FedRAMP Rev5 Community Update

All right, I got 103 and we've got about 166 167 folks in the room with us today. Um, good afternoon. I'm Paul Augusta and welcome to the the Fed Ramp Rev 5 community update for August. Uh, Don, go ahead and hit the next slide. Um, we cheated a little bit and we started recording when we came in. Uh so um don't worry the only thing that are that's being recorded should be what you see on your screen which is myself, Don um and the the screen itself. Uh go ahead and hit the next slide. Uh today's agenda uh is uh as usual we've got the disclaimers up front. Uh we'll then go into program certification which is opening up or your non-sponsored certification which starts uh August 10th. Um then we'll walk through some of the Rev Five common questions and scenarios that we've been getting um from the CR26 perspective. Uh and lastly, we'll go through and talk some of the RFC's that are coming up. I know we we promised we would not bombard you with RFC's as we move into the the new year, but most of these are are are pretty light um and um have been talked about before. So, go ahead and hit the next slide. All right. My legal disclaimer, as I read verbatim uh every month, I'm communicating to today in my official capacity on behalf of the Fed Ramp program office at the General Services Administration. We hold these meetings to enhance transparency between industry and Fed Ramp so that we can open a dialogue and share new developments. Nothing that we share constitutes business advice and any reference in this conversation to any specific commercial product or the use of any corporation name is solely for the information and convenience to the public of the public and does not constitute endorsement recommendation or any type of favoring from GSA or by GSA. Also, we'll note the federal director Pete Waterman is not joining us today. There is no update to what has been publicly announced and GSA will release any further updates through appropriate channels. We want to reassure you that our commitment to the program to our public timelines and to our customers remain unchanged. The program will continue uninterrupted. Our work and upcoming milestones for the 20X and Rev 5 certification paths will not be impacted. So, as we talked about um sponsorless certification or program certification opens up uh next week. Uh we will turn all the forms live uh at around 09 on 10 August 09 Eastern time. Um and so you should be able to submit from then. How do you get to the forms first that that you need to submit? So here's kind of the the the guide if you will. Um if you go to our our Fed ramp 20 CR 2026 homepage um you'll see in the top corner um with the one cloud service providers. If you click that cloud service providers you'll see the drop down on the left side uh annotated by the two um you can click choose a path and then if you scroll down from that page all the way down on the main page you will see a loss sponsor ready conversion section. um all of our forms um or at least the two forms associated with um either loss sponsor or fedramp ready conversions will be listed there. The other real easy way to get to it is to go to the fact section and the link is is later in the slides um or our our help.fedramp.gov section um where all of our forms are listed and you can fill [clears throat] out any of the ones that are alive um as we work through it. Go ahead and hit the next slide, Don. Uh this is just a snapshot of the slides themselves. there is a little bit of difference uh in terms of uh expectations uh right whether you're a you've lost your sponsor and you you've got a SAR a completed SAR or whether you're ready conversion right we we expect that that folks and it may be inaccurate as we go through the motions but we expect folks who who have a completed SAR are probably a little bit further ahead um in being ready to submit than folks who just have a Fed ramp ready especially if you went through an abbreviated review for a Fed ramp ready and not kind of the full you. Um, so we we've got two different forms um that all have kind of automations behind them. Uh, and like I said, the form will go live at 0900 on 10 August. Go ahead, the next slide. Um, so first off, you know, you'll you'll certify there. The links to all the rules associated with program certification are on those forms. Please, please, please make sure that you are actually qualified um for the program certification before you submit the forms. Um right, and we're asking you to, you know, you'll list your RAR date or you'll list your SAR date depending on what form you fill out. Um but uh the basic qualifications are this between January 2025 and March 2026, you either completed a SAR, right? So your SAR completion date should be somewhere in that time frame. If that's you, fill out the lost sponsor form. It'll ask you for STAR information. It should be pretty obvious. Um, if you were listed as agency in process in the marketplace and you lost your sponsor, clearly go to the lost sponsor form um and fill that out. Uh, you know, if if you I guess I'll talk about that, but um, if you've completed a RA, right, your RAR completion date, right? If you don't know what that is, look for when uh I I think it's it's page four or page five maybe uh in the RAR itself. Um should have a date and signature um from your independent [clears throat] assessor 3PAO who did the assessment. If your RAR was completed within that time frame, you qualify for the F FRR conversion um or if you've achieved federal rent ready in the marketplace. Um right, fill out the federal ramp ready conversion form. Um and and I want to be clear about the distinctions, right? like those dates are to make sure that you're qualified, right? Um it is important that we differentiate qualified and ready for submission, right? The the standards for Fed Ramp submission uh you know for for authorization or certification, sorry, have not changed, right? Like you you can't get certified off of Fed RAM ready. You do need a full package. You just qualify if you fall within this this time frame. Um, if you don't qualify, please I I think we average two to three emails a day about and it starts out with something like, "Hey, my my certification or my RAS from this date, which is clearly not in your timelines. Am I still eligible?" No. Right? Like the dates are there. They're set in stone. Um, they're pretty easy to navigate. Uh, please don't email