6 New FedRAMP RFCs Explained: What CSPs Need to Know in 2026

Video Description

Six major FedRAMP Requests for Comment (RFCs) were released at the same time, signaling one of the biggest shifts in federal cloud compliance in years. Together, these proposals outline the next phase of FedRAMP modernization and the transition toward automation, continuous validation, cost transparency, and a more open and competitive marketplace. In this episode of Behind the Shield, Jason, Mike, and Tanner break down all six RFCs and explain what they mean for cloud service providers, assessors, advisors, and federal agencies. The team connects the dots across the proposals, shares real-world perspectives from working with FedRAMP customers, and explains what organizations should be doing now while the public comment period is still open. What You'll Learn: RFC-0019 – Assessment Cost Reporting FedRAMP plans to require reporting of independent assessment and ongoing authorization costs. We discuss why the PMO wants cost transparency, potential penalties for non-reporting, how this may drive competition and reduce costs, and what currently authorized providers should prepare for in upcoming assessments. RFC-0020 – New Authorization Designations FedRAMP is shifting terminology to new certification and validation designations. We cover certified vs validated paths, the move to numbered levels, how this reduces confusion around “ATO vs FedRAMP authorization,” and how the changes align with the long-term transition away from Rev. 5 toward FedRAMP 20x. RFC-0021 – Expanding the FedRAMP Marketplace The marketplace is evolving into a true procurement and discovery platform. Topics include publishing pricing structures, trust center requirements, advisor and assessor listings, and the new “Preparation” stage that allows CSPs to signal intent and progress earlier in their journey. RFC-0022 – Leveraging External Frameworks A new pathway allows CSPs to use existing certifications such as SOC 2, ISO, CMMC, and StateRAMP to achieve validated Level 1. This reduces duplicate compliance work, accelerates entry into the federal market, and helps solve the long-standing sponsorship chicken-and-egg problem. RFC-0023 – Program Certification Without a Sponsor A temporary sponsor-less pathway for Rev. 5 authorization could help organizations that lost sponsors or stalled in the pipeline. We explain who qualifies, key deadlines, and how this could reshape the near-term FedRAMP authorization pipeline. RFC-0024 – Machine-Readable Authorization Packages FedRAMP is moving toward machine-readable packages and automation. We discuss OSCAL, AI-ready authorization data, automated SSP generation, and the broader impact across FedRAMP, FISMA, and DoD authorization processes. These RFCs collectively signal a major shift toward faster authorizations, lower barriers to entry, greater transparency, and continuous validation. If you are pursuing FedRAMP or already operating in the federal cloud, this episode will help you understand what is changing, what to watch closely, and how to respond before the RFC comment deadlines. Like and subscribe to stay up to date on FedRAMP, cloud security, and compliance trends. 0:00 Six FedRAMP RFCs Just Dropped… Why This Matters 1:06 The Big Picture: FedRAMP’s Final Vision 5:35 RFC 19: FedRAMP Will Track Assessment Costs 13:57 Action Required: New Reporting Starts Soon 16:36 RFC-20 FedRAMP Is Renaming Authorization 21:45 Certified vs Validated Explained 30:25 FedRAMP Marketplace Becomes a Real Marketplace 30:42 RFC 21 Expanding the FedRAMP Marketplace 35:32 The New Preparation Stage Changes Everything 44:00 RFC 22: Use SOC2 and ISO to Get FedRAMP Faster 44:13 RFC22 Leveraging external frameworks 49:55 Solving the FedRAMP Chicken and Egg Problem 53:11 FedRAMP Without an Agency Sponsor 59:19 Limited Time Certification Path and Deadlines 1:01:52 Machine Readable FedRAMP Packages 1:06:05 Impact Beyond FedRAMP and Into DoD 1:10:03 Final Thoughts and How to Comment on the RFCs Comment on Each RFC: RFC-0019: https://github.com/FedRAMP/community/discussions/109 RFC-0020: https://github.com/FedRAMP/community/discussions/110 RFC-0021: https://github.com/FedRAMP/community/discussions/111 RFC-0022: https://github.com/FedRAMP/community/discussions/112 RFC-0023: https://github.com/FedRAMP/community/discussions/113 RFC-0024: https://github.com/FedRAMP/community/discussions/114 Read the blog here: https://infusionpoints.com/blogs/six-new-fedramp-rfcs-what-they-mean-and-why-your-input-matters