U.S. flag

An official website of the United States government

Requests for Comment

RFC-0034 Technical Advisory Group Changes

Summary & Motivation

OMB Memorandum M-24-15 describes FedRAMP as a bridge between the federal community and the commercial cloud marketplace, establishing dual roles of enabling agencies to obtain what they need while helping commercial providers satisfy similar needs across the federal government in a streamlined way. The most difficult part of playing this role is effectively navigating situations where both sides want things to change but each side expects the other to change first. In early 2025, FedRAMP was directed to play our role on that bridge by setting policies that enabled private innovation to create the solution - and FedRAMP 20x has already seen massive success because industry was more than ready to do so.

FedRAMP 20x Phase 4 continues to build on this goal by establishing a new pilot combined with direct engagement tracks to test and showcase innovative approaches to higher levels of assurance. The Phase 4 pilot sets the ambitious goal of drastically increasing the top level of assurance at FedRAMP Class D while demonstrating this is achievable under FedRAMP 20x for less cost and time through the use of modern technical capabilities.

Unlike the Phase 1 and 2 pilots, FedRAMP plans to give agencies the opportunity to participate directly in the Phase 4 pilot. Our goal is for at least 3 agencies to complete an agency authorization to operate (ATO) based on a Phase 4 pilot package during the pilot itself. At the same time, we’re making changes to our Technical Advisory Group to help agencies navigate the changes to FedRAMP under 20x, and to accelerate our activities during the Phase 4 pilot overall.

This RFC proposes the following changes to our Technical Advisory Group and Agency Participation:

  • A new Technical Advisory Group will be established as part of the FedRAMP Cybersecurity Service, designed for agencies to send their security staff over to FedRAMP on a reimbursable interagency detail for up to 6 months to advise FedRAMP and get hands on with FedRAMP 20x packages and cloud services.
  • Agencies who support the Technical Advisory Group will be given additional opportunities to participate directly in the Phase 4 pilot with some of the most innovative cloud services to be ready to use those services during and after the pilot.

Feedback Requested

All feedback from the public is welcome, though FedRAMP prefers explicit targeted feedback rather than general commentary.

This RFC is primarily targeted at agencies, and FedRAMP will solicit extra feedback from them via interagency mechanisms - but FedRAMP strongly encourages agencies to participate publicly where feasible.

Technical Advisory Group Changes

The FedRAMP Technical Advisory Group (TAG) was established in OMB Memorandum M-24-15 to provide advice and insights to FedRAMP on an as-needed basis; it is not a governance body and does not exist in the FedRAMP Authorization Act. FedRAMP relied heavily on the TAG in the past for technical expertise and independent advice, but this reliance has waned as the program hired more technical experts and membership in the TAG began to change frequently due to increased departures of technical federal staff over the past year. Today the TAG is effectively inoperable because FedRAMP has struggled to find technical experts in positions where they can dedicate the many hours per week needed to keep up with FedRAMP’s goals. Experts need to be heavily engaged with FedRAMP and following many of the nuances of the FedRAMP 20x initiative to be able to provide timely and relevant advice and feedback, but there’s little extra time for this when technical experts are engaged at their home agency on other daily tasks.

To address these issues, FedRAMP intends to establish a baseline level of commitment to involvement in the Technical Advisory Group and work with agencies to identify candidates to participate in temporary duty assignments to be members of the FedRAMP TAG. Employees chosen for the TAG will embed 4 days per week with FedRAMP to work on significant projects improving the program and providing support to agencies while still spending a day every week at their home agency to continuously bring that knowledge and experience back to the agency.

These fully reimbursable detail positions will be open to federal employees at the GS-13 through GS-15 level throughout all of FY27. FedRAMP will provide easy to use templates to help agencies navigate this process and will provide individualized feedback to agency leadership at the end of each detail.

The initial cohort of Technical Advisory Group details is planned to open in October 2026, with a maximum of 10 members. FedRAMP will follow up with the interagency on process, timing, and expectations separately. If you are an agency employee working in a security role that is interested in participating in the Technical Advisory Group, please speak with your senior leadership to make your interest known. If you are an agency CIO, CISO, or other executive leader with a teammate you would like to include on the TAG, please reach out to the FedRAMP Director (pete@fedramp.gov) to get a head start.

Agency Pilot Participation

The Phase 4 pilot is expected to include some of the most innovative and cutting-edge technology companies offering cloud services to the federal government today. Most agencies will need to wait until the end of the Phase 4 pilot to see the outcome of the work being done during Phase 4, but FedRAMP will expand participation in the pilot to federal agencies in limited circumstances.

Agencies who are interested in adopting a FedRAMP Class D package for one of the pilot participants will be best positioned by participating in the FedRAMP Technical Advisory Group. Members of the FedRAMP TAG will be able to participate directly in the support, review, and certification process for any cloud service their agency intends to use. This will ensure you will have a technical expert that is deeply familiar with the product and the cloud service provider’s general approaches to security and assurance. Agencies in this case will also be given early access to the FedRAMP materials if the cloud service provider agrees, allowing you to integrate early and iteratively.

FedRAMP will also make additional pilot progress information available directly to the FedRAMP Agency Liaison group. This will include briefings from Phase 4 pilot participants to the Agency Liaison group as well as agency support group meetings dedicated to each pilot participant that is open to all Agency Liaisons. You will be able to follow along with any participant to see their progress and gain an understanding of their approach and security, as long as the participant is willing to support the Agency Liaison group.

In addition to optional engagement with the Agency Liaison group, FedRAMP will place hard requirements on participants in the Phase 4 pilot to brief the FedRAMP Board on their progress and approach and receive feedback directly from the incredible executive experts that make up this body. FedRAMP will also require all Phase 4 pilot participants that are on track to receiving a FedRAMP 20x Class D Certification to join the government-wide FedRAMP Day at the end of the pilot for a combination graduation ceremony and opportunity for the Agency Liaison group and other members of government to grill them directly on FedRAMP 20x and their approach to security.

For those still working through initial 20x adoption at their home agencies, the FedRAMP TAG detailees will also have the opportunity to support hands-on agency adoption best practices, tools, and techniques. FedRAMP is also open to other ideas for agency pilot participation and encourages any agency interested in participating in other ways to comment!

Most federal agencies already participate in FedRAMP’s Agency Liaisons Program - but we are always happy to include more agency folks who work in FedRAMP-related areas at their agency. Please review the Liaisons Program page on our website for more information.