FedRAMP 20x Community Update

kick it off, guys. >> Cool. >> So, everyone, welcome to the July edition of the FedRAM 20X community updates. Today's meeting is being recorded for the public record, and we'll place a link to today's video on the Fed Ramp YouTube page after the meeting. Usually, this takes about one or two business days, uh, depending on the file size. So, during the meeting, you can use the Q&A feature in Google Meet to ask questions. Uh, if this is your first time using this feature, simply click on the waffle icon. uh to find the Q&A option in the tools menu. And as a reminder, you can type your questions at any time during the session. So, as you can see for today's agenda, we have a lot to cover. Uh the main topics include pilot updates, uh CR26, class A submissions, machine readable files, and lastly, an agency update. And and Nicole has a a special update, too. in the in the in between all of this and the closer will answer the questions you posted in Q&A. Uh but before we get started, this is an open forum and our legal teams provide a script that I'm required to read verbatim. I'm communicating today in my official capacity on behalf of Fed Ramp and the General Services Administration. We hold these meetings to enhance transparency between industry and Fed Ramp so that we can have an open dialogue and share new developments. Nothing that we share constitutes business advice. Um and any reference in this conversation to any specific commercial product for the use of any corporation name is for the information and convenience of the public. This does not constitute endorsement, recommend recommendation or favoring by the GSA. So, now with the legal stuff out of the way, Nicole. >> Oh, yes. Um, late breaking news. The, um, 2026 Q4 quarterly security inbox test is live as of yesterday afternoon. Um, so that should be in your inboxes. If you have not received it, uh, reach out to us. um maybe check your spam first or your um group settings, group email settings because um we have gotten a few bouncebacks that we'll be reaching out um to people to help solve. But um the responses are due by next Tuesday at 5:00 p.m. So that should give everybody plenty of time to respond back to um the security inbox test. Very basic. Um it is just confirming that you are aware of the vulnerability um rules that went into effect a little bit earlier than expected. So they're going into effect in December um based on SIZAB 2604 that was released last month. Um so up a little bit of an accelerated timeline on the vulnerability reporting rules. Um, and then also we released CR26 official rule sets at the end of June. So also this is your time to go look at those important deadlines that are outlined in CR26 and acknowledge that you will be working toward meeting those in order to remain FedEmp certified. So please please respond to all of those. Um, a couple little tidbits. one. Um, somehow our master tracking spreadsheet got a little bit jumbled up. So, anybody who had privately listed security inbox emails uh got a little bit of a jumbled um security inbox email. We are correcting those and we should have updated security inbox notifications out to you this afternoon. Um, so that should be resolved and we have corrected the master tracking spreadsheet. Fingers crossed it doesn't get jumbled up again. Um, so we're working through that. And then, um, all security inbox notifications went out to anybody who is currently actively listed on the Fed Ramp marketplace. So, if you have not received something and you were expecting to receive something, first make sure that you are actively listed on Fed Ramp marketplace. Um sometimes your Fed Ramp ready or your Fed Ramp in process um designations come with an automatic expiration date and so if that date has passed you get automatically dropped off the marketplace unless you're sponsoring agency um for in process or um you you update your Fed ramp ready status um unless we get those coms we automatically drop you from the marketplace. So make sure that is all good to go. Um, but if you have any questions, reach out to info app. We are actively monitoring that inbox as well during this. All right, back to the regularly scheduled agenda. >> Very important. >> So, uh, on to pilot updates. So, we've completed uh the 20X phase 2 pilot for class C service offerings. Congratulations. Uh, this concludes the pilots. Um, and now 20X officially is here to stay. So in phase two uh 14 total offerings achieve federam certification and in phase one of the pilot we had 15 total offerings achieve fed class B certification. Um out of all these offerings I know this is a shocker to most about 35% um have GRC capabilities. So this was the top service offering category. Um but none of this could have been possible without the verification validation services of our independent assessors. Uh the top assessors with the most assessments during phase two of the pilot included coal fire. We had Portreion uh first information technology services um as well as Shelman. So all of us at Fed really want to thank you all again for making uh 20x a huge huge success. Thank you. So for everyone who achieved the pilot certification congratulations to you too. Um, but as you know, your journey is not over yet. So, providers still need to invite Federam to quarterly check-in meetings. Uh, during these meetings, Fed wants to see that uh, providers are persistently showing progress towards uh, CR26 adoption and are following CR26 maintain timelines for both class C or C, class B or C. Uh, when you have a date and time set, please send the invite to info at feder.gov. So this can also be um an invite to your quarterly collaborative commod meeting with your agency customers. Um this is typically the best option for most providers. So you don't have to cover uh similar status information twice. And when you're ready to submit your final package, uh simply contact Feder again via info@fedamp.gov. So this uh can be annual review packages or a new package if you're changing uh to a different class category. So, as a reminder, uh bottom line up front here, please be sure to follow these steps. Uh show persistent progress and meet CR26 maintain timelines. Unfortunately, if progress is not demonstrated or dates are missed, um your pilot certification will be revoked and your federal marketplace page will be delisted. So, please be sure to follow along here. And lastly, all providers with a class BRC pilot certification will have