FedRAMP Rev5 Community Update

recorded. Don't worry. Only the four faces you see in the on the right side of your screen are the only ones in the recording. We are recording now and I am going to do the normal spiel from legal. I am communicating to today in my official capacity on behalf of the FedRAMP team at the General Services Administration. We hold these meetings to enhance transparency between industry and FedRAMP so that we can open dialogue we can open a dialogue and share new developments. Nothing that we say or share constitutes as business advice and any reference in the conversation to any specific commercial product or the use of any corporation name is solely for the information and convenience of the public does not constitute endorsement, recommendation, or favoring by the GSA. We have a pretty packed agenda today. If you're ever been on the FedRAMP.gov website in the last week or on LinkedIn, you know there's a lot going on with the publishing of CR 26 next week or last [snorts] week. Go ahead Don and hit the next slide. So just kind of high-level discussion points today. FedRAMP cybersecurity services which Nicole will talk about here in a second as we're working through finalization some of our 15s, working through our 14 resumes and hopefully getting ready to post 13 soon. Notices there's been a lot of notices in the last time we've met. I think late May. We're missing late May through all of June. And then a a quick discussion on CR 26 things that you should know as you're navigating the rule sets some of the things to look at and then finally we'll top it off with some Q&A. So next slide, please. Think over to you, Nicole. >> [snorts] >> Cool. All right. We are still working on bringing people in for the FedRAMP cybersecurity process service. Wow, it's been been week. Um so we're in the middle of uh evaluations for the GS-15 and 14 candidates. Um, we still hope to have a GS-13 opening soon, but uh no ETA on that job opening yet. So, we'll keep you guys updated as we continue to move through the process. All right, next. All right, we've been super busy and we have a lot of updates, especially since we canceled June's meeting um because we had so much going on uh and not a ton of updates from May. So, we're combining a lot of information into this one. Um, so a while ago we put out RFC 25 that was talking about um taking another look at our public comment process. Um, so we heard all of your comments loud and clear. We know we put out a ton of RFCs this year. Um, a lot of them at the same time because we were under deadlines to get stuff out. So, um thanks for bearing with us. We really appreciate all the comments that we got from people. Um, in general moving forward, we're going to try to release no more than three RFCs at a time um to hopefully keep workload for you guys a little bit easier. Um, as we get closer to things like CR-27, we may be bumping up against some deadlines and have to release a few more at a time, but we'll try to keep those occurrences at a minimum. Um, we will also start um giving feedback based on general comment themes so that you understand why we're making certain decisions that we're making. Um, and then we're looking at extending um potentially uh some of the uh response windows so that you guys have sufficient time to actually respond, especially if we have some really content-dense material that you guys need to um review and really take in before you comment on it. Or if we're releasing more than one RFC at a time, we'll try to give you guys as much as possible um to to be able to review those documents. Okay. We also talked about um some changes to the incident communication procedures. Um in general, uh we didn't make too too many changes to this, but we did make some intentional changes designed to um reduce the overloading of terms. Um and so adverse impact has um some very specific meaning in industry and in the federal space. So we changed it to potential agency impact so that we focused on um really looking at how an incident will affect an agency's uh environment. Um and then um we have reporting requirement time frames based on your assessment of the incident um and what class level you are maintaining a certification at. So please review all of those. They are released as part of CR 26 um and uh will be a normal part of FedRAMP certification moving forward. Um what's next? Oh, Rev 5 baseline RFC. So these are the ones where we dropped like six of them on you at a time. Um but we did that in part because it was all focused on Rev 5 controls. So in general, um as we were reviewing comments and taking a look at the the material that we were working on, we we realized that a lot of the FedRAMP assigned control parameters or the FedRAMP specific control guidance um actually resulted in less secure outcomes for cloud service providers. So, by setting um specific control parameters, we were ensuring that cloud service providers reported that they met that particular parameter, even if that parameter is not really appropriate anymore for um operating a cloud service in 2026. So, rather than trying to continually update and tighten a lot of those parameters, we are allowing industry um to differentiate themselves by setting their own organizationally defined parameters for um the places that NIST allows organizationally defined parameters. Um this really focuses a lot more on NIST's intent um that we tailor controls, that you guys make business decisions that make sense for your environment instead of defaulting to a set of um a specific federal parameters. Also, this is in line with us moving more toward the environment where cloud service providers are in control of their cloud service offering, and they can make organizationally defined parameters based on what makes sense for their own cloud service offering, um and they don't have to necessarily adopt federal um requirements by default. Like, the federal agency may be beholden