us. Don't email info because that's just emailing us. Um, and please don't email Feder Leadership directly. um because if it's not me receiving it, they'll just forward it to me, which just saves us all a few steps. So, go ahead and hit the next slide. So, kickoff, right? This is important. Um once you fill out the form, um you will get uh there will be a process to I self-schedule a kickoff meeting between you and the PMO. When I say you and the PMO, it's you, me, and one or two of my team members. Uh right. Uh and I think we've established about two hours a day in 30 minute increments. So about um oh man, I'm doing math in public. Uh 20 slots a week, I think is the is the is the math there. Um that that are available to to folks to have a kickoff call. Um so we'll try to get you in as early as possible. Um like I said, you'll have a public link to self-schedule. Uh the goal of the meeting is to yes verify eligibility. And I do want to talk about that, right? your STAR or I'm sorry, if your inprocess date or your Fed ramp ready date is tied to a marketplace event, we have all the information we need because clearly we still have all your information from from your uh from your either your in process or or your uh your Fed ramp ready and we don't need you to bring anything with you except for um you know understanding the status of your your current package. Um, if you qualify solely off of SAR or RAR baits and federal and you weren't anything in the federal marketplace, please do not uh or please make sure you bring whatever documentation you need. Like I said, the RARS have a signed date. Um, the SARS generally have a date. If you have your 3PO with you and they can verify it, right? Like we're good. We'll work you in. But really the goal outside of verifying eligibility and what I want to spend the most time on during that 30 minute block is really identifying the state of your documentation uh the state of your hygiene activities and the state of your consolidated rules for for for 20 your CR26 implementations right because those are going to be the three things that dictate um how you move forward right if you completed a SAR within the time frame you've been keeping up with all your hygiene activities you've been conducting conmon activities you know in a sponsorless manner and uh you know you've got the required CR implementations that are required right now done which are are just the first three um then you'll be good to go and we'll get you in the pipeline as quickly as you're able to provide that documentation as simple as that. We don't expect everybody to show up like that. We expect folks to kind of be in in a variance of uh randomness, right? And so that's really what I want to spend the bulk of time is is is what you need to do to be ready for submission. Um, and please remember the longer you wait for submission, right, the more CR26 rule sets that you'll have to adhere to. Um, and lastly during that meeting, we want to identify any needs from the PMO, right? Do you need if you know if if we are still able to do connect.gov u because we're not past that, you know, uh, grace period end date, right? You know, do you need do you need your repo reopened, right? Who needs access? U do you have marketplace needs? Um, and at the end of the meeting, if you are ready and you're ready to rock and everything's up to date and good to go, um, we'll put you FedE ramp in process once you get us the information, right? Or once you get us access to the repo. If you're not, uh, like I said, I I expect the the majority of folks to kind of fall in some sort of of of close but not there um, category, right? We'll put you in the initial implementation phases within marketplace. Go ahead and hit the next slide. All right. The next step is no different um than it is any other day in the REF 5 process timeline. Yeah. When you're ready for review after we've had our kickoff meeting, you've gone back and and completed whatever package deltas you need to implemented whatever CR26 rules you you you weren't adherent to, right, that you needed to be. Um we'll get you in the pipeline. Well, there'll be a certification readiness form that basically says, "Hey, I'm I'm ready to be certified." If you are familiar with our um initial package checklist, I'll talk a little bit in a few minutes about how that's going to change, but we'll send you the package checklist. Go through like you normally do, check off what CR26 rules you follow, and then send it back to us and we'll get you in the timeline. We're averaging uh below 30 days, right? And once again, our SLA is is is 30 days. Um and that's calendar days. Anytime your package is deficient and we have to send it back for updates, um we uh we uh um we pause that timeline on our behalf, right, until you come back with that information. We do that internally, so nothing to worry about. I just I say that because sometimes we're waiting 25 days on a CSP response and they'll say, "Hey, you know, we're over the 30-day mark. What's going on?" And well, we'll reply nicely back 25 days. It's been in your court, so we're at the fiveday mark, right? for my thing. Class D is not available. Um, right. If your SAR is for class D, we will work with we'll focus on class C unless you tell me that you want to be instead. Not sure I mean [clears throat] your your call on that one, right? But like I said, um the the the RAR conversion and the and the the law sponsor we will not do class D on. Um and like I said, it's no different than the same process. You uh you know, it's the same certification report. um you it will identify the deficiencies. We are adjusting the certification report to include some of the CR26 rule sets that are mandatory, but outside of that, it's it's generally business as usual and you'll be required to conduct your your continuous monitoring activities. Um we call it ghost conmon, right? Like you had a partner so that whenever an agency is ready um to onboard you, there's a there's a a library of documentation that's happened um historically and um any changes are there for them to kind of look through. Let's go to the next slide. Um, beautiful. All right. So, some of the changes in the in the uh agency or I'm sorry, the uh it says agency rev 5 submission. Yeah, I guess the agency rev 5 submission, but really the Rev Five submission process as a whole, right? If if you've been part of the process, you know that when you say, "Hey, Fedramp, I'm