FedRAMP 20x Changes the Evidence Model for AI Cloud Services

FedRAMP 20x changes the unit of assurance. The programme asks cloud providers to state their security goals and explain the decisions behind them. Providers must also produce continuing evidence that the measures work. That approach fits an AI service better than a static screenshot of one approved configuration, because model endpoints and retrieval stores can change between assessments. Policy versions and agent permissions can change too.

The current FedRAMP 20x programme page says certification rules are finalized for Classes A and B. The rules for Class C are also finalized. AI providers now need to map each model-enabled service to the right certification boundary and evidence class without treating the words "FedRAMP 20x" as a blanket approval for every model route.

TL;DR

• FedRAMP 20x centres assurance on security decisions and continuous measurement. It also centres accountability and automatic validation.
• Class A and Class B certification rules are available. Class C rules are also available; Class D remains planned for Phase 4.
• AI services need evidence tied to the actual cloud service and model endpoint. That evidence must also cover the identity path, data flow, and policy version.
• A provider certification and an agency's authorization decision remain distinct records.
• An HTTP AI policy gateway can enforce approved model routes and preserve request decisions, while the wider cloud boundary and certification package stay with the provider and agency.

FedRAMP 20x replaces the annual snapshot with operating evidence

The official programme describes transparency and flexibility as principles. It also names accountability, accuracy, and automatic validation. Its language is unusually direct. Security should be continuously enforced and monitored. It should also be reported, with evidence of what is happening carrying more weight than a policy that says what should happen.

Phase 1 ran between April and September 2025 as a Low pilot and proof of concept. FedRAMP reports 26 complete packages, with 13 reviews completed during the phase. The pilot focused heavily on Key Security Indicators and automation-based validation of security decisions and outcomes.

That history matters for AI teams because the desired artifact is a measured control, not a binder assembled before an assessor arrives. I would rather show an assessor 30 days of denied calls to unapproved model destinations than a 30-page policy claiming those destinations are prohibited. The first record demonstrates operation. The second records intent.

Certification classes set different expectations

FedRAMP 20x now presents Classes A and B as available. Class C is also available. Providers with mature security and compliance programmes can enter the federal market through Class A. Class B addresses common, smaller-scale or light-use services where agency-wide use for important work is unlikely. Common enterprise services likely to support an entire agency or important government services fall under Class C.

The class belongs to the cloud service and its use context. Classification requires the service boundary and intended agency use. It also requires the deployment architecture and data types, along with the dependency chain and expected operational importance. A model catalogue supplies only one part of that record.

The current Class C ruleset reference includes rulesets for certification and minimum assessment scope. It also covers independent verification and collaborative continuous monitoring. Other rulesets address incident evaluation, significant changes, security decision records, vulnerability response, and certification data sharing. Those names create a practical work queue for an AI service owner.

AI scope starts with one complete request path

Draw one model request on a whiteboard. Start with the federal user or workload identity. Follow the request through the application and retrieval layer, then through any policy point to the exact model hostname and region. Record the tenant and storage service too. Add the response path and every durable log.

That drawing should identify which components sit inside the cloud service boundary and which belong to another provider or agency system. Include model aliases that can change their underlying version. Name vector stores and tool endpoints where they handle federal information. Do the same for prompt stores, safety services, and human-review queues.

The FedRAMP LLM requirements guide explains why the authorized cloud service boundary comes before a model checklist. FedRAMP evaluates a service offering and its controls. An agency still decides whether a specific use is authorized.

Security decision records need AI-specific context

A useful security decision record for an AI service should identify the decision owner and service boundary. It should state the threat or requirement and selected measure. The record should name the evidence source and validation method, along with the exception process and review trigger. Link it to the configuration that implements the decision.

For model traffic, include approved destinations and identity propagation. Record prompt and response data classes, retention behaviour, model-change controls, and retrieval sources. Include allowed actions. The record should say what happens when identity is missing or a route changes. It should also cover a classifier failure or an agent request for a tool outside its delegated scope.

Avoid inventing a separate control family called "AI security" and leaving existing ownership unclear. Access and audit duties still apply. Communications, configuration, incident, and vulnerability duties still apply too. The FedRAMP AI controls mapping attaches those duties to the request path through repeatable tests and retained evidence.

Continuous evidence should answer concrete questions

An AI evidence feed should let an assessor sample a decision and reconstruct it without asking an engineer to remember the deployment state. At minimum, preserve the authenticated principal or workload and calling application. Preserve the data classification and model destination, along with the policy version and action. Record the timestamp and integrity result for governed model requests.

Pair traffic evidence with deployment evidence. That includes signed build artifacts and configuration changes. It also includes model and provider inventory changes, vulnerability findings, incident events, exception approvals, and validation results. Keep raw evidence under retention and access rules appropriate to the service. Expose summaries without spilling prompt content into an assessment portal.

The FedRAMP AI audit evidence guide covers this separation between security evidence and sensitive payload data. A record can prove which policy ran and what it decided while storing prompt content under tighter access controls.

Provider, agency, and gateway ownership stay separate

The cloud provider owns the certified service boundary and the evidence required by its class. The agency owns its authorization decision and use case. It also owns connected systems, data rules, and acceptance of residual risk. A model provider may own another authorized service in the chain.

An AI gateway adds a narrower control point. It can verify application-supplied identity context and restrict model destinations. It can also classify data and enforce route policy. The gateway can write per-decision records for HTTP traffic. FedRAMP certification and class selection stay outside that control point. Bypass traffic stays outside it too.

This allocation prevents a common diagram error where a green gateway box appears to cover local tools and browser sessions. It also cannot cover model training or every vendor dependency. Each dotted line needs an owner and evidence source. It also needs a failure response.

DeepInspect

DeepInspect is a stateless proxy for authenticated HTTP traffic between users or agents and LLM endpoints. For routed calls, it can evaluate application-supplied identity and role. It can also evaluate data classification, approved destination, and policy version before forwarding the request. It writes a per-decision audit record that can feed the continuous evidence model described by FedRAMP 20x.

DeepInspect covers that HTTP decision boundary. Provider certification and agency authorization remain with their assigned owners. The same applies to infrastructure hardening and vulnerability management. Incident reporting, model development, local execution, and traffic that bypasses the route also remain with their assigned owners.

Book a demo today.