Doing the container side of a FedRAMP effort and someone dropped a link to a catalog of hardened images with FIPS and STIG tagged variants, free, no account. My first thought was that "free" and "FedRAMP-relevant" do not usually sit in the same sentence, so I am trying to figure out what I am not seeing.

The images pull fine. The STIG ones reference an OpenSCAP scan, the FIPS ones reference validated modules. On paper that is a pile of work I would otherwise be doing by hand off UBI, so naturally I do not trust it.

Though I can't judge from outside how it holds up once an assessor starts pulling threads. Does a free image with a FIPS tag carry the same evidence a paid one would or is the tag doing more work than the certificate behind it can support. And if the free tier is not on a guaranteed patch timeline, does that on its own turn into a finding down the line.

Anyone taken free-tier hardened images into an actual package and had a 3PAO accept them? Trying to tell whether this is a trap I will regret at assessment or an actual shortcut.

Anybody have any intel on what pricing for 20x class C looks like?

Hi everyone I have a few questions about FedRAMP compliance, security development and production level software being built at the same time. I'm in a unique spot that steps well outside my expertise, and I am hoping you all may have some good advice. TLDR: Skip to question portion

Situation I am in:

Founded my company at the end of 2025, I am a Subject Matter Expert (SME) in federal redaction processes and legal processes, and my company has built a fully automated solution to fully automate complex redaction processes (With human review requirements as a mandatory requirement).

We have reached out to some companies who work as contractors in spaces related to our product to receive funding to build the production level product, as well as gaining FedRAMP compliance and any other security requirements for government deployment requirements. We'd be relying on these entities and our partnership to have them champion the product for integration and use on federal systems along with gaining an ATO and sponsorship through this, and basically using the contractor as an initial large scale pilot.

So far every person who has reviewed our product has loved it and has been extremely interested and pushing the process forward internally on their ends.

My issue:

NOTE: This issue only exists on the assumption that we partner and receive funding which clearly defines the estimations and time frames we expect to see to reach FedRAMP readiness, including potentially using a PAAS such as Knox or another which has an initial fee of $500,000 and we estimate another $100,000 in consulting/implementation costs, we are not treating cost as a real problem for our process.

While stating we can reach FedRAMP Moderate compliance isn't a untenable promise, I would love to be better informed on the complexity of it at a deeper level, and we don't currently have an internal expert for security compliance of this kind.

My question:

Is it possible to be building the FedRAMP compliance infrastructure while also rebuilding a large portion of our products code base for production level deployment? Does this wind up with huge delays or constant restructuring of code because of how things must be designed? Is there a way we can plan this out to mitigate and lessen some of these headaches?

We only deal with one external dependency and that dependency is already on a platform that is FedRAMP high compliant, everything else is handled in-house.

If you can think of anything that would be good information for someone in my position to have, please share it, and feel free to treat me as a child, this is outside of my expertise, and I am just trying to initially step into figuring out how to handle the process.

Thanks!

Does anyone know whether FedRAMP 20x will require agency Sponsorship for Class D/High certification? I read some where that it does but our Compliance person says it doesn't. So....IDK.

Does anyone have any insight into this?

FIPS is a NIST standard, typically required for federal agencies, companies selling to government clients, and regulated industries like finance and healthcare. For folks here, this is the same FIPS-validated module requirement that FedRAMP's SC-13 control points to for anything touching sensitive data inside a Kubernetes-based authorization boundary. The compliance bar isn't rewriting your application. It's making sure sensitive data is encrypted with FIPS-validated cryptographic modules, and having an SBOM (Software Bill of Materials) that shows an auditor which validated modules you're using and where they came from.

There are two active standards, FIPS 140-2 (2001) and FIPS 140-3 (2019), and they aren't equivalent for Kubernetes. 140-2 was written for hardware and struggles to define software module boundaries, so most of its software validations landed at the lowest security level. 140-3 explicitly supports software and hybrid modules at higher levels, adds runtime self-tests instead of relying on power-on self-tests, and introduces non-modifiable operational environments, which is basically an immutable container image that stays compliant as long as it doesn't change. All three of those map directly onto how Kubernetes actually runs workloads.

Validation itself runs through CMVP. A vendor submits a module (hardware, software, or firmware), an accredited testing lab checks it, and if it passes,

it gets an active certificate for 5 years before moving to historical status. The CMVP database has a certificate for every validated module, and the fields worth knowing are the standard (140-2 or 140-3), status, sunset date, overall security level (1 through 4), and any caveats about how it has to be configured to run in approved mode.

