FedRAMP Rev5 Community Update

Good afternoon everyone. Uh welcome to our web five community update for the month of October. We have about 150 folks. So we will get started now. Um the this meeting will be recorded and then we will shortly update the update our official Fed web YouTube channel with the recordings. Uh it usually takes one or two days, business days for us to upload the recording. Legal disclaimer, we are communicating today in our office capacity on behalf of PEDRAMP at the general services administration. We hold these meetings to enhance transparency between industry and ped so that we can open up a dialogue and share new developments. Nothing that we share constitutes business advice and any reference in this conversation to any specific commercial product or the use of any corporation name is for the information and convenience of the public and does not constitute endorsement recommendation or favoring by GSA um general. >> Yes, Pete. >> Yeah, no worries. Hey everyone. Um, so I know the last couple meetings we've been saying that we're going to do a a separate Q&A meeting at starting this month. I got ahead of myself a little bit on that. Turned out that's a lot of extra effort for us to set up. So, we're going to target doing those in December. So, we're going to continue to do Q&A in the meeting here. However, we're going to try for a few changes. So, I'm hoping folks would uh respect this, pay attention to this. one, we don't want to do random questions and answers during uh our update. We'll save some of that for the end. So, if you just have a random question about something unrelated to what we're talking about, uh keep it to yourself. Uh otherwise, we will just close it out. Uh then at the end of each section as we go through our agenda today, we'll put a one minute timer up to see if folks have questions. So, if you have questions about that particular section as we're going through it, put them in the chat. And then at the end, we'll give you a little bit of time to ask any other questions before we move on. Hopefully that will make things a little more targeted, a little bit less chaotic. We've had a lot of just like very random Q&A happen during our updates. So, let's try to keep things a little bit more on focus and then if we have time at the end, we'll do a big Q&A. >> Awesome. Um from Fred PMO side today uh we have we're joined by Pete Waterman the director Ronnie Hing chief of staff and uh Nicole Thompson our security director and myself Don Gurung I support the veteran bastion team. This is our agenda for today and I'll pass it on to Ryan now. >> Oh yeah. >> Okay. Let's go. Let's talk about marketplace listings. Um, okay. So, one thing I wanted to make clear to this group is that, um, we have updated our process for getting vendors listed on the marketplace. But we have also updated our process if you are already listed on the marketplace to update um generic service description um additional services uh by implementing new rules in the CR26 that was released on July 4th. And just to like you know add to this like some background right is that uh traditionally if you want to change anything on the marketplace you got to send us an email open a ticket with us we have someone change it you don't like the way it looks you realize there's a typo in there you send us another email we're going back and forth for days. Uh it is not efficient and effective. We want to make it so that you have control over the text on your marketplace. And that is what gives us this. It allows us to eliminate that uh really high overhead of back and forth communications about typos and things like that. Your marketplace, your description. Yep. Let's go ahead and jump to the next slide, Don. Okay. Um so, where can you find this? Um, if you look at CR26 and go into our marketplace listing requirements, there's MKT, CSO, MLR, and this says that providers must address um these rules for new marketplace listings as well exist as existing. We have had several vendors reach out who are already rev 5 certified um requesting to get their marketplace listing updated and they could not find where this rule existed. This rule has been up there since July 4th. I will say we have made some exceptions um for folks between then and now uh to expedite but we um are enforcing this rule across the board now. So if you want to um update your listing, you need to be ready to create um a JSON um with the information on the next slide which is our CDS CSO pub. Um, you can find this all on FedRAMP2026. You can search for that uh unique Fed ramp rule and it will go through the generic public information that you need to provide to us. Um, this is information that as Pete said, you provided it before in either a Google form that we would send out and then over time you would send us emails. There would be back and forth. This was not scalable for us. Um, one of the things with CR26 is we created the new initial implementation phase. Uh, I was just in a meeting with Pete before this when we were talking about the numbers. Um, earlier this week there were 71. Today there's 76 listings in that phase. We do not have uh the staffing here to keep up with the amount of vendors that are coming in and listing their marketplace updates. nor do we um have the staff to continuously update the 500 plus vendors who are already listed on the marketplace. So, >> also your marketplace listing, your information, don't you want to just own it? The >> these are these are this is your public information. So, we want to make sure that you can update it as quickly as um possible and um our team here on the Fed ramp side will we usually run a a new marketplace bill build daily. Um, sometimes that can be every two days. So, this information will get updated um, pretty quickly. Um, but it's on you to update your JSON. Yeah. >> Um, and we'll pull that into our marketplace. >> And two quick things about that. One, obviously that time to update is going to go down, down, down, down, down. We want to get to where we're checking for updates multiple times a day. So like this gives you incredible ability to do things like add meetings, add blog posts, add all sorts of timely stuff to your listing as appropriate and then take it out like you'll have complete control. Uh second, the ask here is for a JSON file on your web server that can be integrated not just with us but with anybody else that's interested agency GRC tools, customers, etc. I we've had a little bit of a struggle about this because uh generally the compliance teams are used to working with word docs and things like that. But I guarantee if you're a cloud service, there is someone in your business that knows how to make a JSON file available on a web page and it's really easy. You can it should take about 20 minutes and that's if you copy and paste from the current marketplace listing. And Don, go ahead and go to the next slide with that. >> All right. This is um you know we're what we're saying here is what what uh the the meim actually says and you know the data on the