Repository navigation
RFC-0033 FedRAMP 20x Phase 4 Development Tracks for 20x Class D #170
Replies: 17 comments 5 replies
|
One concern with item 3 ("Class D services must only use Class B, C, or D Certified Third-Party Information Resources in their Minimum Assessment Scope") is how it interacts with the MAS test. MAS-CSO-IIR pulls in resources likely to impact the confidentiality, integrity, or availability of federal customer data, not only those that handle it. Read broadly, that captures services that influence security decisions but never touch federal customer data or the production environment an employee screening or identity proofing service, or a security training platform, for example. Those dependencies deserve review, but MAS-CSO-TPR already handles them today with documented justification, mitigations, and compensating controls. Item 3 would remove that path at Class D and require full Class B / above certification even where reliance is narrow, which could push providers away from useful security tools. Two asks: (1) Will FedRAMP clarify whether third-party services with no federal customer data and no system access to the production environment are in the MAS at all? Updated Comment: Another option I propose to keep MAS-CSO-TPR intact is to require an agency trust center for continuous KSIs and vulnerability reporting for services that do not require Class B and above. The effort is significant for a vendor to properly setup an automated trust center, but it is much less than continuously maintaining Class B. It is critical for the FedRAMP ecosystem to move towards these automated validations and data but not force vendors into the full requirements with added costs when their solution is unlikely to be selected by federal buyers. Having done both SOC2 and FedRAMP 20x I am conflicted in accepting alternative certifications and see requiring both an external certification and continuously outputting KSI data as comparable solution since 20x is superior even at Class A. The ideal state is for Class D CSPs to have everyone in their supply chain monitorable by an agency. This way automated security measures can continuously respond to any weaker CSP security postures. |
|
As always, we appreciate the FedRAMP PMO keeping these discussions public and open allowing us to contribute. On third-party service certification requirements (MAS Class B/C/D-only rule): We'd ask FedRAMP to reconsider making certified status an absolute requirement for third-party information resources in Class D Minimum Assessment Scope. As written, it forces CSPs to source every dependency, even for non-federal-data workflows, from an already-certified vendor pool. This can block adoption of useful services that never touch federal or CUI data, for example third-party observability and monitoring platforms handling only synthetic or non-customer telemetry, AI-driven feature services like text-to-speech or translation used for product functionality unrelated to federal data. This mirrors a restriction from FedRAMP Rev5, where third-party services had to hold an authorization at the same level as the CSP's own. That approach proved overly restrictive in practice, often forcing CSPs into lower-quality tooling simply because the strongest available vendor hadn't yet pursued certification. We'd suggest allowing non-certified third-party resources when a CSP can demonstrate the resource never processes federal or CUI data, paired with reporting stipulations that preserve assurance: documented data flow diagrams proving isolation, a assessment scope justification reviewed at each annual assessment, ongoing monitoring and reporting on the third party's security posture (SOC 2 Type II or equivalent, incident history, patch cadence), and a commitment to monitor that provider's vulnerability disclosures as part of the CSP's own vulnerability management program. Any change in the provider's data handling would move the resource back under the standard certified-only requirement. This would let CSPs scale into useful non-federal-facing capabilities without waiting on a niche vendor's FedRAMP business case, while keeping the actual federal data boundary just as tight. On a transition path for existing Rev5 Class D cloud-hosted CSPs: The RFC doesn't address how a currently-authorized FedRAMP Rev5 Class D (formerly High) cloud-hosted CSP would obtain a 20x Class D designation. Track 1 appears to require earning 20x Class C first, which effectively asks an already-High-authorized CSP to step down to a Class C 20x certification before re-earning Class D under 20x. It would help to confirm whether that's the intended path, or whether a direct Rev5 Class D to 20x Class D track is planned. We'd request that the anticipated Class D Key Security Indicators and transition options for existing Rev5 Class D cloud-hosted CSPs specifically be included in the October 14 RFC. Many of us are trying to budget FY27 and FY28 compliance and engineering investment in the next 8 weeks, and it's difficult to plan responsibly without visibility into the end-state requirements or an interim path for CSPs already operating at the High baseline. |
that's not how I read it - I thought it meant: for all your dataflows that touch Federal data or support C-I-A (ie MAS) those services must be certified (at the certification level appropriate for those data flows or impact of the controls)? I think your (valid) example scenario of not touching the data is incompletely described though - if the service implements the C-I-A controls for the Fed data, then it might be in MAS. So not just about directly touching data. For example: my CA never "touches data" but it is essential to the key chain to protecting data. Maybe I read it wrong... Overall I agree with the rule as I understand it. Also (editorializing) I think the idea behind the CRs are that FedRAMP goals == any security program goals (not idiosyncratic or niche) - so if someone is a legit vendor and has ISO or SOC2 why not get Class B certified? Personally I'd trust the Certification WAAAAAY more than ISO or SOC2 (having done both and audited both). Especially now that the cost of Class B is roughly equivalent to a SOC2 audit - and in some cases CHEAPER. YMMV. EDIT: splelling typo ;) |
|
@cb-axon thanks for your comments. I strongly support all, especially the Rev5 High/D to Class D path. FedRAMP could make this an explicit area of focus during pilots. |
|
More of a question than a comment and unique: if the 20x Class D Pilot runs during the same timeframe as a Rev5 Moderate Assessment and you are accepted into the Pilot, would it make sense to forgo the Rev5 Moderate Assessment? Class D Certification would complete at the same time as the Rev5 Moderate SAR expected delivery so it seems like double work. |
|
Rereading the RFC - I believe I misunderstood and we must be Class C 20x certified prior to Dec 1 to be eligible for the Class D Pilot, not just claim we have the CR26 in place under Rev5. If we submit a Class C 20x package prior to Nov 13 we should submit a notice of intent for the pilot correct? @pete-gov |
|
The following comment from FedRAMP is for the convenience of the public and is not intended to influence other commenters or endorse this specific comment: Please note the introductory statement in this RFC: FedRAMP may not participate in the formal public comment thread to avoid influencing public comment. If you have general discussions, questions, or other related things to discuss that you do not want to include in formal public comment, please use this discussion thread: #172 (RFC threads are not like normal discussion threads in this forum, this is a formal public comment process - if a question is asked in formal public comment, FedRAMP cannot respond directly but will treat the question as a comment to be addressed during consideration of the outcome) |
|
On item 5 (the assurance-engineering and automation-capabilities part): the nearest hook is SDR-CSX-KSI, which already requires, per KSI, "Verification that the automation in place is accurate and sufficient to demonstrate appropriate measures for the Key Security Indicator." Nothing defines "accurate and sufficient" as including a demonstration that the method can report failure. Measures are covered — IVV-CSO-SEE, "evidence ... of the effectiveness of the measures ...; this evidence is the result of validation", and IVV-IAS-VEF, assessors reviewing them "at a technical level". The validating mechanism is not addressed. Checked against Intent is partly on record in #176: distinctness is "up to the cloud service provider", and "During FedRAMP Certification we will include our own report on how usefully assuring and diverse we think the methods used are." That report is discretionary and after the fact, not a stated expectation. As written, the Class D minimum of four — and Class C's two — counts methods, not demonstrated detections. Proposal, as an evidence expectation rather than a prescribed method: for a Class D automated method, evidence of effectiveness should include at least one observed failing run against a state it is meant to catch; mechanism is the provider's choice. Two methods count as distinct only where each reports failure independently. FRC-CSX-MOT's eighteen months of status from a validator that cannot fail is eighteen months of green; in the same history, those runs distinguish it from a working one. Ask: state this in the October 14 RFC as a Class D evidence expectation. I contribute to open-source security tooling as an individual; the shape is common. On an apache/arrow issue I flagged a fixture whose compose assertions could not fail: composed and decomposed inputs were identical bytes (79e074a). Happy to be told this is already intended under IVV-IAS-VEF. |
Solutions by Jewel — Public Comment on RFC-0033: 20x Phase 4 Development Tracks for 20x Class DSubmitted by: Jewel Darlington, Chief AI Governance Officer & Founder SummarySolutions by Jewel (SBJ) offers targeted feedback on RFC-0033, consistent with FedRAMP's stated preference for explicit, targeted comments. RFC-0033 describes 20x Class D as intended for federal workloads where threats to the confidentiality, integrity, or availability of federal customer data may lead to catastrophic harm, including loss of life. SBJ offers five recommendations, each mapped to a specific RFC-0033 proposal and each built on an existing Consolidated Rules for 2026 mechanism. A closing section addresses agency authorization authority.
