FedRAMP 20x Community Update

All righty. Uh, lucky. Next slide, please. All right. We are recording. Next slide, please. Oh, sorry. Legal disclaimer. Okay. I am communicating today in my official capacity on behalf of Fed Ramp at the General Services Administration. We hold these meetings to enhance transparency between industry and Fed ramp so that we can open a dialogue and share new developments. Nothing that we share constitutes business advice and any reference in this conversation to any specific commercial product or the use of any corporation name is for the information and convenience of the public and does not constitute endorsement, recommendation, or favoring by GSA. All right. So, we're gonna have Q&A during the meeting. We're going to try to pepper some in if it's relevant during the presentations. Uh Q&A, hit the waffle, go to Q&A, put it in. Uh and we'll review it and, you know, pass it through if it's okay. Okay, this is our agenda for today. Uh we're going to talk a little bit about some changes in Fed Ramp support. Um, also, uh, using AI to help understand the rules. Um, a little bit of class A, class B, class C, some RFC's coming out, and then just end it with a bunch of qua. All right. Uh, so Fed Ramps report. Okay. So we have hit critical mass in terms of the volume of general questions that we receive uh in our in zenesk you know via in info at uh fedramp.gov uh it has become extremely challenging to answer them all in a timely manner and it's not particularly efficient when one answer in our help desk services one person versus many people in general. So we are kindly shifting everybody who has questions, feedback about the process, about the rules, about timelines, all of these types of things. Please put them up on our community discussions. You can create a new thread, you can add it to an existing thread. Um or uh in CR26 itself if you go to the site page uh there at the bottom of every page the option to add ask questions and we provide answers. Um we do that usually within a day sometimes like weirdly immediately because we get an alert anytime something comes in and so usually one of us is looking at it and uh trying to jump on it and help people out. Um, but if there is specific agency support, if there is sensitive information that like it just flat out isn't appropriate to be putting out there in the public um that's specific to your certification, your business, your organization, absolutely continue to uh contact us at info@fedramp.gov. Um, we are expanding help.fedramp.gov of uh specifically to use utilize knowledgebased functionality. So we can have you know facts and various articles um based on frequently you know tip things we get a lot of uh so everybody kind of gets the benefit of that information. We are also uh increasing the use of forms for specific tasks so we can better triage that information. All right. Uh, and then uh Dan, are you on? >> Yeah, I'm here. I'm Ryan. I'm masquerading as Ryan today. >> All right, Ryan. Dan, >> I'm in our new office space uh over here sharing with OPM. It's very exciting today. Um yeah, so we're gonna talk just a little bit about some of the ways that we're using a that you can use AI um to help with CR26 activities. Um so these are not officially like like Fedramp products that um AI products that FedRamp is producing or maintaining. These are justformational concepts that you can use uh in your own development or for your own purposes um just proof of concept kind of stuff. So there are two resources that we make available uh that can uh that are designed for AI agents to consume. So the first one um is actually the one on the right right federules in GitHub. This is where you'll find uh all of the Fedramp requirements and KSIS in machine readable JSON format. This is always the latest and most current uh version of those rules available here and you can point your AI agents straight to this GitHub repo in order to find the rules in JSON format. However, what's usually a better idea when you're dealing with AI agents is to use the resource on the left uh which is github.comfedraamp2026mmarkdown. So this is exactly the same content which is in the CR2026 site on fedramp.gov. So feder.gov2026 um but without all the HTML decoration on it. So it's just the raw markdown content. Uh and that includes all of the content that is in the Fedramp rules JSON. So this is actually the best place to point your AI agents at uh is the markdown site because that will give them all the information that is in the the JSON rules, but also a lot of the context around it that might not be uh immediately obvious to an AI that hasn't been following the 20x journey this whole time. So, uh, when you're using the a an AI agent and you're trying to get information about the Feder, uh, 2026 consolidated rules, the best place to point it is to that GitHub repo there. Go ahead, next slide. So, with that in mind, we built a MCP server. Um, and for those of you who aren't familiar, MCP is just a protocol. It's a standard way of providing content to a AI agent um in a way that that the AI agents understand and it provides usually some like basic helper functions um that give the AI basic capabilities with that data and and generally helps to reduce token costs and make your answers more efficient and accurate. Um, so, uh, again on github.com, this one's at dan-fed, fedraamp rules mcp. And I, uh, cannot stress this enough, how little effort I put into building this. Um, it is not intended as an actual useful product for anyone, and no one should use it for anything. It is just intended as kind of a proof of concept to show you what we're talking about with the 2026 markdown. So what I did with this MCP server is I point it to that GitHub repo and then I built some very basic and and by I I mean my AI agent built some very basic uh functions into the M MCP server that let it do things like find specific rules or look up uh search for specific words or context. And with this MCPA agent installed and the instructions are on that GitHub repo if you want to try it you can um you can take a look at it but again not to use it for anything important. Um but you'll see you can ask it questions about the FedM 2026 consolidated rules