Assessor and Advisor Community Update

All right. So, before we start the recording, just going to give you a little bit of background uh just, you know, a little insight into uh what happened here today. Transparency in in our our root cause analysis is that uh the individual that created this meeting as a host uh is on vacation at Busch Gardens [laughter] and the person that that individual made co-host is also on vacation [laughter] and neither of them have their GSA equipment. And we realized about an hour ago that we were not able to uh start this meeting. We worked with our shop. It's still going through the escalation up to the Google admin. So for those of you that found us here on the new URL, I'm so happy to have you and hopefully everyone else can catch up later. So I am going to talk through stuff. As you know, this meeting is recorded uh like all of our meetings to make sure that folks can follow along later. We're going to talk through our agenda. We're going to be I need to move my little Sorry, I can't see this slide. All right, cool. So, we're going to talk a little bit about the change from thirdparty assessment organization to independent assessment services. Why that happens today? Uh we're going to talk about difference in responsibilities between the CSP and the assessor and how that's changing the way that FedRamp is doing things. We're going to talk about some updated workflows and what we're expecting as well as just like the reality sort of brass tax of some of the environments that assessors are going to deal with. Um we're going to talk about how important it is to be familiar with the rules. We're going to emphasize again and again that there are no traps, there are no ghost rules, encourage folks to use the community. And finally, we touch on RFC 33 about especially with the assessor engagement portion. As a reminder, FedRAP is a government program. As much as we try, we work really hard to engage with you much more like industry engages with itself rather than the way the federal government engages uh with people. We are still a government program and we have all the rules and restrictions and capabilities that come along with that. So, we're communicating today on behalf of FedRAP and the General Services Administration. We hold these meetings to enhance transparency between industry and FedEmp so that we can open a dialogue and share new developments. All topics in this meeting are subject to change and nothing that we share constitutes business advice and any reference in this conversation to any specific commercial product or the use of any corporation name is for the information and communities of the public does not constitute endorsement, recommendation or favoring by GSA. So let's talk first of all about the history of names. And I realize that this is there's a lot of uh confusing and complicated things. Um but originally when Fedramp was established, it included this idea of a conformity assessment program run by third-party assessment organizations or 3PAOs. And the main theory in this original approach from 2011 was that basically the 3PAO would be the person, the company, the independent assessor that would determine whether or not something met Fedramp requirements. That created the environment that we uh came into up until 2022 when the Feder authorization act was passed. In the Federal Authorization Act, for whatever reason, Congress decided to use entirely different terminology to refer to this general process. They referred to this as independent assessment services. And they made it clear that FedRamp may use independent assessment services to analyze, validate, and attest to the quality and compliance of security assessment materials that are provided by cloud service providers. So this is different from the old approach which was like determining whether or not uh the system is secure. This is analyzing and validating the materials produced by the cloud service provider. This is what has led to the underlying change in terminology as well as the role of independent assessors. It's very important to understand that we have chosen under the new model that rather than FedRAMP using the independent assessment services directly, we're allowing cloud service providers or requiring cloud service providers to use independent assessment services to review their materials. This is where it gets important. kind of historically the independent assessment was paid for by the cloud service provider but it was kind of done on behalf of the government typically either on behalf of the feder jab or on behalf of the sponsoring agency. So it was was more about producing a deliverable that the sponsoring agency or the jab would consume rather than producing a deliverable that the CSP could consume. That is not the case anymore. the the the purpose is for you to help the cloud service provider. So it's important to understand the cloud service provider and we'll say this again and again and again the cloud service provider is the party that signs a contract with a federal agency. That contract binds the cloud service provider wherein they are fully and entirely responsible for the completeness and accuracy of the materials. If they trick an independent assessor and trick Fed ramp and submit fake materials, that's not your fault. That's not the assessor's fault. That is 100% the cloud service provider's fault. The responsibility of that is entirely up to the cloud service provider. Um, and if the cloud service provider does things that they're not supposed to, especially regarding false claims with United States government, there will be penalties for those people. So, it's really important that you understand that one of the biggest differences in the old process from the new process is that we need the cloud service provider to be supplying all of the materials because they own that responsibility. That is legally the way that it works. And honestly, it kind of has always worked that way and we just done some weird stuff. Um, but the third-party assessment organization or now independent assessment service has obviously never been responsible for determining if a cloud service is trying to trick the government. If a cloud service is trying to trick the government, they're the bad people, not the independent assessor. So under the new concept of how this operate in the future, yes, Google, AWS, Microsoft, GCC high are accountable. Like I don't understand why there would be a question there. If Google lies to the government about the security they have in place, then the people at Google that sign that paperwork are very likely to go to jail and Google will be likely to be fined. Um so when it comes to responsibilities of the assessor the primary role is to verify and validate the cloud service writers materials and feder practices in order to support the provider. That is a partnership that is you are you are helping the provider know that it's doing things right. The