Timeline

Establishes FedRAMP in law as a "Government-wide program that provides a standardized, reusable approach to security assessment and authorization for cloud computing products and services that process unclassified information used by agencies." The law changes FedRAMP significantly and requires the Office of Management and Budget to issue guidance that must be followed by agencies.

Rescinds the entire previous FedRAMP policy memo, replacing it with an "updated vision, scope, and governance structure for FedRAMP that is responsive to developments in Federal cybersecurity and substantial changes to the commercial cloud marketplace that have occurred since the program was established." This vision focuses on rapidly increasing the size of the FedRAMP Marketplace by evolving new FedRAMP authorization paths, streamlining processes through automation, and encouraging government-wide adoption of commercial cloud services.

GSA announces the development of FedRAMP 20x, a new assessment and authorization path based on the authority and goals set forth in the FedRAMP Authorization Act and M-24-15. This path would be developed in collaboration with industry and government, tested in public, and delivered incrementally in phases. FedRAMP would be transparent and responsive to feedback and adjust their goals, timeframes, requirements, processes, and all other aspects of the program based on real-world impacts and changes in the operating environment.

FedRAMP completes 20x Phase 1 while ending FY25 completing an historic 144 FedRAMP authorizations and the elimination of the FedRAMP authorization backlog. The 20x Phase 1 pilot included an initial 12 FedRAMP 20x Low pilot authorizations from 26 pilot submissions with more pilot authorizations to follow. The world sees the potential of the FedRAMP 20x approach.

FedRAMP begins 20x Phase 2 late due to the longest government lapse in appropriations ever.

The 20x Phase 2 pilot included an initial 8 FedRAMP 20x Moderate pilot authorizations from 14 pilot submissions with more pilot authorizations to follow. The potential of the FedRAMP 20x approach is realized and FedRAMP begins preparing the Consolidated Rules for 2026 to open FedRAMP 20x up to the public.

FedRAMP begins 20x Phase 3.