their marketplace page updated to show their pilot certification status. Uh their annual assessment dates will also be updated uh to March 7th, 2027 to align with the greatest CR26 grace dates. Um so that covers all the pilot updates for now. Um, and with that, Nicole is now going to talk about the newly released uh CR26 and how it applies to both uh 20X and REP 5 certification pass. >> Great. Thanks, John. All right. CR26, you can go ahead to the next slide. Um, so we released the consolidated rule set uh on June 24th. So, it's still a little bit new. Right now, Fed Ramp is in an intense period of working on all the internal processes that are going to be required to support all of the guidance that we just released in the consolidated rules. So, um very excited to finally get these finalized down on well virtual paper um your monitors so that you can all see what we've been up to for the past year. Um this is final widescale adoption rules for um not only FedRAMP 20X which has been highly anticipated but also updating the rules for Rev 5. Um this incorporates all the final versions of the RFC's that we've put out over the course of the last year. Um thank you so much for all of your comments on those. It really informed how we brought the RFC's into CR26. Uh the rule set goes into optional adoption as of last weekend. Um so you can go ahead and start uh adopting all of those previously optional um balance improvement releases that are now finalized um and formalized in CR26. Uh you can check out the important dates pages. Um, that's where you're going to find the handy reference of every single um, uh, new rule set or process that is applicable to your particular certification class. Um, when they are due by, so your obtain dates are going to be uh, if you are applying for a new Fed ramp certification or you are upgrading to a new class, um, you need to follow the obtain dates. Uh the maintain dates are if you are just maintaining your current certification class, that is the date by which you must update your package to follow the new CR26 rules. Um and then the grace period ends date. Um that date is the last possible date um that you can still keep a Fed ramp certification if you have not followed the rules yet. So on the day after that grace ends date, we will be revoking Fed Ramp certifications if um you're not updating your packages accordingly. Um we are still making some minor changes to CR26. nothing that is groundbreaking, but um you've already seen some of this if you're checking the comments on some of the consolidated rule set pages. Um as people um catch typos or um if we have a little bit of a clarification issue that we need to make um we're making some minor changes there, but all of the rule sets uh and all the major information is here to stay. Um we will be starting work on CR27. Uh so right now we're in phase three of the 20X journey. So this is working on widescale adoption. This is working on um agency adoption of 20X. Phase four is going to be next. So that is late summer and fall and winter timeline. Um so what we're going to be doing in phase four is trying to figure out what class D looks like for 20X. Um, so we have plenty of work to do there and all of our major work efforts really are going to be aligned to what will be CR27 um for the next annual update to the consolidated rules. So um the consolidated rule set for 20 26 will be valid until December 31st, 2028. So, this will be a stable baseline for about two and a half years. Um, to give you guys something a little bit more stable to hang your hats on, um, you're welcome to update with us to CR27 when that's released next year, but you don't have to update um, until CR26 rules officially expire. All right, what is on the next slide? Oh, good. Lost sponsor and ready conversion. We have gotten so many questions based on loss sponsor and ready conversion. Uh the philosophy behind this is that we believe that cloud service providers who have already invested in Fed ramp should have a path to Fed ramp certification. Um we know a lot of cloud service providers invested quite a bit of time, money, energy um into engaging in the federal market and um a number of those CSPs lost sponsors this past year or um uh had an agency in process like promise um that they were expecting to come through that ultimately fell through uh due to contracting issues or whatever. Um so we have two paths available to people who have not found a sponsor and these will be program certification paths um sponsored effectively by uh Fed ramp. So, if you have an active bed ramp ready before July 28th, 2026, you are eligible to convert to a class B or C certificate. Well, actually a B or C certification uh once we open that pipeline, that pipeline will open on August 10th. Uh similarly, if you um were Fed ramp in well, if you were in agency in process um between January 2025 and March 2026 and you lost your sponsor and you've been struggling to find a sponsor, you also qualify for the program certification route. Um you also um not only if you were just listed in process but if you completed your Fed ramp assessment and you have a SAP and a SAR um but that informal agreement that you had with an agency didn't turn into a formal agreement um once you completed that um and you also fall into that same timeline you qualify for the program certification. uh at this point f like familiarize yourselves with the Fed ramp 5 class B or C rules um because the program certification route requires that you meet all of the class B or um or C rules by February 19th. So that's going to be a little bit of a quick turnaround um given the number of changes that we made. We plan to open the form for both loss sponsor and Fed ramp ready conversion on August 10th. So, you don't necessarily need to do anything with your package yet. Um, in fact, I'd encourage you to kind of wait before doing, like take the time to really familiarize yourself with the rules. When the form opens on August 10th, fill out the form. We will come talk to you about your specific um case because everybody's going to be in a little bit of a different uh position about where they were over the course of the last year and a half. So, when you fill out the form, we will schedule a time to come talk to you and talk about what this process will look like. And then you get to decide whether you want to continue going down this route or if you want to pivot over to something like Fed Ramp 20X or if you want to go off and find an