to certain parameters, and they can configure their tenant in the way that they would like to, but if a cloud service provider wants to run their own commercial um service differently for very specific reasons, we're allowing you to do that. Um so, you'll still have to tell us what ordinarily organizationally defined parameters you are using, what you are setting, what your objectives are. Um but we are not going to define those for you anymore. All right, next. Uh this one was really exciting. Um CISA released a binding operational directive mid-June. Um this aligned very closely with FedRAMP's um vulnerability detection and response and vulnerability evaluation and remediation requirements that had been out in some form or another since basically last August. Uh this focuses on um evaluating vulnerabilities in terms of public reachability, exploitability, um and impact to actual customer data. So, um the the binding operational directive is very much in alignment with where VDR VER already was. Um however, the the implementation dates were a little bit out of alignment. FedRAMP had these originally um going into effect later on next year. As a result of CISA releasing the binding operational directive, we are moving up that timeline. So, now VDR VER is mandatory by December 7th. This meets the timeline um as outlined by CISA in the BOD um and then your grace period ends in March. So, if you have not fully adopted VDR VER by March, that is when um we start revoking uh FedRAMP certifications. So, keep that on your radar. All right, next up. Ooh, this is your section. Have fun, Paul. >> Hey, perfect timing. And and Alex, we'll actually get to your question here in a minute. Um but uh yeah, as I said last week, uh CR 26 went live. Um we are going to go a little bit through uh some of the high-level dates associated with the the rule as a whole. We're going to go We're going to discuss how to find the rules explicit to Rev 5, explicit to 20X, and then talk about what to look for um in some of these individual rule sets uh themselves, right? All of them have cascading timelines. Um, what we didn't want to do was set an arbitrary date that everyone, you know, was required or forced to do everything. Uh what we did is we did look at each individual rule set. We looked at other um other factors um that are either FedRAMP specific, CSP unique, um tied to another um executive order, and we tried to tailor all those individual timelines to those requirements. Um, so go ahead and hit the next slide, Don. And for everyone here, uh it's I realize it's a lot harder to read than it was when I was making the slide today. Um, but we we did try to keep the URL up on the top, but if you are actually looking at the the the top uh as well, you can see kind of where on the on the consolidated rule set we are by looking at the the top row and then the left-hand side, right? We're clearly in the overview important dates columns, right? These are the important dates across CR 26, right? And there are just a few dates um we want to focus on, right? First off, clearly optional early adoption. Uh most of the rule sets do have an optional early adoption period. Um, that will fall on July 4th, which is 3 days from now, but technically when the consolidated rules are in effect. Um, we did pull down if you are following the old kind of BIR um timelines, we pulled down all that documentation and the forms associated with it as well. Um, so you shouldn't be able to access those. Please use the new links, the new uh the new forms. Um, but yeah, so July 4th, I think one of the the the biggest, especially from the Rev 5 uh perspective, that we should be following, right? And I'm going to go all the way to the end first, cuz I think that's probably the one that's most important to folks is the end of new Rev 5 certifications, right? June 11th, 2027. That is not I get to my agency by June 11th, 2027. That is I get to the FedRAMP PMO by June 11th, 2027, right? And for everyone who knows or who's been a part of the Rev 5 process, right? Whenever you want to go in process with an agency, you're required to do a work breakdown structure with estimate your timeline, as well as, you know, have the agency acknowledge that they're in process with you, right? If your WBS is close to or after June 11th, 2027, right? We need to start thinking about working with the agency to to consolidate that or figuring out how to migrate to 20X. You know, that's it's we've been doing the consolidated rule set in public for a while now, and uh a year is enough timeline to transition. I recognize there's one or two agencies that have an elongated timeline, but we we're not going to hold up the entirety of the processes for one or two agencies. Um Yes, please pardon, perfect. Once again, we talked a little bit about, hey, there are there are Rev 5 specific timelines for rule sets and there are 20X specific timelines for rule sets. They do differ based on the individual rule set itself, but if you go into the cloud service providers on the top and then scroll down into important deadlines and click the Rev 5 deadlines, every single Rev 5 rule has has four timelines, right? And it's the optimal adoption period, right? Which starts July 4th. If you can opt in early, that allows you to opt in early, right? Obtain and maintain, right? If you are initially obtaining your Rev 5, and this is the same for 20X2, right? If you're initially obtaining your 20X2. If you are initially obtaining your certification, that is your mandatory date that you must adhere to the rule. Most of the time that's a lot earlier um than than if you're maintaining. Now, if you're maintaining, this says, "Hey, I currently have a Class C certification, so this is the time frame I'm required to implement it." Uh grace period. The grace period ends, and most of these have hard dates. There's one or two that have dates tied to CSP dates, um and we'll talk about that in a second. Um but that's when