FedRAMP: Navigating the future and guiding cloud service providers in the DOGE era
With the Department of Government Efficiency (DOGE) in the forefront, questions around the future of FedRAMP have begun to circulate. The future of FedRAMP is a topic of much discussion and one that we’ve had with many customers and partners, and we’re here to help guide you through the state of uncertainty that currently exists in the market. We will continue to keep this article updated as news continues to roll in on changes.
FedRAMP 20x
On March 24, 2025, FedRAMP announced its plans for a new assessment process for cloud service providers that will be designed by FedRAMP in partnership with industry stakeholders and agency experts. The new approach is called FedRAMP 20x.
FedRAMP 20x has five key goals:
- Make it simple to automate the application and validation of FedRAMP security requirements.
- Leverage existing industry investments in security by inheriting best-in-class commercial security frameworks.
- Continuously monitor security decisions using a simple, hands-off approach.
- Build trust between industry and federal agencies by leaning into the direct business relationships between providers and customers.
- Enable rapid continuous innovation without artificial checkpoints that halt progress.
Over the next few months, industry and government will come together in public community working groups to discuss key topics and chart a path forward for a more efficient FedRAMP assessment process.
FedRAMP Rev5 updates
As of March 24, 2025 the current Rev5 agency authorization pipeline will remain open without significant changes. The current agency operation backlog is on track to be cleared by the end of April and then the PMO will continue to process new Rev5 agency authorizations based on demand. Until a new process is defined, FedRAMP Rev5 agency authorization remains the only active path to FedRAMP authorization.
The value of FedRAMP in the DOGE era
We believe that FedRAMP is vital for modernizing Federal technology and software – aligned with DOGE’s vision to improve efficiency in the Federal government. We share the belief that FedRAMP has opportunities to continue improving efficiency, aligned with the vision that FedRAMP itself shared in December to improve authorization capacity designed to meet the demand that exists for authorization and create improved paths to faster and more straightforward review processes.
FedRAMP has provided a standardized approach to security and risk assessment for cloud technologies and federal agencies, reducing duplicative effort, inconsistency, and cost inefficiency by providing agencies with a security platform that can be leveraged once across several agencies. Through the “audit once, use many times” approach, GSA has estimated that the program has saved oved $700 million in costs associated with one-time assessment and authorization costs.
Charting your path forward
As a top 3 FedRAMP 3PAO, A-LIGN offers the following guidance to CSPs:
- For CSPs considering FedRAMP: We urge you to stay the course. Security remains of critical importance, and with FedRAMP signed into law, Government Agencies are still required to only use cloud solutions with security authorizations. While we do expect changes in FedRAMP funding to evolve objectives and responsibilities, we also know that national security will continue to be a priority. Although FedRAMP process responsibilities may shift a bit, e.g., from FedRAMP to the Agencies, security authorization remains a requirement for cloud solutions that process government data. As a result, our recommendation is to continue pursuit of FedRAMP authorization to open new routes to market and revenue. We believe DOGE’s mission is to modernize and drive efficiency in the Federal government should drive additional uptake in the use of cloud services and being prepared for that will allow your company to win new business.
- For CSPs who are already authorized: Your number one priority should be ensuring continuous monitoring activities are successfully demonstrated. As the FedRAMP program continues to evolve and in discussions about the future state, we’re hearing more and more focus will be placed on Continuous Monitoring (ConMon). In addition, with greater responsibilities shifting to the Agencies, now more than ever, ensure alignment with all your authorizing agencies to determine the right path forward for your company.
The state of FedRAMP
The GSA’s FedRAMP program, which evaluates the security of cloud computing services for Federal agencies, is undergoing significant changes. Although the support team at the FedRAMP Program Management Office (PMO) within GSA may be shrinking in size, the goals and objectives of the Government-wide initiative remain strong and are a focus area for automation and efficiencies. PMO staffing reductions are primarily affecting private sector contractors, with the number of contractors expected to drop to zero due to expiring contracts. Again, this supports the shifting of responsibilities back to the Agencies who are best poised to ascertain the appropriate level of security risk acceptable for the cloud solution they’re authorizing for use.
Despite these changes, FedRAMP continues to be a priority for the US Government. The program is being revamped to increase throughput and enhance government adoption of modern technology. In fact, a recently discussed goal is to decrease the entry barriers so that small businesses in particular are better able to enter the market. FedRAMP’s codification into Federal law in 2022 ensures its staying power, with ongoing efforts to streamline evaluation and approval processes
The role of 3PAOs
While much has been said in the market about the role of the PMO and its impacts on third-party assessment requirements, 3PAOs are crucial for ensuring the security of cloud products – helping to identify risks to government agencies. 3PAOs are beholden to strict standards such as ISO 17020 and FedRAMP-specific requirements set by the American Association for Laboratory Accreditation (A2LA) in their R311 publication. This includes certifications for assessors, continued education, and participation in activities to ensure the integrity of the program.
These requirements ensure that 3PAOs, like A-LIGN, can perform FedRAMP assessments that are high quality for CSPs. Concerns about 3PAO performance and quality are addressed with A2LA as the independent accreditation body, to step in. A2LA conducts a comprehensive initial audit for every candidate 3PAO, followed by a surveillance audit before a full renewal in year 3.
Currently, the Agencies play a role in continuous monitoring, ensuring that cloud service offerings (CSOs) remain secure and compliant over time. However, with the existing cuts and uncertainty around the future of FedRAMP, there is an opportunity for 3PAOs to provide additional assurance to CSPs, government agencies, and taxpayers, to have 3PAOs conduct continuous monitoring activities in lieu of Agencies to ensure security remains fortified.
Moving forward
FedRAMP remains a critical component of federal technology modernization. As the program evolves, CSPs must stay informed and proactive in their compliance efforts. A-LIGN is committed to helping you navigate these changes and achieve your FedRAMP goals.