marketplace is the same the data you're providing in your JSON is the same as on the marketplace. I will make a caveat um not all of the information on your marketplace listing is um stuff that's going to be in your JSON file or owned by you. for example, your certification uh class. Um that is something that Fed Ramp owns. Um but everything else um are are um attributes that are owned and um your information that we're displaying on behalf of you once you get listed on the Feder marketplace. And if you have a good security mindset, you're immediately thinking, if I put that on Feder class D in my JSON file, will it show up on the marketplace's class D? And the answer to that is hopefully not. Unless you are fed around class D, but we'll find out. Um, all right. So, we're gonna put uh a one minute timer up for questions. And there is already one in here, which is absolutely fantastic. Let me see if I can get this one minute timer. Um, and so we want you to do Q&A in the chat. Uh, we got one minute for folks to add additional questions. We got a couple questions in here. Uh, one is how difficult will it be if you need to change the JSON URL in the future. So, that's chill. Send us an email like you know what's up. Hopefully, actually, we'll probably have a form for that um in the near future, but for now, that's just emailing info at um and we'll take care of it. Obviously, we'd prefer you not do that three times a day. Uh but it is what it is. It's not like you're going to be locked in forever. And this really I mean, yeah, you can just have this available almost everywhere. Just make sure that you have control over it so that other people can't deface it as well. Um then there is a question the public information JSON includes references to deliverables under FedRAMP rules to update our marketplace listing. Those rules need to be fully implemented and reference in the JSON file. No. So the important thing that you need to pay attention to is the word applicable. Uh that that that rule says add the applicable information. So if there's stuff that doesn't apply to you because you haven't adopted it yet, don't worry about it. All right. Hopefully that answered. Oh, one one more coming in. >> Uh, may we assume markdown will be rendered as usual. Uh, yeah. So, I believe that we have support for basic markdown in there because that's what we're piping it through. At the moment, we don't have like fancy formatting. So, you have embedded images and stuff like that. It might not work. Um, and we do um we do sanitize that data. So, if you put like JavaScript embeds or things like that, it's not going to come through. and we'll work on iterating that over the time. >> Do we send you an email to get the JSON URL in the first place? No, please do not send us an email. Um, if you go to a our help desk, there is a form that you can use to provide the JSON. Um, we can drop that link in here for folks on the call. >> Yep. Perfect. Um, our JSON is hosted at AOS. Does it have to be on our actual website? No. Um, it doesn't have to be on your actual website. Um, it can be anywhere as long as you tell us and you have control over it. Uh, somebody asked, "What's the turnaround time?" Pretty quick. Um, it's going to be a couple days uh to begin with and then that's going to keep going down over time as we get more and more practice with this. Um, another question, we only submit the updated listing form if our JSON file location changed. Correct. Yes. So, if you or if you want to change something on the marketplace, like right now, if you don't want to change something on the marketplace and you're just sitting there and you got your current listing, you can let that fly for however long until the CDS rules are applicable. But you're probably going to want to change and take advantage of this. Um, we recommend I I would say like please don't come out of this meeting and start yelling at your devs to get this up and then send us an email tomorrow. Like, let's stage it out over the next couple of weeks. But >> please, please. Um, so will there be tools to help with the validation of the JSONs and is an API shape prescribed? So yes, in fact, we actually run a validation when you submit it. There's a validation available and there's a JSON schema provided that uh has a lot of flexibility in it. But just to be really clear, talk to your engineers. You shouldn't be you should not be finding out via a web submission that your JSON isn't valid. Um, you'll need to talk to your engineers about how to properly configure cross origin resource sharing as well as content type and things like that. Uh, so work with your engineers on stuff. Okay, let's uh hold questions on on that topic. Um, and we're going to move forward the rest of our conversation today. We've got a lot of stuff to cover. We're adding a new section to our community updates, which is to quickly highlight the rules that have changed recently. So, we pushed out an update to the uh consolidated rules for 2026 yesterday with some minor adjustments intended to uh clarify common problems as well as address some pain points, sometimes literally. Uh you can find these at fedup.gov/2026log so you don't have to write them all down as we go through this. But the biggest change is that we have modified the rule that requires you to estimate potential agency impact in two ways. The the first way is like right at the bottom. It's really obvious. We have added an N0 rating. That is pain zero. And that is basically it's unlikely that exploitation would have an adverse effect on agencies. Um currently the rule as written requires you to pick N1 through N5. And the reality is that there's a lot of times where there's an N0 and people ask how do we handle that? And so rather than just defaulting to N1 for everything which is minimal uh you know effect N0 is your way of saying no no it's not going to affect things like uh shouldn't be a problem. Then uh we have inserted my favorite word earlier into the uh into the rule which is changing the rule from estimating the potential agency impact of exploitation to estimate the likely potential impact uh of exploitation. And the reason why we added the likely in there and a reminder at the bottom, likely is defined as a reasonable degree of probability based on context is that over a lot of conversations with folks, I I we heard a lot of sort of like, well, if there's a problem with this database that's used by everyone, then we ha it has to be a pain five because there could be some potential impact. Um, we want you to stick with likely potential impact. So if you're if you're like, hey, some some aliens might come down with some crazy technology to overwrite all of the hard drives in our data center and that would take down our service, like you don't need to take a vulnerability for that. It's not that is not a likely potential agency impact. So we also have some other minor changes to smaller rules. We have um we have updated the JSON schema rules to clarify that if there's a public JSON data requirement such as the one we just talked