secondary role is to help that provider ensure that their materials are of appropriate quality and are complete. So the value that the provider gets out of an independent assessment under modern fenerap approach is that they get confidence that their materials and their approach and their security is actually working the way that they think it's working. It's not just to pass an audit in order to get a check and move forward through to the government. It's really important to remind everyone again and again that that assurance the cloud service provider is paying the independent assessment service for that assurance. That assurance is then supplied to the cloud service provider. The cloud service provider can then work to make changes as needed uh to their offering, redo things, you know, build up improvements um or disagree with the uh you know stuff that the independent assessor said. But it is entirely up to the cloud service provider to decide whether or not they meet the rules etc. Then Fedramp will rely on that uh assurance as we make our decisions as will other customers. But again we're doing that from the perspective of knowing that the cloud service provider invested in that double check. We have heard repeatedly that this is a huge value ad to cloud services. The fact of the matter is that sometimes people make mistakes. Some examples we've seen have been things like assessors realizing that entire uh you know swaths of certain cloud services were not properly clicked on in an automated tool and things like that. That is like that's not like an audit like we found it. Oh, you're a bad person. You got to ding on your audit. That's like hey we found this thing. Is that supposed to be in there? Cloud ser in there. Oh our bad. We're going to click the button. We turn it on. is like, "Yep, okay, cool. It's showing up now. You're good." So, that is the goal is to make sure that when that material comes to us, we're not wasting the federal government is not wasting its time, effort, money, and resources, taxpayer funded time, money, effort, and resources to doublech checkck a whole bunch of stuff with a cloud service provider and walk them through things that um really they should have done ahead of time. That said, things are a little rough right now. I'm going to acknowledge that we're in the process where we're in the tail end of agency certification. Agency certification is going away. There will be no more agency certifications after June of 2027. However, the reality is that that agency sponsorship process has existed. It does exist. Um, and many of you have many of your providers have contracts with agencies that they signed two years ago for this process. Some of you signed those contracts, etc. Um, so as that moves forward, I want to be very clear about something that is really confusing to a lot of folks, which is that in order to get an agency certification from FedRAMP, you first have to have an agency authorization to operate. That agency authorization to operate process follows the AY's rules. In most cases, those rules have historically aligned partially in whole or in part, typically in part to FedRamp's legacy rules. The reality is that that continues to be the case. However, if you that cloud service provider wants to then come to Fedramp, they have to meet Fedramp's modern rules. So, you're going to have situations as assessors over the next six months. I mean, especially from January to June, if you're doing like, you know, just like end of life, like trying to rush something over the finish line, you're going to have situations where you're going to be creating materials for the agency that is going to be different with a different expectation than the materials that you're going to create for Fedramp. Because the honest reality is that the agency is expecting to leverage your work to make the decision directly. That is very different when then comes to FedRAMP your work is just part of the package that we consider. So at a top level kind of comparing agency certification versus program certification on the agency side the assessor is expected to follow the agency REFI process. There's a bunch of legacy materials at feder.gov/leacy. You're probably going to keep using those. You're probably going to be doing things like filling out a complete security assessment report and providing recommendations because that's what the agency has expected. That's what the cloud service provider has told the agency they would do because they signed that agreement under previous rules. And hopefully your contract with that cloud service provider entails that uh to do this. So, if you run into a situation where your contract, you know, says that you're only going to follow the latest stuff, then there's a little bit of a problem there. Once you complete that security assessment report, submit all of that stuff to the agency and get that agency atto, then that cloud service provider is going to have to turn around and meet Fedramp rules for their submission for a Fedramp certification. So, let's say it's February of 2027. A number of the CR26 rules have kicked in. Even if you didn't implement those for the agency because the agency didn't care about them, that cloud service fighter is going to have their FedRA app certification rejected until they have implemented those policies, procedures, practices. So your job then flips and now you're going from doing a traditional security assessment to doing a delta IV against this. It is going to be complicated and difficult. On the other hand, program certification is designed very explicitly. You work with cloud service provider against bed ramp rules and you support them against bed ramp rules and agencies aren't a part of that relationship at all. That's the future and that's why program certification is so important. I'm going to take a quick break here to see if there's Q&A. There's no Q&A showing up, but I'm seeing comments in the chat. Um I universities educating students on this is is like yeah, it's definitely I think people are going to have to self-educate and we have a little bit of of stuff about that in a second. Um but like yeah it's hard. All right. So general guidance for for planning and updating stuff. And so this actually is addressing that that question there which is like as a reminder independent assessment services are required to have training materials on their internal processes and those materials uh I believe get reviewed by A2LA every once in a while. Um, it is very important that you begin, if you are an independent assessment service or an advisory service, you need to begin updating your internal training services, business development, all that stuff to focus on Feder 20X. I want to just be very clear, you got a long road, uh, a long runway. June is nine months away, but if in nine months from now you have not transitioned to be able to support 20x, you will not be allowed to maintain Fed app recognition because 