1. Operating History and Assurance-State ContinuityRFC-0033 proposal. Anticipated Class D requirement 1 would require a service offering to hold a 20x Class C Certification with zero corrective actions for six months before becoming eligible for Class D Certification after the Phase 4 pilot. Recommendation. SBJ supports operating history as an assurance input. SBJ recommends that the detailed Class D requirements define assurance-state events that require the provider to determine, and record in the Security Decision Record, whether evidence from the observation period remains representative of the offering seeking Class D. Candidate events include:
For each event type, the requirements should specify the evidence needed to evaluate its effect, whether review is full or scoped, and how the determination is recorded. A scoped determination can resolve a trigger within the existing six-month period. Basis. CCM-OCR-AVL requires an Ongoing Certification Report every three months that summarizes, where applicable, Transformative Changes and FedRAMP Reportable Incidents, so a six-month window spans two reporting cycles. The Significant Change Notification rules supply the event inputs: their Transformative Change examples include adding, removing, or replacing a critical third-party service, replacing underlying management planes, and datacenter migration. SCN-CSO-INF already requires a plan for verifying, assessing, or validating impacted Key Security Indicators. The note to SCN-TRF-UPD scopes the post-change documentation update to service documentation such as user guides and marketplace information. For Class D, SBJ recommends extending that update to the Security Decision Record: after the SCN-TRF-NAV notification, the provider records whether prior assurance conclusions remain applicable. SBJ professional technical position. SBJ AI Governance Architecture V1.0 states: "Derived Authorization is newly scoped authority issued as the result of an event, state or condition, decision, validation, remediation, or authorized transition." Applied to Class D eligibility, an assurance-state event calls for a newly scoped determination of what the operating-history evidence still supports. This application is SBJ's professional technical position. 2. Bounded Inheritance from Class D IaaS/PaaSRFC-0033 proposal. Anticipated Class D requirement 2 would require cloud-hosted or hybrid-hosted Class D services to be deployed on a Class D Certified IaaS/PaaS. Recommendation. For each FedRAMP rule or Key Security Indicator that relies on inherited assurance, the dependent provider's Security Decision Record should identify:
These entries should be machine-identifiable in the Security Decision Record JSON schema, so that a downstream provider can determine whether a material upstream change affects its own assurance state. Basis. SDR-CSO-FRR already requires, for each applicable rule, an explanation of implementation, verification, validation, independent verification, and independent validation. A per-rule inheritance reference is a bounded extension of that structure. SBJ professional technical position. SBJ AI Governance Architecture V1.0 states: "An Authority Envelope is the bounded set of conditions within which an AI system or agent is authorized to act. Depending on context, the envelope may include the actor or system, action, target, tool, credential, environment, time, delegated authority, approval, stop conditions, and evidence requirements." V1.0 also states: "Derived Authorization is newly scoped authority issued as the result of an event, state or condition, decision, validation, remediation, or authorized transition." Applied to Class D infrastructure inheritance, inherited assurance is newly scoped to the dependent offering and carries the boundary of the upstream certification, covering the capabilities and conditions that certification evaluated. This application is SBJ's professional technical position. 3. Third-Party Resource Dependency TraceabilityRFC-0033 proposal. Anticipated Class D requirement 3 would require third-party information resources within a Class D service's Minimum Assessment Scope to hold Class B, C, or D Certification. Recommendation. SBJ recommends that each material third-party information resource be associated with a structured dependency record that identifies:
SBJ also asks FedRAMP to clarify, in the October 14 requirements RFC, how a Class D provider should justify reliance on a Class B or Class C Certified resource for a function whose compromise could produce Class D-level impact. Basis. MAS-CSO-TPR requires providers to document, for each applicable third-party information resource, its general usage and configuration, the explanation or justification for use, mitigation measures, and compensating controls. The recommended record adds the relied-upon assurance, its evidence, and the reassessment condition, linking those existing fields to the proposed Class D certification requirement. 4. Evidence Provenance, Applicability, and ValidityRFC-0033 proposal. Anticipated Class D requirement 4 would expect providers to support integration of assurance data into agency GRC systems. SDR-CSX-KMT states that Class D providers must significantly supersede lower-Class historical-metric requirements, with specifics to be set during the Phase 4 pilot. Recommendation. SBJ recommends that Phase 4 define minimum evidence-level fields for material Class D assurance evidence, where applicable:
Basis. SDR-CSO-MTD requires version, date and time of last update, and source of update at the record level. SDR-CSX-KSI requires summaries of measures, persistent cycles, verification, automation verification, and validation for each Key Security Indicator. The recommended fields carry equivalent information down to individual evidence items, which is the level at which agency GRC systems ingest and evaluate assurance data. SDR-CSO-FRR already separates provider verification and validation from independent verification and validation; the recommended fields preserve that separation for automated evidence. 5. Hosting-Classification ChangesRFC-0033 proposal. RFC-0033 proposes formal definitions for cloud-hosted, self-hosted, and hybrid-hosted cloud service offerings, and Track 2 will develop self-hosted and hybrid-hosted rules for the Consolidated Rules for 2027. Recommendation. When a cloud service offering's classification under these definitions changes, or responsibility for physical infrastructure shifts materially, the provider should record a determination covering:
Scoped review should be available where evidence supports continued applicability of existing conclusions. Several such transitions already qualify as Transformative Changes under the Significant Change Notification rules, including datacenter migration and replacement of underlying management planes. SBJ recommends routing the determination through the SCN-TRF-NAV notification, the Ongoing Certification Report, the Minimum Assessment Scope, and the Security Decision Record, and that Track 2 consider it when drafting self-hosted and hybrid-hosted rules. SBJ professional technical position. SBJ AI Governance Architecture V1.0 states: "Transition Authorization governs whether and under what approved conditions a system may cross a governed environment, lifecycle, privilege, capability, autonomy, or consequence boundary." Its application to FedRAMP hosting classifications is SBJ's professional technical position. 6. Agency Authorization AuthorityThe Collaborative Continuous Monitoring rules describe shared, current authorization information supporting each agency's Information Security Continuous Monitoring strategy, with each agency making its own risk-based decisions about ongoing authorization. SBJ recommends that Class D preserve that separation between evidence generation and decision authority as material changes, evidence validity, and reassessment conditions become more explicit and machine-usable. Scope NoteThe constructs referenced in sections 1, 2, and 5 are documented in SBJ AI Governance Architecture V1.0, a governance architecture for AI systems. Their application to FedRAMP 20x Class D cloud service offerings, a broader category that includes AI systems, is SBJ's professional technical position, offered for FedRAMP's consideration during Phase 4. V1.0 serves as the cross-cutting architecture across SBJ's methodology stack, which includes STRATA™ (GRC foundation), SIGNAL™ (AI-specific control and audit methodology), and SYNTHESIZE™ (Physical AI governance methodology). This comment addresses the five areas above, which fall within SBJ's governance-architecture lane. References
Jewel Darlington |
|
