General discussion on RFC-0035 (FIPS) and RFC-0036 (Phase 4 pilot)

[pete-gov]

Hey all - as a reminder, FedRAMP can't answer questions or generally participate directly in RFC threads to avoid influencing public comment. Sometimes this creates confusion because folks just want to talk about details of something proposed in an RFC to understand it better or learn more about it, so we create these side-threads at times for RFCs.

The two open RFCs in question are:

• RFC-0035 Cryptographic Module Use Rules Updates #179
• RFC-0036 FedRAMP 20x Class D Cloud-Hosted Pilot Requirements #180

Please feel free to use this thread to discuss, ask questions, etc. - but don't forget to add public comment with feedback either way!

[StevenCh99]

With regards to: FRC-CLD-CTP:
"Providers seeking a FedRAMP 20x Class D Certification SHOULD limit the likely handling of federal customer data within the cloud service offering to third-party information resources that are included in a FedRAMP Class B, Class C, Class D, or Class G Certified offering."

What is a Class G Certified offering? I do not believe I have seen or heard references to that previously.

Thank you!

[pete-gov]

That is a tiny little spoiler hiding in there. :) In RFC-0032, we proposed a separate process for FedRAMP Certification of cloud service offerings that were provided by federal agencies - if approved by the FR Board later this month, that will be Class G to differentiate it from commercial classes.

[StevenCh99]

Thank you!