Repository navigation
20x questions and discussion on the Consolidated Rules for 2026 #147
Replies: 18 comments 53 replies
|
I'm not seeing the 20x Pilot documentation on the /legacy page, as indicated by this link: Is that still in the works to be included there? (Or am I just not seeing it?) Excited to have the CR26 finally officially published!! Great work and congrats on getting it out! :) |
|
Oops, that was a miscommunication and should not say that; we haven't made legacy 20x pilot material available to avoid indexing and training issues because it's no longer applicable. Every single pilot participant has completed phase 1 and phase 2. If you want to dumpster dive for that content it's in the commit history at https://github.com/FedRAMP/docs-legacy :) |
|
What is the preferred path for a provider who has some items on prem and some in AWS? Rev 5 had the PE, MP, MA families to address those risks, but 20x is very much designed for cloud native products. With the planned retirement of Rev 5, there doesn't seem to be a path for these services in FedRAMP or am I missing something? |
|
At the moment 20x is for cloud native services built on a FR Certified IaaS/PaaS - Phase 4 will explore expanding this to include on prem and host services including Class D. There will be a 20x option for on prem that is widely available before new Rev5 Certifications are stopped, and it will be developed in public over the next 6-9mo so folks will have plenty of time to follow along and prepare |
|
Does Level A allow for those services to enter the marketplace or will on prem/host services need to wait until Phase 4? |
|
Great question! We discussed this internally and a Class A would be open to folks with hybrid or on-premise infrastructure. However, you would have to go from a Class A to a Rev5 Class B/C/D until we have a pathway available for the higher 20x classes. |
|
I know that @pete-gov is out getting some nature and motorcycle therapy right now, but would love some help with the following questions! :)
|
|
Thank you for the quick answer, @pete-gov - that's very helpful and clears up the RFC-vs-outcome distinction. Much appreciated. So I read the finalized position as: FedRAMP no longer prescribes any particular secure-configuration standard or level (STIG, CIS L1, or CIS L2) for Rev5/CR26. The responsibility shifts to the CSP to select a defensible baseline, apply it, and document the choices and rationale for how they meet the control. One small confirmation, if you don't mind: is it fair to say there's no FedRAMP-defined minimum tier we must hit (i.e., L1+L2 is not implicitly required), so as long as our selected configuration is risk-based, applied, and evidenced? Just want to be sure we're interpreting "roll your own following best practices" correctly before we lock in our approach. The closest I found from requirements perspective relevant to this is here: https://preview.fedramp.gov/2026/reference/secure-configuration-guide/ << so long as we keep these in mind and evidence them along with the actual security configuration guide (which most likely will be a CIS benchmark) - it should be fine I assume. Thanks again for taking the time. Kr, |
That is exactly right - though please remember that is simply to obtain/maintain a FedRAMP Certification. There absolutely might be some agency customers in various situations who might write requirements for that into their contract or expectations depending on their agency use case. |
|
Awesome thanks a lot for the help and the quick response @pete-gov 🙏🏻 |
|
I also want to chime in to make the point that your Secure Configuration Baseline should very intentionally be security-relevant settings specific to your cloud service offering. This means that we hope that CSPs will go beyond generic advice and give agencies specific recommended settings to configure their application of your cloud service securely. I'd be remiss if I didn't mention that our friends at CISA are working on the SCuBA (Secure Cloud Business Applications) project, which is developing frameworks for vendors to provide secure baselines. |
|
Thanks a lot @nicole-gov for the additional information. My question was rather related to the operating system itself - and yes our intent is to definitely go beyond generic advice. In addition thanks for mentioning SCuBA - looks an interesting initiative - I will share it internally. Kr, |
|
Welcome back, Pete! Could you help us with a question? If a ruleset's grace-end date falls before a CSP's Annual Assessment (AA) date, how does FedRAMP expect the CSP to demonstrate compliance? For example, the VDR and VER rulesets have grace-end dates in March, but a CSP may have its AA scheduled for August. In that scenario, how is the CSP expected to show compliance with those rulesets in the gap between March and August? |
|
