- VA has clarified that FedRAMP certification is not required for cloud contract awards
- Cloud providers must submit security documentation after contract award
- The 2026 Healthcare Summit will explore AI adoption, data privacy and modernization
The Department of Veterans Affairs has issued a memorandum clarifying that existing Federal Risk and Authorization Management Program certification is not required for vendors to compete for or secure cloud contracts, FedScoop reported Wednesday.
As VA works to modernize its cloud acquisition approach, federal health agencies continue to weigh how digital tools and AI can further improve data privacy and expand access to care. These priorities and more will be explored at the Potomac Officers Club’s 2026 Healthcare Summit on Dec. 3, where senior leaders will share how their agencies plan to acquire and utilize emerging technologies in exclusive panel discussions. Save your seat now!
Zack Schwartz, principal deputy assistant secretary in the VA’s Office of Information and Technology, signed and issued the memo dated Tuesday.
“This memo supports VA’s ability to sustain momentum with mission needs to provide secure technology solutions in a dynamic cyber risk environment, while avoiding unnecessary delays in the procurement of critical systems and services,” Schwartz wrote.
What Does the Memo Say About FedRAMP Certification?
According to the memo obtained by FedScoop, acquisition documents, including requests for information, proposals or quotations, should not imply or state that a cloud vendor must have already completed existing FedRAMP certification to compete for or win a contract at VA. The memo states that cloud systems, services and solutions will instead meet security and authorization requirements through adherence to NIST Special Publication 800-53 Revision 5 and other established security frameworks.
The document adds that this distinction does not waive, defer or diminish any otherwise applicable VA security, privacy or authorization requirements. It is intended to preserve acquisition flexibility while maintaining VA’s risk management standards.
What Documentation Must Cloud Providers Submit After Contract Award?
The memo states that post-contract award cloud service providers should be prepared to provide security and privacy-related documentation to receive a determination for operating within VA’s environment. At a minimum, this includes:
- Security assessment report
- Architecture/data flow diagrams
- Asset inventory
- Vulnerability scans
- If applicable, implementation status of FedRAMP 20x key security indicators
What Other IT Modernization Efforts Is VA Pursuing?
Beyond the FedRAMP clarification, VA’s OIT released an RFI to assess industry capabilities for delivering a Unified Discovery and Disclosure Platform capable of managing both eDiscovery and electronic Freedom of Information Act processing across the entire records lifecycle, while maintaining role-based access controls for different matter types.
In June, the department also issued an RFI seeking industry input on a potential enterprise cloud brokerage service contract designed to streamline cloud credit procurement, financial management and governance across the VA Enterprise Cloud environment.
