FedRAMP cryptographic-module proposal
From CDG’s Oct 21 company post: RFC-0035 opened October 14 and is open for comment through November 17, 2026. It addresses both 20x and Rev5, separately from the Class D cloud-hosted pilot proposal.
Source: Cyber Defense Group. Original reporting and dates are preserved.
This page uses a text-only headline visual. Any image references in the original reporting below refer to the source publication; its photographs and branded graphics are not reproduced here.
Original CDG company post
FedRAMP® is proposing changes to cryptographic-module rules. Agency obligations under FIPS 140-3 would remain unchanged.
RFC-0035 opened October 14 and is open for comment through November 17, 2026. It addresses both 20x and Rev5, separately from the Class D cloud-hosted pilot proposal.
The proposed updates would: • Change Class D use of CMVP-validated modules from MUST to SHOULD, matching Class C • Define a CMVP-validated module around an active NIST CMVP validation or an update stream of that module • Treat replacement of a validated module with a non-validated one as a transformative change for Classes B, C and D when the cryptographic service protects federal customer data
The RFC does not set post-quantum cryptography requirements or require currently operating cloud services to do anything differently. It is a proposal, not a final rule.
For federal cloud teams, review how module inventories, validation status, customer-facing documentation and change notifications support informed agency risk decisions.
Read the official proposal: https://lnkd.in/eUCf5hpG
Illustrative computing-infrastructure photo: Derrick Coetzee, server racks at NERSC, October 2011, CC0 public-domain dedication. This is not a FedRAMP facility. https://lnkd.in/e2Swvfdr
#FedRAMP #FederalCloud #Cryptography #CyberDefenseGroup
Sources and references
Source publication notes
Historical technology archive. This original commentary does not describe CDG’s current consulting services and is not current security or compliance guidance.
Preserved from CDG’s company LinkedIn history. Original publication dates are retained; later updates may change the source, status, or deadlines.
The original CDG graphic is reproduced above. See its image credit, source and reuse terms.
Educational information, not legal advice. Current official program guidance and the instructions for your application control. Registration, certification, or consulting does not guarantee an award.