FedRAMP Rev5 Community Update

Well, all right. I mean, maybe let's go ahead and start cranking through. Um, when in doubt, if people join late, they can always watch these things on on YouTube uh later, which is pretty awesome. In fact, like our team, like mad props to the team because these things are showing up usually same day on YouTube. It's fantastic. All the FOMO in the world. You just get it going. So, why don't we uh We already recording? Sweet. Why don't we go to the agenda? All right. Super excited, everyone. We're going to go through our standard agenda. We got some disclaimers. Tomorrow, uh, we're going to give you some updates on the Rev Five limited limited capital Limited program certification that we are doing for folks that lost their sponsorship over the last year. We're going to show you some pipeline metrics. This is one of the things that we've always wanted. We we always are trying to be very transparent with what is going on with certification and our pipeline. there's a lot of information that you can get publicly uh and now our data is kind of so uh easily accessible that you can kind of reconstruct a lot of this yourself. Um but we're going to share some information about stuff. We're also going to have you an give you an update on the Feder security inbox situation. A little bit of a spoiler. For the first time in quite a long time, Fedramp has removed and rescended certification from a fair number of cloud service providers for failing to meet Feder rules. So, I just want, you know, we'll talk about how generous and careful and thoughtful we were during that process. Uh, nonetheless, if you don't follow the rules, expect us to follow through the way that we have been warning people that we will. We're also going to talk just a tiny bit about some of the vulnerability detection response and vulnerability evaluation reporting rules and kind of what's going on with that and some things that I've been hearing from folks. Walk you through some changes to community engagement. We're going to talk about upcoming Fed ramp day which in fact like if somebody on my team could p Marcia may paste a link into the chat for that so folks can just click through that. We're joining with the cloud service fighters advisory board. We've been invited to kind of take over day two of their annual summit in the end of September. It's going to be huge. We're going to have a bunch of cloud service fighters, a bunch of folks from agencies really getting together. And this is all like actual staff level executionbased folks, not just a bunch of random executives coming in to talk. And we're really excited about seeing what that looks like for everyone. And finally, we'll just talk you through what's going on with the RFC's, the notices, and things like that coming up. And cool vibes there. So, let's go. Next one. Here we go. Again, we've made a slight update to this because I spent a lot of time recently listening to recordings of our community updates. Uh, and obviously I pluralized it. Uh, so we are communicating today on behalf of Fedramp at the General Services Administration. We hold these meetings to enhance transparency between industry and Feder so that we can open a dialogue and share new developments. Nothing that we share constitutes business advice and any reference in this conversation to any specific commercial product or the use of any corporation name is for the information and convenience of the public and does not constitute endorsement, recommendation or favoring by GSA. We should have a contest see who can say that the fastest and we'll have them read this in the future. Um Paul, over to you. >> Awesome. Awesome. Hey, thanks Pete. Um, so yeah, so like Pete said earlier is uh you know, we really wanted to to be transparent about kind of where we've been the last the last year plus where we're going. Um uh I don't know if you remember this. We talked a little bit uh when we came back from our uh long break during the uh um Oh, I'm sorry. The program certification discussion. I'm getting ahead of myself on slides. I apologize. I built the slides. I should know this. Um but yeah, program certification overview, right? that that pipeline opened up 10 August um 10 August at 9:00 a.m. by 9:07 we had our first official um sponsor in there u just to reiterate the that some of the qualifications because there is a lot of disconnect in qualifications versus am I certification ready right um in order to meet this limited pipeline and it was built for a reason right because we know that there was a huge contract downturn during this timing period so we wanted to open up uh the ability for folks who who have invested in Fed ramp um heavily uh to to to have our pipeline right but also once we notified that we we're going to open this up we wanted to make sure that like you know people weren't popping in, people weren't taking advantage of the open pipeline. Um so we limited it to this to this uh date and scope and it's um January 2025 to March 2026 and you have to have a completed SAR by then or were listed in marketplace as in process agency in process. we wouldn't have stopped you if you hit Fed ramp in process but if you were there too you'd qualify right um or you had a completed RA during this time frame um or you were fed ramp ready on the marketplace right so pretty easy to judge am I available am I not at least I thought so um go ahead and hit the next slide um >> I just I mean he says like pretty easy but like we had we had a few folks that like were like oh yeah it was this date then you talked to them as no it was a year ago buddy like what what are you doing >> you know we build a form a form right and whether if If you click the the RAR submission form or the SAR submission form and I'll talk to why we differentiated those out in a second, right? The SAR or the lost sponsor one said like when was your SAR completion date and you know folks saw the timeline and it was clearly like they were like ah you know what I started it in this date so let me throw that date in there because I know it meets the parameters and then during the kickoff meeting we all look at each other super awkward for a while um and then we have to apologize and let them know they're not in scope and um it's awkward for everyone. Uh please don't do that. I' I'd appreciate it and it it eats time away from others. Um it is it is pretty easy and if you if you don't understand if you qualify or not, ping me and I will help you. Um but since uh since uh from 10 August to 1 September yesterday, we've had 36 uh form submissions um accepted form submissions if you will. That means your SAR date was actually within time frame. Um of those 20 of those have been RAR conversions. 