FedRAMP Public Notice-0011: Initial Outcome of RFC-0025 Retrospective on the Public Comment Process

Notice 11. Initial outcome of RFC 25, which was a retrospective on a public comment process. I was reliably informed that it's too long. There's too much information in our retrospective in our notice about the outcome of the retrospective on RFCs. >> It's unfortunate for all the people who read the RFCs who are listening. >> It's longer than that. It's right. >> Yeah, it it feels like appropriate in a weird way that this like we we did RFCs, we did 25 of them, then we did a retrospective, and now we're producing public notices, which is something that started happening around RFC 20 because people were telling us that wanted to know what happened. So now this meta notice about the outcome from a request for comment on the process of doing a request for comment like this is the world that we live in. >> We just got lost. >> Yeah. It is what it is. It is what it is. What did we learn? >> We learned we put out a lot of RFCs. >> To that was number one complaint? >> big comment >> I think we >> I think we released six of them the day >> the day after. We posted the RFC retrospective, and then like the first three comments were like too many RFCs at once, and then we just were like hold >> [laughter] >> Hold my beer. More RFCs. >> Publish six at the same time. >> Yeah, fair. So I think um sometimes we need to do that. Especially when they're related, and I think that that's something that we've been trying to figure out, but going forward we're going to try to limit it to a maximum of three. And the theory will be like we need to really focus on having them being aligned with each other. So if we're posting multiple RFCs at the same time they need to fit. They need to like support each other. Um and hopefully we can keep that under three. The other option is we could just make them all longer and more complicated. >> That was another comment there. >> But like Yeah, I think yeah, exactly. So, we're going to fix that. Um >> We're also going to open the timelines a little bit longer. >> A little bit. Yeah, carefully. >> Where we can. >> Yeah, this is something that I think is really fascinating. Um we don't want people to take their time on comments. And like this is what makes it hard is we had a lot of feedback from people that said for me to go around within my organization to all of the stakeholders and come to an agreement on what our feedback overall for this entire thing would be, it might take longer than 30 days. But that's not what we want. We want individual representatives posting individual things on individual topics as quickly as possible. Yeah, like this is not intended to be a put it out, wait 30 days, and then the last day we get a we get like multi- page documents. >> Right. >> And like that's why we do this at 30 days. We want quick, fast hits. We want you to tell us what you thought and then come back and tell us something else, and then come back and tell us something else. Like >> Right. >> There's a a level of transparency to the way we do it that is very uncommon, I think, in the federal government and and throws a lot of people off, but it's, you know, we're not shooting for a process where we're soliciting feedback only from, you know, our major stakeholders or from, you know, current CSPs. This is going out to the larger community of security professionals, you know, that do business with the federal government. We want to get feedback from as many people as possible. This is a crowdsourcing initiative. >> Yeah, so your company can totally come up with the company response for that particular RFC. But if you as an individual also have feedback about the RFC, send us individual feedback. We want to hear from everybody. >> We kind of explicitly because the Federal Aviation Authorization Act directs us to create our own comment process, part of what we agreed to with this comment process, and I know by now nobody goes in and reads the like stuff at the bottom of the RFC page that explains it. Um but we worked with legal and a and a key aspect of this was the intent that we would treat every comment the same regardless of where it comes from. We don't care where it comes from. So, if if you're working with a large trade association to put in a comment, that comment has the same weight to us as a comment from like Joe Blow on GitHub. And so, it's important that you put your own comments for yourself, for your company, etc. Like we want to hear these different perspectives. We don't want curated nonsense. So, I mean another thing that the RFCs uh a lot of these requests were kind of like when we go through an RFC, if you compare this to a traditional regulations.gov style RFC, which most of the rest of the government does, they will release these incredibly long disposition documents, where every comment will be quoted, and then they'll say like, "This is how we what we did with this comment." And it's a lot of the same stuff over and over again. It's hundreds of pages, and it's one of the reasons why most of the time when there is a request for comment, the government takes 6 to 12 months to create that disposition. Cuz they're just working through all these one by one forever to create these bespoke things. Um we have a lot of requests for that disposition, and we're not going to do that. And we've explained a little bit more of why in our initial outcome, but the theory is that you can see the disposition by the changes that we make in the rules that we're actually publishing as a result of the RFC. We don't think it's effective to address every single comment in detail over and over and over again. But, what we will do is start addressing the major themes that we see. Um this is something we actually tried a couple of times. Uh the first time first few RFCs uh and every time we looked through them, it was just kind of like there's too much information. People won't be interested in it. It makes the stuff too long. Like let's let's not include it, but everybody wants that. So, optional optional comment themes that you don't have to read are now included. >> Yeah, and we also talk about those things in our community update events, places like this. So, I mean it comes out. >> Yeah. >> But >> There's also I mean all the comments are available for people to read. >> True. >> Right? So, if you want to know like what the themes of the comments were, just go read the comments. >> Yeah, if you want our pain. >> Yeah. >> [laughter] >> One one of the things that we also really want to encourage is uh the community to interact with itself, right? So, feel free to go in and comment on other people's comments and you know, try and collaborate in a friendly respectful way um you know, to come up with with better solutions. Um I mean that's what we're really looking for here is the best possible answers. >> That's what we need. All right, what else? One other theme. We're not going to take comments via email anymore. >> Yeah, that was getting annoying. >> It was really deeply frustrating. A lot of people were sending us emails with PDF attachments and we'd have to go publish it. Like it was it was a whole thing. Um but people wanted an option other than GitHub, which is going to be like I mean that is just where we're going to be at. That is the tool that we have access to, that we're authorized to use. And the process we went through to get approval to do that was very long, very complex. We're not going to do that for something else. Uh so, instead we'll make a public comment form available. And agencies will be able to email us, but the public will can use this public comment form. They can make comments anonymously. I think we'll probably will not accept attachments, so you're just going to have to convert this on your own and that will just save everyone a lot of effort. Like it's 2026. Can we stop emailing each other word documents? Like this is literally all we've been trying to do for the last year and we're still getting those for comments. >> We'll still transfer all of those comments over to GitHub comments on your behalf, so they will still be in one place for public record. >> Yeah, yep. >> So there we're at notice 11 retrospective on RFCs. You will already start to see things shift in that first notice. We got a few more notices as well coming up that'll be super fun.