Skip to main content
Source: RFC threads in FedRAMP community discussions, meaning threads flagged as RFCs or filed under an RFC category. Last reviewed: 2026-10-29 against upstream release 2026.10.14.01.

​
What RFCs are

FedRAMP must seek public comment before it publishes guidance that affects stakeholders. Its Request for Comment (RFC) process is how anyone can give formal feedback (Getting Support; the full list is at fedramp.gov/rfcs). Each RFC has a formal comment thread. Many also have a separate Q&A thread, because FedRAMP staff don’t answer questions in formal comment threads.
An RFC is a proposal, not a rule. Staff said a closed RFC is irrelevant once it closes, except for any outcome it links to (pete-gov, 2026-09-02). They have also stressed that RFCs “do not establish any requirements” (pete-gov, 2026-09-23). For current requirements, use the rules.

​
How to read the table

  • Status is the thread’s GitHub category. Closed RFC and Open RFC are formal comment threads. Q&A marks a “General RFC Discussion” thread. All Q&A threads below are closed except #181.
  • Related ruleset names a current ruleset only when the RFC’s title or text names it directly, or the current rule carries the same name. Otherwise it shows ”—”. Many RFCs fed into several rulesets, or into pages that aren’t rulesets, such as Rev5 control guidance and Scope of FedRAMP.
  • Date is when the thread was opened.

​
RFC threads

RFC-0035 is open. It proposes changes to the current CMU rules, including changing CMU-CSO-UVM for Class D from MUST to SHOULD. Until FedRAMP publishes a change upstream, the current CMU-CSO-UVM text governs, and Class D is MUST. As of 2026-10-25, the thread has four community comments and no FedRAMP staff comments. Community comments are context, not guidance.
RFC-0036 is open. It proposes new definitions, changes to six rulesets and 10 new Key Security Indicators to test in the 20x Phase 4 cloud-hosted Class D pilot. It adds rules such as FRC-CLD-PCD, FRC-CLD-CCH and FRC-FRA-FOD. None of this is in the published rules. In #181, pete-gov said it applies to 20x only and wouldn’t apply to Rev5 (comment). FedRAMP doesn’t answer questions in the RFC threads themselves.
RFC-0033 has two late comments. On 2026-10-28, rhoesing (FedRAMP) posted two comments in #170 that relay input FedRAMP received by email on 2026-10-07 and 2026-10-09, before the RFC closed. One is from Google (comment). The other is from Solutions by Jewel (comment). Both are third-party feedback on the proposal, so they’re community input, not FedRAMP positions. FedRAMP’s own posts only say where the content came from. The thread has no staff answer.
RFC-0001 through RFC-0004 have no threads in this community dataset.