FedRAMP 20x, cloud impact levels, and authorization boundaries

Prerequisites: distinguish generated output from source evidence; review the AI workflow reference. Public self-study is not official agency training, accreditation or a credential.

What you will be able to do

This lesson develops the ability to interpret reusable cloud evidence without converting it into blanket approval. The setting is ORION Service Navigator, a fictional public-benefits information service using public guidance and wholly synthetic constituent questions; it never determines eligibility or takes an action on a person. Every person, organization, system record, metric, and outcome in the case is fictional. Do not replace the case with operational, classified, CUI, export-controlled, proprietary, employer-confidential, or third-party personal information.

By the end of the lesson, you will be able to:

• Demonstrate how to interpret reusable cloud evidence without converting it into blanket approval.
• Apply that model to the synthetic ORION Service Navigator environment.
• Produce a reviewable artifact that separates evidence, assumption, uncertainty, and authority.
• Recognize the critical failure and select a safe remediation path.

The performance standard is not confident language. It is a traceable decision, an artifact another qualified reviewer can inspect, a clear boundary around the learner’s authority, and a safe response to uncertainty. Knowledge checks are formative and do not award a certification or endorsement.

This curriculum runs self-study on VetsLearn. Where the text calls for an instructor, peer or formal review, use the stated acceptance criteria for self-review. Reflection questions support reflection; they do not replace independent assessment. A peer review is optional unless your actual organization requires it.

Part 1 Offering-specific boundary review

Reusable cloud assessment evidence can reduce duplicate work; the agency system still includes identities, integrations, tools and customer configuration. Evaluate the exact offering and boundary, not a brand or region. Split each control into provider implementation and customer responsibility. Physical hosting controls may be inherited under documented conditions; access, retrieval filters, logging and data handling require system evidence. DoD impact-level determinations and FedRAMP evidence have different purposes. Current 20x terminology and offering status require official verification; no current offering approval is asserted here.

Read the current terms without turning them into permission

Reference check: 3 October 2026. FedRAMP’s official 2026 guidance uses Certification for cloud service offering evidence and Classes A–D for assurance packages. Its 20x page lists Class A, B and C rules as available; Class D 20x remains a future phase. The timeline lists January 1, 2027 for mandatory adoption of the Consolidated Rules, subject to area-specific applicability. These dates describe the published transition, not the approval status of any offering; reopen this reference when the rules change.

Question	Terms to inspect	What it does not establish
Which provider evidence is available?	FedRAMP type (20x or Rev5), class, exact offering ID, package and date	Permission for your agency’s integration
Which agency use is authorized?	Agency information-system authorization, data, configuration and customer controls	Approval for a new tool or unrelated logging service
Which DoD cloud protection level applies?	DoD cloud impact level and exact offering/mission evidence	A conversion from a FedRAMP class or a learner’s access permission

The agency authorizing official still accepts risk for the agency’s specific system and use. Reusing the provider package avoids repeating provider assessment; it does not replace testing customer identity, retrieval filtering, logging and recovery.

DoD terminology example: DoDI 8520.03, dated May 19, 2023, §3.1.i summarizes IL2, IL4, IL5 and IL6: IL2 covers public-release and some low-risk unclassified information; IL4 covers CUI and other mission-critical data; IL5 covers CUI needing greater protection and unclassified national-security infrastructure; IL6 covers classified information up to Secret. These short descriptions are orientation, not sufficient handling instructions. The applicable current SRG, information owner, mission authorizing official and exact service evidence control a real decision. No operational or classified data is used here. Class C is not “IL5,” and no letter-to-number conversion is taught.

Practice interpretation: a fictional Class C package for service Cloud-A/notice is reusable evidence. A proposed remote dashboard is absent from its boundary; an invented “IL5” marketing label supplies no DoD evidence. Record both gaps, retain drafting-only synthetic practice and request the responsible review. Do not conclude that Class C approves CUI, classified work, or the dashboard.

Make inherited control evidence usable

For every inherited claim, record the provider service ID, assessed boundary, version/date, implementation responsibility, conditions and customer obligations. Then test the application’s responsibility rather than repeating the provider’s statement.

Fictional control	Provider evidence	ORION responsibility	Test
Facility protection	Cloud A package P1	Confirm exact hosting inclusion	Match service/environment IDs
User authorization	Infrastructure identity feature	Configure app roles and retrieval filters	Reader-A cannot retrieve Reader-B record
Trace retention	None for dashboard B	Establish destination, access and retention	Inspect synthetic trace route and deletion policy
Restoration	Provider storage availability	Restore ORION index and configuration	Rebuild from known backup and query fixture

Decision record: “Candidate A has reusable hosting evidence; authorization for the ORION integration is unresolved because dashboard B and customer access enforcement are not covered.” This is more precise than “FedRAMP compliant.” If B is removed, reopen the trace path review and test the replacement; do not erase the old finding.

Feedback: a provider responsibility matrix can inform inheritance. It cannot establish that the customer implemented the stated obligation. Current offering/20x status remains a live verification item.

Part 2 Synthetic worked example

Fictional Cloud A has hosting evidence, but ORION sends traces to dashboard B outside that boundary. Cloud C has a suitable-looking region but no service evidence. A is only a candidate pending dashboard and customer-control review; C is unverified. Neither receives a blanket CUI-approved label.

Guided practice: identify the unsupported conclusion, name missing evidence and rewrite with its scope intact. Change one assumption and identify which decision reopens.

Part 3 Feedback and repair

Hosting evidence does not cover an unrelated collector; a region does not establish service authorization. Pass when reused evidence names its boundary and customer gaps remain visible.

Keep failed evidence beside the repair. Explain the criterion, correct the artifact and test a different invented case.

Next step: carry your versioned artifact and failures into the next federal lesson; the capstone returns to these records. Check live policy and authorization with current official sources and responsible owners.

References checked 2026-10-03: FedRAMP 20x, agency use under the Consolidated Rules for 2026, published transition dates, and DoDI 8520.03, §3.1.i. The DoDI section was checked through official indexed text; direct full-document retrieval was restricted. Confirm the current SRG, superseding instructions and exact offering evidence with responsible officials before a real decision. No actual service status or organizational approval is asserted.