Historical technology archive
FedRAMP cryptographic-module proposal
From CDG’s Oct 21 company post: RFC-0035 opened October 14 and is open for comment through November 17, 2026. It addresses both 20x and Rev5, separately from the Class D cloud-hosted pilot proposal.
- Original LinkedIn publication
- Added to CDG website
- Historical LinkedIn post checked
- Official source review
- Current claims not revalidated
Original company post
FedRAMP® is proposing changes to cryptographic-module rules. Agency obligations under FIPS 140-3 would remain unchanged.
RFC-0035 opened October 14 and is open for comment through November 17, 2026. It addresses both 20x and Rev5, separately from the Class D cloud-hosted pilot proposal.
The proposed updates would: • Change Class D use of CMVP-validated modules from MUST to SHOULD, matching Class C • Define a CMVP-validated module around an active NIST CMVP validation or an update stream of that module • Treat replacement of a validated module with a non-validated one as a transformative change for Classes B, C and D when the cryptographic service protects federal customer data
The RFC does not set post-quantum cryptography requirements or require currently operating cloud services to do anything differently. It is a proposal, not a final rule.
For federal cloud teams, review how module inventories, validation status, customer-facing documentation and change notifications support informed agency risk decisions.
Read the official proposal: https://lnkd.in/eUCf5hpG
Illustrative computing-infrastructure photo: Derrick Coetzee, server racks at NERSC, October 2011, CC0 public-domain dedication. This is not a FedRAMP facility. https://lnkd.in/e2Swvfdr
#FedRAMP #FederalCloud #Cryptography #CyberDefenseGroup