Comments on RFC-0033: FedRAMP 20x Phase 4 Excentium, Inc. is a FedRAMP Recognized Independent Assessment Service and a Service-Disabled Veteran-Owned Small Business headquartered in Reston, Virginia. We have held A2LA accreditation for FedRAMP assessment work continuously since 2015 and served as the independent assessor for one of the cloud services certified through the FedRAMP 20x Low pilot. We partner with government and commercial industry to strengthen our nation's cyber infrastructure. These comments draw on two bodies of work. The 20x Low pilot gave us direct experience with a compressed schedule and requirements still being developed. Four years as the Independent Assessment Service for a federal agency's multi-bureau shared cloud service offerings, assessed under Rev5 at the Moderate and High baselines, gave us sustained exposure to agency assurance expectations for consequential workloads. The recommendations below address specific terms, dates, and assessment mechanisms so providers and assessors can reach a common reading. Excentium supports the direction of RFC-0033. Extending FedRAMP 20x to Class D completes the Certification Class range for the 20x Type, while extending it to self-hosted and hybrid-hosted services opens the pathway to providers responsible for their physical infrastructure. Developing these requirements through three simultaneous tracks and public RFCs gives providers, assessors, and agencies an opportunity to resolve implementation questions together. References to CR26 use the Consolidated Rules for 2026, version 2026.10.08.01, published and verified on October 8, 2026. We use Independent Assessment Service following FRD-ASR. Proposed RFC requirements are identified as proposals; they do not establish current obligations. R1. Classification Test for Mixed Hosting FootprintsRef: New FedRAMP Definitions for Cloud-Hosted, Self-Hosted, and Hybrid-Hosted; MAS-CSO-IIR The proposed Cloud-Hosted and Self-Hosted definitions use where machine-based information resources primarily run and who takes responsibility for the physical infrastructure. Hybrid-Hosted applies where some resources are cloud-hosted and others are self-hosted. Please clarify how the two uses of primarily interact with the Hybrid-Hosted definition and whether a materiality threshold applies. This classification determines which requirements attach. Anticipated item 2 applies to cloud-hosted and hybrid-hosted Class D services, while Track 2 eligibility includes primarily self-hosted or hybrid-hosted services. An offering that runs almost entirely on certified cloud infrastructure and includes a small component for which the provider takes physical-infrastructure responsibility appears to fit the Hybrid-Hosted definition. Providers need to know whether that component always determines the classification or whether its function and significance affect the result. The test should account for the resources identified under MAS-CSO-IIR, including resources that can affect the confidentiality, integrity, or availability of federal customer data through security functions. Equipment ownership alone does not establish responsibility for physical infrastructure. A test based only on direct handling of federal customer data would also omit applicable resources with indirect security effects. Recommendation: Publish the classification test and explain how primarily and Hybrid-Hosted apply to a mixed offering. State whether any materiality threshold applies, how physical-infrastructure responsibility is established, and how the result affects item 2 and Track 2 eligibility. Use the MAS-CSO-IIR applicability condition so providers and assessors can reach a consistent classification. R2. The Six Month Period Without Corrective ActionRef: Anticipated Requirements item 1; AFC-FRP-COR; SCN-FRP-CAP; VER-FRP-ARP; IEC-FRP-ORV; FRC-CCL-UCC Item 1 proposes that an offering obtain and maintain a 20x Class C Certification without corrective action for six months before becoming eligible for 20x Class D after the Phase 4 pilot. The proposal leaves open which corrective-action events interrupt that period. AFC-FRP-COR describes consequences that can range from negative Marketplace ratings to suspension of Certification, depending on severity. SCN-FRP-CAP and VER-FRP-ARP refer to a formal provider Corrective Action Plan. Individual rules also publish corrective actions: IEC-FRP-ORV provides for a Corrective Action Plan and a three-month grace period to implement proper procedures in specified circumstances. These mechanisms can produce different eligibility results. An assessor organizational plan under REC-IAS-CAP addresses a separate subject and should be distinguished from corrective action affecting the provider or offering. Adoption milestones may fall within the first six-month eligibility windows. Current 20x deadline guidance identifies January 1, 2027 as the Maintaining Ongoing Certification date for many rulesets, with the grace period ending at the first independent assessment started after that date. For existing Certifications, the guidance says providers should adopt by the maintaining date and requires a plan to adopt by the end of the grace period if they have not done so. VDR and VER have a maintaining date of December 7, 2026 and a grace period ending March 7, 2027. Providers need to know how an adoption-related plan affects Class D eligibility. FRC-CCL-UCC requires a new application to upgrade Certification Class, with applicable requirements met in advance. The six-month condition therefore needs a defined start date and a clear point at which it must be satisfied. A material change to architecture, hosting, a relied-upon security function, or a validation method can also change whether earlier operating history represents the offering that seeks Class D. An assessor should be able to examine a dated record of the change, its affected assurance, and the disposition of the earlier evidence. Recommendation: Identify the corrective-action events that affect the six-month period, who determines their effect, and whether each preserves, pauses, or restarts the clock. Confirm whether the period begins with Class C Certification and must be complete at the Class D application. Explain the treatment of adoption-related Corrective Action Plans and how a Class D Pilot Certification relates to the post-pilot six-month condition. Define when material changes require a recorded determination that the prior operating history remains representative, and the evidence for that determination. R3. Certification Profile in Items 2 and 3Ref: Anticipated Requirements items 2 and 3; FRD-CPF; FRD-TPR; MAS-CSO-IIR; MAS-CSO-TPR We understand from FedRAMP's September 23 response in General Discussion 172 that a reference to Certified, without a specified Type, includes both Rev5 and 20x at the stated Class. That answer resolves the initial Type question. Incorporating the interpretation into the pilot requirements will give providers and assessors a common reference. FRD-CPF also includes Certification Path, so any Path restrictions should be stated. The same response explains that Rev5 end dates and transition requirements will be finalized during Phase 5. Current guidance closes applications for new Rev5 Certifications on June 11, 2027 and provides that existing Rev5 Certifications remain active until at least December 31, 2028 unless FedRAMP is otherwise directed. Please explain how dependency eligibility will be handled as Phase 5 establishes the transition, including whether reliance continues while an upstream Certification remains valid or ends on a separately announced date. Item 3 also needs a scope clarification. FRD-TPR defines a Third-Party Information Resource by its incomplete inclusion in the offering's Minimum Assessment Scope. MAS-CSO-TPR addresses third-party information resources used by the offering, subject to MAS-CSO-IIR applicability. That construction covers relevant indirect security functions as well as applicable resources that handle federal customer data. MAS-CSO-TPR requires documentation of usage and configuration, justification for use, mitigation measures, and compensating controls. Providers need to understand how those provisions relate to the proposed Class B minimum when an applicable resource relies on an offering Certified below Class B or without FedRAMP Certification. For any permitted exception, an assessor could examine the resource's function, relevant data and control flows, privileged access, potential effect on security functions and availability, and the provider's retained responsibilities. The decision should record the relied-upon assurance, compensating measures, and events that require reassessment. Recommendation: Incorporate FedRAMP's existing interpretation that the Class references include Rev5 and 20x, and identify any Path restrictions. Explain the treatment of valid Rev5 dependencies during the transition and the notice associated with any separate eligibility cutoff. Align item 3 with FRD-TPR and MAS-CSO-TPR while preserving MAS-CSO-IIR applicability. State whether the Class B minimum is absolute. If exceptions are permitted, require a documented impact determination, specific compensating measures and evidence of their effectiveness, an approval authority, and conditions for continuing review. R4. Assurance Engineering Resources and Agency GRC IntegrationRef: Anticipated Requirements item 4; FRC-CSO-JSN; CDS-CSO-PUB; CDS-CSO-CBF; CDS-CSO-HAD; CDS-CSO-PSM; CDS-TRC-PAC; FRD-PFA Item 4 combines support for agency review of the Certification Package with ongoing integration of assurance data into agency GRC systems. Each commitment needs a stated assessment criterion so providers know what to demonstrate and assessors know what to validate. The integration commitment can build on existing CR26 interfaces. CDS-CSO-PUB requires public information in human-readable and JSON formats; CDS-CSO-CBF requires automation to keep them consistent. CDS-TRC-PAC requires documented programmatic access to all FedRAMP Certification Data. CDS-CSO-HAD requires snapshots aligned to Ongoing Certification Reports, and CDS-CSO-PSM requires per-service materials at Class D. The October 5 clarification to FRC-CSO-JSN also addresses standard web consumption of public JSON, including appropriate CORS behavior and response headers. These rules provide a concrete basis for describing the additional integration support expected at Class D. A practical demonstration would have an agency consumer retrieve applicable public JSON through a standard browser, validate it against the corresponding FedRAMP schema, associate the results with the correct offering, service, rule, and reporting period, and retrieve the relevant historical snapshot. The assessor could examine the recorded ingestion result, human-readable and JSON consistency, CORS and response headers, and