and it does a pretty good job of finding the right answers for you and surfacing that content in a way that's really uh helpful and interesting. So, like I said, this is the sort of thing that can be really useful to you when you are uh if you're a CSP and you're looking to understand the rules or check uh your systems for against the requirements. If you're an agency and you're looking to evaluate a CSP's uh JSON packages um to understand whether or not they're uh how they're how they're complying with the various veteran requirements, this can be a really useful tool to help you do that. It certainly does not replace human review of your security packages on either side. Um, but it is a useful tool to to help with that and it is something when you're thinking about automation and all the automation that we're we're pushing towards in the 2026 program. Um, this can be a really useful tool to help you get there. Go ahead. Next slide. So, this it turns out if you take like a really long uh PNG and you stick it in a slides presentation, it does this scrolly thing which I thought was really cool. Um, but just to give you an idea, this is a prompt that I fed into my AI agent when uh I was asking once I had built put in the MCP server and I just asked I fed it a fake security decision record and asked it to analyze it and produce a report for me and this is what it came out with. If you go to the next slide, so this is broken down a little bit more. So you can see it gave me this nice little summary of this. You can't really read any of this. is too small but it gave me this nice little sec uh overview of the service. It told me what ports and protocols are in use. It told broke out the security controls that are defined in this particular SDR. Next slide. And here you can see in even less legible text, you know, the Fed requirements and the key security indicators and how they're being met by this fictitious CSP. And then the part that's a little bit of, you know, so this is if you don't have a GRC tool yet, if you're an agency and you don't have a GRC tool, um, that lets you view the machine readable packages that are being submitted by CSPs, this is a really cheap, you know, blunt force way to take those JSON documents and convert them into something that's easily human readable. Um, you can just ask your AI to do it and it'll do a pretty good job in most cases of of converting that data into something that's human readable. And if you, you know, refine those prompts a little bit, you can get it to usually spit out that information in a consistent reporting format that makes sense for you and your agency. Um, the last bit here, this number six, risk analysis, is actually I asked the AI to go ahead and flag for me what some of the concerns might be in this uh fictitious CSP. And you can see it found a couple of different things that it thought were, you know, high, moderate, and low priority items. Um, and they were mostly pretty okay. I mean, it was a fake CSP submission, so it was already pretty crappy, but um, you know, it's it's an it's certainly again not a replacement for having the, uh, package reviewed by a security expert. Um, but it did flag some things for me that I, as a security analyst, would want to make sure to go take a closer look at. Um, so there you go. So that was just a really like I said a really quick kind of highle way that you can leverage some of the data that we've made available combined with modern AI tools to you know facilitate and enhance what you're doing with CR26 um and to find ways to uh improve your process or or fill in for GRC tools and things like that if you don't have something yet. Um any questions specifically about the AI stuff? Yes. So there was a question the federal consolidated rules site indicates as public preview. Uh I think I updated that yesterday but if I didn't um I will get to it today. Any other questions? Okay. That's that's all I have. Back to you, Aan. >> Thank you, Dan. And uh just a plug since uh Dan was also talking to agencies. If we have any agencies on the line that are listening in that aren't already part of our liaison group or uh attend our uh 20x uh support groups, please email info at and request to be added to those things because we want you to be part of the party as well. Um, we have a lot of information in this meeting for everybody, but we have uh other meetings with a lot more information just for agencies. Alrighty. Uh, so let's talk about class A. It's open. Uh, here's the high level how you do the class A, right? You you have a framework already that's one of the approved frameworks. Uh, talk to type two uh, Govramp or uh, Rev, you know, Fed Ramp Rev 5. Um, first you get listed. So you need to be on the Fed Ramp marketplace and initial implementation status before we can actually start the process of doing your review. Uh, two, you do the work. Uh, make sure you have a trust center. Um, you know, look at kind of anywhere you need to add, subtract, you know, from your policy to meet the various rules. um create your package and optionally have an independent verification validation by a Fed ramp recognized assessment organization. All right. Uh and then finally you get certified uh you'll submit a separate form for requesting certification. Um and then we'll perform the our program review. We may have a little bit of back and forth, may have some questions, especially now while things are new and there hasn't been a ton of like specific information about submission. You know, we may be asking you to update, change, modify some things. Um, and then, uh, at the end of the line, we have our final disposition and if you're moving forward, uh, you get certified and then you're on to your ongoing responsibilities. Okay. Um so what is in a class A submission package? Uh this has caused a you know a fair amount of confusion. Uh but at a very base level you need your external assessment materials. So if you if it's your sock two your sock two uh report like every page of it you know if you have a bridge letter throw that in there um gov ramp materials you know fed ramp rev 5 your latest raar like you know give us the materials from uh your assessment you also need a certification package overview