The FedRAMP Program Management Office has sought public comments on a draft interpretive technical assistance document for an Office of Management and Budget memorandum titled “Modernizing the Federal Risk and Authorization Management Program.”
FedRAMP said the PMO will accept responses through June 15.
The OMB Memorandum M-24-15 updated the scope of FedRAMP and directed the publication of clarifying guidance to help agencies interpret the defined exclusion categories.
What Is the Purpose of the FedRAMP Scope Interpretation Technical Assistance?
The draft technical assistance offers additional technical nuance to support agency decision-making concerning categories of cloud services excluded from FedRAMP requirements.
The draft document also provides interpretive guidance with examples for each of the five exclusion categories outlined in the OMB Memorandum M-24-15.
The five exclusion categories are single agency systems; social media and communications; search engines; widely available commercial information; and ancillary services.
The draft technical assistance document provides key criteria that agencies can use when assessing cloud services, enabling them to focus resources on services that require FedRAMP authorization.
FedRAMP’s Request for Comment
The FedRAMP PMO is soliciting feedback on the clarity and conciseness of exclusion explanations and whether sections “When FedRAMP Doesn’t Apply” and “Key Tests” provide practical guidance for making determinations.
The office is also asking interested stakeholders if there are areas involving artificial intelligence or other emerging technologies that require additional information to inform agencies’ assessment of FedRAMP scope applicability.