TM... Sorry Pete is out at an event rubbing elbows with Agencies, 3PAOs, and CSPs.... So you get the third string kicker.. Based on your scenario, you are a Rev5 CSP transitioning to the ruleset... Something important to call out as 20x processes and Rev5 are different in regards to timelines and reviews. Transition to Rulesets do not require initial 3rd party validation it just requires you to follow the rules. Yes, transition to some of the rulesets will change control statements that should be validated during your annual review. Your VDR/VER example is great as it will affect your CA-5 controls, but you can transition to rulesets anytime before the required dates. Some Rulesets require notification when transitioning. For example, the CDS Ruleset, under CDS-CSF-TCM, requires you to "Notify FedRAMP via email: info@fedramp.gov," when you transition. Others, we will request your implementation status at various points through the FSI process. The evidence of your transition for most of these will be prevalent in you trust center or repo. The VDR/VER example you provide is an excellent example. Your March ConMon in your scenario should contain VDR/VER requirements (POA&M should change to Monthly activity report with PAIN thresholds, new timelines, etc). When you do your annual assessment we will also ask about status of rulesets and implementation dates. Your agencies should also be tracking your ruleset adoptions and should identify issues and deficiencies as well. Hope that helps. Paul |
|
Thanks for the clarification, Paul. That was a first-string response! |
|
I'm also going to point out that adopting new FedRAMP rules that change your existing processes will almost certainly count as a Significant Change, so you should treat it as such, follow the Significant Change rules, and notify your customers accordingly. |
|
Hello! To prepare for our RAR conversion submission, I have a couple questions:
|
|
We can't offer business advice, so it's really up to you. You can apply for Class B or C as soon as you want after a Class A certification once the relevant B/C pipelines are open or you can skip Class A and head directly for 20x Class B/C (or Rev5 Class B/C if you qualify for lost sponsor or ready conversion). |
|
Totally understand that, just wondering specifically if there is a clear path to C if we start with A, and what that looks like. Is that defined yet or more a WIP? |
|
Yes, all certification paths from Class A through Class C are already defined in CR26. If you start with a Class A, you can submit for any available Class B or C path that you qualify for whenever you're ready. 20x Class B and C opens on 8/31/26. |
|
Thank you Nicole! I'm excited to see where we end up landing. It's amazing how many choices there are - it feels like the open frontier. 😊 |
|
One more clarification. The Secure Configuration Guide required under SCG-CSO-RSC is intended to instruct an agency customer how to configure your service. So unless you expect to have agency customers configuring the OS on your system components, the OS configuration does not need to be included in the Secure Configuration Guide. |
|
We would appreciate some clarification regarding a FedRAMP response to a Q&A question that was raised earlier this week. Is it correct that if a "Must" statement in the rule set is not met by the Maintain Date, FedRAMP will issue a Corrective Action Plan (CAP)? Additionally, if the same non-compliance remains unresolved after the Grace Date, will FedRAMP revoke the CSP's authorization/certification? For example, suppose a CSP is using a cryptographic module that is no longer compliant with FedRAMP requirements (it has a historic CMVP certification, and has no plans to submit for a new one). The CSP has identified the issue, documented it, and has a plan to move to a different technology entirely; however, due to implementation complexity, the remediation cannot be completed until AFTER the Grace Date. Can we track as an open vulnerability with agreement from our Collaborative ConMon? Will we get an automatic CAP? Will we get revoked? |
|
Hello, just checking in to see if there are any updates on the above. Thank you! |
|
Hi FedRAMP team, I'm looking for some clarification regarding Security Decision Record Metadata.
"Version" and "Date and time of last update" is straight forward, but what is the expectation of "Source of update"? Is this referring to if the update was automated v.s. manual? An individual or entity? It would be helpful to have these 3 properties also in the FedRAMP provided SDR JSON Schema with examples or an enum (if appropriate) of what is expected. |
|
@jnguyen1294 The Source of Update is intended to alert the reviewer if this is a regular, recurring update or something prompted by an unusual event. There are no prescribed values, but in general we envision this being a process such as Continuous monitoring, SCN or Incident Response. I opened an issue to remind myself to add these to the schema. Thanks for flagging! |
|
Thanks for the answer! We'll use our own values for now on this and look forward to seeing the schema update! |
|
Hi FedRAMP Team - Can an artifact that supports FedRAMP Rules or Rev. 5 controls be referenced within machine-readable JSON files that contain implementation statement responses for those rules and controls, rather than requiring the artifact itself to be generated in a machine-readable format? Our interpretation is that referencing the supporting artifact is sufficient to satisfy the SDR requirements for SDR-CSO-FRR and SDR-CSF-CTF. Based on this interpretation, the requirement does not necessitate converting the underlying artifact into a machine-readable format. |
|
Taimur, JSON does allow for control specific artifacts, but those should be done in support of the machine readable answers. Maybe your question has a unique situation, but the concern based on the generic question is we see something like this for SDR-CSF-CTF... Schema
A blanket yes could lead to this in implementation.