uh JSON that's actually how we are filling out Feder marketplace information um and after you kind of go through the initial implementation status to get on marketplace in the first place. You are giving you are assigned a Fed ramp ID which you will then place into your certification package overview. Um a specific thing to note for class A is there has been a lot of confusion specifically on the assessor um the like the assessor element and in the CPO and basically if you did not have a separate assessment specifically for your 20X materials you would just not include that. You would leave that blank. Um an assessor is only someone that performed your 20X assessment. Um, and for a class A, it doesn't matter if the same organization also did your sock 2 audit. Uh, that's not the same thing. That was your auditor for the external framework. Even if it was Fed Ramp, right, and it's a Rev Five and they did your RAR, that still wouldn't go in there. That is only for if an like a independent verification validation was performed specifically for your class A package. All right? And then you need to have your security decision record. You need to have uh sample schemas in place. So specific rules that are referenced like your incident in various incident reports, your OCR um and then if you your if you included uh VER, TFR, MRH, which is a mate uh for a class A, then you would need the corresponding historical VER activity SEMA. All right. And then finally your uh if you had an optional IVNV then you would also ensure that you have your assessment summary from your assessor in embedded in the SDR and each individual like rule um and KSI as well as the overall summary of assessment in your CPO. Um, all right. Uh, are there Let me just double check for any questions that might be relevant before I move on. Okay. No, those were Okay. Okay. So, none specific for class A. So, moving on. All right. So, tips for a smooth process, right? Like we get a lot of questions. Um, how do how do I make sure I'm ready? How can this go as fast as it possibly can or as smooth as it possibly can? And really kind of the high level is completeness. Uh making sure that human and machine readable information is present on your trust center. And when we talked about the SDR, you need to include all musts and should rules um as well as all all identified KSIs. Um and uh even if you even if they're not met, right? like even if it's a should, you did not meet because you have a particularly good reason, you need to include that information in the SDR so we can review it and understand it and make sure you're good to go. Um, you can optionally add mays that are relevant to you and that you are working on, but just know if it is included in the SDR, we review it. So if it's a May, you say it's implemented and we're not seeing a lot of information, uh we don't see artifacts, we don't see a mapping, we're going to go back and we're going to ask for more detail on that. So include the may uh if you want it is extra credit. It is great. It shows that you're going above and beyond, but just make sure it's complete. Um all right. Now, accuracy, we have a JSON schema validator. So all those schemas we talked about earlier, the CPO, the SDR, um the uh um OCR, like all of those SIGs, you can check them in our schemas uh in the validator. Um we would prefer if you do that before you do your submission because that'll ensure that you know we can move along rather quickly. Um, another thing to note on accuracy is if a rule or KSI is not fully implemented, mark it partially implemented. Um, please and thank you so much. Uh, it's it's okay to not be fully there in a lot of cases. Um, but, uh, basically trying to stretch something half you meeting half of the rule and trying to stretch that into fully meets. Uh it's pretty obvious to us that you don't and we're gonna ask you to change it. Um all right, review experience. Um so yeah, your trust center is super important. Uh being able to easily get on your trust center, log in, see what's on there, uh use it like that just streamlines and speeds up uh not only the review the review process, but it makes it so much easier for agencies as well. Um, it really should be something that is uh consciously built like built with a purpose and not just check in a box. Um, you know, it doesn't have to be super flashy, but it also shouldn't be like some kind of like file dump, right? Um, okay. So, also, uh, simple to find artifacts. Uh we like super love scavenger hunts when they're fun games, but we don't love them when we're doing it for a review, right? Because that adds a significant amount of time if we're having to figure out where the artifacts are. Um really if you want a quick review uh direct links from the SDR uh to where exactly where they where they are in your trust center like that is super super helpful. All right. Um next slide. Okay. Uh so class A facts. So we just kind of have a lift list here. Um originally we had class A for like two different paths for rev 5 20x that changed. We decided just to go stick with 20x and then um from there you can jump off in either direction, right? You can get a class B, C, C or D if you're rev 5. Um you know Rev 5 or 20X. All right. Um another thing too is since we consolidated kind of the rev 5 and 20x into just 20x class A uh we have also uh we are supporting hybrid or self-hosted in infrastructure. Um class B and C for 20X currently remain uh you know cloudnative only but for class A we are okay with hybrid and self-hosted infrastructure. Um other frameworks so if it's not on the list we don't take it. uh we might take more for CR27. If that happens, we'll put out an RFC. You know, we'll we'll, you know, communicate that well in advance. All right. And then um I don't have an assessment from any of the approved frameworks. Can a Fed ramp recognized independent assessment organization do an assessment instead? So, class A is meant to be pretty, you know, fairly easy. Some, you know, low lift. Uh bring a framework. If you don't have a framework, then go for a class B, class C. Uh that's coming up soon anyways. All right. Okay. And then can an agency use a class C certification? Uh a class or sorry class A. Class A is a real