about for marketplace listings that JSON data must be available with proper cross origin resource sharing and content type settings so that web apps can use them. This is a standard web framework that again talk to your developers. It's super chill. Um but some content tools don't provide this capability and then you shouldn't be using those to provide public JSON data otherwise we have to override security settings in order to access that information. We've also modified the public information thing to explain that the link to a logo that's just to be clear that's a link to an image that we're going to display on your marketplace listing. So you should be a little thoughtful and intentional about that. It should be properly named. It should have proper transparency and it should be designed to like look okay on the Federate marketplace. So if it's all white text with a all with a transparent background, it's just not going to show up on our marketplace. Uh so think about that as you're designing that logo. Finally, we have thanks to thanks to some interesting questions from a friend about uh potential loopholes in the validation cryptographic validation rules. We clarified with a note because this isn't a change to the rule. It's just like this is how definitions work. Um we clarified that if there's a module cryptographic module by definition includes all the algorithms in that module. So if there's an update stream of a validated cryptographic module that adds new algorithms that have never been included in the module when it was cryptographically validated, then those algorithms are not part of the upstream cryptographic module even though they're included in a product that is offered with that same name. Uh so that should be relatively straightforward. Um, you know, I think that was something that uh the request was to make that very clear and we didn't think that needed to be a rules change, but it felt like it needed to have a note to clarify that. Um, all right, let's do Q&A for a minute. We'll add a timer here for a minute. Uh, there's a question here about for the likely score, can it be based on EPSS value from first.org? There are a lot of rules in the Feder detection response and Feder evaluation and reporting uh rule sets that explain how to score and manage your vulnerabilities. Uh oops. I got to set the timer, don't I? Let me set this timer. See if we got other questions on the change. Right. We're all gonna sit back and stare at each other awkwardly. I'm realizing for people that that listen to this like a podcast later, they'll be very confused by the >> It's >> Yeah. Every time uh every time that happens and something I'm like, did my earbuds just die? Did things cut out? I'm really surprised that there aren't more questions about Pain Zero. But I'm also very happy everyone's just come to grips with the reality of it. Oh, a question. With N0, did the remediation timelines change for N1? No changes to any timelines were made? Uh, so you can remediate or mitigate from N1 down to N0. Uh, you know, according to those time, I think N1 didn't have very many timelines because it was already kind of considered like a you do you like get it done when you got to get it done. Uh, but N0 does not have remediation or mitigation timelines in it either. Get things to N0. All right, let's talk about schemas and templates for a bit and the difference between those. Uh, so for folks that that haven't spent their life in the data game. Uh there's there's a big difference between a template and a schema. And I want to make sure that this is really clear. Uh, a template is like a form. It says like this is how you fill things out. Federamp's templates were in themselves rules and instructions and they had requirements and so you're used to see if you're used to looking at templates like fill out this form. You don't need to look at anything else. That's not what a schema is. A schema is a specification for how to share data. It's not a form to fill out. It's not a thing that you process with. Um, and the reason why I felt the need to talk about this today was that we have a lot of people that are clearly starting by the first thing they're doing is they're pulling up a schema and they're like, "Okay, how do I fill this out?" And that's not the approach that you should take. Uh, if you jump us to the next slide, Don, it's like, do not start with the schemas. The schemas are the last thing to worry about. You need to get all of your information for the rules. You need to get them together. Figure out how you make it. Figure out if you meet those rules. Figure out what you need to do. Document it internally. have your internal tools processes all lined up so that you're doing this. Then when you're ready to talk about assurance with Feder, that's when you look at a schema and most likely you should have engineers look at that schema and and develop this. Um, drop to the next slide. Oh, that was it. I thought there was another slide in there. So, I just want to emphasize that. Uh, don't look at the schemas and then try to build to them. We got a lot of questions from folks that have clearly done that and it's just taking the wrong direction and it's like our our bad for not being much more clear on that. So start with the data, get everything ready. Then when you're ready to submit or have an assessment, that's when you worry about the schemas. All right, I'm guessing there aren't going to be too many questions about that because it's fairly straightforward. So we're going to switch on a different topic, which is the Rev 5 to 20x transition. And I know people are like, "Wait, Pete, you said we didn't have to transition from Rev 5 to 20x." But you can. So, the thing that we want to really help people talk about and understand, this is like a very critical point. Fedramp Rev 5 was designed as a opinionated security framework that basically told you how to plan and build a secure service. That's what Feder was back in the day. That's what that NIS sp3 and and those processes that are based on are designed to do. They are designed to tell the government how to go about building a secure service. Uh the thing is most of you already have a service built and so taking that ground up framework that's designed to kind of uh plan and build is not very effective. And so what happened was you most current participants in the marketplace created a govsp specific offering where they followed this process and they use this framework to plan and build a secure service kind of from the ground up. So fram 20x was explicitly designed as an opinionated security framework that tells you how to assure your customers the federal government that you securely operate that securely planned and built service. So by definition, if you have built a service under Rev Five and you are properly implementing all of those Rev Five controls, especially the Rev Five controls about how you continuously monitor and maintain your service, you should be incredibly well positioned to then provide that additional assurance of FedRAMP 20X to your agency customers as well as FedRAMP. You don't have to rearchitect. You don't have to remodel. You don't have to redesign or rebuild stuff. Um, actually, if you jump to the next slide, like we're going to talk about that like you are the best position in the marketplace. 