FedRAMP 20x: Define the Scope of a Limited Agency Pilot

An agency wants to evaluate your already certified 20x Class B or C service. Before setting up a trial, clarify what the agency's policy permits and what the evaluation is intended to learn. FedRAMP 20x agency pilot scope is a joint planning conversation with an agency decision owner, not a permission the provider can grant by pointing to its certification.

FedRAMP's Initial Agency Authorization guidance says agency policy may allow a short pilot using public or otherwise negligible-impact information. It directs teams to set users, data, duration, prohibited uses and exit criteria before the pilot starts. The same guidance explicitly says a pilot does not waive authorization, privacy, acquisition or records requirements.

Start with the agency's permitted use

The guidance describes certification as reusable security evidence. The agency still decides whether and how to use the service in its information system. It also calls for confirming that the planned use involves the FedRAMP Certified version of the service.

For a provider team, the useful first handoff is therefore a clear description of the certified offering, the proposed evaluation and the open policy questions. Ask the agency's responsible owners to confirm whether a pilot is permitted for the contemplated information and use. Public data alone does not establish that permission.

This article concerns an agency's evaluation of an already certified offering. It is separate from joining a FedRAMP program pilot or participating in proposed Phase 4 work. The initial-authorization guidance is not a route to approve an uncertified service for use.

Agree on five boundaries before starting

Use the guidance's five planning dimensions to create a concise working brief. The examples below are editorial ways to make those dimensions concrete, not a new official FedRAMP form.

The guidance describes a short pilot but supplies no universal duration in that passage. Do not turn a convenient trial length into a FedRAMP deadline. Keep the agency's decision and any unresolved conditions visible in the brief.

Make the evaluation question specific

A narrow question makes scope easier to manage. For example, a team might want to learn whether a defined group can complete an agreed workflow using permitted information. The brief can state the observed result the agency wants, the features involved and the evidence the provider can help supply.

That is more useful than an open invitation to explore every feature. If a participant proposes adding a new integration or changing the information used, bring the changed scope back to the agency owners before treating it as part of the agreed evaluation. This is an operating practice for keeping the pilot aligned with its purpose; the provider does not make the agency's risk determination.

Hand the outcome back to the agency

At the end, compare the observed results with the agreed exit criteria. Separate what was tested from what remains unknown, and identify any implementation questions for the agency's next decision.

The outcome can inform the broader onboarding discussion, but it does not promise an Authorization to Operate. The official guidance places the decision about agency use with the agency and preserves authorization, privacy, acquisition and records obligations throughout the pilot.

Use the agency onboarding and package handoff guide to connect that outcome to the customer's system planning. Keep the certified service version, agreed evaluation scope and agency decision ownership clear as the conversation moves forward.