The General Services Administration’s (GSA) Federal Risk and Authorization Management Program (FedRAMP) plans to clear its agency authorization backlog by the end of April and launch new community working groups to speed the program into its next chapter.
FedRAMP Director Pete Waterman announced these initiatives on Monday as part of sweeping changes to the program, which ensures that the Federal government uses secure cloud services.
“The current Rev. 5-based agency authorization pipeline will remain open without significant changes, and the agency authorization backlog is expected to be cleared by the end of April, thanks to the incredible work of our contracted public servants who have served with FedRAMP for many years,” Waterman said on Monday during an event organized by the Alliance for Digital Innovation (ADI).
Once the backlog is cleared, Waterman explained that the FedRAMP Program Management Office (PMO) will continue to process new Rev. 5 agency authorizations “based on demand.”
“The assessments and materials included in a Rev. 5 agency authorization shall be presumed adequate for agency reuse of that FedRAMP authorization – that process is effectively not changing,” he continued. “FedRAMP Rev. 5 agency authorizations will remain the only active path to FedRAMP authorization until other paths are finalized and our community has eventually moved on to something better.”
MeriTalk reported on these coming changes last week, with sources familiar with the program wondering how the new goals will be achieved with recent cuts to the FedRAMP workforce.
Waterman addressed the recent workforce cuts, saying, “Yes, the PMO’s workforce and budget have been reduced significantly, but my remaining team was built for this mission and is dedicated to its delivery.”
“The reality is that FedRAMP is so expensive and burdensome right now that most companies never consider it. We need to lower that burden,” he emphasized.
In addition to clearing the backlog, Waterman said that FedRAMP plans to launch four community working groups starting next week.
“[The] working groups will be entirely open to the public, operating entirely in public, to ensure that everyone has fair and equal access to information,” he said. “We’re going to set the tone and host some discussion, but a lot will depend on you and what you bring.”
The four working groups are:
- Rev 5 Continuous Monitoring: Launch: March 31, 2025
- Automating Assessments: Launch: April 2, 2025
- Applying Existing Frameworks: Launch: April 8, 2025
- Continuous Reporting: Launch: April 10, 2025
Waterman emphasized that the Federal government “is not going to figure out how to do this on its own,” and encouraged industry leaders to help FedRAMP achieve its goals.
“Public servants deserve access to modern tools. FedRAMP will ensure they get them with your help. This is the dawn of something new. Let’s build it together,” Waterman said.