agency sponsor to um uh sponsor you officially through that process. Um, anything I missed? Emu? Um, not that I could think of, but I mean really some of these situations are going to be very bespoke and you just got to talk to us and we got to figure it out together. >> Yes. Yes. Um, if you believe you fall into this category, send us the form when it opens. Um, if you fall just outside of this category and you want to talk to us about it, fill out the form. We'll come talk to you. Um, if you're very outside of this category, uh, go 20X. All right, next slide. All right, let's talk about the force of the rule. U, we have gotten a lot of comments about why requirements are shoulds and not musts. Uh, we've gotten a lot of comments about why should requirements are in the uh the required list. uh instead of an optional list. So, let's talk about the force of the rule. This is based off of um the IETF RFC 2119 I think if I remember that one right where they define exactly what the force of the rule um and these words like the specific meanings of these words when we use them. So, we are using those exact definitions. So for um any rule that has a must in it, this rule is an absolute requirement. You must meet that rule and there are no exceptions. Um and if you do not meet that rule, uh it may result in corrective action and potentially revocation of your FERAP certification. Must not is the exact opposite of that absolute prohibition. You absolutely must not do this thing that's in the rule. um and failure to abide by that threatens your Fedramp certification. Should and should not sound optional, but they are not. Should um is still a requirement. You must have a very valid reason to not do that thing. Um there exist valid reasons to not do that particular statement. You must have a valid reason to not do that. You still must address any should rules. Um, but you are allowed to not do the thing that the rule is telling you to do if you have a good reason to not do it. Should not is the reverse of that. May is the language that means that this rule is truly optional. Um, so kind of re-calibrate re-calibrate your brains around those rules should is a lot stronger than it sounds in normal English language usage. So, um, I just wanted to point that out here so that people have an idea of where our minds are when we're writing rules. Um, if we could imagine a scenario in which uh, a rule may have a good reason that you're not doing it, we used a should. Even though it is a very strong rule and it's a very good idea to do those things, there may exist at least one valid reason that you wouldn't do it. It got a should. If we could think of absolutely no valid reasons for you to not follow a rule, it got a must. So that's kind of our standard of what we use when we were writing the rules. That's [clears throat] what we were thinking. All right. Next. All right. Who's doing class A submission? >> That would be me. All right. Um, let me find my place. Okay. So, uh, next John. There we go. So, big important time frames for class A submission. Uh, we've already hit July 6. So, we are open there for initial implementation listing on Federate Marketplace. um that your initial listing is always the first step now um towards certification and then our class A pipeline officially o opens up on August 3rd 2026. Um next please. All righty. So uh a prerequisite to class A is you must have already had an audit from an approved alternative framework. Um these frameworks for CR26 are Fed ramp red 5 including ready sock 2 type 2 uh gov ramp at any impact level. Um and please stop asking about other frameworks or like audit stacking like I did my HIPPA plus an ISO plus a CMMC. Does that equal one of these? No, it does not. Uh we we will potentially explore additional frameworks in the future. Um, but that would be a CR27 thing and not a CR26 thing. Uh, next slide. All righty. So, very high level process is uh you get listed. Um, you get up on the marketplace in that initial uh implement that initial status. Um, then you do the work following the rules and assembling your certification package. Uh, and then you submit your application to apply for certification. and we'll go through the review process and then uh you know next steps from there. All right, John. Okay, so we are heavily discouraged from uh providing a lot of highly specific examples because sometimes people have the tendency to copy paste those examples. So we're going through a few examples of implementation kind of statements um using the fictional uh pizza ramp and the uh you know this particular uh pizza rule. So um in kind of the first example it's blank right this could be a rule this could be a ksi if it's blank um it's incomplete right and then uh next we have kind of a we don't do this like we don't do this rule in this case we don't deliver pizza so um this is still a you know not acceptable because we don't have an explanation we don't understand why you don't deliver pizza. We don't have details like we don't know if there's future plans. This is just not enough detail to make uh a solid decision off of. All right, next. All right, so here's some other examples of I provided information of, you know, pizza delivery time frames are established in the pizza operations procedure. Cool. you have a procedure, but the ask is that you define your pizza delivery time frames and uh that they are persistently met. So, you're really only capturing the first part of that where you define the time frames. You're not actually telling me how you're persistently meeting this information. Okay. So if we expand that and basically say hey we have a procedure um it's reviewed at least quarterly um and then the these are my problems right like I can't fully implement this here's the explanation why and here is the time frame we plan to fix this that is a pretty reasonable explanation right so um in this it is partially met um but there's a really clear solid explanation of why and kind of next steps. All right, next one. And this kind of, you know, some of this can vary a bit with the force of the rule as Nicole talked about. Um, and there are many ways to slice a pizza. So, you don't have to follow this exact kind flow, but I try to think of a lot of these as a who, what, when, where, why when you're kind of describing what is happening. Um, and so the reason the one on the left is a decent example is because um, they're telling us uh, so Get Your Pizza is telling us uh, they're so there's a site