20X will be the only path to doing assessments. So it's really important that you start thinking about this now. Same thing as advisory services like Rev 5 is going away. You should not be planning to do any new engagements on Rev Five at all. If you're if you're thinking about new engagements on Rev Five right now, that is incredibly high risk. And while I can't provide you business advice, I will say that like that is strongly strongly dangerous and you are likely to end up in a situation where that will be regretted. So, okay, coming through. We're switching switching topics and switching gears here a lot throughout this because I had a lot of content that I wanted to kind of come through. Uh some of this I might I would expect folks will probably like want to review later, want to talk through, etc. Um but like that's why we got hodge podge. We'll be a little more intentional with what we the topics we talk about in these meetings moving forward. One of the things that I wanted to share with folks was that we're getting a lot of incoming from uh from people that shows like not necessarily really diving in and taking this stuff seriously. So, some general tips for assessors and adviserss and I cannot I'm going to emphasize this over and over and over again. You need to read all of the narratives in the consolidated rules and pay attention to the Fed ramp definitions. People are just ignoring the Feder definitions and those definitions are rules. Those are Feder practices that are encoded to help you understand things. I am still daily getting questions about vulnerabilities related to vulnerability scanning. And like by now if you don't understand that vulnerabilities include things like weaknesses, your controls and KSIs, you are not paying attention to the definition. It's like the scope of things are different. Where possible, we tried to use different words and define different words that wouldn't come with a lot of baggage, but you need to understand those definitions. I think genuinely I would recommend that people have those definitions open and like read through them randomly. We need to create some AI uh trivia quizzes on these. Like the definitions matter. Um, second of all is the rules themselves. And I'm going to take a step back to just you know I had an interaction early on in the kooi discord when uh we released the rules and someone that said you know I've been working on feder for like 10 years and I looked at this and I can't make any sense of it and I don't understand and I responded some of these effect of like it doesn't matter that you've been working on federant for 10 years because this is all new and you need to approach it differently and that did not land Well, that individual told me that did not land well, but that is the reality. This is a new program with new rules. Yes. SL2026/definitions is a sole source for definitions. Um, you cannot just take what you used to do and what you used to know and apply that forward. We have changed a lot of the expectations around Fedramp and we will continue to change that. It is very important that you invest in understanding that. Finally, we'll say this again and again and again. If you were at last week's community update, if you missed it, you can check it out on YouTube. Um, our uh uh guests that was one of the pro tips that they shared repeatedly. It's one of the things that we have designed the rules to do is to allow you to use AI and Aentic AI to explore and understand the rules. This is so powerful. I cannot tell you how powerful the capabilities here are. And if you're not using them, you're making a mistake. If you think that we're back in the days when you had to worry about everything being hallucinated, like you can control that and you can easily double check and make evidence-based things. But if you want to do things, you can do things like have an AI agent read some rules, read the definitions to the terms in there, rewrite the rule as a three paragraph narrative explanation that incorporates the definitions and make more sense of it. Like this is how it's been designed. Like I I I recently just uh just to share like a little story about this. Um, I yesterday started sicking my uh local codeex instance on my my personal on the NIST SP847 and I basically had it develop a 30 minute podcast that walked through specific aspects of that and their relationship to other things. And like it cranked for like five hours and out came a pretty decent like Darknet Diaries style podcast that talked about a lot of stuff and it enabled me to then go back to that document later that night and be like, "Oh yeah, I want to look at section G and see what it says and I want to like do this." Like we're in this era where coming to Fed Ramp and asking us to clarify things is not your only route and memorizing every single rule out there is not your only route. There are other options. Use AI. Figure this out. This is going to be your partner. Use AI to create training materials. Use AI to update your processes. Like, this is what we're here for. Don't just rely on it. [laughter] Don't just like let it do your job for you. You've got a human brain that's solid and a lot of experience, but use it to help you understand the deltas and the differences, and it will do that. We're going to keep working on this as well. So, I expect that um as we start adding facts to help.fetamp.gov and um other places, we're going to start integrating that. I just updated the agents. MD in the 2026 GitHub repository to also let agents know that they should go look at the discussion forums for the community and 2026 to get additional information. So, like there is good stuff here. I'm going to hold on some of these questions uh until the end because we've got some uh it looks like a lot of them are off topic once I'm seeing the Q&A. >> Wait, you're gonna >> I would just recommend people if they are going to ask use the QA feature and not chat. >> Yeah. Yeah, definitely. So, normally we have the chat kind of disabled, but because we did this last second, we didn't do that. So, like definitely put questions into the Q&A. That will make life easier for me. Um I want to take a second to talk about ghost rules. Um, and this is like a little bit of a of a a joke. I I know that FedRAP itself participated a little bit in the ghost rule situation. Um, the idea here was basically as you would work with a provider through the federant process. You would get feedback from the federal PMO that was not in writing that was kind of like this is this is what we want. Then you would go through again and maybe get a different thing. No, no, no. That's not what we want. This is what we want. Then advisers and assessors would then take that experience and responsibly trying to help their customers pass would basically start creating these this urban legend of all of these ghost rules that are like, "No, no, here's how you have to do it. It has to be like this. If you don't