20X was designed to create a straight path of I am Rev Five. Here's the assurance I should be doing internally and here's here's what I should share externally about that. You have you will not lose any work. you can maintain a FedRAP rev 5 and a Fed 20 certification very very easily especially with the rules and the SDR you're going to have and your assessment so much of it's going to be the same stuff. So our recommendation is that you start thinking about building out that assurance pipeline now. Most likely if you again if you implemented Rev 5 properly your engineering team, your security team should have the assurance necessary. You should be looking at these metrics like your team should know if people are logging into servers without using MFA or if people are logging into systems passwordless or if you have servers at all, right? like your team should already know that if you're following the rev five controls. So you're very well positioned to roll to 20x. Um next slide I think I don't have all these slides memorized. So like what we recommend is that you actually if you have a current rev 5 certification start working towards a feder 20x certification. There's a common misunderstanding in this rule where we say you have to pick one program certification of Rev 5 or 20X and as as like we want to be very clear that's just program certification right so if red itself my team of 30 people our team of 30 people we're not going to invest federal resources and effort and money into certifying you on two different paths but if an agency has certified you on one path then we'll certify you on the other path. So, I really want to start getting people thinking about this as you're planning your next year. Don't wait to be forced to move to 20X. And also, this is a great opportunity to explore it, to offer this to customers. You're going to have people that want it. Even if you're a class D Fedramp Rev 5, get yourself a class B or a class C Fedramp 20X and like start seeing how people use it. Get that muscle loose. Like, start figuring out. All right, I think that's the end of that section. So, we're going to Oh, no. Yeah, there you go. Think smart agency rev five and program certified 20x. You can have program certification of both, but you can split agency and program. All right, I'm going to add a timer here and then we're going to answer these questions that are already coming in. Although I think we probably won't have to set a timer if the timer is for people to ask questions. So, we've already asked that. Okay. Uh, first question. We're hearing that a lot of agencies won't be accepting 20x and are requiring CSPs to continue to provide Rev 5 style data for exactly supposedly DoD will not accept 20X. What are your thoughts on that and what actions are you taking to convert agencies? So Rev 5 is going away and those people will not be able to use cloud services if they don't update to 20X. Um but there's a whole lot of stuff. We got a Fed board meeting at the end of this month. We got agency use um agency cloud use framework in process, agency cloud use playbook in process. We are trying to get this word out. But again, I talk about this ad infant item. Uh this is a market issue that is like fed 20x is better. It is more efficient. It is more effective. It is fit for purpose. It does exactly what we were ordered to do and what agencies were ordered to do. Congress is getting involved. GAO is getting involved. Um it's better 20x is the right direction to go right now. Um next question. Since KSIs are measurements of outcomes, not security design requirements, if Rev 5 is going away as a certification path, how does a new CSP cso determine what design requirements to build towards without an agency involved upfront? If you're new and you're trying to build, you you can use the SP SP53. That's exactly what it's there for. If you need help, there's also a whole bunch of other cyber security frameworks that you can follow. Um, we're not particularly concerned about what framework you use to design your system. Um, but if you use SP53 and rev uh not necessarily rev 5, whatever is after that, and you follow that similar process to agencies, then you will absolutely be really really well positioned for FedEM 20X. Um, I am currently a Rev 5 class D. The next step for me is to meet CR26, then transition to program certified 20X class D via agency or Feder. Uh so agencies don't do uh FedEmp certification after June 11, 2027, and they don't do 20X certifications. Feder does. Um but what you're looking for there is your next step is to yes adopt CR26 and those rules and meet those requirements. Then we'd recommend on the side you begin developing a FenRap 20X package. um you can begin developing that today at class C. There's no reason to wait for class D because class D is just a a yes and on top of class C if you have a class C package. In fact, class D under 20X is going to require you to have a class C package first. So start building out your class C package over the next fiscal year working with your engineers etc as you have time and you'll be best positioned. Uh question from how does IL5 and NSS controls align to 20X class DKSIS? Um we don't pay attention to the extra IL5 or NSS controls. We have aligned class DKSIs based on the Fed ramp high, the historical fed high baseline. We're not trying to add extra stuff on just for fun. Um a question here. What about Feder moderate equivalency? What is the stance for CSPs that fall into the equivalency path? That's question uh that's a DoD question. Feder monary equivalency is not a federamp thing. That's a term and a process and a rule that was created by the department of war, the do. Uh if you want an answer to that, you have to ask them. Uh question here is does Ocalow fit anywhere here? Yeah, OSCAL can fit anywhere that you want it to fit. If you want to use OCAL and have tools to do it, you absolutely should. And it's trivial for you to convert that to the JSON schemas that we want that are much more simpler and designed for more portability. Uh is it true Rev 5 will go away beginning in 2030? Ye yes like that. So right now we have committed to Rev 5 through the December 31 2029 which is the end of the I think that's right. It might be 2028. Yeah, 2029. The end of the uh whatever the end of the CR26 applicability rules are. It's been a minute since I've thought about that. Um if you look at feder.gov /20x you can see our modernization process is intended to address um a transition path during phase five which will be in the last two quarters of this current fiscal year. So um by this time next year there will be clear timelines and expectations for that transition. Um, one more question here. Now, it seems like we might be getting into some random questions. So, I'm going