FedRAMP 20x Class D Proposal: Who Decides Whether FOCI Is Acceptable?

A customer asks whether FedRAMP certification settles its concerns about foreign ownership, control or influence (FOCI). Under the boundary proposed in RFC-0036, the answer is no: demonstrating that a provider knows and tracks FOCI is separate from an agency deciding whether that FOCI is acceptable for its use.

For teams planning around FedRAMP 20x Class D FOCI agency determinations, that distinction affects both the response owner and the information shared. As checked on October 26, 2026, RFC-0036 presents this as a proposal for the Phase 4 Cloud-Hosted pilot, not a finalized new duty.

Separate the proposed decision owners

Proposed FRC-FRA-FOD says FedRAMP MUST NOT request details of providers' foreign ownership, control or influence, and would not determine whether that FOCI is acceptable. Its note assigns acceptability decisions to agencies for their own use. FedRAMP's role would be to verify that providers know and track FOCI. RFC-0036, FOCI Determinations are Agency Specific

The RFC's narrative adds the assurance context: FedRAMP would confirm whether providers adequately demonstrate persistent review of the relevant indicators to understand FOCI and their business. It explicitly says these practices do not replace agency-specific needs or determinations.

A status showing that review took place therefore answers a different question from an agency determination. Do not describe that status, or certification under this proposed model, as FOCI clearance. The proposal does not establish that any particular nationality, ownership structure or business relationship is acceptable to a customer.

Preserve the customer-contract condition

The proposed FOD note does not remove customer information needs. Although FedRAMP does not intend to collect sensitive business information under this proposal, it expects providers to be able to supply that information when customers require it under their contracts.

For operating purposes, identify who can evaluate a customer request against the relevant contract and who owns the underlying information. A useful handoff preserves the requesting customer, the purpose of the request, the information sought and the person coordinating the response. These are editorial practices, not additional FedRAMP disclosure rules.

For example, a customer-security team may receive a request that cannot be answered by a summary of review status. Route that request to the appropriate provider owner for a customer-specific response. Avoid assuming that material useful to one agency resolves another agency's determination.

Keep status evidence distinct from sensitive details

The RFC's proposed FOCI indicator notes repeatedly say that sensitive underlying details should not appear in Key Security Indicator metrics. Across those notes, the protected detail categories concern changes or actions, persons, businesses, and determinations or mitigation agreements. RFC-0036, proposed FOCI indicators

For planning, separate two kinds of information:

• Review-status evidence: information that helps explain whether the relevant review and tracking activities are occurring.
• Underlying details: sensitive information handled through the appropriate customer-specific process when the contractual condition applies.

This separation is an editorial way to organize ownership and responses. It does not prescribe a metrics schema, a public ownership registry or a particular access-control product. It also does not imply that a metric can stand in for the agency's acceptability decision.

The certification data sharing workflow addresses the separate task of organizing shared certification information. Keep the FOCI proposal's sensitive-detail boundary visible when considering how a future workflow might connect to that broader work.

Use the boundary to prepare better feedback

Walk through a hypothetical customer request with the people who own review status, underlying information and the customer response. Check whether each person can explain what the proposed FedRAMP assurance would show and what remains for the agency to decide.

That exercise can reveal unclear handoffs without inventing a substantive FOCI determination. Keep any planning notes labeled as work against the current proposal, and recheck RFC-0036 before treating its language as an adopted rule.