put these word magic words in it, you're not going to pass." And I think that that was from all the stories I've heard, a lot of that was actually necessary and right. And it's terrible that that um happened. I think it was one of my very first conversations with CSPA AB like a couple months after I started, somebody asked me like, "What are you going to do about ghost rules?" And I was like, "What are you talking about? I've never heard this phrase before in compliance." And and that was when I uh learned about this whole stuff. And we have set out ever since then to just entirely eliminate that. And and that is what is the case right now. If you submit something to my team and we have an issue with what it does or says, we will h make sure that that issue is based entirely on a rule. Now, there are still are very occasional situations where we might be like, "Come on, bro." Like, we all know that's not what it was intended to do, but like, okay. and like we'll work through that. But generally stop with the ghost rules. And this is like not just about ghost rules. It is about the way things are written are not designed to trick you. If it says like paint your walls blue, that means paint your walls blue. But like there's like don't be like does cayenne count as a as a blue to meet this rule. Like is it blue? Will a reasonable person say that it's blue? Yes, it's blue. Let's all move on with our with our life. Um, and so like the number one thing we want to tell people again and again, it's like it's not a trap. It's absolutely not a trap. Like these submissions, these rules, they are not written to trick people. At any point in time, I will promise and guarantee you if you bring something to us that is a good faith attempt to meet a rule. You might get feedback that we don't like the way that you're going to do it, but we are not going to kick you out of the process. You will have a vulnerability that you will take and you will deal with and you will move forward. On the other hand, if you don't pay attention to the rules, you will have a will reject you and like we'll tell you exactly what's going on. So, let's please, please, please do that. But remember, it's not a trap. Um, and a lot of the reason why I'm saying this is because we're getting an excessive number of emails from assessors and advisory services that are asking very basic questions um about the rules that are answered in the rules. You know, do I have to do this? There are questions in this Q&A right now that are literally answered in the rules that that you should ju you can just answer those by looking at the rules. You don't need to ask us. Um and it's the same thing for traps. Like we get a lot of questions that basically I read this rule as saying X is this a trap and we pretty much always answered no that's correct. You have properly read that rule. It is not a trap. So like we're not trying to trap anybody. just we gotta all work together to undo that psychological shared trauma that we have. Uh the the expectation that FedRap is going to try to get you in a trap. We're not trying to gotcha anymore. So another thing is just like please leverage the consolidated rules for 2026 as well as discussions in the federal app community before requesting clarification from bed. We're very generous. I think I would imagine that it is very difficult to find a government program that is as responsive directly to public stakeholders as we are. I, you know, I I see I see a lot of talk about things like CMMC and like that where it's like we're just we just want an answer to this basic question for like months and months and months and nobody knows who can get it like where Feder we do our best to just be out there and available. Um, but we're a small program with limited staffing and resources. Our job is not to be your advisor. Uh, there are adviserss and assessors on this call. you are making money. You need to factor in to that business plan the process of learning how these rules work and interact and generally should try to avoid asking us for things instead of trying to find an answer yourself. when you do have a question that you're really and we get some of these in the community and it's really fantastic um where there's like a a confusion in a rule that's like written badly and like you know it doesn't make sense or a contradiction or something like that. We want you to do that in public in the GitHub community. The reason for that is that it helps everyone. Every email that we send to one person is just answering something for one person. We really want you to ask in public. So please, please, please do your own research and ask in public before you reach out to info at unless it is like sensitive. If it's sensitive, reach out to info at like this is real. Like our our GitHub community is real. Like we had over 340 people, over,00 interactions. One of the things that I just started doing and I'm going to do from here on out is I'm going to permanently enshrine specific acknowledgements to individuals that point out like really serious problems or make strong suggestions that we increment or implement so that everyone can understand like this is helping. Um, you know, there's a there's a comment here in chat from someone saying like just put it in a fact. The um like that sounds so easy. Have you ever tried to maintain a fact from 500 questions a day? It is incredibly difficult and complex. It is not that easy. We actually have less access to AI capabilities in our professional work than most of you do. It is much easier for you to use an agent or me in my personal life to use an agent to review all of the discussions and public comments and create updates and stuff from that than it is for us to manually go and create facts. So, it's not that easy. Although, we 100% are working on that at help.fed.gov. Um, anyway, so change log acknowledgements. Come be part of the team. Get an acknowledgement forever on fedramp.gov. Let's start keeping score. um and see who's a winner. Uh on top of that, I want to shout out some of our top community participants. Like I know who some of these people are. You might recognize some of these names. I see at least one username on this list that I saw pop up on camera a few minutes ago on this call. So like I know that we have a tight community that is rocking and rolling. Um like thank you for participating in this and like being a part of our community. These are the folks that all have been on like, you know, 20 plus comments here and there, like really rocking it out, helping us all understand things together. Um, I want this list to grow and be bigger. On the other hand, some of these people, we don't know who they are, and like I'm pretty sure that's probably by design because they don't want their questions to be associated with their company or their professional life. And that's okay, too. We encourage that. Also, why not both have a professional GitHub account and have a troll GitHub account? I