if the action to maintain didn't happen, and you've passed a grace period, right? Um we will start doing formal corrective actions. Um and for some of these, it's not just formal corrective action, there's there's potentially that that your certification package isn't available to anybody, um right? And so, let's hit the next slide, and that one will make a little bit more sense, especially talking about CSP unique ones. Certification data sharing standards, uh right? Uh we all know connect.gov is the way, right? The intent is if you are getting a new um a new certification, you have a CDS compliant repo, uh um and if you look uh on the top, there's the effective dates for 20X and the effective dates for Rev 5. I'm clearly talking about Rev 5 in this discussion cuz this is the Rev 5 community, um right? You have your obtain date, so if you are getting a new certification, um after January 1st, we will not allow you to use connect.gov as the repo. If you are maintaining it, right? You have until uh August Yeah, August of uh 2027 to get off of the connect.gov repo. The grace period, it's important this one cuz we're not just talking about a cap. Connect.gov for FedRAMP goes away that day. Right? So, there is no there's no secondary um there's no secondary things that we can do if you are not ready to that. So, you are more than likely going to both get a cap and potentially lose ATO, right? So, you know, if you're not providing your authorization data to your your uh agency. The second one is is unique in the sense that um you know, clearly the same rules are are followed, but for MAS, it makes no sense for you to transition to minimum assessment scope when you're not working in an assessment window, right? You to transition to MAS mid-year when you're not having a 3PAO assess that that uh minimum or that scope really doesn't make sense. So, while there is a maintained grace period of of the January 1st, 2027, the reality is is whatever your next assessment window is [clears throat] after January 1st, 2027, that is when you are required to transition to MAS. So, if you happen to to do your you know, if your assessment date happens to be January 2nd, 2027, sorry, that's coming a lot faster and a lot quicker. But, if it happens to be, you know, December 20th, 2027, you've got some time to think about it, right? Cuz transitioning before an assessment is just time that doesn't need to be spent on it. That'll have to be updated whenever your assessment is due. Um so, like I said, all of these dates are tied to either FedRAMP requirements, CSP unique requirements, or other federal um mandates that are out there. Um so, there are a lot of dates and it's super important that you kind of understand where your CSP is and where you need to transition that. Um go ahead and hit the next slide, Don. I talked through all these. Um so, once again, the last one I would point out, grace period. That those are the dates that correct corrective action will start applying. Uh Right. And and in some instances, those are the dates where we are no longer supporting things we had previously supported. Um Yes. Transition to templates. Now, you'll know if you are an agency who provides us ATOs regularly, you'll you you already know this and I'm sorry, we could have done better comms, 100% on me on that. But we are transitioning Oh, no, I'm sorry. This This is templates not forms. Um Uh We are transitioning away from templates with the implementation of CR 26. You'll notice um there all of the templates have migrated to a legacy folder. I believe it's If you type in fedramp.gov/rev5, it'll bring you to the legacy, but it may be fedramp.gov/legacy as well. Uh but all of the templates are there. Uh all the old templates are there. They'll be there for a little bit of time, but every single one of the templates, whether it's a Word document, an Excel file, what have you, all have a notice um on top of them that basically says, "Hey, this is a legacy document and it's being replaced." Um you know, please please make sure you stop using it whenever it is appropriate for based on where you are. Um right. So, please once again, it goes back to the understanding those timelines, understanding how those timelines affects you as a CSP, um and us trying to do everything that we can so that, you know, come January 2027, someone's not submitting their, you know, Rev 4 SSP that's been out of date for years. Uh right. Um Yeah, I think that's all I got to say on on legacy. All of the information requirements are in Consolidated Rules 2026. They are both in human-readable form as we've kind of been walking through, but all of the rules are structured in hierarchical. Um and they are available in JSON as well. Um, so if you do have a GRC, you don't something that you want to suck all the you're absolutely um you're absolutely able to. Um, forms. Okay, this is where I thought we were going earlier. Um, we are Let me start at the bottom. We get about 14,000 um unique tickets a year, 16,000 if you account for all of our spam. Um, and we get some pretty good spam, too, by the way. Uh, some really good generated AI spam. Um, but uh we get about 14,000 unique serviceable tickets a year. Uh, there's no Ben Ramp Zendesk team in the background doing all sorts of cool stuff, right? There's about eight of us, right? If you if you if you're dealing with Marketplace or ATOs or Intake, you've dealt with Chet and Alex, who are who are the the muscle behind the majority of Zendesk, right? But if you're dealing with Rev 5 or you put a Rev 5 question in there, you get Donna or I, right? If you've got a 20X question, you get Emu or John, right? If you've got an OAG concern, uh FOIA request, blah blah blah, you get Nicole and Ryan, right? Like, there is no Zendesk team that you can elevate to the PMO to you're at the elevated peak of the PMO when you're in Zendesk. And all of our triage is currently done manually, um and parsed to teams. Uh, so the end goal