If I am misreading your question, provide some steerage or context. To be fair, I am only half a Monster in this AM. |
|
Noted! Only message Paul in the afternoon. Our question boils down to this: If our supporting artifacts are screenshots for the time being, and therefore not machine readable, what is the best way to present them alongside the SDR? |
|
If not within the SDR itself, direct links are best as there is no confusion on where to find the referenced artifact. "See Trust Center" is not always awesome, even if the folder/file structure is fairly organized because it takes time to dig around and it is really easy for drift to occur with files names. If we have to assemble a search party to find your files, we will push back on your submission, which will further extend the review timeframe. Context is also very important and how the artifact is relevant should be well articulated. |
|
Hi FedRAMP team — a question on the Scope of FedRAMP guidance (https://www.fedramp.gov/2026/scope/#information-providers, originally from RFC-0010). The out-of-scope "Online Learning Platforms" example lists Udemy, Coursera, Skillsoft, and similar platforms. OpenSesame is an online learning and training platform squarely in that same category. Three questions:
We want to give agencies and partners what they need without implying an authorization requirement that doesn't apply. Thanks for the work on CR26. — Aaron Bridges, CTO, OpenSesame |
|
Thanks for posting this here in the community as this is a great topic to dive into! Scope of FedRAMP really depends on how the service is being used. Any example services are to aid understanding and not to be used as any kind of exclusion list. Even those mentioned in the examples could in certain use cases be within scope. So while "it depends" might feel like a non-answer, this stuff is really circumstantial based on how the agency will be using your service. Different uses exist across different agencies and even within the same one! A key test here is general education and training . If the same content is being offered to the general public as it is the agency, then you are likely out of scope. If the agency is creating and publishing internal content to your platform for specific agency users and requires the collecting of federal information, you are probably in scope. Best thing to do is to talk it out with the agency you are working with and you can absolutely reference our Scope of FedRAMP page to help frame the discussion. We don't offer any kind of blanket out of scope hall pass or anything, but are always happy to help support agencies when they have questions. |
|
Hi FedRAMP team- Context: If a capability is sold as a licensed feature inside a larger cloud service — enabled by a feature flag, running entirely on the parent product's infrastructure, not purchasable or operable on its own — can that capability be listed on the FedRAMP Marketplace and pursue a 20x Class A Certification as its own cloud service offering? Or is the expectation that the parent product is the listed offering, with the feature inside the Minimum Assessment Scope? Follow-ups:
Our reading of MAS-CSO-IIR (the identified resource set constitutes the offering) and CDS-CSO-PSM (providers determine what constitutes separate services) suggests there's flexibility - but since the feature depends entirely on the parent's infrastructure, its boundary would pull in the parent's components anyway, making the parent the natural listing. Is that right? |
|
Sorry we have not responded yet, this is a good question that requires a thoughtful and nuanced response. We will discuss internally and get back to ya! |
Being unable to purchase the service as an individual product without the parent would make it ineligible for it's own listing. It also feels a bit on the sneaky side. When you certify the parent product, you have the flexibility to add services under that listing, which are services from a marketing feature perspective, not a technical perspective. So as long as any relevant components that feature relies upon are included in the minimum assessment scope, you are OK. In the other possible scenario that it becomes a product purchasable on its own, but is still heavily dependent on the parent product, you could list and reference the parent as a resource under |
|
To emphasize this response with some specific scenarios: If a company develops a standalone product that has its own team, assurance support, FedRAMP Certification Package, etc. then it's a separate cloud service offering with its own Marketplace listing - even if it is hosted or run on a PaaS/IaaS provided by that company. All FR requirements must be met to maintain a Marketplace listing, and something like a feature or capability where there isn't a standalone package, continuous monitoring, sales pipeline, etc. is obviously part of the parent cloud service offering and listed as a service within that parent Marketplace listing. |
|
Hello FedRAMP team, With regards to IVV-CSO-RAA, could I have some more direction on what is allowed for a 3PAO. For instance, if a 3PAO were to do the advisory for a CSP and have a firewall setup to ensure the advisory team can't influence the assessment team. Would the 3PAO then be permitted to perform the assessment for the same CSP as long as their is no data being shared between the advisory and assessment activities? Thanks for the guidance here, I just want to make sure I understand correctly so that we can work within the expectations of FedRAMP. |
|