to answer them really quick and then we'll go to the s the the last thing and then we'll do open Q&A. Um, any thoughts on how the agency will be using the 20X packages in their own atto process? Will they also be building KSIS for the controls they are responsible for in a customer responsibility matrix? No. So agencies have a process to follow that's like defined uh in the OMB A130 and that's often referred to as the FISMA process but really it's the A130 that outlines that and then directs uh as well as FIPS 200 and some other stuff like the SP 153 they follow that process. They use the KSIs to make a riskinformed decision about the inclusion of a external cloud service as an external service in their agency information system. Uh we explain a lot about that at fedramp.gov/2026. /2026 agencies which walks through how to build stuff and and that's where we're working to add more content. Um there's a question here. We're talking about REF 5 as an authorization path going away, not the need to map KSIS to 853 for agency consumption. Correct. I mean agencies don't have to look at 853 in order to make an informed decision. Actually the KSIs are we say this all the time. Check out the SB53. Um, I think B or maybe A that's about assessment. It has a whole chapter like about capabilities and that's how you can assess the security of a system. That's what key security indicators are and it's built into the 853. Don't confuse controls with 853 because the controls are just a part of it. Um, okay. Let's take a pause on Q&A. We're going to go do our last section. It's going to be quick and then we'll do some open Q&A for a while. >> All right, cool. Um, and because we were talking about dates, I went back and confirmed um, Rev Five is uh, a thing through December 31st, 2028. Um, after that, we're under CR27 rules and those haven't come out yet. So, anybody's game between now and when we put CR27 out. All right, let's talk about the current Rev 5 certification pipeline. Uh, right now, our average Rev Five review time is about 35 days. I say about because our um brave Bastion Rev five team lead is on vacation right now, a well-deserved break and um he tracks these metrics much more closely than the rest of us do. So uh we are getting approximate timelines. Uh so you'll notice that we are hovering a little bit above our our goal average of 30 days. This includes the time that you're sitting in the queue waiting for a reviewer to pick it up. Um, this also includes uh times that you are on hold. So, when we ask you questions and we're waiting for a response, um, this includes that time. Uh, if we exclude some of those waiting periods, then we're back under our 30 days. But to be fair, we want to track worst case um, as well as best case. Our current queue is sitting around 11 packages uh in active review. Uh four of those are on hold right now and we're seeing a troubling trend where Q2 of this year we had about a week um average on hold um for packages. Q3 was a um two weeks on hold and Q4 has been a month average that packages are on hold. So, if you are in our Rev Five review queue and our reviewers ask you a question or ask you for follow-up information or ask for some clarification, please, please, please prioritize getting that information to them because we are actively tracking metrics um around certifications and we want to get you certified as fast as possible. So, please be quick um to respond to us when we ask you questions. We also are tracking that we have quite a few that are about to enter the queue um because we have a number of people who have qualified for the ready conversion and the loss sponsor um processes. They are currently packaging up their package and getting ready to go. It's >> like 40 something like that to 40 that we're going to be doing. So >> there's a lot about to get dumped into the queue. So uh Rev Five team is busy as always racing racing to that June 11th date. So, um, get your packages in early, please. >> All right. I'm guessing we're not going to have too many questions specific to the certification stats. Um, um, oh no, my bad. A question just popped in. When Fedamp sends a follow-up, do the emails come from zenes or.gov just to make it easy to catch in email filters. Uh, so it could be anywhere. It kind of depends on where you are in the process and who's responding. So, keep an eye out for GSA.gov emails for sure. >> Yeah. Yeah. And honestly, like like our expectation is that if people are kind of slow to respond to those emails, it's not because they didn't notice them. It's because they're um you know, running around with their hair on fire trying to figure something out. Uh but like we had a I had a situation just really recently that was interesting where there was a lot of confusion going back and forth and finally our guy uh Paul was like, "Let's just get on a call. Like why are we doing this over email?" And the whole thing was just hammered out in 15 minutes. So, if you're confused at all about what's being like, it's not a trick. It's not a trap. We're not out here trying to get you. Just be like, "I don't know what you're talking about. Get on a call. We'll help sort this out." Like, we want to get you through stuff. Um, all right. I think we're we're we're moving into general questions now. So, like we'll go ahead and and if you want a general question to put a general question in in the chat, do that. While while we have that up, I want to show folks something. I'm going to take over uh from the presenter here and I'm going to show you the the change log. So the first question was about uh does have a having a plan in place to meet the VDR VER by December 7th sufficient to meet the requirement or do you need to be already meeting the mandate? And so um I'm I'm highlighting this because a about a week ago or a couple weeks ago we made a content update here which you can come and check every once in a while. Look at the change log here that adds explanations to what those deadlines meant that are very very specific. And so when it comes to the VDR and the VER, you the date that you're looking for is the maintain date, which means if you do not have those rules addressed on that date, Feder will request a corrective action plan from you. Fed doesn't cap people. We don't put people on caps. We request that you provide us with a corrective action plan about how you will meet that rule by the grace ends date. So if you're submitting that, if you have a plan to implement it, then effectively you have already pre-drafted that corrective action plan, which would be great. Um, and we'll save us all a lot of effort and you could submit that to us. Um, and we can, you know, give you a placeholder as you do that. uh but the expectation is that on December 7 you are meeting the reporting the evaluation the detection evaluation and reporting requirements and we'll talk about this you know again and again that's because on that date every single federal agency will be required to demonstrate to CISA that the cloud services they are using are meeting those requirements