don't know. I just want to be clear. Wise cryptic is not a troll. He's a very wise cryptic and I really appreciate his comments, but I have or her. I have no idea who that person is and I don't know. It could be an AI bot. I hope not. Seems too smart for that. Um, so like I'm just going to emphasize this again. Let's hang in the community, man. like it just as like a a little like if you're if you're not paying attention to what's going on there, what are you doing in the Fed ramp game as an adviser or an assessor? You you should be paying attention to that. I personally post more than anyone on those like responses and interactions. I'm more likely to respond to a public GitHub question than I am to respond to an email to me at this point. Um and I prioritize that. So like that I think should show you how important this community is to us that you are getting the director of Fedramp out here interacting. You're not always going to get that via other forums because it's a it's not it's harder to justify the time for me to interact with one company and one individual and risk that creating an unfair advantage for that company or that individual versus for me to post in public where I know everyone can see the answer and take advantage of it. So that's why we want to drive this. One last thing before we get to Q&A and all this stuff, I am once again asking you to comment on an RFC. Uh if you missed it, the phase 4 development tracks for 20X class D are out in an RFC. There is a section related to direct engagement for independent assessment services. you are obviously more than welcome and heavily encouraged to comment on the entire thing. Um, but we have specified the parameters for some direct engagement with assessors and we want to make sure that that's dialed in and fair. Um, our direct engagement tracks are designed to uh, frankly limit the number of companies that we have to engage with because engaging with companies is very complex and difficult. And we'd certainly if I had to engage one-on-one with 50 companies for two hours a day, we might have phase four done in three years from now. Um, so instead we're trying to like really uh, crank that down a bit. Uh, the big difference for assessors versus cloud service providers is that we're hoping to meet with multiple assessors at the same time because we think there's less sort of like we think that uh cloud service providers are are likely to not have complete cander if they're discussing sensitive kind of like strategic planning stuff in the same room with other cloud service providers. Whereas I believe that independent assessment services generally like you're all happy to kind of share your vibes on the assessment process and and issues with that. But if I'm wrong, please comment on the RFC and if I'm right, please reinforce that and then I will have to sort out the differing opinions there. I will also just as always, please comment early. The earlier you comment on these, the easier it is for us to integrate, manage, and think about it. The best encouragement I can give you is that if you comment now, it'll be noodling in the back of my head for the next three weeks, whereas if you comment two and a half weeks from now, it will be noodling in the back of my head for only a few days with a bunch of other people. Um, and a shout out to Colton uh CBaxton for giving some early RFC feedback that is already is like bouncing around in my head. So, heck yes. All right, that concludes our presentation for the day. Now, let me figure out how to stop sharing and we can go and hit some Q&A and stuff like that. All right. Okay. So, as a reminder, what we're hoping to do in the future, uh, starting next month, is to kind of separate out very specific tracks of information in the community updates followed by, uh, Q&A in a separate Q&A thing. Um, one of the things that we want to do in that separate Q&A is allow people to come off uh, mute and actually have conversations with us. We're going to see how that works. But for now, we're just going to go through and and work on the Q&A here in the chat. So, I'm going to sort this by oldest first. I'm going to go oldest to newest. Um, I'm going to start with the first question is for 853 controls, do assessors need to consider each individual assessment objective when performing IVNV? Um what you need to IVNV is what the cloud service provider says they are doing to meet the control. If the cloud service provider is like I don't care about these like particular aspects of things then it's not relevant to an assessment objective you don't have to perform IBNB on it. Remember, we're we're using some of the same terminology by saying assessors, but the assessor role is now the independent assessor role is now a subset of the historical assessor role. You're not having to like go through and go one by one against everything that's supposed to be there. You're helping go against everything that is there and then telling them if there are gaps. Hopefully that kind of um answers that. And if you want to discuss that more, crank that on the discussion forums. Um next question is uh oh, these have checks next to them, which means somebody's marked them as answered. So I'm just going to let them. Does the CSB need to determine that their approach to internal verification validation as a prerequisite for independent verification and validation to occur? Yeah, totally 100%. Right? because like the independent verification and validation should be verifying and validating the CSP's verification and validation, right? So if the CSP is like, I'm using this automated sensor to figure out whether or not my door is open or closed, then you need to verify that and validate that that's working and that that meets the needs as well and that their monitoring of that is working. Not just that it's there, but that everything that they're going to do to to do metrics and data and all that is all proper and accurate. Next question. So if my or supports a Fed ramp team with KSIS and all that as a conmon team, we can now become the IIA team for them and to do their assessment. This is a complicated question. Um, and one of the reasons why this is a really complicated question is that when people talk about a Feder team, I think it means my team. And it's like I'm always like, so let me like wrap my head. I think it means like a a team at a cloud service provider. Um, I it depends on support, right? So the important thing is that we still have the underlying um separation built into the A2LA requirements which is that if you are actually advising them on how to do a thing, you cannot assess them on that thing. But what we wanted to do was break down the the barriers of that in that during the assessment process you are allowed to talk to each other about gaps, problems, issues and things like that. So you cannot hire the same team to be both an adviser and an assessor. But you can ask your assessor for advice during an assessment