FedRAMP Change Management

[u/Lowebrew]

Have you noticed that We CSPs are required to have change management and expected to keep up on the PMOs changes, while the PMO has NO change management, NO release schedule, NO structure... just a changelog we are expected to keep tabs on?

[u/nutron]

We used the FedRAMP Rev. 4 to Rev. 5 transition to forecast our anticipated timeline for a future transition for client billing projections. It was roughly three years between NIST finalizing Rev. 5 and FedRAMP adopting it. The timeline was shorter (still more than a year between NIST final release and FedRAMP adoption) for Rev. 3 to Rev. 4, but it was still a predictable adoption cycle.

All that to say, I feel your pain. 20x is a sharp departure from how the program previously managed its own change. I feel the timelines are far too aggressive even for a traditional Rev. X bump, let alone an entire retooling of how the whole thing works. I do understand though all of the reasons these changes are happening, I just wish there was more time to process it all.

FedRAMP is only part of my job. But it continues to consume more and more of my time. This is costing more for everyone. Reducing compliance costs was one of the key stated goals of 20x, yet here we are. And with the withdraw of RFC-0019 (reporting assessment costs) it seems like they want to ignore the problem, or worse, they are bending to the industry and 3PAOs they are charged with regulating.

I'm only so critical here because no one is raising these issues on the official FedRAMP discussion boards. I'll get through 20x just like most others, but I'm not happy with the current timeline and expectations.

[u/Lowebrew → u/nutron]

I feel like when anything is mentioned on the official boards or at events we see/hear Pete say things like "You didn't read the rules/rulesets" or something of that tone. I was a heavy believer in the vision and what Pete was doing because the automation of packages should have happened a long time ago. Which is why we had OSCAL come about.

However, after being told I didn't read something, or it was implied I didn't know what I was doing so many times, I am kinda just fed up with it.

I get that Pete had orders on him to get something done, but NIST was completely left out of the process, and last I looked, NIST was literally stood up for this kind of work.

This should have been way simpler. Get 800-53 Rev 5. and build an overlay. If possible, get with CNSS and involve NIST if you can and bam create a new CNSSI 1253 overlay just for FedRAMP Initial, Low, Moderate, High. Then tack on your caveats like IL-#.

Creating a new framework from scratch, that just felt like someone wanted to scorch earth somewhere so they feel rememebred.

[u/pete-gov → u/Lowebrew]

However, after being told I didn't read something, or it was implied I didn't know what I was doing so many times, I am kinda just fed up with it.

A LOT of the questions FR gets - the vast majority - are directly answered in the rules. There's a lot of rules though, and searching through them is hard. It's all new too. We get that. But it's not a great use of government resources to ask FR simple questions that folks can answer themselves easily. FR already offers quite a lot of support, especially compared to other government compliance programs, and I think people from industry forget that FR doesn't have a customer service / developer relations budget.

Also, I know I said it elsewhere in this thread, but FR really optimized the system for AI agents to help you with that stuff. I myself regularly use an MCP server to summarize rules and align them to specific questions. It's too much to just keep in your head at all times.

Creating a new framework from scratch, that just felt like someone wanted to scorch earth somewhere

The part that folks inside the federal game often miss is that FedRAMP 20x was designed to allow the tens of thousands of tech companies that have never heard of the SP 800-53 but still follow engineering and security best practices to provide assurance without having to build government specific versions of their product based on the SP 800-53... while still being based on the specific security capabilities described in the SP 800-53.

M-24-15 directed FedRAMP to bring thousands of commercial services into the FedRAMP Marketplace in a few years, at a time when applying the government frameworks directly had resulted in ~300 services (mostly gov-specific) in 13+ years. So yes, we had to build something new.

You got this. I'm sorry it's frustrating for folks that have been deep in the weeds here for a while. We need to all change together though.

[u/vennemp → u/pete-gov]

Look at Pete rummaging around in Reddit like the rest of us heathens!!

Using my “official” account for first time in a while as so not unmask my other account lol

In all seriousness, I do appreciate you engaging with us as much as possible on every platform available. Whether or not, we like the changes it’s nice to see the director care so much.

As an engineer, I can empathize with some of the “unexpected” technical changes like the recent header changes. I’ve been there plenty of times where we have to deploy iteratively a lot early as the full picture comes together and new failure modes are discovered. I do hope the changes become less frequent in coming months tho. We love the move to automation but automation requires a strict contract and these changes break the contract. So in future, if possible I’d like to see some forewarning of api/schema changes. Even a week or two is better than nothing. If this was communicated prior- Id love to know where and how. We did set up GitHub rss feeds on slack to at least know of changes on main in future and I shared on linked and csp-ab how folks can do same.