16 has been lost sponsor forms. Um, and we talked about the process last month, but if you once you once you submit the form, you get a link to self-schedule a kickoff meeting with myself, Yas, and Don and Nikke, the leadership team within Rev Five. Um, and, uh, we'll go through kind of assess where you're at, figure out what you need from us, all that good stuff. Um, and as of yesterday, um, six of those are already in our review queue. Um, we're in the midst of about 10 or more, right? There's a lot of potential nuances, right? A lot of folks need either firsttime connect.gov access or or readmission to their connect.gov access, building out your uh your folders and then transferring all the data. Um so it's it's it's uh like I said, we've got about 10 in that ify stage close to submission. Um and we've still got I think four or five more kick five more next week or or later this week or next week uh for kickoff meetings. Go ahead. Next slide. I'm going to add to that on the way out just like if you are are looking at this, if you know someone that is looking at this, if you are advising someone that is looking at this, if you are the assessor for someone that is looking at this, this window, this pipeline will not stay open forever. Like get your submission in. Like we have a lot that have come in. If you're I don't know why anybody would be waiting, but like we're not going to keep this open until January because by then you won't have any time to do the things that you need to do. We haven't set an exact date yet, but probably by the middle to end of October. If we don't see any trickling in for a week or two, we'll shut it down. >> Perfect. Perfect. And really, um, like I talked about, we had a kick we have a kickoff meeting with everyone to a make sure you qualify, right? That's the number one number one piece. If you make it that far, we're we're good to go. The rest of the decisions are and and actions are on you, right? Um uh once we figure out you qualify, right, we trying to understand your current posture and hygiene. Um, we've had it all over all over the board, right? Some have done a complete SAR. Um, right, they they had a sponsor, they were ready to go, they got dropped, but they they they were confident they would get picked up somewhere else, and they've kept up all their documentation, all their hygiene items. Everything is ready to rock. Um, and those those are clearly the ones who are going to get through the pipeline a little bit faster. I think by day two or three um of the form even being open, we had our first complete submission. U Right. Right. And then we have we have folks who who are on the opposite end of the spectrum, right, who hey, you know what, we had a SAR um we've been doing the activities. We haven't been doing them in, you know, the feed ramp forms or Fed ramp style. So, there's some catching up to do. Um but really lastly, you know, we just want to baseline everybody where are you? This is where you need to be, right? Because the the the requirements for certification don't change. Once you get through that door, you're treated like every other CSP in the agency pipeline. The only document that you don't have to have required going through that pipeline is clearly the agency ATO, right? Um, you're not going to get that. Um, uh, right. And, and, and we treat you like every other CSP at that point. Um, and lastly, >> I'm going to like pop in on that, Paul, and just like triple, quadruple, octuple, emphasize, right? Like you do not get a Feder certification off of your RAR or something else like that. You just get the opportunity to earn a Feder certification with us as your sponsor equivalent. So, you still have to put in all the work. >> Yes. Yes. Absolutely. And you if you've been continuing your your hygiene and like you've been taking care of business, it's it's first off, it's easy to know and second off, you get through the door a heck of a lot quicker, right? Um uh and lastly, identify your needs, right? A lot of the needs have come in in concert with um having a connect.gov repo, getting connect.gov access. We're able to turn that around and generally two to three days. Alex is going on leave in a few weeks, so maybe a little bit longer after that. But um but it it's generally been pretty quick. Um and really I I do want to talk about the issues we have seen so far, right? Eligibility requirement. Pete just hit on that, right? Like if you have a RAR within that time frame, you you are eligible, right? But the the requirements for certification hasn't changed. So, if you've done a a um a compact review just for a RA and you've only done you only had controls looked at associated with a RAR, then you've got a ways to go before you're fed ramp ready. However, I would say about 50% of the folks who who have RARS that have come through the door and that and the other 50% have done the full control analysis, right? And they just submitted their own RAR, but there's a SAR in the background and 3PO can help help them get it. We open up folders. Life is good. Um some of the other issues I talked to these um hygiene activities either seizing or or or going to your own formats once you lose your agency sponsor. Clearly there's some rework that has to happen there. But once again the standard coming through the door when you're ready is the same. Um right fed ramp formats fed ramp templates. um all expectations uh kickoff meetings containing leadership have listen happy to talk to your C whatever O's absolutely happy to but if none of them can answer questions about your hygiene activities um if they got a full control assessment um it's just a a a fun 30-minute meeting with a bunch of cool people from your company and generally ends up with a second meeting with way too many security people on the back end and but also a good one right um that says hey where where are we truly and we've had about two or right? Where are we truly on hygiene? Right. And and we'll help you map out the path to success. Um lacking familiar CR26 requirements. How you found the law sponsor route and not a CR26 route um in the Federal Ramp web web page is beyond me, but it's happened once. Um and uh once again, I'll I'll point you to our website, your amazing three PAOS, right? And and help you kind of get there. Um, and you are, you know, if if you're coming in early, you know that the earlier you come in with a complete package, the better you are. Um, because the CR26 rules are are piling on month over month, right? Um, and you know, there is a um a caveat for those going through the program. It's in it's in all the documentation that's in your submission. you are you are going you are checking a box that says hey I am going to be um required to be compliant with CR26 rules earlier than everyone else which I think is February 19th was the allotted date 2027. Um last but not least we already talked about this um your dates of your SAR and your RAR are beyond the range. Please just don't waste my time or yours. Um it's it's awkward. Um so yeah. All right. Next page. This is where I thought we were starting but we were not. Um, uh, Pete talked about just being transparent and open, right? Um, you know, at the end of 2025, we've been tracking our stats for a really long time. We built a crap ton of automation, uh, during the uh during the CR lapse last year. Um, and uh um and and we and we've been able to pull a bunch of automated metrics since then, which has been super awesome. Um, so like I said, in July of August last year, we really got rid of all of our huge backlog which skewed our stats in a beautiful direction, right? So I I don't want to cover a lot of our statistics from 202 or FY25 because they they are they are kind of lopsided since we, you know, literally everybody was reviewing packages um from, you know, Pete on down. We all got assigned stuff um in order to clear the backlog and no one out, no one within the team was not within a package at some form or fashion. But really um during the the the laps in the CR is when we really collapsed to the teams you know now the the the Vanguard team which is is 20X and and our team the Bastion team um which is about seven dudes and dudats strong, right? Um and so really what I want to talk through is is um some of our our our metrics that that we report up to leadership as well. Um and uh I will tell you also Q1's a