that displays actual versus target delivery times. Um, they're telling us what like what puts together that information. In this case, it is their lean pizza operations system uh with their moose stack. Um and then the uh they talk about how the PX team meets with the pizza ops team um to look at SEESAT scores and put together like a bi-weekly and review findings, all of that. and then they go through the and set an actual threshold where these particular targets um you know need to be in the top 10th percentile. So if you kind of expand on this when you start thinking about the evidence and the tests associated with the validations later on um they have that pizza status site. So you can have a link to the pizza status site. You could have information about you know down detector is it down if it's public site or you know tools you may have to look at that site. Um could be configuration data for your moose stack. It could be uh information involving like the seesat scores or automated uh meeting uh minutes you know things like that. Um, but the whole point is is that this is an implementation explanation that is clear. It makes sense. It breaks down exactly what's happening and what right and what you know passing looks like um without going into like talking through every single piece of evidence or validation because the details for those should be in those individual steps, right? And then the one on the right, this is the type of situation where maybe you don't meet this role, this particular KSI or rule, but for an extremely good reason. And in this case, um, Robo Pizza does not have uh does not do pizza delivery. they contract with a third-party uncrrewed vehicle delivery service and then go into a lot of detail about how they can't actually capture these numbers or metrics or guarantee service levels um and and all of that good stuff. So hopefully this helps a little bit to kind of break down the mindset behind what we're looking for from an implementation perspective. And before anybody asks, we will absolutely roll this up into a PDF and post it um on po post it in the community group. Um all right. Uh next one. Okay. So, uh it is off to Dan. >> Thanks. I just hold on one second. Let me finish my pizza order here. Okay. Um so let's talk a little bit about machine readable files. everyone's favorite topic and thing that we're all most excited about in CR26. Um, so there are two kinds of machine readable files that are kind of a part of the CR26 roll out. The first one is machine readable files that we're making available to you and then the second one is machine readable files that you're going to make available to us. So um, the first set there [clears throat] are two machine readable pieces of content that are going to be important and relevant to most of you. Um the first one uh is the one on the right hand side right machine readable rules. So all of the rules all of the requirements uh all of the KSIs all the rev five controls that are relevant to a Fedram certification process are contained in the single JSON file available uh on github.comfedrules fed consolidated rules.json. uh this is this one file has everything that you need to do in it. So you can use this as a reference, you can ingest it into your GRC tool, you can write scripts against it, uh you can do all whatever you want with it. And again, there's there's this idea in F 26 uh 20x that we want to get away from shadow rules. So this is the s definitive source of truth. If it's not in this file, you are not required to do it. Um, so everything that you need is is going to be in that file. The other machine readable content that I wanted to make people aware of is another GitHub read. So this is github.com/bedramp2026-markdown. And this is a markdown content of all of the HTML content that is available at fedramp.gov2026. And the reason that we made this available was really for your AI friends and partners to be able to have a a source that is AI friendly for them to read through this content. So this is not really actually intended as a place for humans to go for information ever. Um, but if you're working on an AIM MCP or just trying to train an AI agent against Fedramp data, this is a good place to put it that will provide it with again the same information that is contained in the Fedramp rules, but with a little bit more context surrounding it that'll help the AI understand the rules and the intentions and the purposes behind them. Um, and you can use this as as kind of source data for those AI use cases. But again, the rules JSON is the definitive source uh that the markdown content is built off of. So there's no there's not going to be any rules in the markdown content that aren't contained in the rules JSON. Clear as clear as mine. Next slide. Okay. So the other big change in uh 20x is uh the abolishment of all fed RAM templates. Yay. Everyone rejoice. Um and the replacement with schemas. So why schemas and not templates? Um the templates force you to present information in a particular format. So not only are we asking you for specific information, but then we're asking you to format in a particular way. The schemas get us away from that. We're still asking for specific information, but we want to allow the CSP the most flexibility possible in how they're presenting that information so they can present it in a way that's going to make sense and be valuable and helpful to the government official that's eventually going to review this package to make a riskbased decision. Um, I know in the last slide I said that markdown is machine readable content for purposes of submissions from you to Fedramp. That is not true. All of your submissions should be in JSON format. Although there are numerous places within the JSON schema where we specify that you can use markdown to format your response if that is helpful in uh making it more digestible and easier to understand. Um the JSON schemas are minimal restrictive schemas. So we wanted to walk a balance between having common naming conventions and structures for the data elements that we're asking for but without just replacing templates with schemas where we're still forcing you uh to present the data in a particular way that makes sense to us. We want to allow CSPs to populate the data in whatever way makes sense to you to innovate and to come up with clever and uh innovative ideas on how to make your information most valuable to the federal a uh authorizing official who's eventually going to review