is to really get rid of in not get rid of info app, but get rid of the ability for everyone and their their mom to be able to email info app and put every all of our normal requests into kind of a structured uh ticketing system. So that, "Hey, I've got a a technical question for Rev 5, I can go to the Rev 5 form, I can input my technical question, it'll get auto-assigned to Paul and Don, life will be all right, we can figure out internally, um and we can kind of track metrics associated with it." It's been a little bit of a wild west just with all the changing in personnel and structures and losing some of our tools and accesses over the last year and a half which I'm sure [clears throat] is is common for most of you. But that's what we are trying to do. We are actively piloting the ATO submissions. So if you are a federal agency submitting an ATO for the first time for the 32nd time, right? We are asking that you use a form. And you can see the list of forms, all of them say not live except for one that says pilot live, right? Like We're still getting people filling out the forms, right? If you fill out any of those forms, you're going to get a rejection email. It's going to close and nothing's going to happen. When we go live with those forms, that form will say live and you know, we'll we'll have a better kind of go live dates as we get closer um to CR 26 launch. I'm certain I'm missing something. Yeah, that's I think all I've got from that standpoint. And last but not least, you know, one of the the cool things Emo and Nadine and and Ebu and Emo, Ebu and Nadine put together, folks on our team, for some of our folks who were you know, so with their solely Rev 5 practitioners or their solely 20X practitioners and they haven't been exposed to a lot of the CR 26 thing is is that hey, we put together internal jeopardy for all of our team so that we can start as kind of a fun thing going through and and testing ourselves on some of the rule sets. Pete saw that one day and was like hey, this would be great to push out I I think as a whole, right? Just as a fun activity for folks, right? If if CR 26 isn't exciting for enough for IT folks, then jeopardy to make it a little bit more exciting. And if you go on fedramp.gov/trivia and yeah, I think that that may be the last slide and then we'll get here into the Q&A. And and Alex, I I see your question about specific FedRAMP compliance to VDR standards. I think we answered that without answering that one explicitly, right? If you go to the rule set, you'll you'll be allowed to kind of look at, "Hey, am I the first time, you know, am I an obtainer? This is the first time getting a certification. Am I the main Okay. Am I the maintainer and what's the grace period? Um and I believe Nicole answered in the chat about penetration testing guidance being retired. Yes. >> Yeah, I'm going through and marking the ones I answered, but it takes a while. >> Oh, oh my god. Okay, I'm sorry. My apologies. >> Um All right. Let's get into Q&A. Um and we didn't take nearly enough enough time presenting all the information, so we have plenty of time for Q&A. Um okay, with the assume it's automatable rule, if CISA vulnerability says a CVE is automatable, are CSPs able to overrule that determination if they can prove it's not? Um Y- yes, in general, FedRAMP's position is do what makes sense for your environment. So, if you can prove that something is not automatable, uh be my guest, but that sounds like a lot of work. Um that might be better spent just fixing the vulnerability. Um Can you also cover Rev 5 without agency sponsorship and how that aligns with CR 26? Oh, yeah, we should have talked about this. Um so, program certification is extremely limited. Um it's not a free-for-all, at least on the Rev 5 side, for everybody to come through as a um uh, program certification. What it has, um, primarily been designed for are cloud service providers who were already in process with an agency, had already done a significant amount of work, um, to toward their FedRAMP certification, and then for various reasons, um, were dropped by their agency, couldn't find another agency sponsor. Like, there was a lot of chaos and contractual things happening, uh, over the past year and a half with government. Um, so we wanted to give cloud service providers who had done a bulk of the work, um, to get a FedRAMP certification, the opportunity to finish that work and get a FedRAMP certification on the other side of it. So we are opening very specific windows for class B and class C certifications on the Red 5 side. This is not available for class D certifications because of the level of work that is required, um, for uh, uh, certification at that class level. Like, you still need to have an agency sponsor for FedRAMP to put in the amount of resources it takes to review a class D certification package. Um, all of the, um, rules and everything that cover that path are available in CR 26. Uh, you can search program certification, it'll pull it right up, um, and we will be releasing additional information as this, um, those application windows get a little bit closer. So you'll see like forms for applications with specific requirements that that you can go down, kind of like a checklist to make sure that you have everything you need ready for that. Um, but if you don't fit into that like group of people that have, um, already invested a significant amount of work in the FedRAMP process, this probably is not the certification path for you. All right. >> And >> [clears throat] >> Pete Pete is, I don't know if if folks don't know this, Pete's been on leave for a little while, um, but he's horrible at taking leave, um, and he was just chatting with us probably earlier this morning and late last night about this specific thing, right? Is that there is going to be an expectation that if you tell us you lost your sponsor, you're going to have to show us something that says you lost your sponsor so that