May 13 20x Community Update Special Event: Independent Assessor Roundtable

[emu-gov]

Please join us for an extended special event as we get to hear from members of our 20x Independent Assessor Community!

Special Guests

---

Lunarline

Lesley Hess, FedRAMP Lead

As the 3PAO Lead for Lunarline, Lesley Hess directs the FedRAMP Program for the industry’s longest accredited 3PAO. She maintains executive oversight of all cybersecurity assessment activities and acts as the authoritative point of contact for the FedRAMP PMO, bridging the gap between legacy expertise and modern compliance requirements.

Fortreum

David Clevenger, Director

Currently serving as the Director over the entire Fortreum practice that performs FedRAMP, CMMC, PCI, ISO, SOC, HIPAA, FISMA, CJIS, NIST 800-171 and other similar frameworks.

First Information Technology Services (FITS)

Eric Moss, Principal Information Security Consultant

Primarily FedRAMP Lead Assessor. Additionally FedRAMP advisor, and CMMC assessor depending on current workflow.

Coalfire Systems, Inc.

Jorden Foster, Senior Director, Assessment

Jorden is a leader within Coalfire’s 3PAO, responsible for methodology and accreditation oversight. He supports client assessments across multiple frameworks with a focus on FedRAMP.

Planned Agenda

---

Time	Topic
1:00 PM	Welcome and Opening Remarks (3 mins)
1:03 PM	FedRAMP 20x Community Updates (2 mins)FedRAMP Cybersecurity Service
1:05 PM	Kick-off Roundtable (10 mins)Purpose of the discussion, reminder about 3PAO vs Independent Assessment Services2min intro for each panelistJordan, Eric, Lesley, David
1:15 PM	Independent Assessor Roundtable Discussion: Assessing 20x (40 mins)An interactive discussion with assessors sharing insights and experiences from the first two phases.
2:05 PM	Q&A (20 min)
2:25 PM	Closing Remarks and Next Steps (5 min)
2:30 PM	End Session

Questions

---

Edit: updated questions - originals were first draft 😫

1. So, FedRAMP 20x has been a bit of a wild ride for assessors. You’ve all been involved through Phase 1 and Phase 2. What was the craziest thing you had to deal with?

2. On the other hand, what was the coolest thing you dealt with?

3. One of the biggest changes in the pilots, especially in phase 2, was the idea that it’s actually okay for assessors to talk about stuff with their customers, even to hand out a pro-tip or two, instead of the OG model where you just had to write them up angry reports. How’d that go? Should we keep that model?

4. Assessors are always asking FedRAMP to basically write out 500-page super explicit detailed step-by-step instructions for everything, but that’s kinda not how technology works with so many different ways to do things and stuff changing all of the time. How do y’all plan on handling this in the future as FedRAMP continues to optimize for variance and expert analysis instead of everyone meeting the same checkbox in the same way?

5. What are some of the biggest things you’d like to see officially change for independent assessors in the modern FR approach?

Open Q&A:

If you have other questions for 20x participants, you can ask them in this thread in advance or using the Q&A featuring during the meeting!