this data. So think of it as we want to automatically validate that you provided for example an implementation statement but we don't care what format that statement takes. So that's what you'll see in the schemas is a required element that says like implementation statement or validation statement and then that that element is just going to be a string where you can use markdown to prevent the present the information in whatever way makes the most sense to you. It can be paragraphs, it could be a link to a resource online, it could be a table, it could be a haiku. Bonus points if anyone submits their uh interpretation statements in haikus. Uh go ahead to the next slide. These are all the schemas. Uh I've already been informed that this table is terrible looking. Uh no need to mention that in the comments. We all agree. Um but there are a number of schemas and I wanted to fit them all on the slide. There's actually only two that I'm really going to talk about here though. Um the certification package overview and the security decision record. So the certification package overview is going to be the first schema that you're going to want to take a look at and uh develop a JSON data file against. The certification package overview is kind of the metadata about the CSP and the uh product offering and it is intended to be publicly available. There should not be any sensitive information in this uh in this this JSON file. So it's you know what's the name of your company, what's the name of your product, what services are you offering, uh what's your sales email, where can we get a copy of your logo, um those kinds of things, what product categories you have. This is also the information that we're going to use to populate the marketplace. So this is the best place to start is take a look at this. All of the other schemas here have a required element that is the URL to your certification package overview. So you don't have to repeat this information in every single JSON schema. Um once you define it once if you decide to publish a new logo or you decide to change the name of a product offering you change it in your certification package overview and that will be reflected in any other documentation that you're providing uh as part of your feder package. So uh do this first and figure out where you want to host it on your uh on your website uh and then we'll be you'll reference that in all the other schemas. The second schema that you're going to interact with is the security decision record. And this is where you're going to tell us how you've implemented all of the requirements and KSIs or controls if you're on the Rev Five path for your particular particular product offering. So, this is the one that may or may not you may or may not want to have behind some sort of authentication boundary. You might want to have multiple instances of this. um one that's public and one that's behind an authentication boundary. Um but this is where again when you look at the schema you'll see we're asking for how your product is implemented. So we're looking for the kinds of information if you're on the rev 5 path all the information that used to be in the SSP um that isn't contained in the certification package overview. So all the appendix information uh and a few other pieces of the SSP that contained, you know, potentially sensitive product information have been moved into the security decision record. If you're on the 20X path, this is where you're going to define all of your federant requirement uh responses and all of your KSI responses. Um again, the schemas are intended to be very flexible. You can add elements to them um as long as the elements that we've asked for are there and provided. um don't provide alternative elements that replace elements we've asked for. So like if we ask for implementation statement, you could certainly add an element that's called implementation, you know, description or better implementation statement or whatever you wanted to call it. Um, but don't try try try not to replace the implementation statement with that because again this is we want to be able to do some automated analysis of these files as they're coming in to make sure that they're complete so that we can keep our review times as short as possible for you. Um, so there's a lot of flexibility provided but but try and extend and not replace the stuff that we've already built into the schemas. These schemas will change over time as we start to see what people do with them. um they may become a little bit more restrictive um but our intention is to provide as much flexibility as possible for you uh throughout the process. All right. Uh the others sorry go back to that slide one one more time. Okay. The just very quickly the rest of these what you'll see here is any time that we have a rule or uh that's requiring you to submit information to FedRamp or andor to your agency customers. um we've created a schema for it. So you will find schemas for everything and when you go through the rules you'll see links directly to these schemas for the rules that they are applicable to. Excellent. All right. Now go ahead. >> Yay. Thanks Dan. Let's jump into agency updates here. All right. Um, so big change from the dropping of the consolidated rules for 2026. We have an entire tab dedicated to agencies that's live. And what agencies can get out of that is information on some of the changes that are occurring here at Fed Ramp. None of this should be new information. It's just now written down in one place where agencies can go to and get more information. And the the tab is really broken out into general guidance and support. Um but then there also are agency rules. Um in order for a cloud service provider to be used by an agency, an agency needs to understand what their roles and responsibilities are. So we went um we made sure that we aligned the rules that we outlined there with M2415 um other federal policy and the federal authorization act. So, nothing you see in there in the rules is going to contradict the law. Um, in fact, some of it is just taking uh verbiage from the law or M2415 and typing it up in plain language so agencies can easily understand what their roles are when it comes to authorization. Another big thing is letting agencies know, as everybody here on this call knows, Rev Five is going away. So um it really directs agencies to start pushing cloud service providers that they want to use to the 20X process. Um many many years uh one of the