we don't just get kind of, you know, everybody trying to push through the door because they've they've got this, you know, timeline. I would also say that those timelines associated with it are, um, between January 2025, I believe, and March 26, if I remember correctly. Um, yes. So, I'm very similarly to the the adjust [clears throat] the adjustments in federal contracts and federal personnel. Yeah. >> All right. Um, in some VER rules, um, it talks about some of the reporting requirements. All of the, um, reporting requirements are very explicitly listed in the rule set. So, please go review the rule set, um, in detail. And I will say that the rule set is designed to be like minimum expectations. You are welcome as a cloud service provider to exceed those expectations, um, in ways that better serve your customers. So, um, feel free to treat all of these rules as like the minimum expectations, and, um, you should definitely be aiming to exceed those expectations, especially as you're looking to differentiate yourself, um, in the federal marketplace, uh, with agency customers. Uh, agency customers are dying for really solid, um, customer-centric, like easy-to-use services. So, um, opportunity is ripe. Uh, templates are written into DFARS. Ooh, that's unfortunate. Um, will the templates still be available? Uh, yes, on fedramp.gov/legacy. All of our legacy documentation is still there as it existed the day that we posted CR 26. So, if you're looking for templates and things that are way older than that, uh, web archive might be your friend. Let's see. In May, there was a comment about hosting our own docs trust center with connect.gov going away. Um, one thing that stood out was a statement indicating that this data is ours and not necessarily federal data. If I have a trust center like SafeBase non-gov, can that be used? Um, potentially. Like this is all of the information contained in a FedRAMP certification package is your business proprietary data, potentially proprietary data. It's your business data about your service. So, you as a business decide how that data gets protected, who you share that data with, how you share that data within certain rules that we've set up for certification data sharing. Like we we do stipulate a few rules about how it must be made available to federal customers. Um, but in general, you as a business are in charge of um, how and where you share your data. So, make decisions that uh, meet your business requirements. >> And Nicole, I dropped the the link to the the CVS rules, formerly the ABS rules, in the chat here. >> Amazing. Amazing. Okay, are there templates or examples on how to convert from these legacy document templates to their CR 26 equivalents? We have not put out any like conversion templates yet. Uh, we've tossed around uh, ideas about like creating um, some example documents in the new format so that people can see what they look like, but at the same time like we don't want people taking those examples and then using them as the new template. Like we intentionally don't provide templates so that people can make decisions based on what works for them and their particular cloud service offering. So we have released some limited schemas that help people organize information. Again, those schemas designed for like very minimal requirements. So like it's expected that a cloud service provider will flesh out the schemas a little bit more to make it work for their particular certification package. So kind of treat it as a starting point and iterate based on what works for you from there. All righty. Um Feel Paul, feel free to take over at some point. I'm just kind of reading down the >> Sure, the the VDR there's a question in here about the VDR deadlines and our basically our POAMs in their current form no longer applicable at applicable at that point. The answer is is yes. Right, both the VDR and the VER has multiple reporting requirements. Um There's also an ongoing HC report requirement as well that I believe is every 3 months. So there are there are multiple reporting requirements that essentially not negate the POAM but will replace the POAM. So so yes. Um and I think we've we've had at least two or three questions of can I still use a POAM and adjust it to meet some of the OAR reports. You do you. If you meet them the requirements, how you report that to you and your agency customers is is up to you. Right, whatever is easiest for you and easiest for your agency. Um, if it fits the minimum information requirements, absolutely fine with us. >> Got it. Um, Mark pointed out that it there's a link in the D FARs um, to some of our old templates. So, uh, yeah. Uh, update your link to the new legacy information. Uh, fun fact, uh, they they released a big update about um, the FAR overhaul um, request for comment period and even that points to some uh, websites that we deprecated like two days after that got released. So, uh, we're continually updating. Under program certification, without an agency AO, who makes the decisions on deviations, risk acceptance, etc.? Okay, under program certification, theoretically, you do not have an agency that is currently using your service. Um, so, in that case, like as part of um, collaborative continuous monitoring, like you should be making regular updates to your service. You're the one that gets to um, make uh, uh, decisions based on your cloud service offering, your business priorities, all of those things. As you start acquiring uh, agency customers, each agency, like as part of significant change notifications, like uh, agencies are no longer approving specific change requests. You guys, as commercial service providers, are managing your commercial services. You are notifying us of the changes that you are making in those environments. Um, and the agencies get to decide whether like that is um, uh, whether those changes require additional compensating controls on the agency side, whether um, those changes mean they