that would make the thing better, that would make things more secure, etc. and the assessor can kind of share the main thing that we're looking to eliminate here. And this is why it's really complicated. We need to work with A2A and figure this out. We need to eliminate the idea of the assessor saying if you do X, I will pass you. And so we've partially eliminated that by the assessor doesn't pass things or not. But in general, we don't ever want that. We want the assessor to be saying, hey, um, I think there's I have some concerns about the way this is done in cloud service provider to have that conversation. decisions why go back and forth and figure things out. And maybe it turns out the assessor's concerns are valid and should be implemented by the CSP. Maybe it cons turns out the other way. What we don't want is for the assessor to just drop a report at the end of the day. It's like here's all the things we found wrong. And everyone call service to be like, "Oh man, we didn't know about any of this. Now we like got to go back and redo it." Like your job as the assessor isn't done until you've both agreed that the system is solid and ready to go or the cloud service provider has decided they don't want to take your advice anymore. All right. Um, Andrew says, "So, if it's not written down and we got an email from the PMO stating that they met this when asked about something, when is it when it's not on the website? Do we ignore the PMO?" Um, yeah. I mean, that sounds right. Like, sure, unless it's like in a public thing on.gov, feel free to always send that stuff to me, but you're probably not going to get too much of that. Um, and you might get a situation where we're saying, "Hey, this rule like it's best to interpret like this." But realistically, I don't think you're going to get too many of things where you're going to be like, "Wow, I did not think that that is what you said, and you're telling me to do something that's not there." Ghost rules are usually not we we said this, but meant this. Ghost rules are usually we haven't told anyone that we think this way, and we're just randomly pulling this out because it's my personal opinion as a reviewer. That's what we really want to eliminate. Um, also you're free to fight with us and you should fight with us and escalate that. If you're like, "No, that's not what it says." All right, cool. Let's let's go. I'll adjudicate that all the time. Next question. If we are separating the Fed ramp from the agency process, what is the incentive to go through Fed Ramp? I would just go through agency atto and call it done. What am I missing? Fantastic question. There's a few things in there that you're missing. one. Congratulations. You just got an agency atto. You want to go through that with every single agency. Have fun. You're always going to have to go through some level of that with every agency. That's law. What FedER does is it creates a standardized process that makes it streamlined and easy to go through that agency atto process. It's a repeatable approach. We're spending a lot of time over the next six months developing new processes and procedures to help agencies go through that. The fact of the matter is that if you have a Fener app certification, you'll be better positioned to get an agency atto. But I want to be very clear because this is like one of the biggest most frustrating things for me. You have always been required to have an agency atto. There have been situations where some agencies didn't follow their their ATO process and did crazy stuff and they all got investigated by the IG or GAO and they got yelled at and it continues to happen. Fedramp does not do ATO's. That's why it's called Fenamp certification. Take a breath here. How's everybody doing? So, it' be a lot easier if some of you were if like, man, what if like 40 people were on camera and I could just instead of interacting with like a bunch of thumbs up flying through the air, [laughter] friends, nice to see you. There are people behind all of this. I do love the uh the emojis. They But like Yeah. Um, this will be so much fun when we can actually like have have a conversation. Uh, so I'm really hoping that with the new Q&A thing, we can actually sort of like stub out a five minute discussion back and forth with people, right? And have like a real conversation. That should be really fun. Okay, I'm going to keep cranking through some of these questions. Really appreciate uh, you know, folks being patient with us. If a SAS CSP wants to move to class D but anticipates it being after June 19, 2027, what options would that CSP have? Is there going to be a path forward from there? Yes, 100%. Federact 20X class D will be available to you and that is what you will need to do. So you if you are starting to plan 9 to 12 months from now to get a class D certification, you should be paying real close attention to um the Fed ramp 20X pilot. And honestly, you should just go get yourself a 20X class C as soon as you can. That's the best option for you. There is a rule that we have that I think a lot of people have misinterpreted. It's uh I can't remember the actual ID. I feel like a loser. uh I can't flex my like feder knowledge um but it's called like pick one and the idea of that rule is that you can only get a program certification in rev five or 20x and that's because for us at the program to invest resources in doing the same thing twice makes no sense but if you currently have a rev five class C or a rev five class D you can get a 20x class C from the program and we'll do that and then you can have your rev five class D and your 20X class C and you'll be really well positioned to upgrade to that 20X class D. If you've looked at the RFC, one of our expected requirements is that we're going to tell people that you have to have a 20X class C before you can ask for a class D. We don't want anyone going straight to class D. First of all, that's terrible. It's just nobody should come off the street not having a feder certification and try to go straight to class D. If anybody ever gives you advice to do that, they're a bad adviser. If you give people advice to that, you're a bad adviser. It is so complex to go straight to class D. But when you go to class C under 20X and then look to go to class D, you only have to do the deltas. And so it's a lot more reasonable to get class C first, understand what's involved, and then progress up to class D. So if you want class D next year, start working on better app 20X. Um anonymous asked there's not a third party penetration testing required from a 3PO. Will personnel requirements from A2A will change? Is there anything to adjust on that side? We're working with A2A over the next couple of months to kind of update some of their requirements and things like this. I want to point out something here. Just because we don't require something doesn't mean it's not a really good idea, right? So the vulnerability detection and response expects you to