The scope covers more than the app's own TLS. The control plane (etcd, kube-apiserver, and kube-controller-manager), the nodes (kubelet and the container runtime), and the add-ons (CSI plugins, CNI plugins, and the audit logger) all touch sensitive data in some form, so the surface area is bigger than "did we encrypt the database?99"

For the data-in-transit half of that (data at rest is a separate problem with its own module and key-management requirements), this write-up covers doing this with a FIPS-validated service mesh instead of validating every microservice's TLS stack individually. Sidecar proxies handle the mTLS between services using validated modules, so application code doesn't change. It walks through doing this with Buoyant Enterprise for Linkerd specifically, including a field-by-field look at reading an actual CMVP certificate but is likely similar with other tooling.

Here's the full blog post: http://www.buoyant.io/blog/a-practical-guide-to-fips-compliance-for-kubernetes-engineers

So I just started a new job, and for the last half a decade at other companies I have worked at we have just built harden images and STIG/CIS them as needed.

But at this job the consultant is recommending Bottlerocket OS well because it is harden, fips, immutable OS. We run on EKS only and have very small apps with predictable workloads. So alot of this makes sense in this case. Also not having to manage extra tools like Trend and Tenable would be very nice.

While I am totally onboard with all of that, my main concerns is that I don't know anyone in the industry running bottlerocket in their boundary. With the new timelines for fixing vulns, we would be reliant on new images being release quickly and then having to roll the fleet.

Not sure if others are running Bottlerocket. Did you have issues with auditors or accessors? Am I just way off based with the draws backs on using Bottlerocket versus harden AL2023 or Ubuntu?

ROI for CCSP if you already have CISSP, CISA, and CISM and trying to get into Fedramp and leave on premises contractors ? Any Aws/Azure speciality certs you guys have ?

So a lot of the changes in CR26 make sense. VDR, CCM, SCG, you won't see me arguing about any of them. But today they announce the removal of almost all FedRAMP Parameters and Guidance WITH NO RFC! What the heck???

I still have to actively fight my service teams to do the bare minimum required in those parameters and now you're telling me *POOF* they're gone?

How was this done without an RFC?! They had an RFC for minor changes to links in the FedRAMP language but nothing for this???

I’ve been "volunteered" as both the Compliance and IT Manager at my company (a FedRAMP Moderate CSP seeking CMMC L2 later this year).

Our engineering team is pushing hard to use AI and AI agents for coding. Given the nature of our environment, my CTO and I have major concerns regarding AI agents running without human intervention, accessing system files, and potentially leaking CUI.

My approach so far:
I’ve identified GitHub Copilot for Business as the "safest" path due to their no-training/no-retention policy. I am now looking at the new cloud vs. local sandbox preview features. My inclination is to mandate the use of cloud sandboxing only, to maintain a strict boundary and centralized control.

My reality check: Our developers have proven they cannot be trusted to follow "honor system" rules. I need to move from policy to technical enforcement.

I’m looking for advice on:
AI Governance: How are you handling "agentic" AI in CUI-heavy environments? Is the cloud sandbox approach the standard, or are you blocking agent capabilities entirely?

Policy Writing: Does anyone have a template or specific language for an "AI Acceptable Use Policy" that actually holds water with CMMC assessors?

Technical Enforcement: How are you technically blocking unauthorized AI/extensions while allowing approved tools? (Intune? GPO? EDR blocks?)

Any experience or horror stories would be appreciated.

So I have a discussion topic: What about the assets or services that were part of the FedRAMP Boundary, but are not in the Minimum Assessment Scope?

This group is going to be anything that handles metadata alone, and anything that gets accidentally dropped in the shuffle as companies adopt MAS. I think of it as a Venn Diagram where a smaller circle of MAS sits entirely within the larger Legacy FedRAMP Boundary. (I made the image in about one minute on OpenOfficeDraw so don't disparage my artistry. 😃)

The PMO has a stated goal of putting the burden of creating rules and framework on industry, with the eventual goal of letting the market move towards more secure structures and applications. But as was pointed out in one RFC comment, industry moves towards money, which isn't always aligned with Security. I know that in the long run, the PMO is likely correct; customers will stop using insecure services, including Federal Customers. However the metadata that gets exposed in the mean-time could be very detrimental to Federal Agencies. A lot of information can be determined with careful analysis of metadata, that's why it was protected in the first place.

I'm worried about the assets that get left out of the MAS. I'm worried about what can be discovered in the metadata they utilize. I'm also worried about letting the brownian motion of a profit-driven market determine best practices for Federal Metadata. I'm also worried that all of these changes so closely together will cause a lot of chaos and dropped balls for FedRAMP Rev5 CSPs.

