2026/responsibilities/agencies/

[giscus[bot]]

2026/responsibilities/agencies/

This site contains FedRAMP's Consolidated Rules for 2026.

https://www.fedramp.gov/2026/responsibilities/agencies/

[joksenhe]

@pete: Will there be some sort of oversight to ensure agency compliance?

[pete-gov]

@pete: Will there be some sort of oversight to ensure agency compliance?

Oversight of agencies is provided by the Office of Management and Budget, agency officials, Inspectors General, the Government Accountability Office, and Congress. FedRAMP does not have oversight authority or responsibility.

[pete]

@pete: Will there be some sort of oversight to ensure agency compliance?

I have no idea but I appreciate being asked.

[amita90dahiya]

[pete-gov]

This might be a trick question? There's no "the ATO letter." Every agency has always had to issue an ATO for the federal information system(s) that leverages cloud services. The labeling of "FedRAMP authorization" to FedRAMP Certification is explicitly to avoid confusion where people used to think that a "FedRAMP authorization" was an "authorization to operate" - it was not.

FedRAMP confirms the FedRAMP Certification requirements at met, agencies then develop information systems that use cloud services and ATO those systems.

[pete]

@pete - Pete, with 20x CR26 and the evolving role of the Authorizing Agency, who is responsible for issuing the ATO letter? Under the traditional Rev. 5 process, the agency issued it.

I am, I am responsible for issuing the letter, @amita90dahiya.

[pete-gov]

@pete - I am, I am responsible for issuing the letter, @amita90dahiya.

LOL, and yes, to be clear @amita90dahiya, my username is @pete-gov and randomly summoning poor @pete is just no fair to him (even though it is fun for all of us).

/me carefully bows* to the great pete

[amita90dahiya]

Thank you pete-gov and pete :)