ready to submit a package." We send you an Excel spreadsheet um that asks you, hey, where where is all your documentation live? What is the latest version? Um so that our reviewers have the latest and greatest. We are adding an addendum to that spreadsheet. A little snapshot of the of the beta version is here. And really, it's just to to identify where you are in the CR26 rule set implementation, right? um you know and and [clears throat] really the reality is for you to say yes I've implemented this rule set or no I have not implemented that rule set and you can find the evidence here or or you know at this file location or what however you need to present that right and really what it's intended to tell both us and you is hey if you are not conformant to a rule set and we're past the obtain date um right it'll flag and tell you to take you know a PL2 pelm item uh yes um if you have transition to VDR are in that timeline, but you're not adherent to it, don't take it. We'll adjust the the verbiage to say either take a POM or identify it as a vulnerability in your in your monthly vulnerability disclosure um and in your ongoing authorization report. Um but yes, it's designed to say, hey, you know, if if you're past your obtaining date, take a PL2 POM item. If you are past your grace period date, however, it will tell you do not submit the form. Right? And uh just a little snapshot of what it looks like in action. I did highlight in red the grace period date for uh for marketplace listing. I had to modify that just to to show that the the rules in the background work. And if you're curious on how um how we we did the uh the grace period ending um on your indep independent assessment dates um we basically uh backdated it that says hey um if your independent assessment date was um 20270101 your flag date will be 20280101 right. So it really basically just kind of counts a year out. Um, yeah. Lastly, like if you fail to implement a rule that's passed you, it will tell you not to submit. Please do not submit the form back to us that and tell us you're ready when it clearly tells you that you're not ready. Uh, next slide. Some more changes. Um, some that happened I think today actually. Um, the CSP information form, the Google form that you would normally fill out to get um to get ready to to uh get your Fed Ramp ID is no longer alive. Uh, the marketplace listing form is also no longer alive. They will both redirect you to the the new form. We've consolidated the form within our Fedramps form library. Once again, you can go to help.fedramp.gov. Top right it says Fedramp forms or forms. It's it should be obvious. And then you can see all of our forms. Um, as we're building our forms, we are indicating whether they're live or not. So, if you're planning to submit something and you're you're you know that the timeline's not live for it yet, you can still see it. Please just don't submit. You'll get a an instant closure on the ticketing system. U, but all of our forms are available. The marketplace listing and CSP information form has been consolidated into a single form. And if you're following the uh the grace period end dates, the marketplace listing grace period end date was um July 4th. Um so we waited a month after that to even close the forms. Um and all of your new submissions must have a machine readable submission. There's a JSON schema attached um or a link that you can link to and this include both um new federant submissions and marketplace updates. go ahead and hit the next form and some of the agency changes. I believe we talked about this last month. Um if not, well, here we we are to talk about it. Um so we're in the process of sunsetting a lot of our old processes. The ATO submission form went live. Um we've been pushing this out to all of the AOS and agency representatives that we normally deal with on a day-to-day basis. Um, if you have anything that you need to do with an ATO, whether it's, hey, you're the initial sponsor and you're informing Fed Ramp that the that their ATO is ready and you want to trigger the review process, you fill out this form. It is really self-explanatory, right? It is um the authorizing official name, the Feder ID, and then really anything you need us to know and and attach the ATO, and we'll take care of you from there. It'll go directly to Chat and Alex and our intake team. They'll take care of you. Um, I promise you, you know, these these marketplace forms are tied to triggers. Um, and those triggers will assign direct people. I say that to say that you will get a faster response if you are using our forms um for the correct process than you email info at. We don't have a triage manager at info at. It is literally the the six people you see um you know in in boxes here when they have time go into go into Zenesk and try to triage tickets um for the team right so the the you know if you have an update to current ATO's or rescending of ATO's or you're just a subsequent ATO or ATU right on a Fed ramp authorization please use this form like I said we'll get back to you quicker than we will if you just email infoad or atto ad go ahead and Hit the next form. >> All right. Common questions and kind of scenarios. These are all actually taken from questions we've received in info at it some of these multiple times over and we just want to walk through uh these. So um what does the 11 deadline 11 June deadline for Rev Five actually mean? Don, can you next slide please? If your package is not listed as Fed ramp in process by 11 June 2027, you will not receive a Fed ramp certification under Rev 5. Like you know, so this includes new packages and uplifts. We have always treated uplifts as new submissions. Um that's in the CR26 rule set. It's also in the old um I think it's the old um ongoing or conmon guide book. Um so it's nothing new. Um so your complete package must be in there. Your independent assessment must be complete. If you are not on the program sponsor route and you are going the traditional agency route, you must have your agency atto submitted u right through the sweet ATO portal form I just showed you. And then you're you are required um to to um you know provide whatever evidence you need that shows that you are following the appropriate CR 2026 rule set. And like I said that dynamic spreadsheet is based on whatever whatever date it is um and will help you will help tell you if you're patching or gray period or you can just go to the Fed