RFC-0034 Technical Advisory Group Changes

[pete-gov]

FedRAMP may not participate in the formal public comment thread to avoid influencing public comment. If you have general discussions, questions, or other related things to discuss that you do not want to include in formal public comment, please use this discussion thread: #172

RFC-0034 Technical Advisory Group Changes

Status: Open
Start Date: 2026-09-09
Closing Date: 2026-10-09

Note from Pete: Apologies for the Friday closing date - please save yourself and us the hassle and submit your comments earlier.

---

Summary & Motivation

OMB Memorandum M-24-15 describes FedRAMP as a bridge between the federal community and the commercial cloud marketplace, establishing dual roles of enabling agencies to obtain what they need while helping commercial providers satisfy similar needs across the federal government in a streamlined way. The most difficult part of playing this role is effectively navigating situations where both sides want things to change but each side expects the other to change first. In early 2025, FedRAMP was directed to play our role on that bridge by setting policies that enabled private innovation to create the solution - and FedRAMP 20x has already seen massive success because industry was more than ready to do so.

FedRAMP 20x Phase 4 continues to build on this goal by establishing a new pilot combined with direct engagement tracks to test and showcase innovative approaches to higher levels of assurance. The Phase 4 pilot sets the ambitious goal of drastically increasing the top level of assurance at FedRAMP Class D while demonstrating this is achievable under FedRAMP 20x for less cost and time through the use of modern technical capabilities.

Unlike the Phase 1 and 2 pilots, FedRAMP plans to give agencies the opportunity to participate directly in the Phase 4 pilot. Our goal is for at least 3 agencies to complete an agency authorization to operate (ATO) based on a Phase 4 pilot package during the pilot itself. At the same time, we’re making changes to our Technical Advisory Group to help agencies navigate the changes to FedRAMP under 20x, and to accelerate our activities during the Phase 4 pilot overall.

This RFC proposes the following changes to our Technical Advisory Group and Agency Participation:

• A new Technical Advisory Group will be established as part of the FedRAMP Cybersecurity Service, designed for agencies to send their security staff over to FedRAMP on a reimbursable interagency detail for up to 6 months to advise FedRAMP and get hands on with FedRAMP 20x packages and cloud services.
• Agencies who support the Technical Advisory Group will be given additional opportunities to participate directly in the Phase 4 pilot with some of the most innovative cloud services to be ready to use those services during and after the pilot.

Feedback Requested

All feedback from the public is welcome, though FedRAMP prefers explicit targeted feedback rather than general commentary.

This RFC is primarily targeted at agencies, and FedRAMP will solicit extra feedback from them via interagency mechanisms - but FedRAMP strongly encourages agencies to participate publicly where feasible.

Technical Advisory Group Changes

The FedRAMP Technical Advisory Group (TAG) was established in OMB Memorandum M-24-15 to provide advice and insights to FedRAMP on an as-needed basis; it is not a governance body and does not exist in the FedRAMP Authorization Act. FedRAMP relied heavily on the TAG in the past for technical expertise and independent advice, but this reliance has waned as the program hired more technical experts and membership in the TAG began to change frequently due to increased departures of technical federal staff over the past year. Today the TAG is effectively inoperable because FedRAMP has struggled to find technical experts in positions where they can dedicate the many hours per week needed to keep up with FedRAMP’s goals. Experts need to be heavily engaged with FedRAMP and following many of the nuances of the FedRAMP 20x initiative to be able to provide timely and relevant advice and feedback, but there’s little extra time for this when technical experts are engaged at their home agency on other daily tasks.

To address these issues, FedRAMP intends to establish a baseline level of commitment to involvement in the Technical Advisory Group and work with agencies to identify candidates to participate in temporary duty assignments to be members of the FedRAMP TAG. Employees chosen for the TAG will embed 4 days per week with FedRAMP to work on significant projects improving the program and providing support to agencies while still spending a day every week at their home agency to continuously bring that knowledge and experience back to the agency.

These fully reimbursable detail positions will be open to federal employees at the GS-13 through GS-15 level throughout all of FY27. FedRAMP will provide easy to use templates to help agencies navigate this process and will provide individualized feedback to agency leadership at the end of each detail.

