> ## Documentation Index
> Fetch the complete documentation index at: /docs/llms.txt
> Use this file to discover all available pages before exploring further.

# RFC history

> Every FedRAMP Request for Comment thread in the community discussions, with status, date and the current ruleset it relates to where that's clear.

> [!NOTE]
>
> **Source:** RFC threads in [FedRAMP community discussions](https://github.com/FedRAMP/community/discussions), meaning threads flagged as RFCs or filed under an RFC category. **Last reviewed:** 2026-10-29 against upstream release `2026.10.14.01`.

## What RFCs are

FedRAMP must seek public comment before it publishes guidance that affects stakeholders. Its Request for Comment (RFC) process is how anyone can give formal feedback ([Getting Support](https://www.fedramp.gov/2026/support/); the full list is at [fedramp.gov/rfcs](https://fedramp.gov/rfcs)). Each RFC has a formal comment thread. Many also have a separate Q\&A thread, because FedRAMP staff don't answer questions in formal comment threads.

> [!WARNING]
>
> An RFC is a proposal, not a rule. Staff said a closed RFC is irrelevant once it closes, except for any outcome it links to ([`pete-gov`, 2026-09-02](https://github.com/FedRAMP/community/discussions/147#discussioncomment-18255608)). They have also stressed that RFCs "do not establish any requirements" ([`pete-gov`, 2026-09-23](https://github.com/FedRAMP/community/discussions/172#discussioncomment-18570501)). For current requirements, use the [rules](/docs/rules.md).

## How to read the table

* **Status** is the thread's GitHub category. **Closed RFC** and **Open RFC** are formal comment threads. **Q\&A** marks a "General RFC Discussion" thread. All Q\&A threads below are closed except #181.
* **Related ruleset** names a current ruleset only when the RFC's title or text names it directly, or the current rule carries the same name. Otherwise it shows "—". Many RFCs fed into several rulesets, or into pages that aren't rulesets, such as Rev5 control guidance and Scope of FedRAMP.
* **Date** is when the thread was opened.