biggest uh issues with Fed ramp was CSPs wanted to become authorized and they couldn't. They need an agency sponsor. Um, we will continue the sponsorship option for a year to allow those vendors who have already uh invested in the Rev Five process and are close to the finish line and have agencies that are working with them go through that. But what we really want to do is open up the 20X program certification so that CSPs can come through. It takes that burden off the agency initially to sponsor. And so we're really encouraging agencies to talk to you. And if you're new to FedRAMP and want to come through, come through the 20X process. Um we do have uh I think the timeline is June 11th, 2027th for us to stop doing agency sponsored um authorizations. So um we're really encouraging the 20X uh certification proc process through that page. So the page is intended for agencies. I know there are a few agencies on the call. Um, however, it's open to everybody. I would highly suggest if you're a advisor, if you're a assessor, um, or a cloud service provider to take a look at those pages. There's not a lot there. Um, but it's a lot of valuable information. So, when you're talking to agencies and they might say something that isn't accurate, you can point back to that page. Um, I will say that we also will be augmenting um, not necessarily the rule set, but um, we look to build out FAQs um, things that might have not been hit directly in that agency page. Um, so if you do have questions, uh, please send them to info app and um, we'll be over the course of the next few months building out our FA A F A F A F A F A F A F A F A F A F A FAQ so we can answer all those questions that we didn't hit on. Um, so we've been supporting agencies for a while. The agency liaison program has been around for a a long time and the whole initial concept was a train the trainer approach and that was really successful with 20X. Um, many agencies were reluctant to do or sorry uh, Rev Five. Many agencies were reluctant to do Rev Five authorizations in the beginning and this program helped agency adoption. So, we're continuing the agency liaison program. Um, we're continuing adding new people to that. But what we also did is uh created agency support groups. So, once a month we're meeting with agencies on updates and and answering questions about the changes in FedEmp, but more specifically um we're also added a meeting where we're meeting with agencies where they can ask specific questions on 20X implementation. Um I think a really cool thing that came out of our last agency liaison day was we had one agency who is working with uh one of the vendors who went through a fed rampant pilot for 20x um and this is new to agencies. So they came to our team um Nicole and I talked to them and they asked for us you know can we can we have you sit in and kind of look at this package and meet with the vendor and that is something that we the team has been doing. So, as we continue to push 20x adoption, um, we will be engaging with agencies more, making sure they have the resources they need. Another thing, uh, that changed for many of you, you know, you used to host, if you were a Rev Five package, you would come to Fed Ramp and we would host your Rev Five package on USDA Connect. Well, 20X, everyone has their own trust center. So there's directions for agencies on, hey, if you're looking for a 20X package, you need to reach out directly to that vendor. We will get to a point where we'll include the link to your trust centers on our website um on our marketplace, but right now um we're just getting agencies kind of comfortably moving over to this new idea of working directly with the vendors. Uh we have a big event that uh the team is working with um an industry group on for our next agency day. It will be in September 2026. So keep an eye open for that. Uh you know this is a this is a long arduous process. I know it's been a year and everything has moved quickly but adoption doesn't happen overnight. Um and it's not going to happen in a silo. Fed RAM's not going to magically snap our fingers and make this happen. Agencies, we need the entire community working together. And so that's the purpose of this next uh agency day. Um is bringing our agency partners, agencies in the government together with the industry. Hopefully there will be a lot of 20x uh authorized cloud service pro or sorry certified cloud service providers there. And it's a great way um to interact directly with agencies and and get them comfortable in this new process. Um, I think that's all I have from the agency side. Next, we can probably jump to the Q&A here. It looks like there's a few rolling in um as I speak. [snorts] All right. Um, let's start kind of back at the beginning. So there's a question about how do 20x and rev 5 play together in a CSP subprocessor relationship? Are the entities involved required to hold the same type of certification from Fedramp's perspective? No, they do not have to hold the same type of certification. Any FedRAMP certification is a FedRAMP certification. So, uh, in fact, you can even use subprocessors that are not Fedramp certified as long as you clearly state that in your package and you explain the compensating controls that you have to protect any federal information that's being processed there. Um, so, uh, next, with CR26 being valid until, uh, 2028 December 31, uh, is there still the potential for modifications to CR26 during this timeline? minor modifications only, typos, clarification, uh, a small rule update that helps clarify something. There will not be major adjustments made to CR26. Now, if we get something like a binding operational directive, an emergency directive, that can change things. Um you'll already notice that VDR deadlines were moved way up almost almost a half year um due to SIZA's issuance of the binding operational directive last month. So um this is where CR26 stands. However, if SIZA or another government entity puts out something that we have to urgently respond to, uh we will respond to it. Um, are all shoulds documented in the SDR for agency review for ATO decisions? I'm not quite sure that all the nuance behind that, but um, if there is a rule with a should in it that applies to the class that you are um, applying for, you must address that um, in your security decision record. Dan, did you want to add something to that? >> No, I was just nodding my head a lot and I was like, >> you came on video, so you came on video, so I wasn't