Big Changes to FedRAMP Coming

September 13, 2024

Today, the Office of Management and Budget (OMB) released a much-anticipated update to the FedRAMP program. While much of the new guidance was seen previously in draft form, it is now official. Overall, many of these are significant improvements in the overall FedRAMP program, for both the cloud service providers and the federal customer.

You can find this new guidance under OMB M-24-15 here: Modernizing the Federal Risk and Authorization Management Program (FedRAMP) (whitehouse.gov)

Here’s some of the highlights from the new guidance: Limiting the scope of FedRAMP – The memo explicitly reduces the scope of applications that must be FedRAMP authorized.

Presumption of Adequacy – The memo now formalizes that federal agencies must presume that if a cloud service provider has a FedRAMP authorization at the correct impact level, that that is sufficient.

Introducing “Program Authorizations” – The FedRAMP PMO Director now has the authority to sponsor. Given the challenges for most companies to find a Sponsor, this is a radical improvement. The big unknown remains on what criteria the Director will use, so we’ll see.

Introducing “Preliminary Authorizations” – This introduces the provisional ATO to the federal civilian space, and allows CSP’s to have a temporary FedRAMP authorization to support product trials for up to a year.

Automation and AI – The FedRAMP PMO is moving towards a fully automated process to receive the security documentation, and is looking at AI to help them accelerate the review process.

Making change easier – OMB is asking the FedRAMP PMO and other stakeholders to develop a framework that will allow CSP’s to make rapid changes. This is a must if FedRAMP is going to keep up with modern software delivery, and until now was often blocked due to the existing significant change process.

We will know more in 180 days – OMB is requiring federal agencies to issue updates to agency-wide policies that aligns with the new guidance. At that point, we should have actionable insight on how these changes will be implemented across the federal government.

While this has been in the works for quite some time, it is great to finally see the formal OMB memo to be released. Anything that makes it easier to become FedRAMP authorized while maintaining the appropriate level of cybersecurity is welcomed.

Follow Optiv
LinkedIn: www.linkedin.com/company/clearshark
Facebook: www.facebook.com/optivinc
YouTube: www.youtube.com/c/OptivInc
Blog: www.optiv.com/explore-optiv-insights/blog