## RFC threads

| RFC | Title (one line) | Status | Date | Thread | Related ruleset |
| - | - | - | - | - | - |
| RFC-0005 | Minimum Assessment Scope Standard | Closed RFC | 2025-04-24 | [#2](https://github.com/FedRAMP/community/discussions/2) | [Minimum assessment scope](/docs/rules/minimum-assessment-scope.md) |
| RFC-0006 | 20x Phase One Key Security Indicators | Closed RFC | 2025-04-24 | [#3](https://github.com/FedRAMP/community/discussions/3) | [Key security indicators](/docs/rules/key-security-indicators.md) |
| RFC-0007 | Significant Change Notification Standard | Closed RFC | 2025-04-24 | [#4](https://github.com/FedRAMP/community/discussions/4) | [Significant change notification](/docs/rules/significant-change-notification.md) |
| RFC-0008 | Continuous Reporting Standard (key security metrics for agencies and FedRAMP) | Closed RFC | 2025-05-09 | [#5](https://github.com/FedRAMP/community/discussions/5) | — |
| RFC-0009 | Significant Change Notification Technical Assistance | Closed RFC | 2025-05-15 | [#6](https://github.com/FedRAMP/community/discussions/6) | [Significant change notification](/docs/rules/significant-change-notification.md) |
| RFC-0010 | Scope Interpretation Technical Assistance for OMB M-24-15 | Closed RFC | 2025-05-15 | [#7](https://github.com/FedRAMP/community/discussions/7) | — |
| RFC-0011 | Pilot Standard for Storing and Sharing Authorization Data (self-hosted packages) | Closed RFC | 2025-05-23 | [#8](https://github.com/FedRAMP/community/discussions/8) | — |
| RFC-0012 | Continuous Vulnerability Management Standard | Closed RFC | 2025-07-15 | [#59](https://github.com/FedRAMP/community/discussions/59) | — |
| RFC-0012 | Q\&A on RFC-0012 | Q\&A | 2025-07-15 | [#60](https://github.com/FedRAMP/community/discussions/60) | — |
| RFC-0013 | SC-7 Boundary Protection Balance Improvement Release (Rev5) | Closed RFC | 2025-08-11 | [#71](https://github.com/FedRAMP/community/discussions/71) | — |
| RFC-0013 | Q\&A on RFC-0013 | Q\&A | 2025-08-11 | [#72](https://github.com/FedRAMP/community/discussions/72) | — |
| RFC-0014 | 20x Phase Two Key Security Indicators | Closed RFC | 2025-09-10 | [#83](https://github.com/FedRAMP/community/discussions/83) | [Key security indicators](/docs/rules/key-security-indicators.md) |
| RFC-0015 | Recommended Secure Configuration Standard | Closed RFC | 2025-09-10 | [#84](https://github.com/FedRAMP/community/discussions/84) | [Secure configuration guide](/docs/rules/secure-configuration-guide.md) |
| RFC-0014 to RFC-0018 | Q\&A on the Phase Two RFCs | Q\&A | 2025-09-10 | [#85](https://github.com/FedRAMP/community/discussions/85) | — |
| RFC-0016 | Collaborative Continuous Monitoring Standard | Closed RFC | 2025-09-15 | [#87](https://github.com/FedRAMP/community/discussions/87) | [Collaborative continuous monitoring](/docs/rules/collaborative-continuous-monitoring.md) |
| RFC-0017 | Persistent Validation and Assessment Standard | Closed RFC | 2025-09-15 | [#88](https://github.com/FedRAMP/community/discussions/88) | — |
| RFC-0018 | FedRAMP Security Inbox Requirements | Closed RFC | 2025-09-29 | [#92](https://github.com/FedRAMP/community/discussions/92) | [Addressing FedRAMP communication](/docs/rules/addressing-fedramp-communication.md) |
| RFC-0019 | Reporting Assessment Costs | Closed RFC | 2026-01-13 | [#109](https://github.com/FedRAMP/community/discussions/109) | — |
| RFC-0020 | FedRAMP Authorization Designations (naming of FedRAMP authorizations) | Closed RFC | 2026-01-13 | [#110](https://github.com/FedRAMP/community/discussions/110) | — |
| RFC-0021 | Expanding the FedRAMP Marketplace | Closed RFC | 2026-01-13 | [#111](https://github.com/FedRAMP/community/discussions/111) | [Marketplace listing](/docs/rules/marketplace-listing.md) |
| RFC-0022 | Leveraging External Frameworks | Closed RFC | 2026-01-13 | [#112](https://github.com/FedRAMP/community/discussions/112) | — |
| RFC-0023 | Rev5 Program Certifications (time-limited sponsorless option) | Closed RFC | 2026-01-13 | [#113](https://github.com/FedRAMP/community/discussions/113) | — |
| RFC-0024 | Rev5 Machine-Readable Packages | Closed RFC | 2026-01-13 | [#114](https://github.com/FedRAMP/community/discussions/114) | — |
| RFC-0019 to RFC-0024 | Q\&A on RFC-0019 through RFC-0024 | Q\&A | 2026-01-13 | [#115](https://github.com/FedRAMP/community/discussions/115) | — |
| RFC-0019 to RFC-0024 | Corrective action and public notification comments (moved to #115) | Q\&A | 2026-01-14 | [#116](https://github.com/FedRAMP/community/discussions/116) | — |
| RFC-0031 | Q\&A on RFC-0031 Incident Communications Procedures | Q\&A | 2026-03-18 | [#127](https://github.com/FedRAMP/community/discussions/127) | [Incident evaluation and communication](/docs/rules/incident-evaluation-and-communication.md) |
| RFC-0025 | Retrospective on the Public Comment Process | Closed RFC | 2026-03-18 | [#128](https://github.com/FedRAMP/community/discussions/128) | — |
| RFC-0026 to RFC-0030 | Q\&A on the Rev5 update RFCs | Q\&A | 2026-03-19 | [#129](https://github.com/FedRAMP/community/discussions/129) | — |
| RFC-0026 | Clarifying CA-7 Continuous Monitoring Expectations for Rev5 Providers | Closed RFC | 2026-03-19 | [#130](https://github.com/FedRAMP/community/discussions/130) | — |
| RFC-0027 | Rev5 baseline update: AC, AT, AU, CA, CM control families | Closed RFC | 2026-03-19 | [#131](https://github.com/FedRAMP/community/discussions/131) | — |
| RFC-0028 | Rev5 baseline update: CP, IA, IR, MA, MP control families | Closed RFC | 2026-03-19 | [#132](https://github.com/FedRAMP/community/discussions/132) | — |
| RFC-0029 | Rev5 baseline update: PE, PL, PM, PS, PT control families | Closed RFC | 2026-03-19 | [#133](https://github.com/FedRAMP/community/discussions/133) | — |
| RFC-0030 | Rev5 baseline update: RA, SA, SC, SI, SR control families | Closed RFC | 2026-03-19 | [#134](https://github.com/FedRAMP/community/discussions/134) | — |
| RFC-0031 | Updated Incident Communications Procedures | Closed RFC | 2026-04-08 | [#138](https://github.com/FedRAMP/community/discussions/138) | [Incident evaluation and communication](/docs/rules/incident-evaluation-and-communication.md) |
| RFC-0032 | Q\&A on RFC-0032 Offerings By Government | Q\&A | 2026-08-06 | [#157](https://github.com/FedRAMP/community/discussions/157) | — |
| RFC-0032 | Offerings By Government (agency-provided shared services) | Closed RFC | 2026-08-06 | [#158](https://github.com/FedRAMP/community/discussions/158) | — |
| RFC-0033 | 20x Phase 4 Development Tracks for 20x Class D | Closed RFC | 2026-09-09 | [#170](https://github.com/FedRAMP/community/discussions/170) | — |
| RFC-0034 | Technical Advisory Group Changes | Closed RFC | 2026-09-09 | [#171](https://github.com/FedRAMP/community/discussions/171) | — |
| RFC-0033, RFC-0034 | Q\&A on RFC-0033 and RFC-0034 | Q\&A | 2026-09-09 | [#172](https://github.com/FedRAMP/community/discussions/172) | — |
| RFC-0035 | Cryptographic Module Use Rules Updates | **Open RFC** (closes 2026-11-17) | 2026-10-14 | [#179](https://github.com/FedRAMP/community/discussions/179) | [Cryptographic module use](/docs/rules/cryptographic-module-use.md) |
| RFC-0036 | FedRAMP 20x Class D Cloud-Hosted Pilot Requirements | **Open RFC** (closes 2026-11-19) | 2026-10-15 | [#180](https://github.com/FedRAMP/community/discussions/180) | — |
| RFC-0035, RFC-0036 | General discussion on RFC-0035 (FIPS) and RFC-0036 (Phase 4 pilot) | Q\&A (open) | 2026-10-15 | [#181](https://github.com/FedRAMP/community/discussions/181) | — |