RAM CR26 rule set and look at important deadlines under rev 5. Go ahead and hit the next slide. So how do I approve? This is a really good question. um that I'm compliant with CR26 rule sets. Read the individual rule uh explicitly. Some of them some of them have formal notification requirements. So when you transition to CDS and you want to get out of connect.gov, it does require you to email info at we'll assign it to our our market or not our marketplace team, our connect.gov team and they'll work with you to to turn over everything and inactive your connect.gov portal if you have it. Um, and then we'll identify where your new trust center is so that if people ask us questions or if we need access to it, we have kind of the the the process and procedures in place. Um, others will will request the status over time, right? Um, we're doing quarterly FSI uh uh tests. Um, so clearly we will know if your if your not or your federal amp notification uh rule is implemented or not. Um, we can also use that as an opportunity to ask you about specific rule sets. Um, evidence for your transition of rule sets. We we've gotten some of these questions from agencies like how do we how do we know um, you know, if they've if they've transitioned or not, right? Some of them will be obvious, right? Like if you've transitioned to BDR, there should no longer be a POM, there's an ongoing authorization report, right? Like there should be those those natural transitions that you see. Um, I would also say if you are an active CSP and you are transitioning to a rule set, you should treat them like significant changes, right? It's a significant change in your processes. Um, this way your customers notified. Um, everybody, you know, everybody's on the same page about when it's going to happen. Everybody's on the same page with what right looks like. Um, and just just kind of a best practice here. >> All right, let's hit the next one. >> Oh, before you move on for that one, um, Don, can you just go back really quick? We've gotten a couple questions about um what FedRAMP will do if a cloud service provider misses the um the deadline for a particular rule set um but intends to meet it before the grace period expires. So um at this point Fed Rant plans to put um corrective action plans in place for providers that miss the initial implementation deadlines. uh for all of these rule sets and then once the grace period expires that's when we're looking at revoking FedRAMP certifications. Um so be aware that that's kind of where we're sitting right now. Um some of the rule sets will be enforced more aggressively than others. Um things like VDRVER which is a result of the SISA um uh binding operational directive that came out. So those are going to be enforced a little bit more strictly than perhaps some of the other ones. Um so know that those deadlines are coming up and if you're going to slip past it a little bit but still be within the grace uh period, maybe proactively communicate with us and say, "Hey, we know we're we're missing a deadline. Here's our corrective action plan that we proposed. Like here's our implementation dates. will be done well in advance of the grace period expiring and we'll let you know when we finally uh uh are in compliance with all those rule sets. Make sense? >> Perfect. Cool. Um I am Fed RAM certified and my annual assessment scheduled for November 2026. Assuming you're not transitioning to 20X, what should I do? Um you still need to do your annual assessment, right? Um understand the rule sets that are required um you know by your plan submission deadline. We are not when we look at the rule sets your obtain or in this instance your maintain date right is not tied to when your assessment started right it's tied to today right so if you are expecting your assessment to be completed by I don't know if November let's just say fee Februaryish right like you should have those those uh February 2027 rule sets included in that process right whether that's whether that happens then or happens earlier that's between you and kind of the three PAOs but like when we are looking at implementation of of of planned rule sets we are looking at at today at the point of when we receive it within fed ramp not the point where you met with your 3PO or you met with your agency because sometimes that's months um in between the next slide my initial assessment is scheduled for May 14th 2027 remember initial assessment we also need an agency review before we get to a Fed ramp in process review uh which closes on June 11th, [clears throat] 2027. Right? So, my initial schedule assessment is scheduled for May 14th, 2027. What should I expect? Disappointment. Um right, the the chance of you completing your independent assessment in 28 days, also getting a uh agency atto within that same 28 days, and then submitting a complete package to FedEmp is highly unlikely. If you can do it, go for it. Um I mean that's a business decision that you make. Um but please know we will not take submissions um past the 11 June 2027 deadline. Um so if if you're in this position, it may behoove you to transition to to a 20x model. Um yes, go ahead and go to the next one. All right. I am agency in process. My SAPsar is done. I'm waiting on agency review. They say it'll happen in February 2027. What should I expect? Um this is huge, right? It's it's very important to coordinate with your agency and understand their current timelines for review. Every agency is unique um when it comes to their agency review processes, their backlogs, um you know, and and how quickly they can get to it. Um right, there's also, you know, how good is the submission package itself, which can cause a lot of back and forth between agencies, CSPs, and 3POS's. Uh right, so there's a lot of variables in there. It is it is on the CSP to work with the agency to identify the timeline. Um and like I said it varies greatly. Some we get within two months. We've seen submissions sometimes 16 months deep. Right. Um so it at the end of the day at 11 June on 11 June 2027 after that we will not take any packages. So if it takes 14 months to review you're not going to make it through the title line. If it takes two months to review you'll you'll be good um based on this scenario. U but those are all variables that are out of Fed R. Go ahead and hit the next slide. All right. Um lastly, when should you contact Fed Ramp directly with CR26 questions? Um we we've been pretty