do things like penetration testing. We don't necessarily care if you're doing pen a big coordinated fancy penetration test once a year, if you're doing little penetration tests continuously, you're doing some mix of those. But if you are doing a big formal fancy penetration test that will make you look better, right? Like you can share those results. It is easier for us to say, "Wow, this company is taking security seriously. They are doing these big penetration tests and they're doing automated regular penetration tests and they're doing red team and they have a vulnerability disclosure policy. I think I feel assured that my data will be safer with those people. Not every cloud service provider needs to have a big organized 3PO related penetration test. But if you want to show that you're serious about security, you should get one. So, um it doesn't necessarily have to be from a 3PO, but if you got those people, help people out. Okay. We have customers that have agencies telling them not to get a Feder certification and instead the agency is giving them an atto. Have you ever heard of an agency levering leveraging an ISO certification to give an ATO? Is it no longer part of the law to require agencies to use FedRAP certified cloud products? There's a lot of mixed up things in here. So, the agency is always going to give someone an ATO. So, it's not you get a FedEmp certification or an ATO. Feder certification is supposed to help you get an ATO. Agencies can do whatever they want. Now, there's an OM memorandum I love those. So, agencies can can can do whatever they want. Um, there's an OM memorandum M2415 that has a line in it that says agencies must obtain and maintain FedRAP certification for the cloud services that they use. If you spent any time with the federal government, you probably know that um agencies are going to make their own decisions. Our goal with FedRAP is to make agencies that want to work with cloud service providers that invest in that have a much better experience. If an agency decides that they want they have a real need for something that there's no value in a feder certification, they should do that. They should go do that. Also, there's plenty of cloud services that don't have a lot of um governmentwide use cases. And in that situation, it doesn't make a lot of sense for something to get a Feder certification, right? like if you if you I don't know like some cloud service that specializes in controlling CNC machines, there's probably not a lot of agencies that need that capability. So why would you get a fender app certification? On the other hand, if you're something that expects to deploy and be used across 10 15 different agencies, then that's when a fender app certification is the right way to go. And I was just I'm just gonna add like if every single cloud service used by every single agency like had to go through Federap and be managed with a feder certification, our program would be a lot better than it is like like we're here to provide that translation for the people that want to take advantage of it. And the honest thing that you know this is something that I understand that the dreams from industry is that you get a feder certification and magically three days later you can be deployed at 80 different agencies and in widescale use. That's never been the way that things have been. it will never be the way that things are and there are really you should have real serious security concerns about what that would look like for the federal government if that was how things happened. Um, but the kind of really interesting thing is that if there's five agencies or six agencies that half the time really rely on and leverage the capabilities they get from Fed Ramp and FedRAP certified cloud service providers, then that's already an investment that has repaid itself that the federal government has repaid many, many times over. The federal government invests $10 million a year in Fed Ramp. So, it's really easy for us to provide more than $10 million a year in value to industry. I think generally we provide more on the $500 million a year in value to industry and like no, we don't provide $20 billion a year, but like we're doing what we can with what we got with who we are. Um, all right. I'm going to keep going through it. Uh, a lot of the KSI speak to rules around users and non-users. I don't see a definition for users and non-users. Can I confirm if it states users, it means humans and non-users equate to NHIS accounts? This would be better for a public discussion where we can chime through some stuff. Um, when those were written, generally we did mean when we say users, we we intended human users or something emulating a human user. Um, so a service account is very different from an AI agent that is logging in as a path that was designed for humans, right? Uh, so if you have agents, they can sometimes be users. They can sometimes be service accounts. They can do all sorts of stuff. It depends on how you configure them. Uh but generally users is like a path that is designed for interactive human things whereas non-users is a path that is designed to not be uh you know human style interaction. Uh can we get an RSS feed for most GitHub participation? You should. So like you can use GitHub alerts for that. Um go do that. I've got a uh a channel that and I and I get emails every time anyone posts anything on any of our uh GitHub stuff. We get a post in a chat channel and I get an email about it. So that's part of why I'm so responsive to that because if I'm like running between a meeting or something like that, I see that pop up. I'm like, "Oo, unread chat. Oh, what does what does CVXon say on this RSC today?" Sorry. RSS feed would have to be something provided by GitHub, though. Um, all right. I got this. We can do a few more of these. Thanks for sticking around. Thanks for staying on camera. [laughter] This is like so great to see you. Um, what is the assessor's role for transformative changes? Do impacted controls based on significant change need to be scoped into the next annual assessment. The assessor's role for transformative changes depends on the cloud service provider's environment and the specific individual change. And it is up to the cloud service provider to determine that. So here's why we say that you might the cloud service provider might I'm actually just going to repeat an example that I gave in a community discussion post about this exact topic I think a day or two ago. So get on the discussion forums. Um basically let's say provider has two data centers and they have an automated control plane for their environmental controls that just like says everything that's going on in their data center. It ensures that everything is in place. If they add a third data center, that's definitely a transformative change. But if they activate that same automated environmental control plane in that third data center, that environmental control plane has already been