Release of Emerging Technology Prioritization Framework
June 27 | 2024
Today, FedRAMP is publishing the final Emerging Technology Prioritization Framework, with an initial list of generative AI capabilities that will be the first emerging technologies to be prioritized. The framework is designed to expedite the inclusion of emerging technologies in the FedRAMP Marketplace, so agencies can more easily use modern tools to deliver on their missions. The framework was developed in response to Executive Order (EO) 14110 on the Safe, Secure, and Trustworthy Development and Use of Artificial Intelligence.
What is the Emerging Technology Prioritization Framework?
The Emerging Technology Prioritization Framework outlines how FedRAMP will engage with government and industry to identify which emerging technologies to prioritize, how cloud providers can request that their services be prioritized, and how FedRAMP will determine which services to prioritize.
FedRAMP will open submissions for prioritization requests twice a year. Requests for prioritization by CSPs are voluntary. FedRAMP holds prioritized cloud services to the same security standards as all other cloud services, and reviews them in the same way. FedRAMP ensures prioritized cloud services are reviewed first in the authorization process. Requests will be evaluated against the qualifying and demand criteria to ensure prioritized technologies meet the goal of ensuring agencies have access to necessary emerging technologies. Initially, FedRAMP expects to prioritize up to twelve AI-based cloud services using this framework.
Prioritized Emerging Technology List
The initial list of prioritized emerging technologies includes the generative AI capabilities identified in EO 14110. This includes chat interfaces, code-generation and debugging tools, prompt-based image generators, as well as associated application programming interfaces (APIs) that provide these functions.
How to request prioritization
Cloud service providers whose offerings meet the above criteria, and can demonstrate agency demand, can apply for the initial round of prioritization by completing the Emerging Technology Cloud Service Offering Request Form for cloud service offerings and the Emerging Technology Demand Form by August 31, 2024. Detailed instructions on completing these forms can be found in the Emerging Technologies Prioritization Criteria and Guidance. FedRAMP will announce initial prioritization determinations by September 30, 2024.
Changes from the draft Emerging Technology Prioritization Framework and prioritization list
We thank all those who submitted comments on the draft Emerging Technology Prioritization Framework, as requested in a previous blog post. Your input and feedback helped to shape the final framework release.
One significant change: Analyzing whether a service qualifies as generative AI. We’ve transitioned away from measuring cloud services against quantitative benchmarks and leaderboards. Instead, cloud service providers now submit public links to industry-standard “model cards.” Those model cards describe key features of how their underlying AI models operate. Given the rapid pace of AI development, relying on benchmarks likely would have required an impractical amount of ongoing changes to have them continue to stay relevant across diverse use cases. Instead, FedRAMP will use the information on model cards to validate whether the AI being used is the type of capability being advertised. The purpose of collecting this information is not to assess the performance of the AI capability, but about whether the capability being offered is the one intended for prioritization.
We’ve also broken out the capabilities list in a different way, with “associated APIs” as their own distinct capability. FedRAMP wants to prioritize services that offer AI-enabled tools directly to users, as well as services that offer underlying AI-enabled technologies as services that can be incorporated into other applications (whether those applications are agency-run digital services or other cloud service providers). Separating API-based offerings into a separate capability allows FedRAMP to prioritize both kinds of services without them competing against each other.
Here’s a brief summary of changes:
| Emerging Technology Prioritization Framework Changes | Rationale |
|---|---|
| Removed organizational roles and responsibilities | This section was largely generic to FedRAMP and not specific to the ET prioritization framework. |
| Shifted capability prioritization target to the prioritized technologies list | Allows for the prioritization target to be more flexible, with updates based on demand. |
| Updated process graphic and responsibility matrix | Improved clarity on processes and artifact flows between processes. Incorporate nominations by agencies and CSPs and engagement with the FedRAMP Technical Advisory Group. |
| Revised demand criteria and submission standard operating procedure | Provided more detailed demand formula revisions. Outlined twice yearly application windows for prioritization. Provides a detailed procedure for submitting the ET CSO Request Form and the ET Demand Form. | Changes to Prioritized List | Rationale |
| Additional category for the capability for general-purpose APIs containing the prioritized capabilities | Prioritizes offerings that facilitate the incorporation of chat, code generation or debugging tools, or image generation capabilities into new or existing products and services. |
| Shift from quantitative benchmark to qualitative model card | Model cards are a standardized way for providers to provide intended use information as well as relevant benchmarks. AI performance is rapidly increasing. Additionally, the previously proposed benchmarks may not be relevant to agencies' diverse mission needs over time. |
For any questions, please email info@fedramp.gov