the documented interface. Access to protected Certification Data should be exercised under the appropriate authorization, separately from public JSON access. Active support for agency package review also involves people and availability. FRD-PFA describes a Persistent FedRAMP Assessment as focused on Key Security Indicators. A support commitment needs evidence of the agency-facing outcome and the provider's ability to sustain it. Documented support routes, escalation arrangements, and measurable response commitments would let an Independent Assessment Service examine that capability. Recommendation: State whether item 4 will be expressed as a Certification rule, a KSI with a defined validation method, or a documented commitment in Certification Data. For Class D, require a demonstrated agency GRC ingestion exercise using the applicable CDS and FRC-CSO-JSN interfaces, with results an assessor can reproduce or inspect. Define the measurable evidence for agency package review support, including escalation and response arrangements, and identify the additional Class D outcome to validate. R5. FOCI and Automated Validation IndicatorsRef: Anticipated Requirements item 5; REC-IAS-AFI; REC-IAS-CFI; KSI-CED-RAT; KSI-CNA-OFA; KSI-RPL-RRO; KSI-RPL-TRC; CDS-CSO-AVR; FRC-CSX-VVK; SDR-CSX-KSI; IVV-CSO-SEE; IVV-IAS-VEF CR26 already addresses foreign interest, influence, and control for assessors. REC-IAS-AFI requires annual reporting, and REC-IAS-CFI requires updated information within 48 hours of a change in foreign ownership or control. These recognition obligations offer a useful reporting model for a provider construct, with its own defined scope and acceptance criteria. Placing FOCI within the Key Security Indicators also raises a measurement question. Ownership and control information describes an organizational condition. A KSI needs a security outcome that can be persistently validated. The Cybersecurity Education theme shows that organizational matters can be expressed as indicators, so the proposal should explain the provider outcome and the evidence that will establish it over time. Availability already has anchors in CR26. KSI-CNA-OFA addresses optimization for high availability and rapid recovery. KSI-RPL-RRO addresses recovery objectives, and KSI-RPL-TRC addresses testing recovery capability. CDS-CSO-AVR requires Class B, C, and D providers to maintain a web service showing current and historical availability of core services over at least the past 30 days. Class D can extend these measures with clearly stated assurance expectations. A provider FOCI indicator should also show whether measures addressing identified risks remain effective as ownership, personnel access, governance, or relevant dependencies change. Existing federal determinations could supply evidence where their organization and offering scope applies; an assessor would still need a mapping of coverage, exclusions, and any additional mitigations. FRC-CSX-VVK requires at least four automated methods per Key Security Indicator for 20x Class D. Santoshkumarpuppala's September 20 comment in the formal RFC thread recommends an observed failing run to show that a method can detect the condition it claims to detect. We support that test and add an assessment of shared dependencies. For each method, evidence could identify the controlled failing condition, expected and observed result, method version, and evidence source. The assessor should examine whether methods depend on the same upstream signal or processing path, and whether their combined coverage remains useful if one dependency fails. A representative test environment, replay, or other justified technique can demonstrate detection without disrupting production. Recommendation: Publish the intended scope of the provider FOCI theme, including whether it reaches ownership, personnel, supply chain, or a combination. Define the mitigation outcome to be validated over time and how annual and change-triggered reporting supports it. Consider accepting applicable federal FOCI determinations, including those under 32 CFR 117.11, with a scope mapping and gap analysis for the offering. Build new availability indicators on KSI-CNA-OFA, the Recovery Planning theme, and CDS-CSO-AVR. For automated validation, require evidence that methods detect representative failing conditions and identify shared sources or dependencies, leaving the test technique to the provider. R6. Class C Review Timing Against the December 1 DeadlineRef: Phase 4 Track 1; FedRAMP response in General Discussion 172 on September 18, 2026 Track 1 requires a CR26-compliant FedRAMP 20x Class C Certification received before December 1, 2026. Providers applying for Class C before November 13 and intending to participate are asked to send a notice of intent after submitting the application. The dates are eighteen days apart, and eligibility depends on completed Certification. FedRAMP's September 18 response confirms the completed Class C prerequisite and explains that late applications cannot be promised priority review. The notice-of-intent date therefore provides a coordination step; it does not establish a completion window. Providers would benefit from indicative review assumptions when deciding whether their readiness and schedule support Phase 4 participation. Recommendation: Publish indicative Class C review timing and the readiness assumptions that affect it, subject to package completeness and available review capacity. Provide practical guidance on the remaining opportunity to qualify before December 1 and explain how notices of intent are used. Preserve the distinction between submitting an application and receiving Certification. R7. The Independent Assessment Service Role in the Phase 4 PilotRef: Phase 4 Track 1 items 4 and 5; REC-IAS-ADA; REC-IAS-RQU; REC-IAS-SEP Track 1 expects participants to engage a FedRAMP Recognized Independent Assessment Service. Providers planning a Class D engagement need to understand the personnel competence and technical capabilities expected of the assessor, as well as how independent assessment will be maintained during pilot collaboration. Excentium is a FedRAMP Recognized Independent Assessment Service and could be engaged by a Phase 4 participant. We disclose that interest here. These questions apply to the assessors and providers participating across the pilot. REC-IAS-ADA establishes an ongoing recognition experience floor of at least two initial or ongoing assessments for Class B, C, or D Certifications every two years, without specifying a Certification Type. REC-IAS-RQU separately requires the roles and personnel qualifications prescribed by A2LA R311, subject to a specifically published exception for a limited pilot or other explicitly scoped process. Meeting the recognition experience floor does not by itself describe the competence needed for every Class D engagement. Please state any additional Class D experience or capabilities expected for evaluating automated assurance. REC-IAS-SEP bars an assessor from independently assessing the same offering within two years after supplying advisory or consulting services, subject to a specifically published scoped exception. Participation in developing or interpreting program requirements and offering-specific advisory or consulting work need clear treatment during the pilot. The collaboration described in Track 1 makes this boundary worth publishing early so providers and assessors can plan their roles. Recommendation: Publish the competence expectations for assessors supporting Phase 4, including any additional Class D experience or technical capabilities. Clarify which pilot activities constitute offering-specific advisory or consulting services under REC-IAS-SEP and which constitute participation in developing or interpreting program requirements. If a pilot exception is needed, publish its scope, permitted activities, independence safeguards, and retained assessment duties. Confirm the direct technical channel to the PMO for assessors supporting participants. R8. Publishing Themes From the Direct Engagement RoundsRef: Phase 4 Tracks 2 and 3 Tracks 2 and 3 pair targeted direct engagement with public RFCs so other parties can participate. The direct tracks will help shape the drafts on which the broader community comments. Provider Round 1 runs November 4 through November 20, 2026, and Round 2 runs January 4 through January 15, 2027. The proposed self-hosted and hybrid-hosted rules publish for comment on February 10, after both rounds. Publishing the themes discussed would help parties outside the direct tracks understand the basis for that draft. Recommendation: Publish a short summary of the themes from each direct engagement round as it concludes, protecting information that cannot be disclosed. Make those summaries available with the related public RFCs so all commenters can address the issues informing the Consolidated Rules for 2027. R9. Question Timing for Assessment ServicesRef: Phase 4 Track 3 Track 3 states that assessment services will receive the same general questions and information as providers and respond from their assessment perspective. The first assessor round runs October 19 through October 23, 2026. The RFC carrying the general questions publishes November 4, when provider Round 1 begins. Sending the questions with the October 12 assessor notification would allow participants to review them against their engagement history and bring specific examples to the first round. Recommendation: Send the general questions to qualifying assessment services with the October 12 notification, including any background material needed to prepare for the October 19 through October 23 meetings. R10. Confirming Eligibility for the Assessment Service TrackRef: Phase 4 Track 3 Track 3 publishes