little bit skewed since 45 of those days we were not allowed to authorize certifications uh in Q1 due to the contract lapse. You should have seen the thing on our website and life was good. But we did complete a ton of of automation activities. Um our total packages with within Q1 is 13. Our average days in the Rev 5 review is 21 and our average dayto-day backlog u right is eight. And uh let's talk about average days real quick. Um, we don't have an SLA per se, right? But the target based on the CR26 rule sets and what we've been holding myself and the team to is under 30 days for review. Now, what does that mean? That means we have it in our review queue. Your complete package, it's passed through CNA Alex, right? They've done the initial package checklist, identify that yes, you have all your documents, it goes over to us. That is when our clock starts. If at any point in time, and we'll talk pause and stop, right? If at any point in time we pause or stop your your certification review, that time is no longer counted against us. Let's talk pause. Pause is just quick, hey, there's an administrative issue with your documentation. We can't tran. We need you to do some little bit of actions, right? Um in order for us to move forward, our team will reach out directly to your PC's, email them, tell them what they need. We pause the timer. If you get back to us in 10 minutes, we we not restart the timer. Uh we we continue the timer. Um, right. And life life is good. If you get back to us in 29 and a half days, uh, we will we will start the timer there. Please don't email me on day 30 asking what the status of my package is because it's been 30 days. Um, right? It's been with you for 29. So, you know, cut us some slack. Um, but uh, yeah. So, I mean, that's how we we track our timers. So, that's pause is generally just administrative issues. Stop is a very different thing. Stop. If [clears throat] you get a a meeting invite from the one of the nicest human beings on our team, Nikke, um, and it says, "Paul, Augusta, and Yas want to meet with you, um, that's normally not a good thing, right? That normally means we're going to stop you dead in the process. There's either critical controls issues." Nine out of 10en times it's hygiene issues. U, right, or something like that. We're going to put you on on a stop um on a full stop until you get through all all the requirements that we have with you. Once again, it'll be a meeting. It'll be cordial. We'll tell you all the deficiencies that are stopping you. will help you come up with a plan to get to good, but it's on you to get to good and get back into the pipeline. Um, so that's how we count our days. Uh, Q2, our total packages, you'll start to see the increase now. Um, right, is 22. We're averaging 23 days in the review pipeline, and we're averaging about 7-day backlog. So, if you can see between the eight and sevens across here, we are knocking them out almost as fast as they're coming in, right? Q3 even better. U, we're crushing it a little bit more. Um, 33 total packages completed. Our average timeline is 28 days, which clearly as more come into the pipeline and we tackle more, the timeline is going to get a little bit longer, right? And our average backlog once again is seven. Go ahead and hit the next slide. This is where we're at today, right? Um and and one of the [clears throat] reasons we want to talk, you know, we've already pushed out 14 packages this quarter. Um and we're a little or I guess we're twothirds of the way through. Um we are at the 30-day mark right now. Um and our current packages in the backlog is 22. If you could do the math from seven, right, that's a little more than or seven to eight, that's about a little more than three three times our average Q length. I do expect us and you know, if you've been in the pipeline, I do expect us to to hit over the 30-day marks um as we come into the next few weeks. Uh the loss sponsor RAR conversion route has definitely added a lot more to the to our plate um in a good way. Um so we'll keep kind of trucking through that. That's that's kind of where we're at today. And I have absolutely been ignoring all of the questions in the chat. So I apologize if there's if there's anything good in there. Okay. Um >> good questions. Um and like the main thing I want to add to this is kind of providing a tiny bit of additional background to just kind of keep folks in the loop. Let's talk about like what's going to happen, how it's going to affect things, and what FedE is doing to prepare for all of this, etc. Um, obviously anyone that's been in the game for more than uh two years remembers that the largest contention of uh the last like five to eight years of Fed Ramp was the waiting period in the the backlog. Uh and it was getting pretty big. It was it was exceeding over a year before we managed to chop that down. when we started making plans for uh this particular opening of the pipeline for program certification for Rev 5. At the time we did that, we were expecting to complete hiring actions with over 15 additional staff um as well as some additional uh support staff on board. Between then and now uh we have onboarded no one. Uh we are onboarding our first hiring uh a new new person from outside GSA for the first time since early 2025 next week and it's only one person. There's a couple other people that are possibly coming depending on um you know the hiring process. So that created a very uh predictable situation for us where I made the determination that it would be better to keep this option open for folks and have it take a little bit longer than than the people would like rather than to just close this off in spite of uh trying to help people. So the main thing that I'm sharing this from a level from a transparency perspective is to uh kind of like ask for a little bit of grace from industry in this process that we are giving we are spending government funds with a limited personnel and staff on something that is going to be uh really hard for us to do in order to ensure that some companies that experience very similar um you know negative consequences from unexpected changes over the last year as our program did uh can have a benefit from that. But the flip side of that is that instead of getting your review done in 30 days is likely that some of you might be waiting closer to 60 or 90 because we have explicitly determined I have explicitly determined that we will prioritize full agency sponsored Rev 5 packages over these ones that we're doing. So this is just to say however it comes, you're going to get it. It's going to happen. it just might take a couple more months uh than than we would like. So, the 30-day metric is gonna get overwhelmed here. So far, this isn't affecting the 20x side of the house, but we'll see how the 20x side of the house goes as that demand starts to increase from the 20x side as well. >> John, there's a really good or Pete, there's a really good question in the chat from from from John regarding pipeline metrics. I don't have the numbers of how many pauses and stops. Pauses happen regularly. Once again, they're not negative. That just means there's either a conflict in your documentation, there's missing documentation. We ask you to submit 1,200 pages of documents, right? Like if you do it beautifully every time, you're a hero, right? But it's we make it hard to be heroic in that in that instance, right? >> There's this I was asked this today by my new boss that was like, you know, is there's like a hidden thing in there where you're like screwing