Hi FedRAMP Team - Following up on the Class A → Class C path (@nicole-gov previously mentioned to apply at any time for class C). How does FRC-CSX-MOT apply in that case? Its note says that for initial certification, providers "will need to have mechanisms in place and agree to meet this requirement" when the service has not been operating with related metrics available for the required 6 months. If a CSO is certified at Class A first and then applies for 20x Class C a few months later, does that note still apply? E.g., can we apply with ≥2 automated validation methods per KSI running and status recorded nightly, plus the agreement to meet the 6 months or does the Class A certification make the full 6 months of KSI metrics a hard prerequisite for Class C? We'd rather not skip Class A if the note carries over. Thanks! |
|
Initial Certification means when we originally review your Certification package materials. If you have a Class A and submit for a Class C, our Class C review is still the "initial certification". Also, as we are doing our Class A Certification reviews, we put a section on your Certification report specifically for any feedback we have for ascending to a Class B or C. Feedback on things that could enhance future review timelines and avoid rework like clarity of implementation descriptions, quality of artifacts, package review experience, etc. |
|
So to fully answer your question, that note does indeed carry over even if you already have a Class A or B. Just be mindful of your implementation status, as in you don't have that fully implemented if you don't have the 6 mo of metrics. We can't give business advice, but if you already have an approved alternative security framework (SOC 2 Type II, FR Rev5 or GovRAMP) and are working on a Class B or C, Class A is a awesome way to iterate your package build, get actionable feedback from FedRAMP early on and get listed on the Marketplace with a read deal Certification. |
|
Is a CSP required to have a Trust Center to get listed on the Marketplace in the Initial Implementation Phase? CDS-CSO-PUB and MKT-IIP-DCP make reference to Trust Centers, however, do not seem to specifically require a Trust Center (as machine-readable information via public webpage is an option). However, the CSP Getting Listing narrative (https://www.fedramp.gov/2026/providers/implement/marketplace/) states: "You will need a basic FedRAMP-compatible Trust Center" and 20x CWG meetings have discussed CSPs not needing "a full Trust Center", insinuating some level of a Trust Center is required for the Initial Implementation Phase. |
|
You've hit on a small narrative issue but the key thing is that the explicit rules are followed, not the narrative. The rules require you to make information available publicly and a "basic FedRAMP-compatible Trust Center" is explained as a way to do that in the narrative, but there is no rule that applies FedRAMP-compatible Trust Center requirements here. Per the rules:
So basically if you have a FedRAMP landing page that publishes all of that information publicly we would consider that to be "a basic FedRAMP-compatible Trust Center." |
|
Hey team - as the 20x pathways have become generally available I have seen a lot of interest in class A but also a lot of confusion on how to get there. One of the main questions being the independent assessment for Class A certification. In the rules for Class A, the wording seems deliberate in having MAY instead of MUST. Can a cloud service provider get listed on the FR marketplace at Class A without an independent assessment? |
|
Yes, you can get listed on the FedRAMP Marketplace for a Class A Certification without an Independent Assessment Service performing and Independent Verification and Validation. We have 2 CSPs who both recently became Class A Certified speaking about their experience TODAY on our 20x Community Update. Both of them did not have an IV&V performed. |
|
lol jumping on this to +1 emu-gov and also be extra clear that it's really not a trap when a FedRAMP rule says you MAY do something 🤣 All of the rules wording is deliberate. Force of the rule is explained here: https://www.fedramp.gov/2026/rules/#force-of-the-rule We do want to make it clear that if someone wants to initiate a relationship with an independent assessor and get them to double check things before submitting for Class A that they can document that they did so and might have a smoother time, but it is absolutely 100% not expected. |
|
I'm looking for clarification on how to apply the scope criteria for FedRAMP 20x in cases where locally installed software handles Federal data and is essential for the CSO to function, but operational control resides entirely with the agency. Based on MAS-CSO-IIR, it appears that such software may be in scope if it handles Federal data or could impact its CIA. Additionally, the Scope of FedRAMP website includes an example where a locally installed agent that handles Federal data is considered within the FedRAMP assessment scope: However, both the Scope of FedRAMP site and notes within MAS-CSO-IIR also state that FedRAMP is focused on cloud products, and that locally installed software is generally out of scope unless it is operated as part of a shared responsibility model. In this case, which factor takes precedence for scoping purposes: |