its eligibility criterion: a recognized assessment service must be the current assessor of record or have been the primary assessor within the last three years for a provider qualifying for Track 2. FedRAMP will identify qualifying services using the information available to it and the Marketplace, then notify them at the public email address in their Marketplace listing. Notifications are targeted for October 12, 2026, with an October 16 opt-in deadline. A service that believes it meets the published criterion needs a timely route to resolve a missing invitation or a disputed eligibility determination during that short window. Recommendation: Provide a contact route for assessment services that believe they meet the published Track 3 criterion and have not received an invitation by October 13. Identify the supporting evidence needed, such as the qualifying provider and offering, the assessor relationship, and the relevant dates. Explain how a missing invitation or disputed eligibility determination can be resolved before the October 16 opt-in deadline. R11. Aligning Guidance on Class D AvailabilityRef: CR26 guidance on Choosing a Certification Type; Phase 4 Track 1 target dates Current CR26 guidance anticipates piloting 20x Class D in late 2026 and making it available as a formal option in early 2027. RFC-0033 places the pilot in FY27 Q1 and Q2, with final review extending into the beginning of Q3. The March 23, 2027 FedRAMP Day is tentative, and the final Phase 4 rules will be incorporated into the Consolidated Rules for 2027. These statements serve different planning purposes. Providers need an indicative target for general availability outside the pilot, together with the dependencies that could affect it. That information is particularly useful before June 11, 2027, the final date to apply for a new Rev5 Certification. Recommendation: Align the Certification Type guidance with the Phase 4 planning schedule and state an indicative target for general availability of 20x Class D outside the pilot. Distinguish that target from pilot package deadlines and the tentative FedRAMP Day, and identify the review and rule-publication dependencies that could affect it. Keep the guidance current so providers can plan against the June 11 Rev5 application deadline. R12. Reusing Physical Infrastructure Assurance in Tracks 2 and 3Ref: Phase 4 Tracks 2 and 3; MAS-CSO-IIR; IVV-CSO-SEE; IVV-IAS-VEF Tracks 2 and 3 ask which existing certifications and classifications can support self-hosted or hybrid-hosted offerings and what remains to be assessed for FedRAMP. An assessor-reviewed mapping would let FedRAMP reuse applicable infrastructure assurance while making the coverage of that assurance visible to agencies. The mapping should identify the issuing body, standard and edition, current certificate or assessment report, covered facilities and services, validity period, exclusions, relevant findings, and shared responsibilities. It should connect each relied-upon assessment result to the actual deployed environment and the FedRAMP requirement or security outcome it supports. For example, evidence about a facility's physical access, power, environmental protections, or recovery arrangements has value when the facility and services covered match the offering and the provider's retained responsibilities are clear. An Independent Assessment Service could examine that mapping, identify residual gaps, and perform targeted verification and validation of the remaining work. A certificate title alone does not establish that a specific offering, facility, or configuration is covered. This record would let the provider, assessor, FedRAMP, and relying agencies understand exactly which assurance can be reused. Recommendation: Use Tracks 2 and 3 to develop an assessor-reviewed mapping for physical-infrastructure assurance. Specify the evidence of coverage and applicability, exclusions and retained responsibilities, relevant findings, and the gap analysis. Reuse covered results with targeted independent verification of residual FedRAMP requirements and security outcomes. Excentium appreciates the opportunity to comment on RFC-0033 and welcomes further discussion of these recommendations with the FedRAMP PMO. Class D addresses workloads where threats to the confidentiality, integrity, or availability of federal customer data may lead to catastrophic harm, including loss of life. Clear requirements and assessable evidence will help agencies place confidence in the resulting Certification. We support developing that assurance in the open and resolving the practical questions while the requirements are being written. This work supports our shared mission to reduce the vulnerabilities of our Nation. Respectfully submitted, Colin Corlett |
|
New FedRAMP Definitions Comments A solid foundation for the present. No suggested changes. Future signals to look for: Edge and fog computing instances. Currently, 99% of edge computing (CDNs, colos, PoPs) fits nicely into a hybrid model, with workable scopes and interfaces defining the boundary. Future trends that could complicate this model include sensor/mesh networks deployed in smart cities, research areas, or battlespaces; generalized robotification, such as worker or drone machines on a network; and mini data centers. Most of these are forward-looking scenarios in which high-sensitivity CIA may be exposed to risk. Overall Anticipated 20x Class D Requirements FedRAMP should prepare for the following scenario: an agency or prime contractor has a use case that is not typically High (D), but instead of requiring C plus an overlay, they require D for a scenario that isn’t truly D. They may want to blanket-require D to avoid building boundary checks. They may feel D will be easier than managing an overlay. They may simply be security posturing, or making the wrong call. However, this means the authority issuing the requirement may be lax about some D requirements and strict about others. This puts the CSP in the awkward position of potentially overbuilding. How to handle these scenarios may be an excellent question to investigate during the pilot period. Ideally, FedRAMP and the CSP would catch potential issues early and right-size the approach. In any case, I recommend that KSIs be structured to hold to a known standard while remaining flexible enough to capture variable uses within that standard. Item 1: If the certification is purely a program certification, it may benefit FedRAMP operations and potentially even agency assurance, to run at C for six months before moving to D. However, if an agency wishes to onboard the system immediately because of a past relationship or operational need, this six-month period should in no way hinder the parties from doing business or fulfilling their missions. This should be made clear in the rules and guidance. I recommend not implementing the six-month period. If this is implemented, to signal intent or preparedness for D, FedRAMP could create a designation such as “D Pending,” meaning the CSP attests to D but FedRAMP has not yet reviewed the materials. Item 3: Similar to sca1235’s comment, this runs close to a problem CSPs had with the old SA-9 controls. FedRAMP used to insert a parameter assignment requiring all external services to apply the same FedRAMP baseline as the system under review. This caused many problems, because many types of systems under many types of authorizations did not fall under FedRAMP. Examples include telephony, public infrastructure integration services (“public” here meaning infrastructure that handles public information, not “public cloud services”), scrapers, and messaging services. While Item 3 relies on the strength of FedRAMP’s minimum assessment scope definition, I expect this to be at least an area of vigorous discussion, and likely one where exceptions to the rule will eventually be raised. Phase 4 Track 1: 20x Class D Cloud-Hosted Pilot Comments While I support the rapid pace of improvement in FedRAMP, the June 2027 Rev 5 cutoff for Class D seems too abrupt following the pilot. I encourage extending the deadline for Rev 5 High (D) acceptance. I have a client who will likely be negatively affected by this cutoff. Keeping participants engaged with the TAG and board will benefit all parties. This should be a primary goal, as it will spread lessons learned and encourage greater engagement outside that group as well. Phase 4 Track 2: Expanding 20x to Self-Hosted or Hybrid-Hosted Services Comments If none of the applicants holding 15+ agency uses are smaller enterprises, I recommend including at least one. In the past, large players were selected because of their impact and then influenced rules that disadvantaged smaller players with leading-edge solutions. This stifled the breadth and novelty of solutions in the marketplace. Phase 4 Track 3: Independent Assessment Service Engagement Comments No comments. |
|
Thank you, FedRAMP, as always, for your thoughtful and rapid improvement efforts. |
|
Socure appreciates FedRAMP's work to define a rigorous 20x Class D and supports the higher assurance bar described in this RFC. The following comments focus on continuity for agencies that already rely on Rev5-certified services. Re: Overall Anticipated 20x Class D Requirements, item 1 (6 months of 20x Class C without corrective action) The 6-month requirement is a sensible way to confirm a provider can sustain 20x-level operations before taking on Class D. For providers that already hold a Rev5 Class C or Class D certification, however, a clean continuous monitoring record of that length (or longer) may already exist and has been reviewed by agency authorizing officials. We support @cb-axon's request for a direct path for existing Rev5 Class D providers, and ask that the same principle extend to Rev5 Class C providers seeking Class D. Once Rev5 closes to new applications on 11 June 2027, these providers will move to 20x, and without credit for their existing record agencies may face a gap of a year or more before those services can reach Class D, even where the underlying security program has a long, clean history. Suggestion: allow a Rev5-certified provider with no corrective actions in the most recent 6 months to satisfy item 1 using its Rev5 continuous monitoring record, or to complete 20x Class C and Class D in a single combined assessment. This would preserve the intent of the requirement, reduce duplicate assessment cost for agencies and providers, and help agencies reach Class D-level assurance sooner. |
