The New Roadmap for FedRAMP

Michael Peters

8 months ago

Recently, FedRAMP announced that, per stakeholder feedback, the federal market’s needs for cloud SaaS products are not being met. A significant part of this is the program’s bottleneck.

To address this issue, the Office of Management and Budget (OMB) has released a draft memo offering significant program changes, including updates to infrastructure, leadership, and authorization.

This article will briefly overview this new roadmap based on the information currently available to the public.

Why the New Roadmap for FedRAMP?

Per the FedRAMP blog:

“While SaaS applications are used in government, and FedRAMP does have some in its marketplace, it’s not nearly enough and it’s not working the way that it should. We know that for many companies, especially software-focused companies, it takes too much time and money to get a FedRAMP authorization.”

The blog is quite frank in its assessment that the FedRAMP program isn’t authorizing SaaS products as fast as needed and that the marketplace isn’t nearly as robust as it should be. As such, it is rolling out this new roadmap to foreground new priorities and processes to grow the program and the marketplace.

The Primary Goals of the New Roadmap

To support the goals of this new approach to FedRAMP, program leadership has defined four specific priorities:

Customer Experience: Simplifying the process for cloud providers and making the results more useful for agencies. The goal is to align the perceived time and cost of going through FedRAMP with customers’ actual experience.
Cybersecurity Leadership: Ensuring FedRAMP remains a security and risk management program by making security expectations more transparent and consistent for all FedRAMP authorizations. This involves updating policies to balance security requirements with real-world security needs.
Scaling the Marketplace: Develop clear processes with trusted authorizing partners to reduce unnecessary reviews and streamline the process. Additionally, FedRAMP will support scalability by taking on more post-authorization monitoring and automation.
Smarter, Tech-Forward Operations: Implementing tools, specifications, and services to create and share digital authorization packages and other information will build a data-first, API-first foundation for FedRAMP, modernizing operations and enabling automation.

What Initiatives Are Being Put in Place to Follow These Priorities?

To support these priorities, the program will see significant changes… and it looks like these changes might be coming very soon.

The initiatives that the program has identified as necessary to support the new program priorities include:

Agile Change Management: FedRAMP plans to replace the significant change request process with a more agile approach that doesn’t require advance approval for each change. This will enable more rapid improvements and updates to the program’s processes.
Customer-Oriented Metrics: The program will introduce customer-oriented metrics to understand better the cost and time involved in FedRAMP authorizations. Customer feedback will inform these metrics and help refine the program’s performance measurement.
Defining Security Expectations: FedRAMP aims to clearly define the security outcomes expected for all types of authorizations. This involves collaborating with the Cybersecurity and Infrastructure Security Agency (CISA) to develop and deploy the best protections for the federal enterprise.
Focusing on Outcomes: FedRAMP will focus on outcomes rather than just requirements, ensuring that security standards are applied reasonably and effectively. This includes updating guidance in FIPS 140, DNSSEC, and external service integrations.
Increasing Authorization Capacity: FedRAMP plans to work with trusted authorizing partners to streamline processes and eliminate unnecessary reviews. This includes piloting approaches with partners such as the Defense Information Systems Agency (DISA) to align processes and reduce review burdens.
Digital Authorization Practices: FedRAMP aims to transition to machine-readable authorization packages to facilitate automation and scalability. This involves defining machine-readable packages, providing guidance and tools, and piloting the approach with interested cloud providers and agencies.

These initiatives are designed to address specific challenges and opportunities identified in the FedRAMP program, ultimately improving the authorization process’s efficiency, effectiveness, and security for cloud service providers and federal agencies.

What Is the Timeline for These Changes?

FedRAMP has released a timeline for rolling out this new roadmap, but it is still a high-level timeline that’s broad in scope and involves cloud service providers receiving updates over the next 18 months.

This plan seems to break down into three distinct phases:

FY 2024 (Q2-Q4): This phase sees a significant push to release new knowledge and expertise into the market, including expanded guidance on approaching monitoring, FIPS compliance, and program navigation. It will also see the start of a “low-review” process with trusted authorization partners.
FY 2025 (Q1-Q2): This phase focuses on integrating more advanced review capabilities into the program and publishing new criteria for authorization (including the low-review authorization criteria). This phase will also include migration to a new FedRAMP platform with associated pilot programs.
FY 2025 (Q3-Q4): This phase will include releasing programs for a “crosswalk” between FedRAMP Low and external frameworks and drafting an Expert Risk Assessment Framework. It will also open up low-review authorization for more agencies.

Stay Aligned with the Latest FedRAMP Updates with Lazarus Alliance

Knowing this new roadmap is essential if you’re preparing for your FedRAMP Authorization. Work with Lazarus Alliance to ensure you’re always ahead of FedRAMP updates and changes.

If you’re looking to kickstart your assessment, contact Lazarus Alliance.

[wpforms id=”137574″]