The answer - as you've seen - is that the nuance depends on the implementation. For FedRAMP and the Minimum Assessment Scope, the scoping occurs within the data boundary of the cloud service. If you have command and control from the cloud service, or accept telemetry from devices, or have some other form of control over the deployed software (such as updated) then all of that aspect of the cloud service is in scope for FedRAMP. The actual software itself, the process of deploying and operating it within an agency enclave or device, the risk and analysis of it, etc. is outside scope for FedRAMP. MAS-CSO-SUP (Supplemental Information) allows you to include information like this in your FedRAMP Certification Package for easy distribution, but FedRAMP will not assess the security of something that isn't a cloud computing product or service within the scope of FedRAMP and FedRAMP's rules do not extend to locally deployed software that is placed inside an agency boundary. Does that help or just have more questions? If there's a specific architecture scenario we can help walk through it. |
|
Thank you very much. I think I'm following. For locally installed software, different aspects may be considered in or outside the FedRAMP scope depending on the level of control the CSO exercises over the software. So, in cases where the local software can be controlled to some extent from the CSO, the control the CSO exercises over the local software is within the FedRAMP scope. This would mean that KSIs and rules applicable to the actions the CSO can take on the local software must be addressed, but other aspects of the software fully managed by the agency would remain outside the FedRAMP scope. |
|
Yes, exactly right! |
|
Can a provider that runs its own infrastructure obtain a 20x Class A Certification today? |
Yes, they can obtain a Class A Certification. They will not be able to advance to a 20x Class B+ until self-hosted rules are in place, but could transition to a Class B+ Rev5. |
|
Following the recent introduction of N0 to the PAIN ratings, I have a question about how N0 interacts with Accepted Vulnerability classification. If a vulnerability remains detectable but has been fully mitigated such that its likely agency impact is N0, does VER-TFR-MAV still require it to be categorized as an Accepted Vulnerability after 192 days, or does full mitigation satisfy the requirement regardless of continued detection? |
|
There does not have to be any interaction between N0 and Accepted Vulnerabilities. A cloud service provider may choose to accept the risk of a PAIN5 vulnerability.
Vulnerabilities should live on as a tracked vulnerability until they are remediated. Even a fully mitigated vulnerability that has been accepted needs to be tracked in case there's a future circumstance where it comes into play. Remember that fully mitigated means it's still there, you can still see it. Remediated means it's gone. Remediation is the only true end state for tracking a vulnerability. |
|
We’re preparing a FedRAMP 20x Class C certification for a multi-tenant SaaS platform that lets customers use our tools with data and workloads appropriate to the assessed scope and applicable agency requirements. Class C is our initial step. We plan to pursue Class D or IL4 later, and we’d like the Class C work to be a reusable foundation for that. Since Class D isn’t available in this window, agencies would initially be responsible for securing and authorizing any data storage in their own solutions. Three scoping questions: We have a documented SaaS use case but no named agency customer or live federal workload yet. Does that support an initial Marketplace listing under MKT-IIP-AGU, and how should we define the initial assessment scope before an agency customer exists? Under MAS-CSO-IIR, if agency data stays in agency-managed storage and the platform only processes it in transit, how should we treat that data and the resources that handle it when defining the offering? If a storage service is added once a Class D path opens, would it be added to the existing certification or assessed separately? |
|
Hi! I do want to be clear that the specifics might vary from situation to situation and it's usually a good idea to have an advisory service with some experience to help navigate stuff - but overall if you're intentional and stay up with the rules there shouldn't be any surprises. Remember... it's not a trap!
If you intend for the offering to be used by agencies then you're fine.
Scope it to whatever parts of the offering you expect to make available to agencies that are likely to handle or affect confidentiality, integrity, or availability of federal customer data when they onboard.
FR can't provide advice and would need to deep dive on your architecture in any case to understand what you're asking here, but the rubric is simple - everything handling it is in play. Everything related that would likely affect CIA of it is in play.
This is up to you and would depend on the business case and goals. You can add it to an existing certified assessment scope as a significant change or you could get a separate certified offering if it's a different product. 🤷 Hope this helps! |
Uh oh!
There was an error while loading. Please reload this page.
This thread is for any and all Q&A or general discussion related to FedRAMP 20x in general that does not need to have its own thread.
FedRAMP released the Consolidated Rules for 2026 on June 24, 2026 with all requirements for FedRAMP 20x Class A, B, and C.
This includes:
We're excited for folks to continue digging in after the Public Preview and begin preparing. We're happy to answer any general questions that don't need their own thread here!
You may see some of the following folks from FedRAMP responding in this thread:
pete-gov- Pete, FedRAMP Directornicole-gov- Nicole, Security Directordan-fedramp- Dan, Lead Cloud Security Engineerpaulagosta- Paul, Lead Cloud Security Engineer (Bastion)emu-gov- Emu, Lead Cloud Security Engineer (Vanguard)rhoesing- Ryan, Chief of Staff & Policy Branch ChiefAll reactions