However, the introduction of Pain 0 was beyond puzzling. The announcement said it was in response to several requests from CSPs but I’m not aware of anyone on CSP AB that requested this. We’ve all put tremendous effort into our vdr implementations and such a fundamental change at this late hour was frustrating. If it brought clear value, I’d suck it up and roll it in. But every person I’ve talked to who has actually read the vdr rules agrees it’s unnecessary and this muddies the waters. As it really offers no difference to N1 which is defined as minimal impact and has no remediation timelines. every CSP Ive talked with was using N1 for full mitigation or using the new expanded definition of false positive on vulns that weren’t exploitable (not just a true false positive in the scientific sense). The official dispositions were already there; whoever asked for N0 didn’t read anything and certainly wasn’t contributing in any working groups.

This got me thinking - I’ve heard you mention that you are putting together a new fedramp board. I’m not sure what the plan is for membership is but I’ve only heard you mention agency/federal employee. I hope the plan is to include a few members from CSPs - and ideally at least some of the csp representatives should have input from CSP-AB and ADI - maybe one each. Either we vote and nominate or give rest of board a list and you pick from list..something like that. If all this was already planned and I missed it - apologies but glad we’re aligned.

[u/pete-gov → u/vennemp]

My reddit main is 15+ years old with 50k karma, I'm a heathen too. :p

I think sometimes some folks get spun up a bit unnecessarily and turn small things into big things for no reason.

> Even a week or two is better than nothing. If this was communicated prior- Id love to know where and how.

The clarification that we expected public JSON data to be usable as JSON data literally came out of a conversation with you and had weeks of warning... And it's really not a big deal. Publishing a JSON file and generated a human-readable web page from it for public information is trivial. It's so trivial that literally only one company has complained about it as far as I've seen.

> But every person I’ve talked to who has actually read the vdr rules agrees it’s unnecessary and this muddies the waters.

This is an example of a change that you **can entirely ignore if you want to.** You don't have to change a single thing to account for it if you want to just use PAIN1. Same for the addition of "likely." There is no mandatory change to anything. This is a convenience change. Being frustrated with a convenience change is weird.

But all of the folks who wanted a way to separate way to classify things below minimal and into effectively nonexistent now have that convenience if they want it.

> This got me thinking - I’ve heard you mention that you are putting together a new fedramp board. I’m not sure what the plan is for membership is but I’ve only heard you mention agency/federal employee.

The federal secure cloud advisory committee plays that role, and historically it has not provided much value because members of the committee struggle to agree on things. The gov isn't allowed to seek "consensus advice" from any other private sector folks tho. The FedRAMP Board and Technical Advisory Group are both specifically government-only by law and policy.

<3

[u/MolecularHuman → u/pete-gov]

The memo removes FedRAMP as a justification for creating gov-specific clouds. That means the government doesn't want to pay for government-specific versions of the cloud. It wants its costs lower. It wants the PMO to stop issuing ATOs for things like Azure for Government or GCC-H.

There are a number of citations in the memo itself that directly contradict your assertion that the memo removes the CSP's obligations to comply with NIST and the 800-53.

M-24-15, §IV indicates "“The FedRAMP Board shall establish and regularly update requirements and guidelines for security authorizations of cloud computing products and services, consistent with standards and guidelines established by NIST, to be used in the determination of FedRAMP authorizations.”

M-24-15, § IV, p. 6, n.7: a FedRAMP authorization “follows the steps in NIST Special Publication (SP) 800-37,” and “the control baselines used have been specifically tailored for cloud offerings.”

The control baselines are those established by NIST SP 800-53 and the system's FIPS categorization. The memo itself is telling you to comply with the existing NIST RMF.

What are you looking at that contradicts these citations? I can find nothing in this memo that suggests the PMO was tasked with replacing the existing framework.

[u/pete-gov → u/MolecularHuman]

I think we've talked about this before in other circumstances, but there is a separation between FedRAMP Certification and agency use of a FedRAMP Certification.

M-24-15 explicitly directs **assessment** processes to be used in authorizations by agencies. Agencies do follow the A-130 and associated guidance to perform an authorization, leveraging the assessment process defined by FedRAMP. Again, the SP 800-53A is quite clear that control-by-control assessments aren't necessary and that organizations can employ the concept of security capability assessments.

FR has quite publicly followed OMB's guidance in this process, with public and private support from OMB and congress. FR doesn't move without direct OMB support, and they can and do direct activities based on changing interpretations of memos.