real Fed ramp certification. Right. And like real is highlighted, bolded, capitalized, underlined. It is all of those things. It is very much real. Um it can you know it's it's really designed for limited low-risk you know eval evaluation type of use cases but this will enable use especially for agencies doing a try than buy right uh you can limit the amount of uh amount you invest in this process to initially see if somebody is actually interested and then kind of go from there. All right. And then how long does it take to get a class A certification? Uh this is really just kind of a copout answer to say I don't know. Uh like we have to process more of them until we have um like a real timeline to provide. Uh basically our SLA for all FedE ramp certifications is 30 business days not including time we're like waiting on the provider but um as we get further in this process you know we'll start releasing more information about our actual time so people can have a better understanding. All right seeing some more questions pop in just making sure if anything is class A related. Don't see anything yet. Okay. So, [snorts] all right. So, continuing on to class B and C. All right. Class B and C will get will be open soon. So, the uh you can go ahead and submit for your initial implementation listing now. That open July 6. Uh but you can't actually submit for the certification review until August 31st. If you attempt to submit the form for a class B, class C, you will get you know an automated message from management that says uh you know uh you your request has gone to the trash. So uh that day we'll open up but until then we're not. All right. So for any of our 20X pilot participants, this is just kind of a reminder. Initially, we had a 12-month window to be able to kind of do the conversion. We're to simplify things. We're aligning it with the CR26 maintain time frames. Um, you're still responsible for performing your quarterly check-ins. You need to if you're going to send us that invite, like send it to info@fedramp. Uh, we're not acting the 20x email group anymore. Um and then uh you need to during this time progressively show progress uh with adopting CR26 and then final submission you can do it as an annual re annual assessment or you can uh submit a final certification package. All right. So same process is you know or similar process as class A. Uh you just have a little more stuff on the do the work and get certified part. Um so uh on the do the work side class B class C automation and historical metrics are now in play which they weren't necessarily uh in a class A and you know for class C they're a must for class B they're a should allighty and then let's okay so our class B and C program review process looks like this. So, when you submit, we're going to do an intake. We're going to make sure it's complete. It's got all the right stuff. We're going to update Fed Rant Marketplace. We're going to add it to the review queue. Um, we have kind of a sort of kickoff process where folks get set up in the trust center. uh we meet with the provider to do uh a walkthrough um like a walkthrough of your uh service, a walkthrough of your package just so we get a better understanding and context. Um and then team goes back performs their internal review. Uh then we're going to assemble with the provider for a collaborative review where well the provider and the assessor for a collaborative review where we may have questions. We ask you to kind of explain how you approach certain KSIs or rules. Um folks that were in the pilot process are very familiar. We did that in both phases. All right. And then step [clears throat] five determination. This is where we generate our certification report and uh have final disposition on if if you go through or not. Uh if not, uh we're probably going to work back and forth with you to kind of you know figure it out or uh you know work on next steps. And then finally you get certified uh and you will get your certification letter which includes that certification report which will then get you will file on your Fed ramp trust center. All righty and then okay next tips for a smooth process. So this is the same as a class A completeness accurate accuracy um focus on review experience like make it easy. Um, but some additional things to add is it's a lot more important, especially when we're in B and C, when there are a lot more rules, a lot more KSIS, uh, a lot more evidence and, uh, tests and, you know, verification, validation. It's really making sure that it's readable that uh not like walls of sloppy text like just you know clear concise tell us what's happening tell us what you are doing now. Um you can talk about future plans if you have specific gaps like especially if you're it's only partially implemented or not implemented. Um, but just in ensure they include specific time frames of when they're going to be addressed or in cases where they're not going to be addressed, be very clear. Uh, we aren't doing this. This does not match or meet our business goals. Um, all right. Also think of so there's your implementation statement but your individual verification validation your tests your metrics your evidence all of the things that are nested underneath your particular KSIS or rules uh those should all be clearly described as well. Um it is very challenging to look at artifacts or to look at uh you know certain like validations automatic you know automated validations that are happening and try to pick through exactly what is going on. Like we can often follow along but it takes a lot of extra time. It takes a lot of effort and really there should be a solid explanation and kind of fall back to thinking of the old school who, what, when, where, why, and how, right? If you have that addressed fully like in your picture like throughout the imple your implementation statement, how it relates to your test, how your tests, the types of evidence that are produced by your tests. um then it just makes for a very cohesive and easy to read and easy to understand um uh you know statement in in the STR. Uh also relevance uh we sometimes there is the the uh sometimes folks will kind of heir on the side of more information versus less information, right? like