FedRAMP 20x – Update On Significant Change Process And Assessment Scope Standards

Last month, the federal government announced a major overhaul of the Federal Risk and Authorization Management Program ("FedRAMP") called "FedRAMP 20x" (we discussed the initiative here). FedRAMP 20x is moving forward fast – with new authorizations, community engagement efforts, standards documents, and the Phase One pilot program. (More information about the Phase One pilot program is available here.)

Of particular note, there are two draft standards for public comment: (1) the Significant Change Notification Standard, which will replace the current standard with a new process that allows cloud service providers to make changes without prior approval from the government; and (2) the Minimum Assessment Scope Standard, which will replace the current Authorization Boundary guidance materials (previously summarized here). The public comment period for both standards currently is open until May 25, 2025.