|
Re: transition from Rev5 to 20x for providers seeking Class D, and the 11 June 2027 Rev5 cutoff Many Rev5-certified providers and their agency customers are planning 2027 investments now, and the key input is how Rev5 certifications will transition to 20x. As @Excentium-CPS notes, transition requirements are expected to be finalized during Phase 5. However, a Rev5 Class D application requires many months of preparation, an independent assessment and an agency authorization before 11 June 2027. A provider that cannot complete all of that by the cutoff would, as currently proposed, need to earn 20x Class C, hold it for six months, and wait for 20x Class D to open beyond the pilot, likely a delay of a year or more before agencies can use the service at Class D. Providers and agencies must therefore effectively choose between a Rev5 Class D upgrade and a 20x route in the next few months. Guidance that arrives in 2027 will be too late to inform that choice, and may lead to duplicate assessments or a rush of incomplete Rev5 applications near the cutoff. Suggestions:
|
|
Re: Overall Anticipated 20x Class D Requirements, item 3 (only Class B, C or D certified third-party information resources) We support the points raised by @sca1235, @cb-axon, @wisecryptic and @Excentium-CPS on scoping this requirement and preserving the documented MAS-CSO-TPR path. Certification status is one useful signal of third-party assurance, but it is not the only one, and it does not by itself reflect the actual risk a third-party resource introduces. Many best-in-class services have no federal business case for pursuing FedRAMP certification, regardless of its cost. An absolute certified-only rule would require providers to substitute certified but less capable alternatives, or remove functionality entirely, even where the third party handles no federal customer data or has narrowly limited access. In those cases agencies would receive a less capable service without a corresponding reduction in risk. Suggestion: replace the absolute requirement with a risk-based approval path that applies whether or not a certified alternative exists. A provider could use a non-certified third-party resource where it documents:
Approval would rest with the agency authorizing official, or FedRAMP, and could be scaled to risk: lighter for resources with no access to federal customer data, stricter or not permitted where a resource processes federal customer data or could directly compromise the offering's security. This preserves Class D assurance where it matters, while letting agencies benefit from the best available capabilities. Thank you for the opportunity to comment. |
|
The Alliance for Digital Innovation (ADI) appreciates the opportunity to comment on RFC-0033, 20x Phase 4 Development Tracks for 20x Class D. To support FedRAMP’s efforts, we offer the following recommendations: Align FedRAMP 20x with Agency Authorization and FISMA Responsibilities ADI appreciates RFC-0033's inclusion of additional agency engagement during the Phase 4 pilot. Agencies will ultimately need to understand how FedRAMP 20x certifications can be incorporated into their existing risk-management and authorization processes. As Phase 4 progresses, FedRAMP should provide agencies and CSPs with a clear framework showing how the evidence generated through a 20x Class D Certification can support an agency's own authorization decision and responsibilities under FISMA. The goal should be to ensure that FedRAMP 20x and agency authorization processes operate as complementary components of a common risk-management framework rather than as separate or duplicative processes. ADI encourages FedRAMP to work closely with agency CIOs and authorizing officials during the pilot and to publish clear guidance or mappings that agencies can use when incorporating 20x certification evidence into their own authorization processes. This coordination should extend to agency Inspectors General and other oversight entities so agencies have a common understanding of how 20x will be recognized within existing authorization and cybersecurity oversight processes. Establish a Workable Transition from Rev. 5 to FedRAMP 20x RFC-0033 appropriately focuses on developing the future Class D model, but the transition from existing FedRAMP Rev. 5 authorizations to 20x will be equally important. Without a coordinated transition, CSPs that already maintain Rev. 5 authorizations may need to continue supporting those requirements for existing agency customers while also investing in and maintaining 20x processes. This can create significant duplicative compliance costs and operational burdens, particularly as agencies adopt 20x at different speeds. This challenge is already emerging in practice, as the pace of FedRAMP modernization may outpace agency readiness to adopt the new model, including where agencies and their oversight bodies continue to evaluate authorization practices against existing Rev. 5 expectations. FedRAMP should therefore make the transition path between Rev. 5 and 20x clear and explicit, including how existing agency authorizations will be treated as agencies move to the new framework. FedRAMP should coordinate the transition with agency CIOs, authorizing officials, Inspectors General, and other relevant oversight entities so agencies and CSPs have a common understanding of how 20x will be recognized and used. The transition framework should resolve differing federal expectations at the government level rather than leaving individual CSPs to navigate or reconcile them on their own. FedRAMP should develop a clear transition framework before finalizing broader Class D requirements. That framework should: FedRAMP should also use the Phase 4 pilot to measure the practical costs and operational challenges associated with transition, rather than evaluating only whether individual CSPs can successfully satisfy the new Class D requirements. Ensure the Phase 4 Pilot Reflects the Existing Federal Cloud Market RFC-0033 would limit the Phase 4 Class D pilot to no more than ten participants and require participants to receive a CR26-compliant FedRAMP 20x Class C Certification before December 1, 2026. ADI understands the value of selecting participants that have demonstrated an ability to meet 20x requirements. At the same time, the final Class D framework should not be developed based solely on the experience of providers already positioned to move quickly through the 20x process. Many mature commercial cloud offerings have made significant investments in Rev. 5 authorization and currently support federal agencies under that framework. Their experience will be important in identifying migration challenges, interoperability issues, and agency adoption considerations that may not arise among providers already optimized for 20x. ADI encourages FedRAMP to ensure that Phase 4 incorporates meaningful input from existing Rev. 5 Class C and Class D providers, including providers that may not be able to obtain a 20x Class C Certification in time to participate directly in the pilot. This could include an additional transition-focused engagement cohort or other structured mechanism for testing proposed requirements against existing authorized services before those requirements are finalized. FedRAMP should also ensure that participating agencies have a meaningful role in evaluating how Class D requirements operate within their existing risk-management and authorization frameworks. Clarify the Scope of Self-Hosted and Hybrid-Hosted Offerings ADI welcomes FedRAMP's effort to clarify the treatment of self-hosted and hybrid-hosted cloud service offerings. As FedRAMP develops these definitions and associated requirements, however, the program should ensure that their scope remains clear and predictable. In particular, FedRAMP should clarify how self-hosted and hybrid-hosted offerings fit within FedRAMP's established cloud-service scope, including the circumstances in which customer-managed or on-premises deployments would fall within the program. Clear boundaries will help agencies and providers determine when FedRAMP requirements apply and prevent uncertainty for commercial products that may support multiple deployment models. Sincerely, Alliance for Digital Innovation |
|
Commenter: Mike Kim, CEO, Mycroft (GRC automation vendor supporting 20x certification packages) Thank you to the FedRAMP team for running this process in the open. 20x has already changed what our customers can achieve, and we think Class D is the right next step. Mycroft is pursuing 20x Class C and Class D certification, and we offer these suggestions from the perspective of the tooling that produces and transports assurance data.
We appreciate the pace and transparency of this work and look forward to the detailed requirements. |
|
CSP-AB submits the following comments to RFC-0033: Overall Anticipated 20x Class D Requirements.
1.) External services that are required for ther operation of the CSO, but that are not themselves strictly CSOs - things like DNS, SMS, Mobile Notification APIs, etc.