assessed, then you don't need to reassess does it work all of that way in the new data center. That cloud service provider might decide. We should have the assessor at least double check that it is enabled. Right? And like that's okay, but that's kind of optional. But then once you come down to your um your annual assessment, which now we call your Feder independent assessment, um at that point, the reason why we started calling it Feder independent assessment instead of annual assessment is because it's not always going to be annual. So we want to start getting people thinking about your Fed independent assessment. Um you kind of have to scope how much of that you want to pick at. Now you got three data centers with a bunch of environmental controls. Do we want to focus on the new data center and make sure that that's all included or do we want to just do a sample? How confident are we that looking at one data center is represented the sample etc. So it's it's nuanced. Every single transformative change is going to be nuanced and that decision should be made by the engineering team and the product team as part of that process not by a compliance team or a compliance rule. Um, next question. EFA is a should telling providers to weigh criticality. EPA is the must that assigns the ratings. The ratings definitions give no give criticality no way to change the number. Um, so what is weighing CR? I think there's a specific rule being discussed here. I'm not 100% sure. It's kind of unclear. Let's do this one in discussion forums. Um, I will just point out that sometimes we have a should about weighing critic crit. We say you should determine how important this is and then you must do something based on how important it is. If that happens, there's usually a rule that says if you don't determine how important it is, then it's really damn important by default and you have to treat it that way. I'm guessing that's what's going on here. Um I don't understand what this means. This sounds like an AI. Is the absence of a duration bound on debilitating intentional? And how should Oh, this is related to Okay. Should a provider rate an interruption that exceeds the disrupted? Yeah, let's talk about this one in the discussion forums that's like more complicated than I'm just going to walk through because some of that's a little nuanced. Um, as an assessor, if we determine that a KSI has been implemented as documented and meets the stated requirements, but we find the implementation provides little or no meaningful security value, do we have the authority to determine that the KSI is not effectively implemented? So, the first part of this question is lovely. The second part is where you you don't determine whether or not it's effectively implemented. You provide your uh feedback on your assessment and your assessment might say like I don't think this is effectively implemented. But like that's okay. That's 100% fine. You then hopefully will work that out with the cloud service provider. But if they disagree with you, they'll disagree with you and then Feder will make the decision on whether or not that matters. Um, but like you're not the one that decides >> Oh, we're letting people come off mute in this meeting after all. Um, and I I can't >> Yeah. Oh, there. >> Huh. Well, hopefully somebody can put Joseph on mute. Um, we're almost done here. Um, this is a good one because it was something we just talked about. I'm confused by one of the answers. Pete, did you just say a current Rev Five class D should maintain their rev 5 class D but also achieve a 20X class C in prep for 20X class D? Doesn't that contradict choose one path? Um I think EMU put that in there and like the pick one path is for program certification. If you have a REF 5 class D right now, it is from an agency certification. So you can still get one program certification for 20X class C. You know, that actually reminds me um this didn't come up in the Q&A, but it's something I want to address with everyone while we have in the last couple minutes here because it's really important. I've been hearing a lot of people getting this wrong and I'm really bummed about it and it's important for both adviserss and assessors. One of the rules, and again, my apologies. Maybe you can can dig this up. Uh one of the rules says that depending on different class targets you must supply a certain amount a certain duration of metrics for your your KSIs and your practices. That rule like for example I think for class C it's six months. It is not intended that you have that in advance of applying for a certification. is intended that you demonstrate that you are able to collect and like your system is designed to have that. So if you build a cloud service on September 1st, put everything in place that you need to get a Feder class C certification including all of the metrics and data and you apply for it today. Even though you only have maybe one week of metrics, you can still receive your FedRAP certification. You just have to explain how you're going to keep that stuff for six months, etc. And then once six months goes by, we want to be able to look at that at any point in time and verify that you have that. Um, so I have heard a few folks like saying you have to wait. This is not intended to do that. You will just have to demonstrate that you understand and have the capability to maintain those metrics over time. And in order to maintain your certification, that will be something you'll have to demonstrate in ongoing certification that you have that at any point in time. Um, all right. So, as we close in at 2 o'clock, this was super fun. Uh, there's a lot of Q&A I didn't get to. I'm just going to remind everyone once again, get over to the discussion forums and let's like do this in GitHub. It would be super super lovely. Um, I have really appreciated some of you uh coming off of camera for a little bit of real person interaction. Last thing I'm going to say is we have the CSPAB summit at the end of September, September 29th and September 30th. If you're not signed up for it, get signed up. I heard a rumor they might have capped it. Um, but like let's go do that and we'll see you there. I'm gonna have like my whole Fed ramp team there. I think almost at least all of the feds and I think we've got like six or seven people on the team that are be talking on panels and stuff like that. We are we are rolling deep and I'm very excited to do that. Um I don't have the link but I'm just going to say it is uh well let's I think it's summit.cspab.com. If it's not you're going to have to Google it and figure it out. All right everyone. Yeah, it's already capp success. Well, if you're an agency person, I heard a rumor you might be able to get past the cap. But all right, we'll see you soon. Thanks for coming by. 123 people there at the end. Man, I pe 140. So like >> 170 >> 170. So it worked. The last minute link worked. Really appreciate everyone's patience with that. Take care all.