, title, and email of a preferred follow-up contact. FedRAMP also says response times will be tracked and reviewed, and individual response times may be published as a security metric. Under the referenced requirements, the inbox must accept .gov and .mil messages without disruption, route them to a senior security official, and avoid login gates, sender verification, or automatic closure without human review. If the informational notice was not received by February 23, FedRAMP says to contact info@fedramp.gov immediately.