Phase 4 Track 2: Expanding 20x to Self-Hosted or Hybrid-Hosted Services
|
GitHub General Privacy StatementGitHub Privacy StatementEffective date: April 27, 2026 Welcome to the GitHub Privacy Statement. This is where we describe how we handle your “Personal Data”, which is information that is directly linked or can be linked to you. It applies to the Personal Data that GitHub, Inc. or GitHub B.V., processes as the “Data Controller” when you interact with websites, applications, and services that display this Statement (collectively, “Services”). This Statement does not apply to services or products that do not display this Statement, such as Previews, where relevant. End User Notice: Organization-Provided GitHub AccountsWhen a school or employer supplies your GitHub account, they assume the role of Data Controller for most Personal Data used in our Services. This enables them to:
Should you access a GitHub Service through an account provided by an organization, such as your employer or school, the organization becomes the Data Controller, and this Privacy Statement's direct applicability to you changes. Even so, GitHub remains dedicated to preserving your privacy rights. In such circumstances, GitHub functions as a Data Processor, adhering to the Data Controller's instructions regarding your Personal Data's processing. A Data Protection Agreement governs the relationship between GitHub and the Data Controller. For further details regarding their privacy practices, please refer to the privacy statement of the organization providing your account. In cases where your organization grants access to GitHub products, GitHub acts as the Data Controller solely for specific processing activities. These activities are clearly defined in a contractual agreement with your organization, known as a Data Protection Agreement. You can review our standard Data Protection Agreement at GitHub Data Protection Agreement. For those limited purposes, this Statement governs the handling of your Personal Data. For all other aspects of GitHub product usage, your organization's policies apply. Third Party Access and Data ProtectionWhen you use third-party extensions, integrations, or follow references and links within our Services, the privacy policies of these third parties apply to any Personal Data you provide or consent to share with them. Their privacy statements will govern how this data is processed. Personal Data is collected from you directly, automatically from your device, and also from third parties. The Personal Data GitHub processes when you use the Services depends on variables like how you interact with our Services (such as through web interfaces, desktop or mobile applications), the features you use (such as pull requests, Codespaces, or GitHub Copilot) and your method of accessing the Services (your preferred IDE). Below, we detail the information we collect through each of these channels: From You
|
|
Pete told me to close this. |
|
This content came in on October 9, 2026 via email - So I am including as it was submitted before RFC deadline closed. Thank you for the opportunity to review and provide input on this request for comment. Overall, Google supports the structural modernization goals outlined in the draft, but we see several areas where terminology and architectural assumptions require refinement to align with standard industry practices and maintain commercial viability. Key RecommendationsPhased Transition and EquivalencyFedRAMP should implement a grandfather clause for Class C certifications and grant High-impact equivalency during the pilot phase to prevent massive provider downgrades while the Class D ecosystem matures. Pragmatic Assessment ScopingThe Minimum Assessment Scope should be strictly defined by whether a component processes, stores, or transmits federal High-impact data, allowing necessary Class A telemetry and monitoring tools to operate within a Class D boundary without forcing niche vendors out of the market. Assurance Engineering FeasibilityMandating active engineering support for all agencies represents a burden that will increase costs and negatively impact service availability for all agencies. Additionally, there are a large depth and breadth of offerings for GRC tools, requiring Cloud providers to offer integration support that would extend beyond GRC agreements the government currently holds. Streamlined FOCI VerificationTo prevent redundant evaluations, FedRAMP should explicitly defer to existing Defense Counterintelligence and Security Agency provisions and accept an eligible status within the National Industrial Security System. Proposed Revisions to Language Provided
Thank you! |
|
These comments were submitted via email on October 7, 2026: SOLUTIONS BY JEWEL Response to FedRAMP RFC-0033Solutions by Jewel | Public Comment | October 7, 2026 Response to FedRAMP RFC-003320x Phase 4 Development Tracks for 20x Class DSubmitted by: Jewel Darlington, Chief AI Governance Officer & Founder SummarySolutions by Jewel (SBJ) offers targeted feedback on RFC-0033, consistent with FedRAMP's stated preference for explicit, targeted comments. RFC-0033 describes 20x Class D as intended for federal workloads where threats to the confidentiality, integrity, or availability of federal customer data may lead to catastrophic harm, including loss of life. SBJ offers five recommendations, each mapped to a specific RFC-0033 proposal and each built on an existing Consolidated Rules for 2026 mechanism. A closing section addresses agency authorization authority.
1. Operating History and Assurance-State ContinuityRFC-0033 proposal. Anticipated Class D requirement 1 would require a service offering to hold a 20x Class C Certification with zero corrective actions for six months before becoming eligible for Class D Certification after the Phase 4 pilot. Recommendation. SBJ supports operating history as an assurance input. SBJ recommends that the detailed Class D requirements define assurance-state events that require the provider to determine, and record in the Security Decision Record, whether evidence from the observation period remains representative of the offering seeking Class D. Candidate events include:
For each event type, the requirements should specify the evidence needed to evaluate its effect, whether review is full or scoped, and how the determination is recorded. A scoped determination can resolve a trigger within the existing six-month period. Basis. CCM-OCR-AVL requires an Ongoing Certification Report every three months that summarizes, where applicable, Transformative Changes and FedRAMP Reportable Incidents, so a six-month window spans two reporting cycles. The Significant Change Notification rules supply the event inputs: their Transformative Change examples include adding, removing, or replacing a critical third-party service, replacing underlying management planes, and datacenter migration. SCN-CSO-INF already requires a plan for verifying, assessing, or validating impacted Key Security Indicators. The note to SCN-TRF-UPD scopes the post-change documentation update to service documentation such as user guides and marketplace information. For Class D, SBJ recommends extending that update to the Security Decision Record: after the SCN-TRF-NAV notification, the provider records whether prior assurance conclusions remain applicable. SBJ professional technical position. SBJ AI Governance Architecture V1.0 states:
Applied to Class D eligibility, an assurance-state event calls for a newly scoped determination of what the operating-history evidence still supports. This application is SBJ's professional technical position. 2. Bounded Inheritance from Class D IaaS/PaaSRFC-0033 proposal. Anticipated Class D requirement 2 would require cloud-hosted or hybrid-hosted Class D services to be deployed on a Class D Certified IaaS/PaaS. Recommendation. For each FedRAMP rule or Key Security Indicator that relies on inherited assurance, the dependent provider's Security Decision Record should identify:
These entries should be machine-identifiable in the Security Decision Record JSON schema, so that a downstream provider can determine whether a material upstream change affects its own assurance state. Basis. SDR-CSO-FRR already requires, for each applicable rule, an explanation of implementation, verification, validation, independent verification, and independent validation. A per-rule inheritance reference is a bounded extension of that structure. SBJ professional technical position. SBJ AI Governance Architecture V1.0 states:
V1.0 also states:
Applied to Class D infrastructure inheritance, inherited assurance is newly scoped to the dependent offering and carries the boundary of the upstream certification, covering the capabilities and conditions that certification evaluated. This application is SBJ's professional technical position. 3. Third-Party Resource Dependency TraceabilityRFC-0033 proposal. Anticipated Class D requirement 3 would require third-party information resources within a Class D service's Minimum Assessment Scope to hold Class B, C, or D Certification. Recommendation. SBJ recommends that each material third-party information resource be associated with a structured dependency record that identifies:
SBJ also asks FedRAMP to clarify, in the October 14 requirements RFC, how a Class D provider should justify reliance on a Class B or Class C Certified resource for a function whose compromise could produce Class D-level impact. Basis. MAS-CSO-TPR requires providers to document, for each applicable third-party information resource, its general usage and configuration, the explanation or justification for use, mitigation measures, and compensating controls. The recommended record adds the relied-upon assurance, its evidence, and the reassessment condition, linking those existing fields to the proposed Class D certification requirement. 4. Evidence Provenance, Applicability, and ValidityRFC-0033 proposal. Anticipated Class D requirement 4 would expect providers to support integration of assurance data into agency GRC systems. SDR-CSX-KMT states that Class D providers must significantly supersede lower-Class historical-metric requirements, with specifics to be set during the Phase 4 pilot. Recommendation. SBJ recommends that Phase 4 define minimum evidence-level fields for material Class D assurance evidence, where applicable:
Basis. SDR-CSO-MTD requires version, date and time of last update, and source of update at the record level. SDR-CSX-KSI requires summaries of measures, persistent cycles, verification, automation verification, and validation for each Key Security Indicator. The recommended fields carry equivalent information down to individual evidence items, which is the level at which agency GRC systems ingest and evaluate assurance data. SDR-CSO-FRR already separates provider verification and validation from independent verification and validation; the recommended fields preserve that separation for automated evidence. 5. Hosting-Classification ChangesRFC-0033 proposal. RFC-0033 proposes formal definitions for cloud-hosted, self-hosted, and hybrid-hosted cloud service offerings, and Track 2 will develop self-hosted and hybrid-hosted rules for the Consolidated Rules for 2027. Recommendation. When a cloud service offering's classification under these definitions changes, or responsibility for physical infrastructure shifts materially, the provider should record a determination covering:
Scoped review should be available where evidence supports continued applicability of existing conclusions. Several such transitions already qualify as Transformative Changes under the Significant Change Notification rules, including datacenter migration and replacement of underlying management planes. SBJ recommends routing the determination through the SCN-TRF-NAV notification, the Ongoing Certification Report, the Minimum Assessment Scope, and the Security Decision Record, and that Track 2 consider it when drafting self-hosted and hybrid-hosted rules. SBJ professional technical position. SBJ AI Governance Architecture V1.0 states:
Its application to FedRAMP hosting classifications is SBJ's professional technical position. 6. Agency Authorization AuthorityThe Collaborative Continuous Monitoring rules describe shared, current authorization information supporting each agency's Information Security Continuous Monitoring strategy, with each agency making its own risk-based decisions about ongoing authorization. SBJ recommends that Class D preserve that separation between evidence generation and decision authority as material changes, evidence validity, and reassessment conditions become more explicit and machine-usable. Scope NoteThe constructs referenced in sections 1, 2, and 5 are documented in SBJ AI Governance Architecture V1.0, a governance architecture for AI systems. Their application to FedRAMP 20x Class D cloud service offerings, a broader category that includes AI systems, is SBJ's professional technical position, offered for FedRAMP's consideration during Phase 4. V1.0 serves as the cross-cutting architecture across SBJ's methodology stack, which includes STRATA™ — GRC foundation, SIGNAL™ — AI-specific control and audit methodology, and SYNTHESIZE™ — Physical AI governance methodology. This comment addresses the five areas above, which fall within SBJ's governance-architecture lane. |
Uh oh!