The initial cohort of Technical Advisory Group details is planned to open in October 2026, with a maximum of 10 members. FedRAMP will follow up with the interagency on process, timing, and expectations separately. If you are an agency employee working in a security role that is interested in participating in the Technical Advisory Group, please speak with your senior leadership to make your interest known. If you are an agency CIO, CISO, or other executive leader with a teammate you would like to include on the TAG, please reach out to the FedRAMP Director (pete@fedramp.gov) to get a head start.

Agency Pilot Participation

The Phase 4 pilot is expected to include some of the most innovative and cutting-edge technology companies offering cloud services to the federal government today. Most agencies will need to wait until the end of the Phase 4 pilot to see the outcome of the work being done during Phase 4, but FedRAMP will expand participation in the pilot to federal agencies in limited circumstances.

Agencies who are interested in adopting a FedRAMP Class D package for one of the pilot participants will be best positioned by participating in the FedRAMP Technical Advisory Group. Members of the FedRAMP TAG will be able to participate directly in the support, review, and certification process for any cloud service their agency intends to use. This will ensure you will have a technical expert that is deeply familiar with the product and the cloud service provider’s general approaches to security and assurance. Agencies in this case will also be given early access to the FedRAMP materials if the cloud service provider agrees, allowing you to integrate early and iteratively.

FedRAMP will also make additional pilot progress information available directly to the FedRAMP Agency Liaison group. This will include briefings from Phase 4 pilot participants to the Agency Liaison group as well as agency support group meetings dedicated to each pilot participant that is open to all Agency Liaisons. You will be able to follow along with any participant to see their progress and gain an understanding of their approach and security, as long as the participant is willing to support the Agency Liaison group.

In addition to optional engagement with the Agency Liaison group, FedRAMP will place hard requirements on participants in the Phase 4 pilot to brief the FedRAMP Board on their progress and approach and receive feedback directly from the incredible executive experts that make up this body. FedRAMP will also require all Phase 4 pilot participants that are on track to receiving a FedRAMP 20x Class D Certification to join the government-wide FedRAMP Day at the end of the pilot for a combination graduation ceremony and opportunity for the Agency Liaison group and other members of government to grill them directly on FedRAMP 20x and their approach to security.

For those still working through initial 20x adoption at their home agencies, the FedRAMP TAG detailees will also have the opportunity to support hands-on agency adoption best practices, tools, and techniques. FedRAMP is also open to other ideas for agency pilot participation and encourages any agency interested in participating in other ways to comment!

Most federal agencies already participate in FedRAMP’s Agency Liaisons Program - but we are always happy to include more agency folks who work in FedRAMP-related areas at their agency. Please review the Liaisons Program page on our website for more information.

[cb-axon]

As a CSP, we're not a direct participant in this RFC's changes, but we're highly supportive and wanted to share a perspective from the Cloud Provider side.

The biggest value we see in a stronger, more embedded Technical Advisory Group isn't just faster reviews, it's the opportunity to spread a more mature way of evaluating cloud service packages across government. Too much of the current evaluation culture, at every level, rewards checkbox completion over understanding actual risk. A TAG member who spends real time embedded with FedRAMP and hands-on with 20x packages (we'd hope) is going to come back to their agency with a fundamentally different, and better, model of what security assurance should look like, one built on intended outcomes rather than control-by-control literalism.

We'd encourage FedRAMP to make this cultural shift an explicit goal of the TAG, not just a side effect. If part of the TAG's mandate is to help agencies articulate their own risk tolerance and desired security outcomes before evaluating a package, agencies and CSPs can have a much more productive conversation grounded in what actually matters for that system, rather than a compliance exercise that treats every control as equally critical regardless of context. That shift benefits everyone: agencies get faster, more confident authorizations, CSPs get evaluated on real risk rather than theater, and the taxpayer gets a more efficient process overall.

We'd also encourage FedRAMP to think about how lessons learned by TAG detailees get formally captured and shared back out, not just with their home agency, but across the broader Agency Liaison community, so this cultural shift compounds rather than staying siloed with the 10 people who rotated through in a given year.