in terms of evidence, in terms of of tests, uh, but if it doesn't directly relate to the to that specific KSI or isn't kind of like nested to that KSI, then it really doesn't make sense to include it because the more stuff that's there is the more that we have to understand what is happening and review and go through and if it really just does not make sense why a piece of evidence is attached to that KSI, uh, we're going to go back and we're going to ask you about it. Um, and same with metrics, right? Like, uh, pretty graphs are awesome. Like they're really neat to look at, especially on like fully fleshed out like trust centers, but if there isn't context to what it means, what it's doing, it's not directly related to that particular KSI or rule, then it's not particularly helpful. Okay. And then this is a reminder of the force of the rule. uh we talked about it earlier and you know the musts and the shoulds always need to be in your SDR like if it's applicable to a class A if it's applicable to a class B a class C like whatever you are submitting the musts and the shoulds you know and when I say must I mean must not and should should not uh they need to be there may are extra credit uh may show you're going above and beyond but if you do include them make sure they are complete Okay. All righty. And finally, we are to requests for comment. Uh we have a few that are out and coming out. So RFC 0032 offerings by government. It is open today. You can put in comments now. It is open until September 8th. It is probably a little more relevant to agencies, but um Fed Ramp is going to you know what we're the intention here is for Fed Ramp to establish an offerings by government rule set. Um so a an offering by the government is already adhering to that agency's atto process and so having to additionally go through the fed rampant process is a bit redundant. And so this is trying to eliminate the need for that but also put in place some of the things that uh need to be there from kind of a continuous monitoring perspective uh so that you know there there is some alignment right you know you'll need to have a CPO schema so that we can uh process it on Fed rampant marketplace so there's a few things that you'll you know they would need to do for fed ramp uh but by eliminating this we eliminate a lot of time, effort, money, all that good stuff. So, all right. So, this will be coming. This is not posted yet. This is just advanced notice. Um, LISASS retirement uh looking to retire LISAS um not accepted anymore uh after the first of the year uh 2027. And then you can do one of two things. you can switch to a class B uh rev 5 certification or a 20X class C or class B program certification. Right. Okay. And then phase 4 pilot. This is one that a lot of people are interested in and excited for. And this is where we will focus on 20X class T certifications. Um, which also include us getting more into the weeds with self-hosted infrastructure, IAS, PAS, all that good stuff. Um, so the expected pilot's going to run during the fall and uh beginning of the year and then uh we'll be announcing what participation looks like. You know, that those kinds of options, that sort of thing. Alrighty. I think we're we're at the Q&A's. Uh I I apologize. There was a bunch that came in, but it's uh uh we're moderating, so it they weren't all moderated by the time I was looking. So if they're relevant to stuff from before, I apologize. Uh we'll kind of get through them now. Um Nicole, uh Ryan, Dan, do you want to jump in and also help out? Okay. Let's see here. All right. So, Dan, there's one at the top for does the AI take a look at just the implementation statement for the rule to provide risk analysis. You see that one >> clear? What Fedramp isn't providing an AI agent or model. So, the answer to that question is going to depend on what AI you're using. Um, you know, generally speaking, the AIS are pretty good at consuming however much data you give them. So, if all you pass in is the, you know, JSON from the SDR, then that's all they'll have. If you pass in, you know, additional supporting evidence ev uh or or additional attachments or whatever, then then they'll have that as well. But, you know, this is um really something that you want to investigate with your AI provider um and not really a federal question. Similarly, there was a question in here about uh what assurances do you have? Uh if you're using a commercial LLM that the data the the uh CSP provided security data isn't going to be used for training or exposed in some of the way. Again, that's something to discuss with the AI provider. If you're using your AY's provided AI service, then they should be able to give you good guidance as to what uh you should and shouldn't be uh feeding into the AI. I'm going to touch on a couple. I I closed out um but I dropped it into chat for folks who to to look there. It was about the six-month metrics requirement and whether those are required for initial certification. I dropped a link directly to that rule. Um but basically if you're coming through and it's initial certification you need to have um mechanisms in place to uh ensure that over the course of the next six months you're able to agree to meet this requirement. So it is applicable and we'll be looking at that as soon as uh we open up class C. >> All righty. And I see one here for uh are there any rules not ksis that are not musts for class A? So uh I'm not sure if this means are there shoulds or mays or if there are must nots but uh there are definitely uh shoulds and mays and uh class A is a little bit different because there are rules that specify the rules that are applicable underneath and there is one rule that goes over uh the Mus there's another rule that covers the shoods and another for the maze. Um, all right. And the second part, >> that's the sort of question that an AI agent with the MCP server installed is really good at answering. >> Yep. [snorts] Um, and then, do you encourage CSPs to submit for class A in our current state while we work on bridging documented deviations in our SDR? If so, what are the absolute hard requirements before submitting? So, uh, you know, we can't give business advice and we don't know your