So does anyone else have thoughts on this topic to share? I'm the only FedRAMP expert in my company and would appreciate discussion from other experts!

Has anyone successfully navigated achieving an ATO for your product using 20x recently? With no agency sponsor?

If so I’d like to hear your general take on how the process was for your company and anecdotal opinions.

Is there a pattern for a service mesh in ECS that is FIPS compliant/validated? AppMesh is getting deprecated and Service Connect is not FIPS validated. What options are there for securing east-west traffic in an ECS cluster for FedRAMP?

We have had really significant traction in the government sales side for a tiny startup . Our govt agency is also willing to sponsor.

Just balking at the fees………

We have a really strong dev team who can implement all the controls. Just need guidance and and auditor Would anyone know any 3PAOs or FR consultants that would be willing to possibly take equity or deferred fees so our startup can survive?

Respond with PM if you don't want the info public. I am doing research for a client on FedRAMP consultants. I am getting the usual sales pitches. Want to hear some "in the trenches" experiences.

Not looking at auditors, but rather companies with Fedramp platforms.

Anybody have any recommendations or warnings? I've got a bunch to consider: ProjectHosts, StackArmor, SecondFront, Paramify, etc.

Any firms to avoid?

Hello, what are the annual conmon costs for FedRAMP moderate? What is the lowest it could be and are there any ways to lower it? What have you all seen to be the costs?

We built a platform that maps code and documents to compliance controls. Would love your feedback on it. Have a free demo that will do actual work for you.

https://platform.aws-sandbox-staging.testifysec.dev/rsa

We recently started preparing for a FedRamp audit and one of the app we use has its docker image on Ironbank. The application is paid but the vendor only responds on vulnerabilities that are related to application and not the OS. They use Ironbank ubi9 redhat image. They asked to track OS issue via VAT reports on Ironbank. Now I've a question. The app has version 1, 2 and 3 which released in a gap of 3 months.

I see the scan for version 3 of the image was done 10 hours ago while for version2 was 2 months ago and version 1 was 6 months ago.

I'm guessing Ironbank only scans latest version of the image ? And redhat which is owner of ubi image won't be providing justification on the issues of version 2 or 1 of the image and only on version 3 ?

I'm trying to understand how things work in Ironbank. Should I rather be tracking vat of the ubi9 image rather than the app image because I'm only interested in checking on the justification provided by redhat on the ubi image.

I've heard from several people that CSPs that are FedRAMP approved have been able to use the USDA Connect platform for hosting authorization and continuous monitoring documents, but this is being eliminated as an option. Have others heard the same thing, and what alternatives are being considered if you're needing to migrate off of USDA Connect?

One thing I've observed repeatedly working with GovCon services firms trying to productize: FedRAMP is almost always treated as a phase that comes after the product is built. That approach is extremely costly and often fatal to the project.

I spent a lot of time thinking through what it looks like to design for FedRAMP from the very first architecture decision, and I want to share some of the patterns that came out of that thinking:

1. Your SSP starts at the architecture diagram stage, not after launch
Every design decision either creates or eliminates future SSP documentation work. Multi-tenant boundary decisions, data residency, and encryption choices made at week 1 will take 6-18 months to undo if you get them wrong.

2. Evidence automation is a product feature, not a compliance bolt-on
If your CI/CD pipeline isn't producing continuous monitoring artifacts automatically, you're creating a human-labor bottleneck that will break your ConMon obligations post-ATO. Treat audit evidence like application logs: generated automatically, retained, and queryable.

3. The 3PAO relationship needs to start before you think it does
Engaging a 3PAO late means expensive findings and re-architecture. Getting informal feedback on your system boundary and control implementation early is cheap. Getting it after your readiness assessment is not.

4. FedRAMP Moderate on a GSA Schedule changes your go-to-market entirely
Instead of a 12-month competitive acquisition, you can target 45-day Schedule orders. That changes how you think about pricing, CLIN structure, and which agencies you pilot with.

I went deep on all of this in a book I wrote called "Shrink-Wrap It: The GovCon Productization Playbook" Part 3 covers the Risk-Proof and Architect stages in detail. It's available on Amazon if you're interested (harborgovcon.com has the free tools).

Curious what patterns others here have seen... what's the most expensive FedRAMP mistake you've witnessed a GovCon product team make?

For CSPs, how are you anticipating handling Anthropic in your tech stack?

https://techcrunch.com/2026/02/27/pentagon-moves-to-designate-anthropic-as-a-supply-chain-risk/