good at uh um answering the discussions in the discussion forums and at the bottom of the CR26 rule sets. Those are actually linked if you haven't noticed. Um, you know, uh, the the leadership team built a a chatbot basically that anytime somebody posts in that in their either the the discussion forum or the CR26 page, every single lead, Rev Five, 20X, chief of staff, security director, Feder director, and a few other folks are all notified. Uh, right. Right. And if you look at our response time frame, we're averaging about a business day in responding to to everybody's questions in there. Um, so if you have a question that is more likely shared amongst the community, um, please post there. Don't email info. Um, if you email us, you know, uh, someone built a a beautiful reply for folks who who fall in that category of, hey, I'm going to email info a very generic question that I think other folks have. you're going to get a a generic response FH says, "Hey, appreciate you. Appreciate your question, post it in CR26 and we'll get back to you." Um, here's the link. If you have emailed info at a question that has been answered in multiple forums and is obvious on our website, you will just get a response with the link. Once again, we still appreciate you, but like, you know, there's some onus to do some some some research before questions um are asked. If you do have a very unique or niche question that is tied specifically to you, put it in info at and we'll assign it when we can and we'll get to it when we can. All right, RFC's. Um, we've got three RFC's in the pipeline. Um, the first one has a very limited audience. Um, right, it's it's for offerings by government. Uh, so if you think the, you know, cloud.gov, uh, login.gov gov any of the other governmentowned, government operated um cloud services within the Fed ramp portfolio. Um it's it's really intended for them, but once again, it'll be open for public comment for at least 30 days. The Fed Ramp certification process was really designed for commercial cloud providers. Government cloud service providers by default are required to follow all statutory and regulatory um requirements. Um and so you know for federal information systems by default, right? So um the specific rule sets within CR26 are a little bit heavier than probably they they need to. So the intent is for Fed Ramp to kind of shift to a offerings by government rule set um which tell you which which rule sets you do have to implement. Um we will exempt them from um from this the traditional CR26 rules and have them follow a subset of those. um any rule set deviation can can be done based on agency approval, right? You are an agency owned and operated service. Uh um so we'll work with you on that. And then um really it it's no, you know, there's clearly not going to be a a program certification path for this, right? If you are an you have an agency need or a multi- agency need um you still need to have an ATO to go through the process. Um and you will still need to provide your own trust center. We do we do not intend um to continue connect um once we hit the the grace period to end date for CDS we will transition everyone out whether they like it or not um and we will everyone will migrate to their own um trust center. Go ahead and hit the next one. LISASS retirement. Um, you should see, I'm sorry, I probably should have said this on the last slide. Um, the the offerings by government one we're hoping to get out in the next twoish weeks. Um, the LIASS retirement one were estimated sometime either this month or early next month. Um, really the plan is to do no more uh no more new LISASSes after after 1 2027. Um, right. uh really the the alternate pathways for ISAS systems will be either a Rev 5 class B or a 20X class B and we'll provide kind of migration time frames for those. I don't expect that to once again affect many people. I I think in the last eight months we've probably done one LIASS. I know we have one or two in the pipeline now. Um but once again a small audience um as we as we migrate to more consolidated rules. Um the next one and lastly not necessarily uh um a Rev Five thing but does have implica implications for Rev 5 class D providers. Um we will be opening our 20X phase 4 pilot. The RFC should come out as well late August early September time frame. Uh phase 4 will clearly focus on 20X class D certifications. The intent is to run the pilots somewhere between October and March time frame. Um we'll be able to provide I think a little bit more insight into the into the the 20X pilots through the 20X community updates. Uh but we did want to at least announce that it is going to come out here in the next month, month and a halfish. Um and the target participants will be announced later. All right, that being said, I've not been looking at the Q&A piece. Um, so I don't know. >> We have we have a lot. >> Oh, do we? >> I would expect. All right. Uh, let's start off at the top. Um, so we have a question about updating stale assessments and first package and assessment rules um and how they apply to the loss sponsor and RAR conversion pipeline. Everybody's situation um is going to be a little bit different for the lost sponsor of our conversion pipeline and that's why we've set up the opportunity to start this process with a kickoff meeting. So um join that meeting with us and we will talk through your particular um case what your details are where your materials are and we will chart a course for you um together that makes sense. We're trying to be reasonable with everybody as they come through this process. So, we want to talk So many of you have individual scenarios that are unique to you. So, we'll talk through them at the kickoff meeting. If you think that you qualify for that um that particular pipeline, you meet the explicit requirements that we've set out, fill out the form, we'll send you a meeting request for a kickoff meeting and we'll sit down and talk about everything. >> Yeah. So, so the the meeting request is actually a link that allows you to self-chedu. Um, you'll also get a note with that self-ched schedule that I think is super important to talk about here is make sure you have the right people in the room during that kickoff meeting, right? Like you are going to meet with the the the leads on the Rev Five side. Make sure the people who can answer the question about status uh, right? I know everybody's CEOs and program leads and all those