specific situation. I think it's a judgment call, uh, for you. um hard requirements. You have to have uh either a sock 2 type two uh gov ramp um or a fed ramp rep five. So if you don't have those things, you definitely can't submit for a class A. Uh but a lot of the things earlier as far as like making sure you have your CPO, you have your SDR, you have all of the musts and the shoulds addressed in your SDR, you know, have the schemas, then uh you should be able to submit. All right, >> we have a question. Um, have you seen organizations automate the following KSIS? KSI PIR and KSI PIY RIS for folks on the call. Um, those are reviewing executive support and reviewing investments in security as part of the um, policy and inventory KSIS. And I'll I'll let Emu you jump in on this one. I will say we have not received any uh 20x packages yet outside of the uh 20x pilot packages. Um so anything that we've learned so far here at Fed Ramp would be based on those uh pilot 20x pilot uh certifications. >> Yeah, I I will add the in the pilot program there were a lot of really innovative ways to measure these KSIS. Um, and this is the sort of thing that it's really great to post in the community discussion groups on GitHub. Um, so that those pilot organizations, the people that participated in the pilot can weigh in and provide kind of their experience. Um, and other other organizations that are working on this now can also provide their experience. >> Yep. Yeah, absolutely. We we definitely saw examples. Uh, so there there are many ways to skin a cat and like Dan said, post there and maybe they will clue you in on what they did. >> To be clear, Fed Ramp does not endorse the skinning of cats. >> All right. Uh, let's see. Uh uh have you seen any federal agency explicitly reject a Fed ramp 20x authorization or state that they would not accept 20x? >> Um >> I haven't you? >> No. >> Yeah. We uh and and to be clear like we have agency liaison group that we meet with every month. Uh we additionally specifically for 20X have an agency support group and so we get a lot of uh one-on-one time in those particular venues. >> We we have had meetings with a number of agencies that had questions about 20X and how it could fit into their agency's internal process. But I would say you know kind of universally those meetings have always ended with the agency feeling very positive about integrating 20X. All righty. Uh, will there be a different set of rules and KSIs applicable to class A and B authorizations that are not cloudnative? Historically, Fed Ramp has been cloud SAS only certification. Much of its require controls would have. Yeah. So, so, uh, the reason we're okay with, uh, class A being okay for, uh, self-hosted and hybrid situations in addition to cloud native is it's very low risk. Uh, very, you know, like and it is, uh, we're not doing any special KSIs for those at this moment. uh when we start moving into the class D pilot, that is when we will be defining those other sets of KSIs, rules, things that would apply specifically to uh self-hosted infrastructure. >> Yeah. So for right now 20x if you have a hybrid solution where part of your solution is running in cloud architecture and part of it is running in you know on-prem maintained systems that's not uh 20x doesn't doesn't work for that right now. Um those >> unless it's a class A >> unless it's a class A. >> Yeah. Um so in the you know future we'll be coming up with requirements for infrastructure providers for kind of like the Amazon's and and Microsofts and Google cloud providers of the world um as to what they need to do in order to get a Fed Ramp certification for that hardware infrastructure layer that they're maintaining and providing. Um and when those requirements come out then that may open the door for hybrid solutions where you know an organization is using cloud for most of their system but has some uh local infrastructure as well. But that's something that we would look for probably in the early part of uh 2027. >> All right. Oh, sorry. Go ahead. >> I got one. Um okay. So, under FedRAMP CR26, if a CSP meets the machine readable KSI SDR requirements, but the sponsoring agency hasn't adopted um CR26 processes, does that block certification? Since CR26 removes the agency sponsor requirement, can CSP get certified independent of agency readiness? And I'm going to tie this in with another one I saw because it's also relevant. uh D says I understand the official Fed ramp sponsor will be going away. What is the process uh what is taking the place of sponsor that we meet with on a monthly basis? So the first question about um Fedramp certifications to be very clear a Fedramp certification means that you met the Fed Fedramp rules and requirements and have all the documentation needed to meet a Fed ramp certification. that happens before you even engage with an agency. So folks on the call who might have done Fed ramp before or are familiar with um the way Fed ramp was done before is you often have to have an agency sponsor first and then do FedRAMP. Fed ramp 20X eliminates the need for a sponsor. You come through, you submit your documentation directly to Fedramp and then the agency comes after. So in terms of you know the agency not having the documentation that is why uh we require all of our sorry does not have the ability to re uh read machinebased documentation um that is why it's important for you to be able to display that information in human readable form to your agencies as agencies continue to do adopt GRC tools and uh things for them to be able to ingest your machine readable um documentation uh the previous question about um you know having a sponsor a meeting on a monthly basis. A lot of the things that were required in a traditional Rev Five assessment, you know, you needed an agency to sign off for. For example, the significant change um uh request >> request process you had to submit to your agency, have them approve a uh Fed 20X and the new rules that are rolling into the Rev 5 don't require an agency to actually sign off. It's more about you as a cloud service provider. You're making these changes. you're updating your stakeholders and the collaborative continuous monitoring rules which are applicable to both 