Summary

  • FedRAMP’s proposed calendar calls for notices to qualifying self-hosted or hybrid-hosted providers on 12 October and opt-in replies by 16 October.
  • The targeted track will study how existing commercial certifications could support future FedRAMP 20x rules; neither participation nor reuse guarantees a new FedRAMP certification or an agency-specific authorization.

Analysis

The Federal Risk and Authorization Management Program (FedRAMP) has put a near-term participation gate into its proposal for Phase 4 of FedRAMP 20x. It expects to identify qualifying cloud service providers from information already in the Marketplace, send instructions through their FedRAMP Security Inbox on 12 October, and ask them to respond by 16 October. The document labels these as target dates and says they assume no unexpected delays; it does not name invitees or report that notices have been sent.

The provider criteria are specific. A provider must hold a current FedRAMP Rev5 Class C or Class D certification, have at least 15 agency uses on record, and operate primarily with self-hosted or hybrid-hosted infrastructure. A provider with several eligible offerings counts once. “Self-hosted” includes infrastructure the provider operates itself or takes responsibility for through an arrangement with a third party. The opt-in is for a direct engagement track, not a public certification application.

That distinction matters because the first three FedRAMP 20x phases focused on services running on infrastructure or platforms that already held FedRAMP Rev5 certification. The Phase 4 proposal treats providers responsible for their own physical infrastructure as a separate design problem. FedRAMP wants to examine the industry certifications these providers already use, compare them with the relevant Rev5 requirements and, where possible, make existing evidence reusable in a future 20x certification.

The proposal also separates this provider track from two parallel efforts: a cloud-hosted Class D pilot and an engagement track for independent assessment services. Each has its own eligibility and schedule. For the provider track, the proposed 16 October response date concerns who will join early discussions; it is not a deadline for every cloud provider, an award of FedRAMP status or proof that an existing commercial certificate will satisfy a federal requirement.

The final 20x rules for self-hosted and hybrid-hosted services are not yet set. FedRAMP says it intends to incorporate the resulting rules into its Consolidated Rules for 2027, with a public request for comment on this hosting model targeted for 4 November. The posted schedule also proposes later meetings and a further public rules request in February. Those are planning dates, not completed milestones.

Sources