cool people are are all die hard who want to go to those meetings, but like if you can't answer the simple questions around your assessments, around your, you know, your continuous monitoring, your hygiene activities, where your system is today, it's hard to have an honest conversation and set a chart out. Like I said, you're either, you know, it's pretty binary in terms of the the dates. You're either qualified or not. I only want to spend a little bit of time in that meeting on figuring that piece out, right? If you are qualified, I want to spend the bulk of the time figuring out where you truly are, right? Because it's not there to disqualify you there. It's there to tell you what you need to get into the review door. >> Cool. >> All right. What is the formal process to switch to the NC the SCN process? All right. Here's where um I'm pulling in answers to a lot of other questions that have been asked in here, too. uh a FedRAMP certification is distinct different from an agency authorization. So your relationship with your agency customers is one thing that you have to manage. Your relationship to the Fed ramp PMO is another thing. Um for Fedramp certification rules, you can switch to SCN anytime you want. It has been live under optional beta for almost a year now. um that we've been working off off of this. So, you can switch for Fed Ramp to SEN whenever you want. Now, you're I I don't know what your contractual obligations are to the agencies that um are your customers. I do not know what your relationship with those agencies looks like. For Fed Ramp requirements, SCN meets all of our requirements. for your agencies. This is something that you're going to have to negotiate with your agencies. I know that we have a lot of agencies who are still requesting that you follow the STR process. Um, you as a business can choose to accommodate that request from them or not. Again, depending on your contractual obligations to those agencies. Um but your agency authorization process and your fid certification process are two different things and you should manage them separately. Um, if you are getting into a scenario where agency requirements are precluding you from meeting Fed ramp requirements, then come chat with us um because we'll have a talk with everybody. Where agencies are requesting some additional information or some additional um uh requirements, that's a customer relationship that you manage between you and your agency customers. um that's going to hit a few questions that we've gotten. Um but one of the distinctions that we're starting to make at Fed Ramp. >> Yeah. And I'll I'll piggy back off of what Nicole said because there that there's a question there about POAMS and I that hits that as well. You have to remember that these are new changes and it's going to take time for agencies to adopt them and keep up with them. Um, so there might be some overlap where you have to do POMs and VDR, but the idea is as we transition to VDR, agencies will then be required to follow Fed Ramp. Um, one thing I do want to note um is helpful for us and it's um something that was in policy and it's in our CR26 is if agencies are asking you to do above and beyond FedRAMP, they are supposed to be reporting that to Fed Ramp. I'll find the actual uh Fed ramp rule that states that. Um and the reason that's important is it helps us understand, okay, what are agencies still doing? We can communicate back with the agency and say, hey, we're moving away from this POM process. Here's the new VDR. So, part of this is education, training agencies on the new process. Um but there is going to be a time where there's overlap and um people aren't just going to drop one thing until the new thing's up. So, >> yeah, I specifically want to hit on the the POM requirement for agencies. Um, if you're still tracking vulnerabilities in an Excel spreadsheet, um, you it's 2026. What are we doing? Um, the vulnerabilities are happening way too fast for an Excel spreadsheet to effectively track the vulnerabilities in your environment. Um, so by switching to VDR VER, uh, rules, you're going to generate all of this machine readable data. You can generate human readable poems from that machine readable data if agencies are still requiring those traditional human readable formats. But if if Excel spreadsheets are how you as a CSP are managing your vulnerabilities in 2026, um we we have some work to do. All right. >> There's a question about SCN and it gives an explicit um it gives an explicit scenario and basically says is this adapted or is this transformative? I I will tell you not to go into this explicit scenario but having sat through all the betas u you know if if you're whether you're doing SCR whether or if you're doing SCN um right uh the you you are still required to do a security impact assessment right it's it's part of the reporting requirements that is the easiest way to figure out if it's if it's truly transformative or if it's adaptive um right and once you know at all the betas once we walked through those it was it was almost obvious obvious in in most of them and there were a few that that we had some back and forth on but um that's the best way um Fed ramp is not going to if you ask Fed Ramp about a explicit scenario um and is it adaptive or is it not we're not going to answer we're going to tell you to work with your provider provide a security impact assessment and if there's major disagreement with based on that come talk to us afterwards >> cool all right we have another question about if CSPs failed to meet a must statement for any rule in the rule set after the due date has passed but before the grace due date is the CSP considered non-compliant with that rule set um technically yes however uh the we at Fed Ramp think that we are rather reasonable people um so what we would really look for is um are you partially compliant what parts of that must statement have you implemented and what parts are still outstanding? What is your plan for remediation? Do you like do you know that you don't meet that statement and what are you doing to address it? What other compensating controls do you have in place to mitigate that um that particular weakness? And if you have a solid understanding and you have a reasonable case, we're here to talk about it. Um, these Fed ramp packages are really to highlight risks to agencies. It's not to create an arbitrary bar that every [clears throat] CSP needs to scale. Um, it's