20X and Rev 5 uh packages will have you meeting with your uh agencies at least uh quarterly and then you'll have to do ongoing um reporting to to your agencies. So um you're not sitting there meeting with the agency. Now, that's not to say that if your agency requests to meet with you, that's a business decision that you as a CSP can make between you and your agency. But from a Fed ramp standpoint, our requirements are quarterly meetings and um ongoing reports. >> All righty. I've got one for would the RFC for class D pilot cover what is required of an IAS CSP to participate? Um yes the intention is to uh include IAS in that and that will be in the RFC so you all can comment on it. Okay. Uh next are there agencies that are more cautiously optimistic? We have clients interested in multiple agencies asking about Fed Ramp generally. We'd like to help steer them in the direction of a more progressive agency partner if possible. So, uh, we're doing our part to work with agencies. Um, but y'all can too, right? Having a very good agency experience using your trust center, looking at your package, um, showing them, right? Like, um, there is certainly trepidation uh, about the idea of trust centers instead of the consolidated uh, location that they are used to. And part of that is based on some people just having bad experiences with the legacy high like self-hosted uh you know areas. And so if you have a good experience like you build a good experience in your trust center if you are responsive if when an agency reaches out and says hey I want to look at your 20X package you're like yeah let's go let me give you a demo of what is in this trust center. let me give you a demo of how we approached it of what we did. Like that is a way that you can directly get involved and you can help help help the cause so to speak, right? Okay. Um let's see what else we have. Uh class A seems to indicate that a three POW's involvement is optional. I'm assuming independent valation blah blah blah means three POW involvement. That is correct. So we have adjusted terminology. Uh it is not a threepow anymore. It is a um fed ramp uh recognized independent assessment organization. And Ryan that you explained that the other day uh very well for our agencies and that's because that is in law. Correct. >> Yeah. >> I I see another one here um that has to do with agencies. So can you speak to the agency representation rough count and not including sub and component agencies in the cadence of calls the PMO has had with the agencies. So this is something that just yesterday we had our agency liaison meeting. I think there were roughly over a hundred um folks on that call maybe a little bit more from different agencies. Um those are also recorded and supplied to the agencies directly so that they can share internally with other folks at their agencies. And as Emu said that we get a lot of questions. We spent most of that call answering questions about 20x similar to what we do here. We present but a lot of it is just Q&A with the agencies. Um we also have another call I believe it's next week maybe the following which um and Emu can talk more about this but um the purpose of that call is to really sit down with agencies and walk them through uh 20x package and give them specifics on 20X. Um we're kind of balancing two things here. We're balancing transition of Rev 5 um with all the CR26 rules that have to do with Rev 5, but then we're also um pushing um information out on a entirely new process that agencies are now doing. So instead of just meeting monthly uh with agencies like we used to, we're doing it uh by monthly. I think that's the right term. Um so meeting with them twice a month. And then we also are doing um agency um we call them fed ramp day and it typically is between fed ramp and the agencies and um we that we dedicate an entire day quarterly to talk with agencies and I I will say um like with anything new probably a year ago when we talked to agencies there was a lot of unknowns apprehension agencies didn't know what was coming um and the meeting we had yesterday I thought was really productive and the agencies were asking questions about okay how do we adopt this and and really the questions were focused on what what do we need to do to do this and I will also say we we are getting emails from agencies saying hey we're trying to adopt this at our agency but like we want like a playbook or a slide deck and they're even taking it on themselves to build out based on the public information that's out there decks and and materials that they're sharing with us that they think would be helpful to other agencies. So I I've seen a lot of progress there uh amongst the agencies. >> Yep. And and we also take a lot of like ad hoc individual a agency meetings, right, where we're meeting with them and talking through their specific circumstances um to, you know, just just help kind of the the implementation. and to that meeting that uh Ryan mentioned, the support group. We're going to go through some class A uh certifications live and go through kind of our review process, what information is in there, how to kind of look and evaluate that information. Um and then uh what to expect uh from a provider, from a trust center, all that good stuff, right? And we're going to do the same thing with class B, class C as we're going through. It's hard to go through materials hypothetically, right, with like test cases and like this is what we think this is going to look like. It's a lot easier to look through um you know, once we're receiving uh all of these different submissions and uh providing certifications. So, all righty. Um, for CSPs class Certified in the pilot, are there specific steps to submit the final package after completing uh CR26? Okay, so you can do this as either part of your annual assessment or if you just want to get it in out the door. you can go through like you're going through a new certification and submit that and we will put it in our queue and we will review it and then flip you from a pilot to a full certification. Um, and same goes too for uh if you want to level up, right? Like if you participated in phase one class B uh and you want to move to a class C, uh get your class C ready, get