Agency Requirements and Guidance

[pete-gov]

The FedRAMP Authorization Act places several responsibilities on federal agencies regarding FedRAMP assessments and authorizations, with M-24-15 providing additional guidance on the implementation of these roles and responsibilities.

Both the law and OMB policy require FedRAMP to make information and data available to help agencies fulfill these requirements and for the FedRAMP Board to ensure consistency and transparency.

Given the extensive materials included in the FedRAMP Authorization Act and M-24-15, with responsibilities of different parties interwoven in these materials, FedRAMP (in collaboration with OMB) intends to produce a single set of explicit guidance targeted at federal agencies to explain their responsibilities under this law and policy.

[pete-gov]

A fair amount of internal work has been done preparing this to date, but concerted effort to move this forward will begin in September.

[pete-gov]

The draft Agency Implementation Guidance (now tentatively renamed Agency Requirements and Guidance but likely to shift again because names are complicated and a lot of people have opinions) will be reviewed and finalized with the FedRAMP Board on September 18 and published shortly afterwards.

This guidance focuses on clarifying existing agency requirements and is not considered new guidance that requires public comment, therefore it will be released much quicker than previously anticipated.

[pete-gov]

Finalization and publication of this guidance has been delayed one sprint as a result of an unexpected event; it should be formalized soon. I've moved the likely end date to October 10 to allow some padding.

[pete-gov]

This guidance is now delayed indefinitely due the government shutdown. Timeline will be reassessed when the shutdown ends. This activity has been placed into the Hold / Pending status.

[pete-gov]

Updating these materials will be an early December priority, balanced against 20x Cohort 1 applications and collaborative workshops.

[pete-gov]

This will be a topic of conversation at the December 18 FedRAMP Board meeting.

[pete-gov]

This has slipped continuously, especially in the aftermath of the shutdown, but as we change focus of priority towards agency adoption we need to push this over the finish line. It's become one of those things that folks keep having more ideas about adding to or changing things up in a way that hasn't aligned with our external approach of incremental delivery because we're aware that with agencies it's more important to have a complete thing they can take and run with in one go without having to keep learning more.

Based on that, I've reset the target to end of January and we will align this with the Federal AI adoption sprint to ensure folks have this guidance as we engage government-wide on that.

[pete-gov]

This continues to slip as less critical than many of the other activities we are working towards, but is quickly approaching the point where it will be completely necessary.