can't use the service anymore. Um that it's going to the the decisions that agencies have are not can you change your service. The decisions agencies have are should the agency still be using your service in that same way. Should the agency put compensating controls on the types of data that the agency wants to put into your service. Um granted you still have to meet all of your contractual obligations that you have with that particular agency. Um but in general trying to get commercial services to be able to run their commercial services without undue government [clears throat] influence in those. Please talk with your agency customers though. Like those collaborative combine meetings should be an exchange of information. Um should be collaborative. You should be listening to what your customers are wanting um from your service and then you guys get to make business priority decisions based on that feedback. >> And I would say that if you do you have agencies that aren't actively participating, right? And you've done everything you can to invite them, document the decisions that were made, document the the lack of attendance, right? And so that if there ever is ever any an issue, there there's a record of that. Um Tara, um does the 1 January deadline of mandatory adoption of CR mean for mean for all current Rev 5 CSPs? Um I would say look at the individual rules. If you look a few slides back, Don, can you go to one of the the mass uh one a few slides back? Um Yeah, like every individual rule rule or rule set within CR 26 has deadlines associated with it, right? The one you're talking about with hey, your annual uh machine readability of annual assessment materials, you're going to find those um in I believe it's the the Rev 5 certification rules. You're going to find specific rules in the security decision record um rule set under package rule sets, as well as maybe some of the assurance rule set. But, those also change. Some of the rule sets change based on what your class is, as well, right? For like class D, machinery abilities are must early, whereas class C and B, you'll see should in some of those, as well. Can we get a copy of the slide deck today? Yeah, we'll end up PDFing it, and we should post it to our GitHub site. I know that uh the guy who's supposed to be doing it has failed the last few months. That's me. But, I will get this one and I think the last one I've missed, as well, up there. So that yeah, in in PDF so that everyone's got a copy of it. There's no mention of the rules. There There's no mention in the CR 26 SCM for the CSP to submit a form for early adoption. Can you please confirm? Yeah, so we had forms previously on the BIR website with the the migration to CR 26, all of those links died out, and all of those old websites died out, as well. So for now, there's not links. I don't know um you know, we were tracking and and reporting out if we do something like, hey, putting, you know, notices on Marketplace for folks who are doing unique things, we may go back to trying to figure that out. But, as of right now, I believe Pete said they're OVE. >> Yep. All right. With the whole Is there coordination with GovRamp for how that process is going to shift, or are us CSPs likely to still need to maintain both the traditional poem and the new CR 26 exceptions document. Uh we do not coordinate with FedRAMP. Um in fact we're not allowed to. So I don't know how FedRAMP is going to change. Uh if you have requirements under additional certification programs, you should probably manage that with that certification program, but these are what FedRAMP requirements are moving forward. All right. Uh for CSPs transitioning from traditional Rev 5 poem process to the new Vader process, um do we recommend what basically what um how do we recommend that CSPs do that? We recommend that you do it in whatever way works best for you. Um so if it works best for you to do a phased approach, do a phased approach. If it works best for you to completely cut over one month, um do that. You guys, the timelines and the method are up to you, as long as by December 7th, you have Vader and VER implemented. Um and then you get an additional 3 months uh to work out the quirks. So by March, you should have an idea of where this going. >> Sitting through uh some of the the the BIR betas, I will tell you use your your current monthly touch point with your agency to at least expose your plan one month before you implement it the next month. That you know, whatever your plan is, right? That seemed to be the easiest uh transition versus like, "Hey, we're showing up on this month. This month it's SCN, right? Like and we're all there now, right?" It gives It gives the agencies the ability to ask questions, to provide feedback, maybe identify things that may or may not work for them um before the transition. Uh but yeah, like I said, um it it's up to you how you want to do that. >> Yep, again, we talked about like uh being really receptive to the customer experience. This is one way like all of this change we're doing a lot of work on the agency side to familiarize themselves with the changes in FedRAMP requirements, but you guys are the ones actually walking with the changes through with them. So, try to make it a positive customer experience for the agencies as you transition from one process to the next. Um it it'll make your lives easier and their lives easier, I think, too, as well. >> So, the next one is it's a it's a good question, right? And I hate to go say go back to the the the rules and look. So, for Rev 5 annual assessments, we have a Rev 5 annual assessment coming in November 2026, but the SAR won't be ready until after January 1st. Does this mean all the work is is for naught? Um I would say no, right? You just have to look at the individual rule associated to figure out like um what what the impact, if there is any, because there are going to be some requirements for some of the BIR implementation at