to give agencies visibility into the risks that they're taking on. So, um, provide us as much information as you can and that will help just illuminate that risk. um make it very clear to agencies what is what is not being met so that they can make um mission use case riskbased decisions based on that information. Alrighty. Um oh there's another question about whether services listed under another Fed ramp certification count as Fed Ramp certified. Um, this is going to be up to agencies, but functionally, yes. Like if if you're running a service on an under an approved bed ramp certified umbrella, then presumably they have met the uh Fed Ramp requirements under that um the the overarching certification. >> I'll take the next one on the list. Does the agency issue an atto before FedRAMP receives the package? This is different from many agency processes where Fed Ramp acted as the certification authority. If you are the initial sponsor, we will receive the ATO. But so if you're the first agency um who's using this product and this product falls within the the 2415 umbrella of being required to have fed ramp certification the the first agency will issue an atto before fed ramp reviews the package. Yes. However once we have the package and once we've bought or certified it right we tend to get um agency or we get ATOS after that all the time. Right. And then if you go to our marketplace, you can see uh I think it's the authorization reuse tab or whatever. Um you can see all the agencies that have issued ATO's under that. The only time we've ever really deviated from that process is with the JAB which has been gone since I think March of 25. >> All right. Um next question is a Dissa question. Our very favorite. Um, you will have to talk to DISA about DSA's requirements. Um, there is no reciprocity between DISA and Fed Ramp. They are two distinct processes. Um, so if you want to get Fed Ramp certification, come talk to us. If you want to get DA authorized, go talk to DSA. >> I'm going to take one. Um, so we have been FedEmp authorized for five years now at Rev Five. It's still unclear if we have to transition to 20x pipeline by 2028. We understand that regardless, we need to implement the consolidated rules according to rep 5 deadlines. Do we need to assess 20x at some point? Um, we have to migrate. So, the 20 the consolidated rules for 2026 align Rev 5 with rules that are associated with 20X. So, that's your first step. Focus on those. We have timelines outlined for those. If you're currently rev five, it the idea is you move and you implement these new rules. We have not yet released anything about transition. We're still um moving towards phase 4, which is a focus on class D authorizations and any um further timelines will be posted publicly uh with clear dates associated. That being said, I'm not going to say you shouldn't look at the KSIs because that will help you understand as you do begin to transition over to those um you know what what you can and can't do now and what you need to do for the future. But in terms of giving you a a specific date two years down the road from now, um we can't do that. Um, but everything we're doing with Rev 5 is slowly transitioning towards the 20 and aligning with 20x rules. To jump on that, there's a there's a question about incorporating KSIs into a Rev 5. Um, it says, "How do we incorporate KSIs into our Rev Five pack?" KSIs are are uniquely 20X. They're they're not a Rev Five thing. Um, but there is a mapping [clears throat] um from KSIS to controls that'll help allow you to kind of bridge that gap even more um for CR or for whenever you transition to 20X. >> All right, let's talk about um how the PMO plans to monitor CSP certification status on an ongoing basis under CR26. Okay, CR26 is um a pretty big fundamental shift in how Fed Ramp is operating. So, it's going to take us a minute to figure all of this out. Um, we talked a little bit about how we're going to kind of monitor the state of things. We're going to ask for updates through quarterly security inbox testing. We are going to um be in close communication with all of your agency customers, making sure that they are getting what they need from the um collaborative continuous monitoring meetings. So, we're going to have a lot more communication between agencies uh and the Fed ramp PMO and they will be able to raise issues to us. So if you are not meeting expected rule sets um when we have dates defined your agencies that are sitting in those um collaborative conmon meetings will be reporting your status back to us if you are not meeting the the stated timelines. So um we have a variety of methods that we're going to be exploring. Um, but just meet the requirements, please. Makes all of our lives easier. Uh, multi-tenant SAS pain methodology. Uh, they plan to default all findings to multi- agency impact, skipping N3 and mapping to either N4 or N5. Is this acceptable or does Fed ramp expect per voladius analysis? Certainly, you're welcome to assume uh a higher end rating um and then get a little bit more detailed from there if that's what works for you and your CSP. Um we allow the full range of one through five, but if you kind of want to write off one and two and assume that everything is is starting between that N3 and N5 rating, uh that certainly works for us. >> I'm going to take one. Um, is there a mapping from old KSI naming convention to the new one? No, there is not. Um, one of the things that we did with our KSIs a year ago and working in the open and piloting with the 20some cloud service providers who came through uh, Rev Five, Class B and Class C was we were building in the open and changing KSIs. And so, um, there's not a one for one mapping to the old naming convention to the new one because there were changes in those KSIs based on what we learned through the pilot. Um, so if you're looking for the newest KSIs, please go to fedramp.gov2026 and find the KSIs there. We've as a program have run into several folks that we've talked to are still using old naming conventions or looking in old RFC's and all of that was just us building in the open. So something you saw in an RFC a year ago is completely changed now in the consolidated rules and everything that you need will be found in the consolidated rule set um that was released a month ago. All right. Uh there's a question about postquantum crypto. Um we are working with uh SIZA to uh evaluate what guidance they're going