people over by pausing the clock. And last time we pulled the data, the the delta between the average factoring for pauses and the average not factoring for pauses was like two days because it turns out most people when they submit a package, if you have a question about their package, they tend to respond pretty quick. They don't just sit there for a month and not tell you something. >> Absolutely. And and I would say 99 or 90% at least of the the pauses. We we do get back pretty pretty quickly or immediately. And most of the time it's just it's it's deconlicting things, right? The stops happen generally once to twice a month. And once again, if if you get stopped in the process, you're going to hear it from the government lead, right? Like, you're not going to hear it from anyone else. You're not going to hear from the contractor, right? Like, you're going to hear it from us. I will have a look at it. They will have dumbed it a down enough for me to articulate the issue back to you. Um, and like we and we will work with you to a to a pathway to good. Whether you get to that pathway or not, it's on you. Um, but yeah, uh, really great question. All right, FSI failures. Um, so, uh, Pete hit on this a little bit, right? Um, the last the last FSI quarterly test that we did, we did tell folks that like, hey, this is the first real one. You need to respond. You need to respond in the time frames. For those that didn't respond, we reached out multiple times. We looked, literally scred our entire uh, Zenesk to figure out if there were alternate PC's who we could also contact during the process. And for that um uh you should have been able to track a few weeks ago we dropped caps on the marketplace. Caps are now um are visible in the marketplace. You can filter by it. Um and so as of I think today is or they they'll whenever the next website is populated, you'll see the following ones removed from from Fed Ramp. We will work to notify all the agency PC's that have been identified on there. Most of them are onesies and twsies. I think there's one that's a little bit bigger. Um but we have provided multiple times and multiple ways we've attempted to communicate with the CSPs. Um they have either not followed through or they've not followed through, right? Is is the reality. And we're going to start pulling people from marketplace and and I think you're going to start to see that a little bit more regularly. Um if [clears throat] you don't respond, right, and and for those who who didn't meet the timeline and did respond, um you know, there was a process to do a cap. Um, we're working through that process now and you will see those folks actually removed from the cap piece on marketplace. It should be in tomorrow's build. Um, so you will see a discrepancy in number in marketplace if you look at caps between what's on this list and what's there. Um, Nicole, did I miss anything? I know this is your your baby. >> No, I think you got it. Like this is not a one-time punitive action. This is like a repeated history of not responding to us, us not being able to contact. Get in contact with anybody from the company. We've reached out to agency partners and said, "Hey, if you are using these CSPs, tell us who you're talking to so that we can talk to them." Like, we have tried so many times to contact these CSPs and have not gotten a response. So, um, we are pulling them off of marketplace, uh, after a concerted effort to contact all of these. So, please don't worry that if you make one misstep, we're going to yank your Fed Ramp certification. That is not what this is. >> I can't emphasize that enough. I I do want people to understand that if you're not following the rules, like the penalties apply. Um but also at the same time we went through with number of cloud service providers who were responsive or we were able to get a hold of them eventually. They provide us with a corrective action plan. They demonstrated that they were then complying with the rules and like no harm everybody moves on. Like that is our preferred path anytime any day. Um, in most of the situations, we expect that the majority of these providers are like companies that literally abandoned this thing and never told anyone and we never found out because their uh previous agency sponsor wasn't doing oversight anymore because their agency uh had stopped doing it and Feder hadn't been um you know catching up and monitoring what's going on with every single provider. So um this is yes you will lose certification if you are if you repeatedly for a period of six plus months fail to communicate with veteran. I think no one should be surprised or uh feel like that is unjustified. Um if we can't talk to people they can't maintain our certification. I do want to point out um one of the biggest failures that we see with the Feder security inbox is that people do not test their security inbox from a domain outside of their company. So please please have a process set up to regularly test that your domain can receive email at least from atgsa.gov or at fedramp.gov. But if you're intending it to be a wider audience um it should be able to receive email from an outside domain. Um, so that's the biggest failure we see both on the security inbox side and the sales inbox side because we default to sales if we can't get you on your security inbox. So, >> we should start the sales emails off. We're we're interested in learning more about your your software and you know, maybe we'll get a better response there. Um, but okay. Oh, looks like I'm done talking for a little bit. So Pete, over to you with uh VDR VER vibes. >> I did it. I was talking on mute. I caught myself. 10 points. Um let's talk a little bit about VDR and VER. There's a lot going on here. There's a lot of talk and stuff uh in industry. There's a lot of concerns, a lot of thoughts. Um like we acknowledge that. Um, the number one thing that I keep hearing from folks is, is the December 7th deadline a hard deadline? Yes or no? And the answer has always been from FedRAMP's perspective, it is not a hard deadline. There is a bakedin grace period. We gave you that grace period. The thing is, SISA has not given agencies that grace period. And I realize that uh as this stuff trickles down through the agency process, it hasn't necessarily come through with enough pressure yet, but I guarantee every cloud service provider that as we get closer to that December 7 deadline for uh from SISA that agencies will start panicking and asking why you haven't done this yet. And so we negotiated with CISA based on FedRAMP's responsibility and M2415 to be the communicator uh with FedRAMP certified cloud services that basically we would be the one yelling at cloud services about this so other agencies could sit back and chill out and focus on their own stuff because they've got their hands full figuring out how to apply these this bod 2604 to themselves. Um, nonetheless, you should be really focusing on getting these this new approach in place. That said, I want to talk through a couple little things um just to kind of brass tax like reality of what FedAmp expects uh Feder's approach to life and how we think about things. So, one of the things that I frequently have to remind people is that if it doesn't exist um in the Fed ramp rules, then it's not a real rule. But the plus side is that our rules are very very particular uh and often are very specific. They are designed to match and manage allow industry to take a similar approach to agencies. Following the risk management framework, you have the