General Discussion on RFC-0033 (Phase 4) and RFC-0034 (TAG)

[pete-gov]

FedRAMP is not allowed to influence public comment by answering questions or interacting with folks during the public comment process in our Request for Comment process.

This thread exists for folks that do not wish to submit public comment but wish to ask questions in general or discuss things related to RFCs in a way that isn't official public comment. FedRAMP will participate in this thread.

• RFC-0033 FedRAMP 20x Phase 4 Development Tracks for 20x Class D #170
• RFC-0034 Technical Advisory Group Changes #171

[bennett2606]

My original comment: More of a question than a comment and unique: if the 20x Class D Pilot runs during the same timeframe as a Rev5 Moderate Assessment and you are accepted into the Pilot, would it make sense to forgo the Rev5 Moderate Assessment? Class D Certification would complete at the same time as the Rev5 Moderate SAR expected delivery so it seems like double work.

Additional question: Rereading the RFC - I believe I misunderstood and we must be Class C 20x certified prior to Dec 1 to be eligible for the Class D Pilot, not just claim we have the CR26 in place under Rev5. If we submit a Class C 20x package prior to Nov 13 we should submit a notice of intent for the pilot correct?

Thanks for the redirect Pete!

[pete-gov]

if the 20x Class D Pilot runs during the same timeframe as a Rev5 Moderate Assessment and you are accepted into the Pilot, would it make sense to forgo the Rev5 Moderate Assessment?

FedRAMP can't provide business advice and this sorta goes into that direction, but I can highlight the following factors for new folks:

1. FedRAMP Rev5 Class C/D will not be an option for any provider after June 11, 2027.
2. FedRAMP Rev5 is a dead-end path that will be entirely retired at some point after December 31, 2028 (see Phase 5 plans, which includes establishing transition requirements).
3. CR26 requirements for FedRAMP Rev5 are very different from legacy FedRAMP Rev5 requirements to begin forcing adoption of higher assurance expectations.
4. An agency sponsored FedRAMP Rev5 Class C or D that isn't already in progress is unlikely to complete before June 11, 2027. Agencies typically take 2-3 years to complete a sponsored FedRAMP Certification.

I believe I misunderstood and we must be Class C 20x certified prior to Dec 1 to be eligible for the Class D Pilot, not just claim we have the CR26 in place under Rev5. If we submit a Class C 20x package prior to Nov 13 we should submit a notice of intent for the pilot correct?

Correct, the proposal in the RFC is intended to limit 20x Class D pilot participation to parties who have a complete 20x Class C Certification before the pilot begins. This will significantly reduce the load on FedRAMP (we're already familiar with your package, approach, mindset, and assurance materials from the 20x Class C Certification) and on pilot participants who can focus entirely on the new requirements for 20x Class D without simultaneously trying to address other requirements.

We can't promise to prioritize review of folks that submit a 20x Class C right under the wire to qualify for the 20x Class D pilot, but I'd like to at least know. And like every other pilot, folks can follow along in public and begin implementing things even if they aren't an active participant with FR so they are ready to meet the final requirements when they are posted.

[mikedizon]

RFC-0033 requires Class D services to deploy on a "Class D Certified IaaS/PaaS" and to use only "Class B, C, or D Certified" third-party information resources in MAS.

Does "Certified" here include Rev5 certifications (for example, a Rev5 Class D IaaS, or a Rev5 Class D security tool that other CSPs include in their MAS)? If yes, does that hold through the pilot and after CR27, or does it end on a set date?

[pete-gov]

RFC-0033 requires ....

Just as a note, our RFCs do not establish any requirements. This is a proposed requirement, not an actual one that exists yet. (clarifying because sometimes folks think RFCs are final)

Does "Certified" here include Rev5 certifications (for example, a Rev5 Class D IaaS, or a Rev5 Class D security tool that other CSPs include in their MAS)?

Yes, FedRAMP would say "20x Certified" or "Rev5 Certified" when referring to a specific certification type. A 20x Class C Certified service and a Rev5 Class C Certified service are both FedRAMP Class C Certified services.

If yes, does that hold through the pilot and after CR27, or does it end on a set date?

These are proposed requirements that we'd test in the pilot. We'll modify them for the pilot after the feedback from the RFC, then modify the final requirements in CR27 based on what we learn in the pilot and any other additional RFCs performed later.

I will note that the end dates for maintaining FedRAMP Rev5 Certification and transition requirements will be finalized during 20x Phase 5 (as explained in the Phased Implementation section of our 20x page). In the long run, there will not be a FedRAMP Rev5 Certification.

[HazemEld]

There are scenarios where Cloud Service Providers will want to leverage their IL4/5 provisionally authorized cloud service offerings to signal readiness for FedRAMP 20x Class D for a mirrored tech stack of the CSO for FedCiv. This is similar to how CSO's with Class D certifications currently signal readiness for IL4/5 PA. Please consider expanding the "additional expectations" to be to "...maintain a 20x Class C Certification_, IL4 or IL5 PA for a similar tech stack_... Class D services must only use Class B, C, D_, or mirrored version of services that are IL4 or IL5 PA'd._"

[pete-gov]

If you want to toss that into the official RFC comment thread we can treat it like an official comment!

Or if you want to discuss it (since this is the discussion thread): the 20x Class C Certification requirement is intended to ensure there's an existing reviewed and approved 20x approach in place so that the review effort for 20x Class D doesn't require starting from scratch. If someone has a IL4/5 or a Rev5 Class D, that doesn't particularly help solve this at all, it's still mostly like reviewing a brand new application from scratch if we look at their 20x application.

I'm also not sure how to addressed the "mirrored version" idea in concept at all... how would that be verified? I understand the thrust of the point - the theory of the architecture was good enough for a IL4/5 PATO - but how do we know a copy is actually complete? 🤔

[HazemEld]

Thanks for the clarity. I was unclear of the intent of the Class C. The "additional expectation" for Class C is for a 20x Class C to demonstrate that you can do CR26+KSI's at a high level before even taking it higher.

[pete-gov]

I will make sure we explain the details on that reason better in any followups!

[rhoesing]

Closing this.