so FedRAP has given you a three-month grace period that your agency might not give you and that CISA might not give you and so we have tried to navigate that. But that timeline is based on that requirement. And you can bet even though right now you're not really feeling necessarily the pain because agencies are going through this process themselves. As we get closer to that timeline, there will be data calls and a lot more, you know, effort. I personally have been through many of these helping agencies in a lot of different situations and I have seen multiple circumstances where agencies have decided to simply turn off and stop using a service that hasn't met their requirements in order to get a threshold number because their CIO says I need 70% of our stuff to to meet this requirement by this date and then we'll do a a deviation or something. and then they look and they're like, "Which of these services can we turn off in order to get to that 70%." You don't want to be that service. So, like, get her done. All right, we're moving into general Q&A and again, uh, we got 20 minutes of this today and so we'll see what kind of happens through here. U, but want to emphasize we're not going to do too many 20x questions, uh, on this call because that's what our 20x community update is for. Um, otherwise we'll work through some of this stuff. First question, if a Rev 5 offerings agency in process designation expired and it was removed from the marketplace, but the sponsoring agency is still actively reviewing the package, can it return the agency in process if the agency confirms it commitment or does it have to go through the loss sponsored pipeline? So you're it's if the agency review is still in process, you don't have a lost sponsor, you have an agency sponsor, highlight that this is a a good example scenario of why we're moving away from agency sponsorship and into the federant pipeline because the expiration is a year, I think. >> So So if your agency hasn't moved something forward for a year, but they're still moving it forward, that's kind of woof, right? Like that's a long time and you're probably been in feature freeze that whole time. Like that is no good. Uh your other option would be to just pivot to Federam 20X and get yourself a program certification at class G in uh 60 days, 30 days after it comes to us. But um yeah, uh get us get your agency to send us an update on the form and that says you're still in process and we'll put you back on the marketplace. Make sure that what do you have to do to get back on the marketplace? >> Oh, you have to fill out the marketplace listing form >> and have a JSON file with your marketplace info. We don't we're not just going to restore it from our backup. Okay. Uh Nicole, do you want to handle I'm doing these as old as first show unanswered. Do you want to handle this one about the VR uh and N0? >> Let's >> Oh, no. Never mind. I already answered this one. Uh pain time frames are not applicable to N0. >> Fine. I'll mark it as answered. >> It doesn't need to it doesn't need to be listed there. I think that's fine. Like zero null is null. Um, okay. I'm gonna in the next in the last meeting, correct me if I misunderstood, uh, I understood that false positives can be filtered out before uploading the scan report with N0. Is an N0ero essentially intended for findings that are false positives or have no impact on the system. Uh, so there's a rule about false positives that you can follow and should follow because it's a should it's a should rule and that gives you a way of approaching these. Um the problem the the pain rating required you to even evaluate the potential impacts of false positives. So now with the N0 you can just auto say if there's a false positive then it's an N0 job done. Uh to be specific for Rev Five certification holders, they are not currently required to implement KSIs until January 1, 2029. To be specific, no REV 5 certification holders are required to implement KSIs. KSIs are part of a 20X certification. On January 1, 2029, you may be required to have a Fedramp 20X certification. Your refive certification may go away. It's probably not going to be on that date. We got to, you know, like I said, the transition stuff over the next, it's in phase five. Over the next year, we'll sort that out. What we're saying is it's going to happen. You should be working towards 20x now. It's it's just like think of this. Think of 20x is not just a compliance thing. Like 20x is valuable to your business. Talk to anyone that is deploying it and using it. is valuable information that is designed so that your syso and your sock team and your engineering team all care about that information. You should be doing the 20x no matter what because it's the right thing to do. You should be doing a lot of it already as part of rev 5. You're just not reporting it out to us. So it's not this this thing of like when do I have to do the ksis. It's for now. You should be using those as a really convenient framework to prove to yourself that your Rev Five decisions are right and that you're doing a good job inside your company. And as you do that, that will help you transition to the new certification where Better Ramp is focused on assurance rather than telling you what to do. Okay. Um, question. Did I understand correctly that a rev 5 class D will have to be a 20X class C before they can have a 20X class D even if they wait until next year when all timelines for D are in place? I got great news for the questioner of the person asking this question which is that there's an RFC available right now which I think closes in like two days uh where we highlighted this and there's going to be another RFC next week where we have the specifics but our intent yes is to require a class C 20X certification for at least 6 months and then you uplift to class it won't be called an uplift but then you apply for a class D. Uh there's a couple reasons behind that. The first reason is that doing a class D all by itself is a massive massive effort. We'd like to know how your security works and that you have good assurance in place. Start with class C. That gives you a base as a foundation and then when you do the class C to class D, you're only assessing the deltas. We're only assessing the deltas. It is a lot more chill. We can do a class C to class D really quick. Um but it's just a much lower risk and effort for everyone to have class C first. Like it's don't think of it in the Rev Five way of like I'm going to spend $3 million on this assessment so I'm just going to might as well do the class D like as I do it. That's not how it works under 20X. Um okay. Uh there's a question here about VER RPT HLLO which says that providers should include highle overviews of all vulnerability detection and response activities conducted during this period. they're struggling to find what period this rule is referencing. Um it's the reporting period which I believe is a couple rules up which tells you that you have to persistently report information. So if you choose to persistently report