ability to accept and manage your own risk. Then your customers can choose whether or not they agree with your acceptance or management of risk and continue to be your customers or halt being your customers or ask you to do other things. How you manage that business relationship is not a compliance thing. It is a what does your contract say? What does your agreement say? and how do you manage and negotiate complex issues with your customers? That said, I'm going to start with vulnerability. And I strongly encourage everyone to remind themselves what Feder's definition of vulnerability is because Federamp's definition of vulnerability is taken from the law. So, it applies elsewhere. A vulnerability is not I scanned something and there was a CVE. Okay? A vulnerability is any attribute of hardware, software, process, or procedure that could enable or facilitate the defeat of management, operational, and technical controls used to protect against an unauthorized effort to adversely affect the confidentiality, integrity, and availability of an information system or its information. This includes gaps. This is added from the law. This includes gaps in Rev 5 controls and 20X key security indicators, software vulnerabilities, misconfigurations, exposures, weak credentials, insecure services and all other such potential weaknesses in protection whether they are intentional or unintentional. Okay, so what does that mean? So like the traditional finding in an assessment if the cloud source fighter agrees that there is a problem there, there is a gap that is a vulnerability and should be tracked and managed like a vulnerability. The vulnerability detection and response rules require you as a CSP to track, monitor, and discover the detect the vulnerabilities that you have in your system. The vulnerability evaluation and reporting requirements require you to evaluate the potential impact of those vulnerabilities to your customers and to yourself and to report on the potential impact of those vulnerabilities. And so I connect all of this together to say that we've we've orchestrated this set of rules such that a partial implementation of the VDR or the VER will result in a vulnerability. You can then choose to accept some of the weaknesses resulting from that vulnerability and it will be documented that you don't meet this requirement. It will be documented that you don't provide that capability and then it will be up to your customers to determine whether or not they want to continue to use you based on that acceptance. You can also put a timeline on it and say hey this isn't going to have a particular effect etc. Um and so I say all of this I'm laughing [laughter] at Erici there. Um, I say all of this to say that there is inherently flexibility in our certification process that allows a cloud service to have a good technical reason to not implement something yet or to not have it ready or to have a plan for things. So on December 8th, 2026, like that's what we're going to be looking for. Have you put in the effort to identify the weaknesses in your system and in your implementation of the requirements for the vulnerability detection and response and a vulnerability and evaluation reporting? If you have, then you're probably not going to have a corrective action plan requested because you have already identified the weaknesses and are telling us how you're going to fix it. If it comes to December 8th and you haven't done any of that and we don't have any of that information available, then we will request a corrective action plan and you will be placed in public remediation. So, take a holistic approach, invest in the effort and let's get all this stuff done. I'm going to also add I have said this uh publicly a few other places but just like to be very clear in this context. If SISA moves the deadline, we will move the deadline. So, but for right now, I can't extend that deadline other than giving you a grace period. Uh, only SISA can. So, if you have issues with that deadline, etc. Uh, SISA has received some emails from folks about the complexity of that. I'm not saying go spam them or anything like that. I'm just saying we are going to follow that. So, if you see an update to those timelines from the SISA bot, take a breath and expect us to release updated timelines as well. So, some are in here. I got some new questions and things like that. I'm just going to scan through these really quick as some of these questions come in related explicitly to this. Um, ah, so there's a there's a question here about you may sample identical resources versus you must scan a representative sample every 3 days. So, these are not actually contradictory. These are supportive in that you must at least do a representative sample and then you may choose to sample representative samples. So the point is like you don't have to scan or you don't have to check every single thing. If you have 8,000 boxes 8,000 containers, they're all deployed at the same thing. I don't care if you scan 8,000 containers. If 8,000 of them are deployed from the same pipeline with the same thing, you may scan a representative sample, but you have to scan at least every three days a representative sample. Um, so that one is answered. Okay, cool. Tanner uh answering somebody else. Thank you for that. Um, ah, yeah. So there's a a VDR VER question about providers must verify and validate the status of non-machinebased information resources at least once every three months. Yes. Uh so this means uh that you must ensure that all of your non-machine based information resources are real, valid, and meet what your expectations are. Uh you must make sure that the person that is uh telling you that they are Jimmy is still Jimmy and it's not somebody else. Things like that. Um we haven't provided a lot of guidance on that. That is really focused on um you know you showing that you are managing your workspace. You cannot just not you can't just ignore non-machine based information resources in your vulnerability detection. You can have vulnerabilities anywhere. If a CSP has a valid rationale for not implementing a should requirement, where does that justification evidence need to live? Yeah. So the the the SDR the security decision record requirements explain in the future how you'll justify that. If you haven't switched to the SDR then just write it into your narrative and just be like here's our technical reasons for why this isn't implemented. It's cool. Uh can I provide a link to Feder's documentation for a person that can't that needs it? Sure. I have it up. Here you go. that has a link to the definitions of Fenamp in Fenamp documentation. Um, where are we going on here? Hold on, hold on, hold on. Okay, did that one. Fet address the common complaint threat I've heard in community saying either agencies won't follow this federal has no authority. Um, so these are two different things. So, first of all, um, agencies won't follow this lol. agencies are bound by the same binding operational directive to follow this. Guarantee you they'll follow it. Um they need they are required to change their entire risk management process. They're going to change it. It's going to take a little bit. Don't worry about it. Um there's also a thing that says Fedmp has no authority to tell agencies how to do things because of FISMO requirements. Um Fedramp in the law is actually given the authority and the responsibility to tell agencies how to do things uh in this case when it comes to cloud services. So FSMA is not just like a thing that stands on its