it submitted, and we'll we'll we'll bump you up. All right. Uh let's see. So agency Conmon meetings are only required quarterly, not monthly. Uh correct. So Bed Ramp's continuous collaborative monitoring process is quarterly every three months. Uh details of that are in our CR26 rule set. Okay, let's see what else we have. All right. If changes are necessary to meet Fed Ramp class A that weren't in the Sock 2 type 2, should the class A still be pursued? Absolutely. So, we have some pretty specific rules. Like I can't imagine you're going to have in your sock 2 type two that you have to set up your you know email spam filters to you know for fedramp.gov got right like there are a lot of very hypersp specific rules that are just for fed ramp that it's not going to be in your sock 2 audit um the expectation with the sock 2 is to provide some level of assurance that some third party uh you know auditor assessment organization whatever you know depending on whatever the framework is what they're called uh that they have looked at your infrastructure at your system that they're uh you know they were in the same zip code or neighborhood as maybe some of your KSIs. Uh but if you look at the class A rules, we specify that we're looking for either a mapping to a specific sock tube control like within the document where an auditor looked at those things um and or an artifact that helps support that. So in places where you there isn't a clear mapping, uh provide an artifact and you're as long as it's understood, it makes sense, well explained, you're you're good to go there. Okay. Um will Fed Ramp be spot-checking CSPs, KSIs, and blocking certification if Fed Ramp does not think the implementation is sufficient? Yes, absolutely. That's that's what we're doing. Like we're so uh our job is not to say you you know you are not secure you don't pass go or you are secure you pass go we are looking at is the information you provided does it make sense is it accurate like we are uh you know very much like security professionals uh a lot of us have a lot of hands-on experience digging into technical our architecture like we are going to be spot-checking stuff. We know how certain you know AWS, Azure, GCP like you know octa whatever like we know how things work and how things are put together and if we see something that is like totally wrong or totally off or does not make sense whatsoever like we are going to call you out on it and we're going to ask you questions. Um because the intent of this is not to create like here is the bar minimum bar of security. The intent is for it to be easy like for us or an agency to assess risk of your system and how you are meeting various rules or KSIs. Okay, >> I'm going to jump in. I got one. >> Yeah. >> Um can the agency have tailored controls on top of the 20X after meeting Fed ramp requirements? What should we expect the agency to require in order to get a full ATO under 20X? I'm going to um also this is applicable to the Rev Five Fed Ramp [snorts] certifications. Uh the law states that there is presumption of adequacy and what that means is that there is enough um information in a Fed ramp package for an agency to make a security based decision on whether or not they will issue their own authorization for the use of that service based on the information they're putting in the system etc etc. For Rev 5 or 20X agencies always have the ability to ask for additional controls. That's that's FSMA. That is up to each agency. However, the presumption of adequacy says, you know, Fed ramp should be adequate. If you're asking for more, why? So, if you look at the Fed ramp consolidated rules for 2026, there are actually column, there are headers at the top, overview, FedRAMP agencies, cloud service providers. If you click in the agencies tab, there are agency rules. And these agency rules, a lot of them are derived from M2415 or the Fedramp authorization act. If an agency is going to ask you to do things above and beyond the Fed ramp authorization, they are uh supposed to be reporting those to Fed Ramp. So feel free as you're going through this process if um you're a CSP um you know, let us know. Part of this is us understanding what agencies are asking. If they are asking for for more, but um they the presumption of adequacy means everything in your package should be good for them to pick up and use. So if they're asking for more, we want to know about it. >> I want to add on to that because we got another question that I hear often um asking about plans to address agencies who require maintenance of legacy documentation like the SSP and POAMS and things like that. This is where we can really use a partnership with you um agencies like it it's human nature to be resistant to change. So what we need from CSPs is your partnership to demonstrate that the products that you are providing as part of your new 20X uh certifications are better than their traditional Rev 5 process. And until you can help us prove that with agencies with like actual packages that they use, um, we're gonna have a hard time convincing them. We're working on it. They agencies have bought into the concept, but now it's time to actually prove that the concept works. And that's where we're relying on industry to help us out because we're not the ones building these fed rampant packages. You are. Um, so the more that you can um integrate automation into all of your um your products, the more that you can report out in real time, the the more information that you can give them, the easier you make the customer experience accessing your trust center, the better the agencies are going to feel about your product in general and the more that they will be willing to move over to a more modern approach. Cool. And we are at time. Uh I just noticed. So if we didn't get to your question, we have the community GitHub. Please, please, please uh use the community GitHub. These are all >> This is being recorded. >> Um so continue the conversation over on the community GitHubs. We do uh sit in there often and directly answer questions that are beneficial to the community. So please keep showing up there. Emu, any last words? >> No, just uh thank you everybody and go make some killer packages. >> Bye guys.