FedRAMP — Federal Risk and Authorization Management Program

FedRAMP is a government-wide programme that provides a standardised approach to security assessment for cloud service providers working with federal agencies. Its public site presents running totals of authorised services, including services certified under the newer FedRAMP 20x path. The programme is led by Director Pete Waterman, with staff including Security Director Nicole Thompson and Cloud Security Engineer Dan Chandler appearing at public sessions.

• Government-wide standardised approach to cloud security assessment
• 531 total FedRAMP certified services reported on the homepage
• 30 total FedRAMP 20x certified services reported on the homepage
• Director: Pete Waterman

The FedRAMP Marketplace is the programme's searchable database of FedRAMP certified cloud services. Alongside services, it lists authorising agencies and FedRAMP recognised assessors. It is presented as the route for agencies to find FedRAMP certified cloud solutions, and can be browsed directly from the FedRAMP homepage.

• Searchable database of certified cloud services
• Listings for authorising agencies
• Listings for FedRAMP recognised assessors
• Browsable from fedramp.gov

FedRAMP publishes Requests for Comment (RFCs) inviting feedback on proposed programme changes, and posts a "What's New at FedRAMP" feed of recent activity. Recent items include an update to the Consolidated Rules for 2026 with typo fixes and minor clarifications, and the opening of two new Requests for Comment. Open RFCs cover FedRAMP 20x development tracks and changes to the Technical Advisory Group.

• RFC-0033: FedRAMP 20x Phase 4 Development Tracks for 20x Class D
• RFC-0034: Technical Advisory Group Changes
• Updated Consolidated Rules for 2026
• Request for Comment on Offerings By Government

FedRAMP runs recurring virtual meetings over Google Meet for cloud service providers, assessors and government agencies. The Rev5 Community Updates Meeting is held on the first Wednesday of each month to discuss Rev5 updates and gather community feedback, while the 20x Community Updates Meeting is held on the second Wednesday of each month to cover FedRAMP 20x pilot updates and community collaboration. The Agency Liaison Meeting, held on the second Tuesday of each month, briefs FedRAMP Agency Liaisons on changes and updates affecting federal agencies. Each series currently runs through 31 December 2026, and past occurrences are available with recordings for the community meetings.

• Rev5 Community Updates Meeting — 1st Wednesday monthly, 1:00–2:00 PM ET
• 20x Community Updates Meeting — 2nd Wednesday monthly, 1:00–2:00 PM ET
• Agency Liaison Meeting — 2nd Tuesday monthly, 11:00 AM–12:00 PM ET, registration required
• Agency Support Group Meeting listed among upcoming events

FedRAMP Day is an invitation-only event at which attendees hear the latest updates supporting FedRAMP modernisation, including updates from FedRAMP and the Office of the Federal CIO (OFCIO). The spring and summer 2026 editions are aimed at government agencies and take place in Washington, DC, while the autumn edition opens to cloud service providers and assessors as part of the annual 2026 Cloud Service Providers – Advisory Board programme in Arlington, Virginia.

• Spring 2026 — 26 March 2026, ATF, 99 New York Ave NE, Washington, DC
• Summer 2026 — 23 June 2026, US General Services Administration, 1800 F Street NW, Washington, DC
• Fall 2026 — 30 September 2026, Fuse at Mason Square, 3401 Fairfax Drive, Arlington, VA

Beyond its regular series, FedRAMP convenes one-off sessions and takes part in external industry events. A Vulnerability Management Special Event assembled a panel of industry experts to answer questions on how cloud service providers approach vulnerability management. FedRAMP staff have also appeared on the GRC Engineering podcast and at industry summits to discuss the 20x pilot and federal authorisation.

• FedRAMP Vulnerability Management Special Event — 30 July 2025, Google Meet
• "From Checklists to Code: Engineering the Future of FedRAMP w/ Pete Waterman" — 28 October 2025
• Federal News Network's Risk & Compliance Exchange 2026 — 11 May 2026
• Secureframe National Cybersecurity Summit — 12 May 2026

The Federal Secure Cloud Advisory Committee (FSCAC) meets to discuss matters related to the secure adoption, certification, monitoring and acquisition of cloud services across government. Its meetings are listed on the FedRAMP events calendar and are open to the public. The June 2026 meeting is scheduled as a virtual session.