own. It's part of the law and the Feder authorization act which is so FSMA's 44 USC chapter 35 has a bunch of stuff. Feder is in 44 USC chapter 36 and says hey Fedramp tells everyone how to do this one. It's just really weird to me when people bring up FSMA like it's a standalone like thing. Also FSMA has been changed multiple times too. Um question from oh there's a point. What Pete said contradicts what Paul said last month that you would get a PL2 finding if you missed December 7 and we put on a cap only if you missed the grace period of March 7. Yeah, Paul was wrong. >> Pete's not here to to know what I said last month. [laughter] Um, no, I it's >> Oh, good. Um, >> no, I mean the rules are clear, the timelines are clear, right? Like once you're in a grace period, you will be asked to provide a cap. And I just want to be clear on another thing is that you don't get put on a cap. You are asked to provide a cap. Okay? You give us a corrective action plan that tells us how and if that if that's good, you're in remediation until you fix it. You fix it solid. But you will be put in remediation if you are not meeting the requirements and you are not addressing them effectively. >> Yep. There is we talked a little bit about a deviation and it's in the um it's in the GitHub forums too, right? There are five rule sets explicitly tied to your annual assessments, right? And by the the maintain date or the obtained or really the maintaining date, you should have a plan associated with when those timelines are, right? Um but like clearly, you know, you can't move to a mass when you're not on an assessment, right? You can't have an IBM, you can't follow the IBM rule set when you're not going through an assessment, right? Um, so you know, like I said, we will use the FSI um quarterly uh reachouts to identify your um your your uh or to selfidentify and self-report where you are at for a lot of these as we go through them. Um like I said, for those those five that are tied explicitly to your annual assessments, you you can't do outside or you shouldn't do outside, we will ask you to just have a plan during that maintain timeline. Yeah, it it's also important to understand that the um enforcement of the VDR and VR comes outside of the expected schedule and original plan for CR26 due to the timelines provided in that SISBOD which made things a little awkward for all of us. So, one of the things that I have said repeatedly is that Fed Ramp is not out trying to get you over everything, right? And I think what we talked about with FSI is a good example of that. We have people that were, you know, a half a year overdue and we're still working with them trying to trying to figure things out. Um, so I we want you to prioritize it and show that you are prioritizing it. If you are working in good faith towards it, communicating with your customers and things like that that you are doing it. I don't see any reason for us to drop a banhammer on you. Um, but at the same time, your potential customers do need to know that you haven't met those rules yet because they're going to make decisions based on that. So, we got to figure out what that looks like. Um, dropping into uh Colton, given your explanation of the definition of vulnerability, if a CSP is scanning from a scanner that is known to produce lots of false positives, does the CSP not have to report bones they don't agree with from that scanner? Yeah, the vulnerability detection vulnerability evaluation and response uh and reporting rules basically say you the first thing you're supposed to do is evaluate if you think it's likely to affect federal customer data. If you think it's nonsense, then it's not likely to affect it. Uh you don't have to report it. you might want to keep a record of it so you can demonstrate that you like did the analysis, but we're not looking for that stuff. We don't want to waste anyone's time with that. Um, question from Alec. Sorry, I won't read off everyone's name. I shouldn't do that. Um, a question about sharing information behind a trust center and not behind click to accept NDAs or similar. So, uh, we'll talk about some other stuff in a minute, but basic I think this might be more of a a 20x question, although it becomes a RA 5 question right here. Um basically eventually when the certification data sharing standard becomes a requirement that applies to row five which is throughout uh it's like you know January one for new folks and then spread I think it's like really late in the year like August or something for current folks then yes you need it to be published to a trust center and not behind a click to accept NDA or similar um based on what your customers need. there's rule that the information has to be acceptable uh to people. And I'll just add as a general thing like when you have conversations about trust centers and NDAs, one of we have this conversation with folks a lot. Our lawyers sometimes have to talk to uh private company lawyers to explain the law prevents us as federal employees from doing something bad with your information. Like we're not allowed to. We have much stronger protections under the law than your nonsense NDA puts on us. So you basically can trust feds given that situation. On top of that, feds can't accept that NDA. We have to have that reviewed by our council because we're it is illegal for an individual federal employee to bind the federal government to an agreement. So it has to go through general counsel review. It becomes this whole complicated thing and it's very limited. Uh so if you are putting NDAs in front of feds, you should talk to your lawyers and come up with a better practice uh that doesn't do that because you're wasting everyone's time. Um >> there's a there's I think there's two questions in here around uh individual or independent assessment of you transitioning to the your rule sets outside of those five rule sets that are tied to your annual assessments. Right? So you don't need you don't require 3PO or independent assessment for you to transition to each individual rule set as it happens. Right? Treat them as significant changes. Right? So if you transition to VDR, VER, clearly that that affects the control your controls, right? Your CA15 more seven more than likely, right? Um and treat those as significant changes. This way you've given your agency enough notification that you're transitioning to these processes um as well. You've done any impact assessments, but it doesn't require a validation from a 3PAO perspective, right? Or an independent organization's perspective. Same thing with SCM, right? Um there are some there's one that require there's one that requires notification formally to Fed ramp that is the certification um the CDS um one that tells us hey you now have your own trust center and that just lets us know that we can decommission your your connect.gov of repo access and accounts. >> A big thing um there is like just follow this new change process and like try to keep your stuff do this incrementally and then it's not a big deal. You don't need to constantly have it assessed. Um there's a question within the VR about the relationship between persistent reporting and monthly activity report. Um these are again complimentary rules. Uh you must persistently report and you must at least provide a monthly report. Um, if you want your persistency cycle to be monthly, then your persistency cycle can be monthly. Uh, you should expect and be prepared to be able to report more persistently than monthly over time. Uh, uh, because agencies are going to want