Self-Hosted Industry Engagement¶
To enable maximum speed and widest adoption, FedRAMP 20x Phase 1-3 focused exclusively on developing an updated path for cloud services that were hosted on infrastructure or platforms that were already FedRAMP Rev5 Certified. This provided a path for the majority of cloud services, but de-prioritized a path for the rare services that operate their own physical infrastructure.
FedRAMP plans to remedy this in the Consolidated Rules for 2027 by offering an expanded set of criteria for self-hosted or hybrid-hosted services to qualify for a FedRAMP 20x Certification of any Class. We understand that most companies who are responsible for their own infrastructure are already expected or required to meet stringent government regulations and commercial guidelines to operate datacenters safely. We anticipate leveraging those existing investments to the maximum extent possible.
There is now a single Industry Engagement track for Phase 4.
RFC-0033 Phase 4 Development Tracks for 20x Class D initially proposed 2 separate industry engagement tracks, one for cloud service providers and another for independent assessment services. We have reworked this into a single Industry Engagement track to ensure all activities align with the same schedule.
During Phase 4, FedRAMP will gather data and perspectives directly from current FedRAMP Certified cloud service providers with self-hosted or hybrid-hosted services and their independent assessment services. We will focus on industry standard certifications that are most widely used by these providers, and the deltas between those certifications and the requirements from existing FedRAMP Rev5. Our goal, where possible, will be to identify existing reusable certifications and classifications that can be included directly in a FedRAMP 20x Certification to address infrastructure-related controls.
FedRAMP will also publish at least 2 RFCs related to self-hosted and hybrid-hosted rules to ensure all stakeholders have the opportunity to participate.