The Federal Risk and Authorization Management Program has rolled out a set of policy proposals aimed at bringing its overhaul under the FedRAMP Authorization Act to a close.
FedRAMP released on Tuesday six requests for comments, or RFCs, to align the program with its updated statutory role and Office of Management and Budget Memorandum M-24-15, following nearly a year of testing and engagement with the cloud security community.
What FedRAMP Changes Are Being Proposed?
The RFCs propose new requirements for reporting independent assessment costs, a revised authorization designation system that distinguishes FedRAMP approvals from agency authorizations to operate and expanded FedRAMP Marketplace listings that would include services still in the preparation phase.
Other proposals introduce a new authorization step that leverages external security assessments for limited, low-risk use cases; a temporary sponsorless Rev5 certification path for certain providers; and requirements for machine-readable authorization data tied to defined implementation timelines.
Why Release Six FedRAMP RFCs at the Same Time?
Rather than issuing changes incrementally, FedRAMP opted for a single, coordinated release of the RFCs. The program office said the approach reflects the close connection between the proposed updates and aims to avoid creating a prolonged period of uncertainty for the FedRAMP ecosystem.
To reduce the burden on stakeholders, comment deadlines were staggered across the six proposals. Comment periods will remain open through mid-February and March, depending on the proposal.
FedRAMP said it will address questions about the RFCs during upcoming community update meetings and plans to host at least one special event focused on the changes.
Data gathered will be used to improve the proposed updates.