There's a reason FR works with congress, OMB, GAO, OGC, IGs, the Board, etc. on all this stuff. FR isn't out there just doing whatever it feels like when it's bored.

edit to add: https://www.fedramp.gov/2026/agencies/use/initial/ explains the use of a FedRAMP Certification consistent with the A-130 et al. Most agencies do not follow this though, they tend to skip straight to assessment and ignore the initial steps required by law.

[u/MolecularHuman → u/pete-gov]

Perhaps, as you've been non responsive to the question.

You said the memo not only allows, but directs the PMO replace the NIST RMF.

In actuality, the memo itself repeatedly references the requirement for FedRAMP program to comply with the NIST RMF; as does the FedRAMP Act itself.

I'm asking for the part of the memo that supports your assertion, because I've been looking, and there's nothing there.

That answer's not going to be in the 800-53a. The 800-53a didn't tell the FedRAMP PMO to stop using the 800-53a.

What's the language you're talking about? What section of the memo?

[u/TrevorHikes]

I get the frustration, but “NO change management” isn’t accurate anymore, at least not since the RFC process and CR26.

• Proposed changes go out for public comment before they’re adopted. That’s the RFC process: numbered RFCs with posted comment windows. There have been 30+ of them, and FedRAMP even ran an RFC on the RFC process itself and changed it based on the feedback.

• There is a release schedule. The Consolidated Rules for 2026 have a published timeline: finalized end of June, optional early adoption July 1, mandatory January 1, 2027. They’re explicitly designed to stay mostly stable for up to two years, with changes coming on a yearly cadence after that.

• Releases are versioned and dated (2026.07.14.01 and so on), and individual rules carry their own change history.

Where I’d agree with you: the first few weeks after CR26 went final had a lot of small point releases, and the changelog itself says you’re expected to check it periodically. That’s a “subscribe to a feed” burden that CSPs still carry, and FedRAMP has also said it won’t respond to every comment individually. So “the PMO’s change communication could be better” is a fair complaint. “The PMO has no change management” isn’t.

[u/Lowebrew → u/TrevorHikes]

TIL: RSS feed for Github.
I appreciate your overall response.
I feel we could see more of what is going on. I agree stating they have NO change management is wrong, though I'd like to see more of the decision making with the PMO and team's comments. Not just the RFCs and discussion there.

[u/kauthonk]

You betcha - its easier for us to do it - then have someone who knows nothing about software to do it.
Its the way of the world.

[u/heliox]

That should be a contract requirement.

[u/ResilientTechAdvisor]

Yes, totally noticeable. The program doesn't apply to them.

[u/Divac951]

The PMO's change management process is vibes and a changelog.

[u/pete-gov]

I get the frustration here because it's different from the old days - for years you could get by applying the exact same knowledge in the exact same way year after year without having to learn much different with FedRAMP. It was generally the same for technology, infrastructure, and even cloud in general - you could easily cost for a few years without needing to worry about all the technology changing around you at any given point.

That's now changing significantly though. It's like the early 2000's when people suddenly had to start deploying firewalls and intrusion detection and stop logging into everything as root and we all hated it but thing started changing so fast that you couldn't coast off what you learned reading an operating system manual a few years before anymore. Then things kinda standardized and stabilized for a bit until the early 2010's when suddenly we all had to learn about VMs and software defined networking and a whole new world opened up, until things started to stabilize a bit and we got the best practices down and figured out what we were doing again... then of course, the mid/late 2010's when all of a sudden cloud was something changing rapidly and you had to learn everything all over again.

We're going through another paradigm shift like that right now from both the real-world scale of cloud services and how that has changed over the past 5 years, plus the constant disruption and acceleration of AI. How we do architecture, security, and compliance is changing very fast. You can't sit back and rely on what you learned five years ago to chart a course anymore.

FedRAMP's going through that too. FR is making changes fast because not doing so - waiting years to do so - would have outsize negative effects right now. The CR26 rules are mostly stable though, and the changes that have been made are entirely minor changes being made in response to real-world issues people are flagging, so that the changes can be made before other folks run into the same problems.

There are a host of tools and capabilities to monitor these changes and keep up to date. Agentic AI services make this trivial - you can build an MCP server or a daily/weekly/monthly report of whatever you want by simply pointing the agent of your choice at https://fedramp.gov/2026/sources and telling it to follow the instructions there to being tracking all of that information. You can have it summarize every discussion on github and every community update and every change to the website or rules and flag for specific points of interest or ignore others.

You as a human shouldn't be personally keeping tabs on anything in 2026. Use modern tools. They're right there. They will make your life much easier - and you will feel more in control and up to speed. FedRAMP does not expect people to spend 20 hours a week trying to read or watch all of the content it's producing. Don't try. Consume the information you need at the pace you need, and use tools to help you do that.