Self-Hosted Services and FedRAMP 20x: What RFC-0033 Proposes

If your service depends on physical infrastructure your company operates, the proposed FedRAMP 20x expansion raises a practical question: what work can you prepare before the new criteria exist? Start by separating the infrastructure engagement track from the Class D cloud-hosted pilot. They have different purposes and proposed participation criteria.

This article explains RFC-0033 as reviewed on October 10, 2026. The RFC proposes an approach for Phase 4; it explicitly says details and timelines may shift with public comment. Its plans for self-hosted and hybrid-hosted services are not a certification approval or a promise that a particular infrastructure audit will be accepted.

Identify who is responsible for the physical infrastructure

RFC-0033 proposes three hosting definitions. Cloud-hosted offerings primarily run on third-party cloud offerings, with the provider not responsible for the physical infrastructure. Self-hosted offerings primarily run on infrastructure operated by the provider directly or through a third-party agreement, with the provider taking responsibility for that infrastructure. The proposal includes colocated or third-party-managed infrastructure when that responsibility remains with the provider. Hybrid-hosted combines cloud-hosted and self-hosted resources.

For planning, write down who operates and who takes responsibility for each facility and infrastructure layer. A colocation contract alone does not answer the question the proposed definition asks. Treat the definitions as RFC proposals when describing your situation internally or to a prospective customer.

Separate the three proposed tracks

The RFC describes three concurrent Phase 4 tracks:

Track 2 aims to inform expanded criteria in the Consolidated Rules for 2027 for self-hosted or hybrid-hosted services of any Class. It is broader than a Class D-only infrastructure discussion. Conversely, participation in a requirements-development discussion is not the same outcome as earning a pilot certification.

For direct provider engagement, the RFC proposes that participants be Rev5 Class C or D certified, have at least 15 agency uses on record, and be primarily self-hosted or hybrid-hosted. Providers with multiple qualifying offerings would count once. The proposal says FedRAMP would identify qualifying providers using Marketplace information and notify them through the FedRAMP Security Inbox. These criteria describe the proposed engagement track, not general 20x certification eligibility.

Prepare a useful infrastructure assurance inventory

Track 2 proposes examining widely used industry certifications and their differences from existing FedRAMP Rev5 requirements. FedRAMP's stated goal is to identify reusable certifications and classifications where possible for infrastructure-related controls. That goal is not blanket recognition of every existing audit.

A useful preparation exercise is to build an internal comparison with these fields:

• Infrastructure component and responsible organization.
• Existing certification or assessment, including its scope and period.
• Activities or facilities outside that assessment's scope.
• Supporting evidence you can share appropriately.
• Specific question about reuse that future rules would need to resolve.

These fields are our suggested working format. Do not label the result an official application or assume it satisfies unpublished criteria. For example, if an assessment covers a facility but excludes a service you operate within it, flag the gap explicitly. That makes the question more useful than simply asking whether the certificate “counts.”

Treat target dates as targets

RFC-0033 lists an October 12 notification target and October 16 opt-in response target for qualifying providers. It also proposes a November 4 RFC with general questions and a February 10, 2027 RFC on self-hosted or hybrid-hosted service rules. The source qualifies its timeline with the possibility of unexpected changes.

As of this article's October 10 source check, those dates are planning targets in the RFC. Verify actual notifications and subsequent official publications before organizing work around them. Do not interpret an expected notification date as an open public certification application window.

The RFC also says public questions and proposed rules will be published so that other parties can participate. A provider outside the targeted engagement criteria can prepare specific questions for those public processes. Check the relevant RFC's current comment instructions and dates when responding.

Keep customer commitments tied to published criteria

For internal planning, maintain two lists: work useful under your existing commitments, and assumptions dependent on future 20x rules. Assign someone to update the second list when official notices or final requirements appear. This is a suggested planning practice, not a FedRAMP deliverable.

The immediate value of the proposal is a clearer set of questions about physical infrastructure responsibility, existing assurance, and assessment gaps. Use it to prepare those questions. Describe future certification options conditionally until the applicable criteria and process are published.