> [!NOTE]
>
> **RFC-0035 is open.** It proposes changes to the current `CMU` rules, including changing `CMU-CSO-UVM` for Class D from MUST to SHOULD. Until FedRAMP publishes a change upstream, the current [`CMU-CSO-UVM`](https://www.fedramp.gov/2026/reference/cryptographic-module-use/#using-validated-cryptographic-modules) text governs, and Class D is MUST. As of 2026-10-25, the thread has four community comments and no FedRAMP staff comments. Community comments are context, not guidance.

> [!NOTE]
>
> **RFC-0036 is open.** It proposes new definitions, changes to six rulesets and 10 new Key Security Indicators to test in the 20x Phase 4 cloud-hosted Class D pilot. It adds rules such as `FRC-CLD-PCD`, `FRC-CLD-CCH` and `FRC-FRA-FOD`. None of this is in the published rules. In [#181](https://github.com/FedRAMP/community/discussions/181), `pete-gov` said it applies to 20x only and wouldn't apply to Rev5 ([comment](https://github.com/FedRAMP/community/discussions/181#discussioncomment-19081418)). FedRAMP doesn't answer questions in the RFC threads themselves.

> [!NOTE]
>
> **RFC-0033 has two late comments.** On 2026-10-28, `rhoesing` (FedRAMP) posted two comments in [#170](https://github.com/FedRAMP/community/discussions/170) that relay input FedRAMP received by email on 2026-10-07 and 2026-10-09, before the RFC closed. One is from Google ([comment](https://github.com/FedRAMP/community/discussions/170#discussioncomment-19247327)). The other is from Solutions by Jewel ([comment](https://github.com/FedRAMP/community/discussions/170#discussioncomment-19250402)). Both are third-party feedback on the proposal, so they're community input, not FedRAMP positions. FedRAMP's own posts only say where the content came from. The thread has no staff answer.

RFC-0001 through RFC-0004 have no threads in this community dataset.

## Related

* [Discussion digests overview](/docs/discussions.md)
* [Notable staff answers](/docs/discussions/notable-staff-answers.md)
* [Rules overview](/docs/rules.md)


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.