that a lot more real time as uh, time goes by and capabilities come in. Uh so there's a lot of things like that that are structured in a way where it says there's one rule that says you must do this and then there's another rule that says it must be done at least this often and we did that so that they were you could define your own persistent time frame. So you can create you can report vulnerabilities on a daily basis by making them available in a uh subscription uh schema where someone can like subscribe to a message provider and get things as the vulnerabilities come in. But you still must give them a monthly activity report. Um there's a follow-up question about like why isn't this rule added to the controls? So we separate out rules and controls ODPs sometimes. So like um because they're designed to fit across multiple things. So just follow the rules and if the rule means that there's an ODP that we haven't specified, I think you can do the math on that yourself. Um what is the relationship between full OSCAL newer simpler JSON schema these independently coexisting tracks? So like we like OSCAL is a very complex very full-fledged way to do a uh default NIST system security plan. Our JSON schemas are designed to uh provide a structure that is very high level and very basic like a skeletal structure for shipping assurance data to customers. So assurance data to customers is different from a OSCLA based thing which is like this is how I'm going to build and manage my system. Veteran's looking for assurance data not this big thing. Um you can translate between the two of those as much as you want. It's trivial especially with today's modern tools and things like that. Uh so go to town do that. Um if you want to do things uh in both you probably should. Uh feds have never leaked anything before. Right. No, I'm sure. But I guarantee you the law is a little bit and the DOJ is a little bit more enforceable than your NDA. That was my point. Thank you. The updated marketplace listing where the web form now asks for a link to our CPO URL. Yeah, the CPO maintained a blah blah blah blah blah blah. Um, so we are working on marketplace stuff, but like basically just figure out how to make your marketplace data available via JSON file as quick as possible and like that will reduce the burden on us. We're not going to let you keep sending us emails for the next year. I think let's just be reasonable. It is a trivial task for you to figure out how to make information about your marketplace available via JSON. So, like, let's go ahead and do that and everybody will be happy and we'll figure out how to like make that more clear in our rules. Um, okay. So, we're at 148 and we got a lot of stuff on here and I think we got a few more things we want to talk about. So, I'm going to cut off the Q&A for now, but we have something else to talk about, which is uh updates to the community engagement process. Let's like crank this out. So, thanks for all your patience. I know there's a big sack of Q&A built up. There's a few things that we're going to be changing about our community engagement process over the next month. First of all, on September 16th, it's not up on the website yet, but it's going to be up on feder.gov/events over the next couple of days. So, you should be sitting there like mad refreshing that like and ready for it. Um, but this same time on the third Wednesday of the month, we're going to add a assessor community update to our schedule. So, right now we have a rev five and then a 20x and then an assessor community update. The intent there is to focus the conversation on uh assessor stuff. As a part of this, we are going to start getting very strict. We're going to be really mean big governmenties about making sure that anything is on topic. So like discussion about 20x is not going to happen in the rev five stuff, you know, and things like that. So just like be aware that that's going to happen. Um the intent is to then have those three chains of things and everyone can attend any of them there but the assessor one will be focused on updates that assessors really need to know and providing them kind of like pride of place in that discussion. We're also going to change up our Q&A rules and you can see uh today like an example of why it's we think it's important to do that. uh during each community update, we are going to restrict Q&A explicitly to the specific topics discussed in kind of segments within that community update. And we're not just going to answer random questions about whatever. Um and we expect that Q&A to be kind of tightly scoped to a smaller portion of the meeting, but we're going to schedule separate sessions. I know you guys want more meetings with Better Amp. You love meetings with Better Amp. Uh, I don't know if you're like me, you got FOMO if you don't have a Feder podcast to listen to in the morning or something. So, we're going to get you more stuff to listen to on YouTube every day on your commute. So, on Fridays, we're going to open a one-hour meeting that is going to be for Q&A about that thing. So, if it's a fed on Feder Wednesday, first Wednesday of the month, you have a Feder Rev 5 and then a Friday Rev 5 Q&A. Come ask us anything. Uh, same thing 20x 20x assessors assessors. Those are intended to be um recorded like this um and we'll save them for everyone. So don't use it to ask like really private questions and things like that. Um but if you got like cool interesting questions, we want to do that. We are hoping we're going to try this out. We're going to see what happens. But this um it's not as cool as we'd like to have it just be us yelling at you and reading text questions and stuff like that. So, if we have good participation and folks are thoughtful, respectful, uh, and responsive, what we're really hoping to do is to kind of have like five minute windows where people can maybe come off ca on camera and off mute and have a conversation with us about their question and then we can kind of talk through it back and forth. Um, and that I think will give you a better uh, you know, feeling a more precise answer uh, etc. Obviously, that will elim, you know, limit the amount of engagement we can do. And we have to be really respectful as a community, not to just take a whole bunch of time. There's one person that already does that. Any room he's in and just rants and talks forever. We don't need more of those people. Uh [laughter] I don't know what happen if two of us start talking to each other. Gets crazy. Everyone else is like, "We're ready to go home now." Um so I'm really looking forward to that. We're going to try that out. We're gonna see how it works. The plan is for the community Q&As's to start next month. So, um, just really demonstrating like we're doing our best. We're trying to we're trying to do this this communication and things like that. So, pay attention to the Fed Ramp events page and we'll get more on that. Okay, next slide. Fedramp Day. This is the Cloud Service Providers Advisory Board's um, annual summit. There's a link here uh which hopefully somebody put in the chat earlier, but we want to just really emphasize this. Every quarter except for one for the last five or six quarters, we have brought all of agencies together to talk about changes with Fed Ramp. Um we talk about this publicly. Um that's on top of our agency liaison meetings that are monthly. Um but they they're really valuable and they're really important. And one of the things that we've heard constantly from industry was, hey, can you bring some of those