sure if you wanted to add to that. >> Um, what's next? Are there any trust services requirements for the SOCK 2 certification to be accepted or are all SOCK 2 certifications regardless of applicable trust services accepted? Emu, do you want to talk about SOCK 2? >> Sure. Yeah. So, we don't have any specified right now. Uh, we're kind of, yes, we could probably totally get a stock to that just has some common criteria and maybe privacy or availability and not get in all of what we're looking for. Um, but we're kind of playing that by ear. We're asking folks to map uh to the mandatory um controls and rules to anything that is related that was performed within uh that audit. Uh we haven't defined if there's like a threshold like this many need to map versus this many are okay to be self, you know, self attested to. Uh we're just going to kind of see what we get and push back if it becomes a problem. And like Nicole mentioned, CR26, we're not seeing it change drastically, but there may be minor tweaks based on issues we run into. >> I do want to highlight that class A is not meant to be a permanent destination for anybody. Class A is to kind of dip your toes in the federal market, see if there are um pathways available for you to sell to the federal government, and then based on that response, start uplifting to a class B or C or potentially D um certification. So, you're not meant to hang out at a class A forever. um you will find it very difficult um to use a class A widely in the government. This is meant for mostly agency pilot use cases. It gives you what it does is it gives you a full-fledged Fed ramp certification at a at a class A level. So you do have an actual Fed ramp certification and you can go to agencies based off of that. However, you're not providing a ton of information about your cloud service offering. And so, agencies are going to be asking for more information, especially if they're interested in buying your service to widely adopt across their agency. So, you will need to start thinking about moving to class B and class C. And um in fact, we have placed specific timeline limits around how long you can hold a class A. You cannot hold a class A for more than two years. Um, so you need to show progress or we will kick you off the marketplace. All right. Uh, I answered some in the chats. So, um, if we're not talking about them, go check the chat to see if we answered there. I was dropping some of the the rules reference in CR26 for CSP monthly vulnerability reporting. Can we talk more about the thresholds pain or vulnerability classification types deers for which vulnerabilities we need to report on or is it all vulnerabilities? I know these are new so understand if I'm asking this too early. Okay. All the VDR and VER rules are published and finalized. Uh there are specific rule we we did break VDR into two uh rule sets vulnerability detection and response and vulnerability evaluation and reporting. So um there are specific this was largely done out of convenience because Vader was getting rather large. Um so now we have specific rules about how you detect vulnerabilities in your environment. Um and then we have specific rules about how you evaluate them and how you report them to us. So all the information is there and it heavily depends on what classification you hold uh what uh class certification you hold and how you've evaluated the vulnerability um where they are on the pain scale. So, um, we can talk more in nuance after people have kind of gotten a chance to digest these rules, but, um, we tried to make it pretty self-explanatory in the rules so that you know what needs to be reported and where. >> Yeah. So one other thing I'd add to that. So the you know there's a there's a requirement for a monthly vulnerability detail report but in addition to that you have to keep in mind that sometimes identifying a vulnerability is an incident. And so then you need to look at the incident reporting requirements. So if you identified a vulnerability and that vulnerability may have been exploited, then now you're looking at a potential incident and you need to follow the incident reporting as well as the vulnerability reporting. So generally speaking, if you had a vulnerability and it wasn't exploited and you patched it, that can go in your monthly report. If it's anything other than that, then you're need to at least look at the incident reporting performance. All right. Uh, more vulnerability topics. BOD 2604 versus Vader. Um, so there this question goes into some details about the timelines. Um, so we talked a little bit about this in notice 14. So if you want to go reference that, we talked specifically about how Vader and Ver and the BOD align um, and differ. But you'll notice that even in the rule set in Vader, um, as soon as SIZA defines a KEV, um, we recommend that you go follow the Kev timeline. So yes, in a lot of cases that Kev timeline got a lot tighter than the um, Fed ramp timeline. In some cases, the Fed ramp timeline is tighter than the the BOD timeline. So, um it all depends on how you evaluate the um the particular vulnerability and how quickly SIZA can make their evaluation and add things to the KD list. Um so, FedRamp is asking you to evaluate for likely exploitability which is different than known exploited by SIZA and SIZA is not looking for is there a proof of concept available out there. they are looking for no I have seen this in the wild. So their standard is pretty high for adding things to the Kev list. So if there are proof of concepts out there if it's reasonably automatable like you should be treating it as if this could turn exploitable in a moment. Um so in general like make the right security decisions for the right reasons. like we are trying to put these out there to empower you to make good security choices and not to limit you. Um but we have some tight timelines for a reason because um SIZA has recognized we have recognized that vulnerability management is a problem in the federal government um and in services who serve the federal government. So um best efforts like we don't have fed ramp police that are going to come down on you. um the best we can do or like the the limit that we have is revoking your Fed RAM certification if you're consistently not following Fed Ramp timelines. Um you're also going to have agencies breathing down your neck if you're not following um at the very least those BOD timelines. Yeah, I I would just add like in that particular example, if CISA