The Federal Risk and Authorization Management Program has announced the second phase of FedRAMP 20x, a cloud-native authorization framework that aims to advance the use of automation to accelerate secure cloud adoption across federal agencies.
The program said it is targeting about 10 Moderate pilot authorizations as part of the FedRAMP 20x pilot’s Phase 2, which is not open to the public.
According to FedRAMP, the Phase 2 pilot will continue to be iterative and explore an automation-based approach to assessment and validation of security decisions by cloud service providers seeking FedRAMP authorization.
The submission window for this phase is expected to run from Oct. 16 to Dec. 16. FedRAMP said it plans to finalize all Phase 2 requirements from mid-October through Oct. 23.
Eligibility Criteria for FedRAMP 20x Phase 2 Submissions
According to FedRAMP, Phase Two submissions will be accepted only from CSPs that meet one of the following conditions:
- Providers who submitted a complete package for Phase One that was not rejected or withdrawn
- Cloud services that satisfy all FedRAMP AI Prioritization criteria
- Cloud services with GRC automation capabilities that can consume FedRAMP 20x machine-readable information from authorized services to enable review of initial and ongoing authorization data
- Cloud services that provide FedRAMP-compatible trust centers
The public can still participate in refining FedRAMP 20x through the program’s Community Working Groups.
FedRAMP 20x Phase 2 Authorization Requirements for CSPs
To submit a qualifying package for FedRAMP 20x Phase Two review, CSPs and assessors must address every recommendation and requirement in the framework.
Submission packages must demonstrate compliance by showing how the recommendation or requirement is implemented; sharing a plan to implement requirements or recommendations within the next six months; and explaining valid reasons for not implementing recommendations.