to be putting out relating to PQC. So stay tuned as we know more. But right now all of those uh the guidance and discussion around uh PQC requirements are still very much in discussions. Uh let's see. Oh, there's another question about um will an existing CSO that is not cloudnative um be eligible for a 20x certification? So right now 20X has been highly tuned for cloudnative SAS products. Uh with the phase 4 development, that's where we're going to start looking at non-cloudnative is pass um and and handling some more of those trickier situations. So um right now probably doesn't fit the best into 20x rules. Um, but definitely looking to pilot that out in the first couple quarters of FY27 and then include all of those rule sets into CR27. >> So the next one is about CMU. Some CSPs will fall out of compliance with crypto module use in September when FIPS 140-2 moves to historical status and they may not be able to reach compliance by the due date. How does Fed Ramp want CSPs to approach this? There's actually a fact or frequently asked questions on our website um that uh that addresses uh this issue um right because this issue is is more of a process issue than a security issue when it comes to CMVP right if you're not tracking 140-2 goes away completely or not goes away I'm sorry everything that's 140-2 compliant um gets set to historical in September I thought it was this month I I'll go with what you wrote there September um and uh there is a huge backlog in the 140-3 pipeline. Uh, right. I think there's only been about 400. Um, I think the the pipeline is just as big as the backlog right now or those that are approved is just as many as in the backlog. So, there are a lot of folks in this limbo status of do I stay on a 140-2 that goes historical next month or do I move on a 140-3 that that's migrating and just hasn't been approved yet. That's really a business decision. Either way you take you take a poem or you take a vulnerability, right? If you fall into that category and you can either can either stay until your 140-3 gets variant gets approved or you can move to the 140-3 variant early at the risk that it may not get approved. Right. And like I said, there's a frequently asked questions on our fax page that addresses this explicitly. >> Cool. All right. Um, lots of questions about GRC tools. Um, a GRC tool will likely be very helpful to you as you work toward meeting a lot of the CR26 rules. Um, is it absolutely needed? Uh, depending on how you want to meet the rules in the rule set. If you can meet them without a GRC tool, that's up to you. Um, we've had people build out their own solutions. We've had people procure other GRC tools. Um so there are plenty of options out there but um very quickly becoming apparent that um it is very difficult to get your hands wrapped around this problem set without some sort of tooling to help you with that. Um additionally agencies have been directed to invest in GRC tooling to help them with these problems. Um, a lot of agencies haven't quite gotten um, as far as we'd hope on the GRC requirement. We've talked about that at length um, in other community updates largely because um, the data just isn't available in a way that GRC tools at agencies could really be helpful. Um, and so we're trying to solve the chicken and the egg problem by starting to put the requirements out on industry so that it generates that demand that agencies can then use. Um, it's very hard to go the other way because it's hard to get agencies to spend money. In fact, in some cases, it's illegal to get uh agencies to spend money to um solve problems that are future problems like buy a GRC tool to ingest machine readable data. Well, there is no machine readable data. So, why would I buy a GRC tool? So, um lots of solving chicken and egg problems. Um I think the next one is on we hold a rev five agency class cert and our only sponsor will park the platform in 2027. Our intent is to move from agency path to a program path. Is that route is the route to program certification path a new 20x class C application maybe? Okay. So I think there's really two questions here. Right. One um what happens when I lose my sponsor? Once again I'm going to point you to the facts page. U right you don't go from a agency certification to a program certification. Right? We keep you in the same category. You're certified if you lose your agency sponsor. You're required to continue your conmon activities. um like you were any other day. Um right, you're you're continue or you're required to migrate to CR26 rule sets as applicable. And if you pick up another, you know, um another agency on that uh that Rev 5 class C pathway while you're there, great. They can pick up and and kind of drive on from there. Secondary, I think the question is, can I submit a 20X class C while I'm still rev 5 class C? And so the intent behind it was you needed to choose one or the other, but like you can keep your class C rev five as you work towards your your class C 20X. The the thing is once you hit that class C 20X, you will need to migrate to that, right? And we'll work to to get rid of the other one. That hopefully makes sense as I blab. I'm gonna go with yes. >> All right. Um we are just about at time and we have a few more questions here but so many of them are um related to things that we already answered and or have really good spots um to either be commented directly on the CR26 rule page that it's applicable to or in the community GitHub discussions. So, um, please if you have additional questions that we didn't quite get to or we didn't get enough nuance into it, please go ask on our GitHub. Uh, we talked about how, um, Paul, Emu, myself, we, uh, we spend a fair amount of time on those GitHub pages answering questions publicly so that everybody in the community can benefit. Uh we've seen a lot of these general questions coming into info at and we don't want just one CSP or one 3PAO um to benefit from the answer. We want the entire community to benefit from the answer. So please continue to ask questions over on our GitHub. If you have a very specific um uh question about your particular scenario, um that may be more appropriate for info at if it's not something that we should be um really answering out in the public. But for generic questions about CR26 and nuance implementations, GitHub is is your best place. >> All right, I think that's it for this one. Thank you. [clears throat] Thanks everyone.