by Michael Peters
Bookmark

The Evolution of FedRAMP in 2024

2024 has been a watershed year for FedRAMP, ushering in significant structural, procedural, and technological advancements to the program meant to streamline authorization and make bringing cloud products to federal agencies easier. 

From new governance to new paths to authorization, we’re recapping FedRAMP’s changes in 2024. 

 

Strategic Goals for FedRAMP Modernization

Each new initiative reflected broader strategic goals for FedRAMP in 2024, including:

  • Modernizing operations expedites the adoption of secure cloud solutions and accelerates the broader adoption of cloud technology across government agencies.
  • Emphasizing objective, data-driven approaches to security assessments that allow agencies and assessors to consider risk as part of their decision-making.
  • Leveraging automation and digital tools to streamline how agencies can scale with the demands of their constituencies. 

These efforts align with FedRAMP’s mission to secure federal cloud environments while enabling innovation and operational efficiency.

 

A New FedRAMP Board

FedRAMP in 2024

Perhaps one of the most dramatic changes to the program in 2024 was establishing the FedRAMP Board. The FedRAMP Board replaces the previous Joint Authorization Board (JAB), which handled provisional Authorizations and essentially governed the program (specifically by including several representatives from key security departments). 

The FedRAMP Board comprises seven federal technology executives appointed by the Office of Management and Budget (OMB). The Federal Chief Information Officer is the non-voting Chair, while the FedRAMP Director is the non-voting Vice Chair. This streamlined and expert-driven board is tasked with:

  • Policy Approval and Guidance: Reviewing and approving FedRAMP policies to align with federal security standards.
  • Enhancing Authorization Capacity: Expanding the capacity for authorizing cloud services to foster a secure and robust cloud ecosystem.
  • Program Oversight: Monitoring the overall health and performance of FedRAMP.

Memorandum M-24-15 outlines how the new FedRAMP board is positioned to more effectively address the security and operational challenges associated with cloud technologies. The shift also underscores FedRAMP’s evolution from an authorization program to a comprehensive security and risk management initiative.

 

The Agile Delivery Pilot

One key challenge of FedRAMP has been the time cloud offerings take to move through the authorization process. The process can take months or years to complete between the RFP, agency partnership, and third-party assessments (depending on the demands of the sponsor agencies). 

The Agile Delivery Pilot attempts to address this challenge. This pilot program enables CSPs to rapidly introduce new features and services, aligning with modern development practices such as CI/CD and DevSecOps.

Key objectives of the pilot include:

  • Accelerated Deployment: CSPs can deploy updates without requiring prior agency approval, reducing time-to-market for new capabilities.
  • Streamlined Change Management: The pilot reimagines the significant change request process to better align with industry best practices.
  • Continuous Assessment: The program explores opportunities to transition from point-in-time evaluations to continuous assessment models.

With six cloud service offerings and twelve federal agencies participating, early feedback has been overwhelmingly positive. Agencies appreciate the expedited change approvals and the potential for automation to mitigate risks. The Agile Delivery Pilot runs until the end of 2024, and findings will inform long-term updates to FedRAMP’s processes.

 

Digital Authorization Packages

FedRAMP launched the Digital Authorization Package pilot in August, another groundbreaking initiative. This initiative leverages the Open Security Controls Assessment Language (OSCAL) to create machine-readable authorization packages that modernize and automate the authorization process.

The primary goals of the pilot include:

  • Enhancing Guidance and Tools: Developing open-source guidance and validation tools to assist CSPs in creating high-quality System Security Plans (SSPs) in OSCAL format.
  • Automated Validation: Introducing validations that offer faster, more consistent reviews of FedRAMP packages.

The pilot, conducted as an open-source project on GitHub, encourages transparency and community involvement. While it does not immediately alter the current authorization process, it lays the groundwork for a future where digital authorization packages streamline compliance and improve review consistency.

 

The Technical Advisory Group

The Technical Advisory Group (TAG) emerged as an independent body of federal experts tasked with providing technical guidance to FedRAMP. This group complements the work of the Federal Secure Cloud Advisory Committee (FSCAC) by offering in-depth technical expertise.

The inaugural TAG members bring knowledge from various federal agencies, including the Department of Homeland Security, the Cybersecurity and Infrastructure Security Agency (CISA), and the Centers for Medicare and Medicaid Services. Their responsibilities include:

  • Advising on emerging technologies and security challenges.
  • Enhancing the effectiveness of FedRAMP’s risk management practices.

The TAG’s work ensures that FedRAMP stays ahead of the curve in addressing the unique security needs of federal cloud services.

 

A Transformative Year For FedRAMP

From establishing the FedRAMP Board and launching innovative pilots like Agile Delivery and Digital Authorization Packages to forming the Technical Advisory Group, each initiative underscores the mission of using FedRAMP as the bedrock for an agile and effective cloud service authorization program. 

As FedRAMP evolves, these advancements will bolster federal agencies’ ability to adopt cloud technologies securely and serve as a model for modernizing government operations in the digital age.

To learn more about how Lazarus Alliance can help, contact us. 

[wpforms id=”137574″]