that point in time. But, if you're worried about like the SSP, go to the security decision record, right? Um for maintain on the security decision record, that implementation date is 2027 0801. Um right? So, you're not having to transition the SSP work, but there are um there are going to be some uh I believe certificate standard you're probably need to adhere to, right? There are going to be ones in 2026. Like I said, based on your target date, you need to look at the individual rule sets. Um but, like I said, we tried to not slow roll, but roll um in what makes sense for each rule based on where we know FedRAMP is with things, where we know legislation is with things, and where we know CSPs, you know, have the best option to transition. So, there's a question that uh does that business case argument apply to third-party service? Oh, can I use non-services offering within my FedRAMP? >> Non-FedRAMP services within your offering. >> Yes. The answer is is yes. I think there's always been this strict mindset of like if you're high, everything you touch in life needs to be high with it. Everything they touch needs to be high, right? And like that's I don't I don't know where that misnomer started, right? But it's not a practice that we follow anymore, right? It's it's one of those, "Hey, what data is being transitioned in that? And what protection at what level of protection does that data need to transition to, right?" And I think that's the key. We can't tell you yes or no for anything that agency can tell you yes or no. But like as we transition to this red box boundary of everything inside needs to be equal to that level, the reality is is now it's tied to where is the agency information and what level does that need to be protected at. >> Yeah, this one gets really nuanced in a hurry. So, in general, yes, the option is available to you to use non-FedRAMP services within your service offering. However, you're going to be want to be smart about how you do that. What compensating controls do you have in place to identify any risks that may exist from using a non-FedRAMP service in the way that you're you're doing it. It there's going to be different types of discussions based on whether it's just a third-party like service that you're using just to help you process some metadata or whether like you want to use a non-FedRAMP IAS provider to host your entire cloud service. Like those are two very different discussions. So, um uh use that power wisely. Um but in general, like you can do what makes sense for your business use case. You just need to be very clear and very upfront about what you're doing um and how you're protecting customer data as it moves through your environment. Uh and I brought Dan up um as as a moderator so that he can answer the next question, uh which is specifically about schemas. So, the new Rev 5 control adjustments do not have control details in the schema. Is it expected to just use the NIST catalog language? Um this impacts 3PAO SRTMs. >> Yeah, so the decision was made that when we reference Rev 5 NIST 853 controls, Rev 5 or otherwise, um we will not duplicate information that is already provided by NIST. So, yes. The answer is we're providing just the control ID. You should get the language for the control, the implementation guidance, all the rest of that stuff from directly from NIST. The only addition is it's in those cases where FedRAMP is still providing additional guidance, you'll see that additional guidance is provided uh in the schema file. >> Cool. All right, how does a CSP track manual control findings? Um in whichever way makes sense for you. >> You almost I mean, treat it as a vulnerability, right? I mean, report on it regularly, uh right? I mean, clearly it's not an automated one, um but uh yeah. >> Yeah. >> The next Oh my god. I'm sorry, my I'll take the next one. Nicole, can you read it? I'm sorry, I lost my >> Do these CSPs have the ability to change parameter definitions at any time. >> So, no. Right, I If you If you were making a change to your parameters, follow SCN, right? Your significant change notification process, right? If it's If you just got through your assessment, right? And you're all rocking all high controls, and you're like, all right, the assessor's gone, we're just going to change cuz it's Wednesday now, right? Like, clearly that's a no-go. Right, so like, make sure with any change, if you're changing parameters and things associated with your your security controls because of that, follow significant change process. >> Yeah, and to be clear, that doesn't necessarily mean like, no, you can't change them at any time. You just need to follow the change process to change something that is included in your certification package. So, clearly, people are not going to have an issue if you change your parameter definitions to tighten them even further. But if you're starting to get looser, like it's it's a change that potentially has a security impact related to it, follow the significant change notification process, and evaluate what that change does to your environment. As a new status of class has been assigned to us on the marketplace, is this set in stone? We are moderate, and there seems to be a big big difference between class B and C. So, if you're moderate, you should have been switched to class C. Um So, the those requirements are still there. I'm a little unsure what the exact problem is here, but in general, like, the old rules still apply until the deadlines set out in CR 26. So, >> But if if you were moderate, and during the conversion, you accidentally got put in a class B instead of a class C, contact info at, and let us know and we'll fix it. It was a you know, it was a big bulk change. It is not inconceivable that a few people ended up in the wrong spot. >> Uh similarly, if we didn't get the nuance quite right, send us an email at info at and we will address it with more nuance. When will the path for class D announced for 