There was an error while loading. Please reload this page.
Uh oh!
There was an error while loading. Please reload this page.
FedRAMP may not participate in the formal public comment thread to avoid influencing public comment. If you have general discussions, questions, or other related things to discuss that you do not want to include in formal public comment, please use this discussion thread: #172
RFC-0033 FedRAMP 20x Phase 4 Development Tracks for 20x Class D
Status: Open
Start Date: 2026-09-09
Closing Date: 2026-10-09
Summary & Motivation
FedRAMP 20x Phase 4 is focused on the expansion of FedRAMP 20x Certifications to Class D and to services that are not primarily cloud-hosted. This RFC proposes the general approach that FedRAMP will take during Phase 4 to develop and test these new 20x requirements, along with expectations with industry and agency partners. The actual specifics, timelines, and details will shift based on public comment but the approach and requirements proposed in this RFC will also provide interested parties with an initial framework to prepare for participation in Phase 4.
Phase 4 will evaluate new requirements and assurance expectations to ensure FedRAMP 20x Class D Certified cloud service providers supply an appropriate level of assurance to be used in federal workloads where threats to confidentiality, integrity, or availability of federal customer data may lead to catastrophic harm, including loss of life.
We anticipate that the requirements for FedRAMP 20x Class D, when finalized, will provide a greater level of assurance than a legacy FedRAMP Rev5 Class D. Unlike other FedRAMP 20x Certifications, Class D will also require considerable additional investment to meet government-specific use cases compared to commercial ones, and we anticipate that few commercial services will invest fully in the necessary assurance.
This RFC proposes the following:
This RFC will close in 30 days due to the urgent need to finalize and open the FedRAMP 20x Phase 4 pilot. Additional specifics may be provided in follow-on RFCs. This RFC has been posted simultaneously with RFC-TBD FedRAMP 20x Phase 4 Technical Advisory Group Changes & Agency Participation as both proposals are strongly related.
The final Rules that are developed during Phase 4 will be incorporated into the FedRAMP Consolidated Rules for 2027.
Feedback Requested
All feedback from the public is welcome, though FedRAMP prefers explicit targeted feedback rather than general commentary.
New FedRAMP Definitions
This RFC proposes the following new FedRAMP Definitions to be used in FedRAMP materials:
Cloud-Hosted (Cloud Service Offering)
Self-Hosted (Cloud Service Offering)
Hybrid-Hosted (Cloud Service Offering)
Overall Anticipated 20x Class D Requirements
FedRAMP 20x Class D is intended to be significantly more robust than FedRAMP 20x Class C or FedRAMP Rev5 Class D. Detailed proposed requirements will be released during the pilot, but this section provides a high-level overview of the direction FedRAMP plans to take FedRAMP 20x Class D for initial feedback.
FedRAMP 20x Class D will be a significant jump over FedRAMP 20x Class C, and will introduce at least the following additional expectations:
Similar to FedRAMP Rev5, many Rules will have stricter timelines and other expectations for 20x Class D services. Some of these have been previewed in the Consolidated Rules for 2026 and others will be added during the pilot.
FedRAMP will publish the full requirements as an RFC on October 14, shortly after this RFC closes. If you have targeted feedback on the proposed requirements mentioned above, please submit them early if possible.
Phase 4 Track 1: 20x Class D Cloud-Hosted Pilot
The Phase 4 pilot will take place during FY27 Q1 and Q2, with final review eating into the beginning of FY27 Q3.
There will be a single requirement to apply for participation in the Phase 4 pilot: You must receive a CR26-compliant FedRAMP 20x Class C Certification before December 1, 2026.
If you apply for a FedRAMP 20x Class C Certification before November 13, 2026, and intend to participate in the Phase 4 pilot, please reach out directly to the FedRAMP Director (pete@fedramp.gov) with a notice of intent after your Class C application has been submitted. Phase 2 pilot participants, including AI Prioritized participants, will not be eligible for participation in the Phase 4 pilot unless they have received a full CR26-compliant FedRAMP 20x Class C Certification before December 1.
The following target dates assume no unexpected bumps in the road:
The Phase 4 pilot will follow a similar approach to the Phase 2 pilot:
FedRAMP will also be adding an additional agency engagement component to the Phase 4 pilot; participants should expect to engage with FedRAMP’s Technical Advisory Group, the FedRAMP Board, and certain interested agency stakeholders during the Phase 4 pilot.
Finally, FedRAMP will establish a firm maximum of 10 participants in the Phase 4 pilot.
Phase 4 Track 2: Expanding 20x to Self-Hosted or Hybrid-Hosted Services
To enable maximum speed and widest adoption, FedRAMP 20x Phase 1-3 focused exclusively on developing an updated path for cloud services that were hosted on infrastructure or platforms that were already FedRAMP Rev5 Certified. This provided a path for the majority of cloud services, but deprioritized a path for the rare services that operate their own physical infrastructure.
FedRAMP plans to remedy this in the Consolidated Rules for 2027 by offering an expanded set of criteria for self-hosted or hybrid-hosted services to qualify for a FedRAMP 20x Certification of any Class. We understand that most companies who are responsible for their own infrastructure are already expected or required to meet stringent government regulations and commercial guidelines to operate datacenters safely. We anticipate leveraging those existing investments to the maximum extent possible.
During Phase 4, FedRAMP will gather data and perspectives directly from current FedRAMP Certified cloud service providers with self-hosted or hybrid-hosted services. We will focus on industry standard certifications that are most widely used by these providers, and the deltas between those certifications and the requirements from existing FedRAMP Rev5. Our goal, where possible, will be to identify existing reusable certifications and classifications that can be included directly in a FedRAMP 20x Certification to address infrastructure-related controls.
FedRAMP will establish a direct engagement track where we will offer the opportunity to discuss this with us directly to a targeted subset of cloud service providers. In compliance with federal law and regulations, FedRAMP has identified the following criteria for providers to participate in this engagement track, to ensure a wide range of FedRAMP Certified cloud service providers will be able to contribute to this effort fairly:
FedRAMP will identify qualifying cloud service providers based on the information available on the FedRAMP Marketplace. All qualifying providers will receive a non-emergency notification in their FedRAMP Security Inbox with instructions on how to apply to participate in the direct engagement track and the expectations of that track.
At the same time, FedRAMP will publish RFCs with related questions then proposed rules so that all other parties can participate.
The following target dates for expanding 20x to self-hosted or hybrid-hosted services assume no unexpected bumps in the road:
Phase 4 Track 3: Independent Assessment Service Engagement
The final component of Phase 4 will be a direct engagement track with FedRAMP Recognized independent assessment services (FRR-IAS) on self-hosted or hybrid-hosted rules. Many FRR-IAS have deep experience in auditing and assessing complex physical infrastructure environments for certifications that go well beyond the NIST SP 800-53 in commercial engagements and we plan to tap their expertise and knowledge.
In compliance with federal law and regulations, FedRAMP has identified the following criteria for assessors to participate in this engagement track, to ensure a wide range of FedRAMP Recognized independent assessment services will be able to contribute to this effort fairly:
FedRAMP will identify qualifying assessment services based on the information available to us and the FedRAMP Marketplace. All qualifying assessors will be notified via an email to the public email address on record in their FedRAMP Marketplace Listing.
Unlike cloud service providers, FedRAMP plans to meet with small groups of assessment services at the same time to increase efficiency. Assessment services will receive the same general questions and information as cloud service providers but will be expected to respond from their unique perspective.
All assessment services will also be able to participate in the same public comment processes on the RFCs released regarding these requirements.
The following target dates for engaging with assessment services assume no unexpected bumps in the road:
All reactions