Sign in

Low Guidance US

FedRAMP publishes initial outcomes of RFC-0022 on leveraging external frameworks

Original title: Published a public notice with the initial outcome of RFC-0022 Leveraging External Frameworks

Published
Source: fedramp.gov
Effective
Not stated
Deadline
Not stated
Framework: FedRAMP
CR26 source
in 53 days
CR26 becomes mandatory: new Rev5 applications and all active 20x certifications must follow it source

Why it matters

FedRAMP has published a public notice outlining the initial outcomes of RFC-0022, which addresses the use of external security frameworks within the FedRAMP authorization process. This notice provides stakeholder feedback and preliminary decisions on how external frameworks can be integrated into FedRAMP assessments. Organizations undergoing or planning FedRAMP authorizations should monitor these developments, as changes to framework leveraging could affect assessment scope and timelines.

What changed

  • FedRAMP published initial outcomes of RFC-0022 consultation on leveraging external frameworks in the authorization process
  • Public notice released detailing stakeholder input and preliminary FedRAMP decisions on external framework integration

Who is affected

Cloud service providers (CSPs) seeking FedRAMP authorization, federal agencies evaluating cloud services, and security assessors involved in FedRAMP authorizations

What to do

Open the official document

AI-assisted summary of the official document; the official text prevails. Not legal advice.

More changes in FedRAMP