Notice 0011: FedRAMP caps open requests for comment at three and replaces email comments with a public form

▶ Play the video: FedRAMP Public Notice-0011: Initial Outcome of RFC-0025 Retrospective on the Public Comment Process

On June 10, 2026, the Federal Risk and Authorization Management Program (FedRAMP) posted a video about FedRAMP Notice 0011, issued May 27, 2026. The notice gives the initial outcome of RFC-0025, a request for comment (RFC) that asked people how FedRAMP's public comment process had worked. FedRAMP uses RFCs to share proposed guidance with cloud providers, agencies, and the public before it makes a final decision. Cloud providers follow that guidance to obtain and keep a FedRAMP Certification.

In short:

• What FedRAMP said. It will keep no more than three RFCs open at once, replace email comments with a public form, and summarize the main comment themes in each outcome notice.
• Who it affects. Anyone who comments on FedRAMP's proposed rules: cloud service providers, independent assessors, agencies, trade groups, and the public.
• What they must do. Comment on GitHub or through the new public form, not by email. Comment early and on specific points. Agencies may still email their comments.
• By when. The changes apply to RFCs after the notice. In the video, a speaker said readers would already start to see things shift in that first notice.

Why did FedRAMP limit how many RFCs are open at once?

Commenters said FedRAMP opened too many RFCs at the same time. The notice answers in two words: "Yup, fair." Open RFCs are now capped at three. In the video, a FedRAMP speaker said that when FedRAMP opens several at once, they should fit together and support each other.

Will FedRAMP answer every comment?

No. The notice says FedRAMP will not give a reply to each comment. Instead, each initial outcome will have a section on the main themes and how FedRAMP handled them, including the ideas it did not adopt.

In the video, a speaker compared this with other agencies' comment processes, which publish long documents that quote and answer every comment. The speaker said those can take 6 to 12 months, and that readers can see FedRAMP's answer in the rules it publishes after an RFC. A speaker also pointed out that every comment is public, so anyone can read them all.

The notice says: "FedRAMP considers every public comment both individually and as part of the broader feedback received."

How should a company or person comment?

Comment early and often. The notice keeps the 30-day default and says: "Early and frequent participation encourages additional participation." Early comments also let commenters respond to each other. In the video, a speaker said FedRAMP does not want a company to spend 30 days gathering one combined response; it wants individuals to post quick comments on specific topics, then come back with more.

Speakers also said:

• a company may file its own response, and its staff may also comment as individuals;
• a comment filed through a large trade association carries the same weight as a comment from any single person on GitHub; and
• commenters may reply to each other's comments to work toward better answers.

The public form will allow anonymous comments, which RFC-0025 had asked about for people who do not want customers or partners to see their views.

Sources

• FedXchange tracker: FedRAMP Public Notice-0011 video (June 10, 2026)
• YouTube: FedRAMP Public Notice-0011: Initial Outcome of RFC-0025
• FedRAMP Notice 0011: Initial Outcome of RFC-0025 Retrospective on the Public Comment Process (FedRAMP's page)
• FedRAMP RFC-0025: Retrospective on the Public Comment Process (FedRAMP's page)