people together for us to talk to and so we don't want this to be like a salesy thing or anything like that, but there's a fantastic agenda that has been worked out where uh there will be opportunity on the first day, I think that's September 29th, um that where people will be we'll be talking about industries perspective on a lot of changes in Fed Ramp. And then the next day we'll be talking about um you know all the latest with Fedramp. It's end of the fiscal year. It's going to be the announcement, the official announcement of like transitioning into phase four. It's like gonna be super exciting. Come get all of the latest in person. But more importantly, it's an incredible opportunity to be in a room with 200 people and find out who they are, what they think, what they do, have those conversations, get that perspective. Um, please, if you can come attend, like I think it would be fantastic. You'll have a really great time. All right, let's crank. Last couple minutes. RFC's I know we've talked about the offerings by government RFC in the past community update. This is going to close soon. We haven't had a lot of comments on this, but that's okay. We don't really expect a lot of feedback uh publicly. A lot of our feedback is coming in uh directly. The main thing I'll just clarify at this point because I I think there has been um some some confusion on this is that offerings by government is when the government is the responsible party for the offering. So if um the government pays if like the general services administration pays a contractor to build software in order for GSA to offer that to the rest of the inter agency community such as go.gov gov, which is our really cool travel platform, uh, or USAI, which is our our, uh, fascinating little like AI chatbot thing. Then in those situations, GSA is the AO is the owner, actually like actually owns this, right? They're not just developing a system on it. They've built it. So that's an offering by government. There's about eight of these in the marketplace right now, but the reality is that we know there's about 50 to 80 of them across the entire government and we want to get those into the marketplace in a way that doesn't require people to do a bunch of extra unusual stuff. Next, RSSE. We talked about this before also. We have spent some time finalizing some of what's going to go into that. I'm going to give you some very quick spoilers on what's going to be in this RFC when it comes out. Um, we're going to do a phase four pilot for class D for 20X for SAS. That will be similar to the phase one and phase two pilots. The goal of that will be for some people to go through and by January, February, March receive a class D Fed Ramp 20X pilot authorization. We are expecting to to uh, you know, in the request for comments. All this is subject to change blah blah blah blah blah. Um, in the respect request for comments, we're going to point out that we are expecting to require any participants in that pilot to have a complete full existing FedRAMP class 20X class C that meets all CR26 requirements. So, for folks that are thinking about participating in the class D pilot, if you were expecting to put off meeting the CR26 requirements until your annual assessment, you know, in March of next year, you won't be able to do that. you might want to hurry up um on top of that pilot and then on the 20x side that pilot for SAS is going to focus primarily on increased assurance. One of the examples that we're going to propose is that class D systems will be required to use FedRAMP certified class B, C or D systems in their if they are independent thirdparty information systems. Uh so right now we don't require you to use Feder certified or Feder authorized in the olden days uh thirdparty information systems but for class D we'll say you do have to use it. So if you're not endorsing any product um but if you're a class C and you're using octa sweet no problem you can do that with the right compensating controls in place etc uh with your mass you know and whatnot. But if you're going to go up to class D, you're probably going to have to switch to Octa for Gov because that is an example of a third-party independent service that is very likely or thirdparty information service that is very likely to affect the confidentiality, integrity, availability of your data. Um, next to that, we're going to do something uh we're going to do two things different. So that's going to be the pilot. Then we're going to do this series of like we don't have a cool name for them yet, but let's call them like brodowns where we are going to meet with cloud service providers that are platform as a service or infrastructure as a service customer uh Federam certified folks that have at least 15 uses across government. We're going to give them opportunity to talk with us in a series of two-hour meetings about um kind of underlying PE controls and other sort of things like that that we can really use to optimize uh a different approach. Then our other parallel series of is going to be with assessors. We're super excited about this. We're going to have separate meetings with assessment services with independent assessment services that have independently assessed a certain number of class C and D uh rev 5 services to talk about how that would transition to 20X. So it's going to be really exciting. But the whole point of this is we are really continuing to target by May June of next year it will be very clear what the requirements are for Fed Ramp 20X class D. and we expect those to be included in the consolidated rules for 2027 released at the end of June 2027, which feels like a long ways away, but it's not. Um, last one, super excited about this. I'm excited about all this stuff. This is great. I love bed ramp. Uh, we have a technical advisory group. That technical advisory group, uh, supposed to involve a bunch of experts across agencies. We've really struggled with that over the last year because every time we add someone to the technical advisory group, they go get a job from one of you. Uh, and it's like exhausting, like stop stealing all of our cool people. Um, instead we are going to be working with the federal board and agencies to get more folks like this gentleman next to me here who's named Hank. Hank is a detailed who's spending some time with us um, helping us figure out how to work with agencies and help train agencies and make things better for agencies. And we're looking to open up that pipeline and create an official technical advisory group where folks from agencies can come and actually live with Feder for six months and take this information and everything they learned back to their agencies. So very very cool coming very very soon on that RFC about that. And I think with that we're at the final slide. We're at two o'clock. We are not Oh, we're doing live retirement. That's coming soon. Don't worry about it. It's going to be it's gonna be a month or a week or two later. Um, all right. No more Q&A. We're done with Q&A. I'm so sorry. As always, there's a thousand,000 Actually, there's two things I'm going to say. One, there's a thousand thousand questions. We have this amazing GitHub discussion forum. You can ask questions there at any time and we are super responsive. Two, why does it have to be a bro down? Bro, I use bro in the widest, most extreme and inclusive phrase. Like we can have a we can have whatever type of down you want, but like all my sisters are included in our brodown. 100% guaranteed. All right, everyone. Talk to you soon. Cheers.