information every um month then you should have high level overviews of all of the vulnerability detection response activities uh over the last month. If you report every week then it should be every week. Mark that is answered. Um question, what specific value requirements does the quarterly OCR add beyond what monthly conmon meetings provide? So don't close this out whoever's closing out questions because there's two of them. Uh so this is replaces the monthly conmon meetings and the monthly conmon meetings are primarily focused on reviewing POM spreadsheets and they're not really productive or useful. Uh so instead you have a quarterly report that has all that information that is sent out that can be reviewed followed by a meeting where uh the agencies can learn about what's changed and what the security issues and things like that are about your cloud service. So it's much less effort for agencies because we can focus on reading reports and data um as we have time and it's much less effort for cloud service providers because you can have a meaningful engagement on a monthly basis that isn't arguing over the same 16 poems that are still not resolved. This does not mean that you don't talk at all between in those quarter periods though like it should be more of like if an agency has a question they can reach out to you and get clarification about that question even if you're not in a quarterly conmon update. >> Yeah. Yeah. So and then the next question here which shows shows like one of the underlying issues here um is do we need to decide this directly with our agency sponsor and if they agree it's already covered by monthly meetings are we good to proceed without a separate quarterly meeting? Uh so sponsorship is only relevant for initial certification. There's no such thing as an like once you have your uh Feder certification. You no longer have a sponsor. You are required to meet Feder's requirements and the requirements of all of your agencies that use you. If you have just one agency that uses you, um provide them the best customer experience that that they want. Um but you still have to meet Federant requirements on the side. Uh so some agencies might want to meet with you uh every Tuesday for coffee and if they want to do that you should put that into the contract and provide them with that customer experience to make sure that you have good stuff like Nicole was talking about like uh Fed Ramp doesn't set set the maximum amount of communication and engagement and assurance that you provide we set the minimum amount of engagement communication and assurance uh apps have historically been considered poison pills for CSPs. Is the Federate PMO doing any work to help agencies understand that caps will be more commonplace for the next while and more closely reflect program adherence versus risk posture of the system. So there's a few aspects of this that are interesting. Um I don't think that it necessarily is accurate to say that it reflects program adherence versus risk posture of the system. Um if you are in remediation and you are um working under a corrective action plan it means that you have some significant vulnerabilities that is that create massive risk for an agency using your system. If you are not following the new requirements from CISA for vulnerability detection uh and response then like that is a risk that is not just like you're not meeting better app requirements that is that you are not responding to vulnerabilities in an appropriate way for the modern era. Uh so you're going to you're going to be placed on inter remediation and we're going to warn folks about that. Uh it's not a intended to be a poison pill. It's a intended to be a thing that you can communicate very clearly that over the next few months these are the risks to your data because of me not meeting these requirements. This is what we're doing to address those. This is how you as an agency can mitigate those risks yourself to continue to operate it. And like it's a critical critical assurance thing. Um when there are egregious breaches of federal amp requirements, a corrective action plan provided by the c by the CSP is not a poison pill. It is a very clear statement of intentionality about your reasons and ways to fix it. So I think historically even just like the the terminology that we use right like oh feder put them on a cap like that's not how this works in the modern day will say like you're not meeting your certification requirements what is your plan to correct your action in order to meet those requirements and then you get to share that. So it's like an opportunity not a poison pill. Um, and agencies are encouraged to make risk determinations of their own. Uh, there's going to be some agencies that won't touch you if you're not implementing the VDR and the VDR. There's going to be agencies that won't care is what it is. That's what FedRamp's here for, but we want to make sure that they know. >> This is kind of across the board too as well, kind of going back to the philosophy of some of the changes that are happening at Fed Ramp. Um, is that we don't necessarily expect perfect packages. We want to understand the actual risk of using a service. And so if I go to your trust center and I see green check marks on every single category, I have more questions than I have answers at that point. So like be upfront with us. And we're working with agencies on that too to kind of change that perception. >> All right, we have a ton of questions in this queue already. So, um, just acknowledging that if you're thinking about adding a question, it's probably too late. Um, but we're going to work through what we have here. And this is why we want to dedicate a whole hour to Q&A because like, woof. I'm going to take a moment to just be like, remember, we say this every meeting. You don't have to come to these meetings to ask these questions. Uh, we answer these questions every day on our GitHub discussions forum and then everyone can see those. Like, we we love that. We really prefer that or this over you sending an email to info at um with a general question. But like ask them in GitHub. We're out there. We're we're crushing it. We're very responsive. Uh okay. What is the burden of acknowledgement with the SCN transformative adaptive time frames? Um it's in the rules. You have to send it. Uh you don't have to get an acknowledgement. The expectation is that agencies and customers are paying attention. And if they're not, then they've accepted the risk of not paying attention. Uh, does the PMO still intend to release an RFC covering LISA's retirement? Yes. Uh, over the next by the end of this month, hopefully. Uh, you might recall we did an RFC on RFC's, a retrospective on RFC's not too long ago. And the thing that we heard a lot of feedback on was that we shouldn't have 14 RFC's open at a time. So, we've been trying to keep that uh number down as we promised. And this one is less timely than some of the other ones that we have going out. Ryan's pointing at me like, "Give me a thumbs up." He's proud of me. Uh because