has added something to the known exploited vulnerabilities, that means it is actively being exploited in the wild by a sophisticated adversary. I I would really like if if that's the situation and you're looking at the same vulnerability within your system and saying nah it's not likely to be exploited you should be very very sure of that because is unlikely that that's the case. All right. What type of support will Fed Ramp provide to CSPs that encounter agencies who do not want to comply with the new 20X rules? Ryan, do you want to take this one while I get a chance to take a drink? >> Sure. I was responding to a question. Um, but we can pick it up after. So, um, as of right now, we're doing a lot of direct engagement with agencies, but we really need your support, CSPs, to let us know when agencies are pushing back and what you're hearing from agencies because we can't support you unless we know what it is agencies are telling you. If we need to lean in and and point agencies to a particular place, we can do that. if you're having issues, what we can do is invite them to one of our agency support groups and have direct contact with the agencies to really help um them understand this new process. This is a completely new way for them to authorize cloud services. They're not looking at a bunch of security documentation. They're going into trust centers. So, um I'm figuring over the course of the next year there will be a lot of agency engagement um to support adoption. This is not something Fedramp has is new to FedRAMP. Uh we had to do this when we opened up the agency authorization process for REP 5. Um this is something that we've done as a program before. We can do it again. Um it's just a matter of you letting us know what agencies and be very specific. If you're hearing back from a specific agency and and there's one person that says, "I don't understand this process." Say, "Hey, I can put you in touch with Fed Ramp so we can actually pull them in." because if we're getting generic information from CSPs, it's really hard for us to tackle the issues and help you. So, um, be as specific as you can when agencies, you know, may not understand the rules or pushing back, um, because otherwise we can't do our job and and really engage with the agencies and support them and give them what they need. Um, Dan's got his hand up, so piggy back off me, Dan. Yeah, I just I just wanted to say like, you know, without naming names, we've had direct one-on-one conversations with several agencies now. And all those conversations started with the agency saying, "I don't understand. My internal agency process says, "I need SP 853 controls from my vendor." And in in every case so far, we've managed to end the conversation with them saying, "Okay, now I understand that I don't need that. Um, I am going to need to change my agency process, but I recognize that that's the right thing to do now." So, so we've been having these conversations with agencies um that and in every case they've been successful. So if you have someone that is you know confused or is pushing back you know have make a connection between us and the specific person at that agency that you're talking to and and we will help them understand the process but you know the guidance from the federal CIO's office um has been very clear they must adopt their adjust their agency policies to match bed ramps guidance. I also want to point out that um this is uh very related to another question that we have a little bit later on um where somebody says that their agency is not making the same strides to align with automation as FedRAMP is. Um and so their agency has put out more requirements for reporting conmon items manually. Um and so they're talking about Fedramp versus agency requirements. But our point has been that if you adopt those automations that Fed ramp is requiring, it should be trivial for you to provide the manual um products that your agencies are asking for. So you can always generate human readable content from your automated machine readable content. Um so put in the effort to at least convert your processes over to more machine readable, more automated um uh forms. And then if your agencies are specifically asking for human readable or um different formats of those sorts of things, like just use your machine readable stuff to give it to them in whatever um version they're looking for. Separately, the the um federal government, OM, the federal CIO, they are pushing agencies to start investing in um GRC tools that can accept machine readable packages. But there needs, we've talked about this in other community updates too, there needs to be machine readable packages ready for us to ingest before agencies are going to meaningfully invest in GRC tools that can accept machine readable packages. It is wasteful for the federal government to buy a solution to a problem that doesn't yet exist. Um, so we're trying to generate demand. Um, in the meantime, while we're getting agencies converted over to more machine readable um, mentalities, use your machine readable um, processes to generate your human readable content that your agencies are asking for. I want to make sure we answer one that's really important here from um someone. Uh do trust centers have to be fully featured complete for initial marketplace listing or are in progress oh it got deleted. Um are they listed in progress? Um we opened this week on Monday our initial implementation uh marketplace listing phase. You do not have to have a fully complete trust center to be listed at in the initial implementation phase. Um so please go to uh fedramp.gov 2026 and look at the marketplace listing rules. Um there are some requirements. You will need some uh machine readable language and need to provide us with some input but it is not it to get listed. You do not need a full trust center. It's just to show us that you're working towards that. Now, when you get to your class A, B, C, D, eventually D, you will have to have everything built out and meet those rules. But just to get listed, you do not have to have a full trust center up. >> All right, we've already gone over time a little bit. Um, we still have a couple questions rolling in. So, if we didn't get to your question, please either use info at or preferably ask it publicly over on our GitHub um discussion pages. We love engaging over there publicly for everybody to see. Thank you so much for joining us. Uh we'll see you next month at next month's community update.