20X given the dates for no longer accepting new rev 5 certifications? That's a great question. Um the path for class D will likely be uh implemented in CR 27. So, um given the time frame that we just published in CR 26 uh and no longer accepting new rev 5 certifications, we have to have a new path open uh for 20X class D before June 11th. That's as much information as I have. Um so, we will all be learning together. >> Um so, there's a good question on um CMU C S O UVM says that class D providers must use crypto modules or update streams with active validations to protect to protect federal customer data. FIPS 1 140-2 is being sunset in the coming months. Will the PMO provide guidance? We've actually previously provided guidance um very akin to this, right? We know that if you're running the numbers, it's something like there are only like 400 140-3 uh validated modules. However, there's like 400 in the pipeline and about 600 uh 140 tech 2 and all those 140 tech 2s are about to go historical, I think, in 2 months. Um right? So, uh there is a a uh a what to do if your if your crypto module status is is stuck in historical, um right? Both of them involve uh uh taking a poem basically and say it, "Hey, I'm either using the historical version until the 140 deck tech 3 is approved or I'm using the 140 tech 3 at the risk of it potentially maybe not being approved and I have to find an alternate action." But yes, that's not it's less a a FedRAMP problem and more a a missed backlog problem that everyone is adjusting around. And like I said, in 2 months when 140 tech 2 goes away, you're just going to have a ton of things in this weird limbo. All right. 853 base catalog does have a lot more assessment procedures in the 853 than FedRAMP traditional baselines did. So, we're going to the NIST catalog, should we apply them all? This You are free to apply anything you want to to everything like. However, the controls associated with FedRAMP certification are the ones that we've listed based on, you know, your your class. If there are extra ones because it's an agency requirement or you have some sort of special overlays for the agency that require different things or that's the standard you want to keep yourself to, go for it. But yeah, there's a a ton more controls in the the holistic baseline than than they're are being used in well, everybody's baselines. >> Uh we did skip over one question. Uh I believe I read that we have to essentially reapply to be included on the marketplace due to 20X changes. Is that correct? Um if you're a CSPE, we automatically converted your marketplace listing over to the new nomenclature. There have been some discussions around um marketplace applications and forms. I have not been super involved in all those discussions. Dan or Paul, do you guys know anything more about that? >> Uh not I mean not really like like you said the we automatically flip the things over, right? So if you were a FedRAMP moderate, you'll end up becoming a FedRAMP, you know, Class C, right? And that should be there now. And if that's wrong, please let us know at info@ we're not perfect. Ryan's on leave all week, so we've been blaming him for everything that falls apart. So, you know, blame him and we'll we'll get back to you and and fix it. You know, we have an off log that we pull from. That's our authoritative source. It is you know, it is reflected in marketplace, but like I said, every now and then we we we we are human. So, please let us know. The real question long-term becomes things like we are opening up a FedRAMP marketplace status for and Zoya's going to text me here hopefully and save me. But you are not necessarily in the process with a federal agency, but you would gearing up to a for a formal assessment. And so, we'll have that status. And then the the other question becomes is what happens to those FedRAMP in process. The term in process is is going away. So, whether because you know, as we move to 20X, the Itsu requirement moves away. So, when do we stop taking taking those as new in processes and when do we change over to the new nomenclature? But you shouldn't have to apply for anything new. >> Yeah, I agree. If you're on the marketplace now, you know, pay attention to the dates in the consolidated rules. You will be expected to comply with the new requirements by the appropriate dates. Um you know, so maybe that like I can see someone interpreting that as like complying but that's you know as long as you continue to comply with the you know with the requirements as they change then you should continue to be listed on Marketplace. >> Yeah, there is a unique one if you do have a Rev 5 FedRAMP ready you will have to apply to go to a 20X class A but we're still kind of working through those widgets. >> Yeah. >> [snorts] >> All right, we are just about at time so I'm going to close off Q&A for now. If we didn't get to your question info@ is available. If it's something that the rest of the community would likely be interested in enter to please post them publicly on our GitHub. We actively monitor those discussions and we love answering questions one time for the benefit of the entire public rather than answering it 15 times info@. So while we are developing a frequently asked questions page like please feel free to use our GitHub discussion boards for questions that are relevant to the entire community. We will be back at this time next week to talk about more specific FedRAMP 20X type things. So come join us again then we will have Ryan back but not Pete yet. Pete is taking a much deserved multi-week vacation to go drive around the lovely state of Montana. So if you're out there wave along the highway you might see him. >> [snorts] >> But he should be back for August update and in the meantime we're all holding down the fort while he's checking in remotely. >> Awesome. Thank you all. These were great questions by the way and yeah we'll see we'll see some of you all next week. >> Yep.