I just want to have RF I just want to have five RC's open every day. Like let's just go. Um fun question. All right. I haven't read this question yet. Well, let's find out if it's actually a fun question or not. Any chance newly certified CSPs can get one of those awesome Feder stickers you shared on LinkedIn when they hit the certification milestone? Oh, that is lovely. Yeah. So, you can get awesome Feder stickers. Shout out to our boy James for getting those stickers made the last set. Um, you can get those stickers by going to an event that FedRamp is also attending. Now, that makes things a little bit hard, but that's that's what we can do. Um, maybe one day we can talk about having you sending a self self-addressed self-stamped envelope uh to to GSA and we can send those out in the in the mail. I like that. >> Until what date can CSP still go through an initial Federant Rev 5 agency off pass? When must testing be completed for this? So, one of the things that we work really hard to to to kind of deal with is a reminder that like we're a federal agency program. We're the we're the US government. I know that some of us uh have shinier colors than most US government people, but like that's we are the government. You are using government resources when you ask questions that can be found in a basic Google search or like your own research. We ask generally like when you ask questions of us especially in like large you know groups like this has 250 people in it um as well as sending emails to info at that you uh do a little bit of research before asking a question because chances are you can find the answer yourself uh in this case that is very clearly June 11 2027 it's it's all over a lot of our documentation uh Pete you had noted on GitHub that agencies determine data sensitivity however the rules say CSPs obligation for the use of FIPS validated cryptographic modules depends on class. Can you clarify the expectations for the use of FIPS validated cryptographic modules? Yes. Uh so agencies determine data sensitivity. However, uh Federramp determines the minimum assurance required for different class systems and uh historically agencies that use high impact systems from FedRAMP or class D systems expect FIF validated cryptographic modules to be used across the board. Um if we simply relax that requirement for class D, uh we would put a number of agency decisions that of already used services at high risk. as well as the fact of the matter is that if you're coming in at class D, you're committing in advance to sensitive workloads, whereas class B and class C aren't necessarily committing to sensitive workloads. So that's why uh Feder class D always has much stricter requirements and will continue to have uh more and stricter requirements because effectively you're saying my service is good enough that federal agencies can use this to store data in a way that people will die if something goes wrong with our service. If you're not willing to make that commitment, you shouldn't be at class D. If you're on the federant moderate equivalency path, I'm not going to answer the rest of this question because I don't know the answer. If it's federant moderate equivalency, you'll need to talk to the department of war about what their madeup federate moderate equivalency uh rules are. If 20x class C is required before class D, how will FedAmp counter the perception of a downgrade for services that converted from rev 5 class high to class D? So, we're saying you can run both at the same time. So you can have your rev 5 class D and then get yourself a 20X class C and then go from there to a 20X class D if you want it. Um there there's the vast 80% plus of the uses in the marketplace are at class C. The idea that it's like a downgrade or whatever. It's just silly marketing stuff. You should even have class C versions of your offering available that are cheaper, more affordable. Um you can have class B versions of it. Like don't don't think of it as like a sticker that you got. It's a level of assurance that you're providing. There's nothing wrong with providing two different levels of assurance. Um, we're coming right down here to the end. If you already class C rev 5, will you have to do class C 20x before class D? Yep. If you try to change our class C to a class D vjent marketplace listing, will you hold that against us or consider as form? Yeah, that's red teaming, bro. Do it. Like all good. uh like like I will yell at I will not yell. I will uh gent gently give sad puppy dog eyes to our dev team if that happens but uh we're not going to hold that against you uh with regard to reporting incidents and considering vva grv can you provide some examples of these logical groupings? Yeah, logical groupings are going to depend entirely on the cloud service provider and your environment and your approach. Um, but as a reminder for folks, this rule says that you should group vulnerabilities based on logical groupings. So that could be um all all of all of the vulnerabilities that are on this version of the container that we have deployed 8,000 times. That's one vulnerability. That's not 46,000 vulnerabilities, right? Like if they're logically the same and they're grouped the same and you're going to fix them in the same way and they have the same likely impact, logical grouping. You might group it based on like these are all vulnerabilities that apply to this specific geographic location or this data center or this tenant. There's there's so many different ways that you should group it. The reality is that your security team almost certainly is already doing this. So talk to your security folks about how they approach this as well as your engineering folks and you'll get a lot more. But like that's that's the intent is that that be really open. uh you should never have vulnerability listings that are like thousands of rows long. That's not logical grouping and you can't work through that at at the appropriate speed. You have to group them in a way that makes sense as the way you're going to fix them. Okay, last question I think because oh, we're kind of we're almost here. Only 24 of 246 CR26 rules reference a JSON schema. Uh, okay. The JSON schema tells you how to implement those two how to report on those 246 rules. The this so the rules say do a bunch of stuff and then there's one rule that says tell us how you do this stuff and that rule has a schema that tells you tells you how to tell us to do the stuff. Hopefully that makes sense. Um, okay. There's a couple more questions here but it looks like we just hit two o'clock. We got to respect everyone's calendars as well as my own uh and OM who we have a meeting with right now. So, we're going to drop here for today. There are some great questions still in the chat. We'll remind you as always, just post them in the GitHub discussions and then you can get your answer from us. I hope this was fun. Hope you learned a lot. We'll see you some of you maybe at the 20X next week um or the assessors uh community update in the week after. Cheers everyone. Thank you so much.