[CSP-AB]

The Cloud Service Providers Advisory Board (CSP-AB) writes in support of FedRAMP RFC-0034. Our members represent leading cloud service providers serving federal agencies and are focused on promoting and enabling adoption of secure cloud technologies across the public sector. CSP-AB supports modern cloud security policies and practices and views agency adoption of FedRAMP requirements and 20x certifications as key to modernizing the Federal government’s cloud security practices.

CSP-AB strongly supports changes to the Technical Advisory Group (TAG) to allow agency employees to embed with FedRAMP for up to six months to gain hands-on experience with FedRAMP 20x packages. The proposed reimbursable detail model addresses a real and growing concern among CSP-AB members that agencies lack a structured channel to build the technical fluency needed to engage confidently review and adopt 20x packages. Embedding agency information security staff directly with FedRAMP for a sustained period is a practical way to close that gap.

We see clear reciprocal benefits in this structure. TAG members gain practical exposure to 20x processes, terminology, and assurance approaches, which they will bring back to their home agencies. That experience in reviewing and certifying 20x packages should reduce friction as agencies look to reuse 20x-certified packages. At the same time, FedRAMP stands to gain from the sustained, engaged feedback of detailees who understand both the program's technical direction and their home agency's operational realities. We encourage FedRAMP to identify a mechanism for ensuring that detailees share their knowledge with home agency colleagues and that lessons learned and best practices are captured for wider interagency distribution.

We also support extending 20x Phase 4 pilot participation to Federal agencies through the TAG. Giving TAG members a direct role in the review and certification process for cloud services their agencies intend to use provides concrete experience that can be shared across their organizations. This approach is a sensible way to involve agencies in the 20x framework and expand the pilot’s utility across the interagency community.

Finally, we see this proposal as a useful step toward greater reuse of FedRAMP certification and continuous monitoring requirements across the government. Much of the hesitancy that slows reuse today stems from agencies' caution about adopting a package they did not review themselves and with unfamiliarity with programmatic changes to FedRAMP including CR26 and 20x. By giving agency staff direct experience with how 20x packages are built, assessed, and maintained, this TAG model can help build the technical literacy that effective reuse requires.

We encourage FedRAMP to move forward with this approach and would welcome the opportunity to provide additional feedback or support.

[wisecryptic]

This appears to be a strong step toward resolving many long-standing challenges in this space. I imagine that implementation of the details may reveal unforeseen challenges but I encourage FedRAMP to continue to pursue this model for the following reasons.

For abbreviated context, a persistent challenge has been finding expertise that understands the process while keeping pace with an innovation target that is always moving:

• Relying only on industry expertise brings cutting-edge solutions, but at the cost of dedicated time and government-side knowledge.
• Relying only on agency-grown expertise brings government-side knowledge, but at the cost of government-scale efficiencies and cutting-edge solutions.
• Developing expertise solely within FedRAMP tends to silo knowledge and let expertise go stale. It can also produce solutions that look good on paper but create heavy documentation burdens for both agencies and industry.

At its core, this RFC proposal addresses the trilemma by drawing expertise from across organizations rather than trying to build it in one place. Bringing agency representatives into the FedRAMP sphere and exposing them directly to industry solutions lets them stay current with emerging technology, understand the bigger picture of how it is reaching government, and carry that understanding back to the end customers who benefit from the process.

[Excentium-CPS]

Comments on RFC-0034: Technical Advisory Group Changes

Date: October 9, 2026
To: FedRAMP Program Management Office
Submitted via: RFC-0034 comment thread on GitHub
Comment period: September 9, 2026 through October 9, 2026
From: Excentium, Inc.

Excentium, Inc. is a FedRAMP Recognized Independent Assessment Service and a Service-Disabled Veteran-Owned Small Business headquartered in Reston, Virginia. We have held A2LA accreditation for FedRAMP assessment work continuously since 2015 and served as the independent assessor for one of the cloud services authorized under the FedRAMP 20x Low pilot. We partner with government and commercial industry to strengthen our nation's cyber infrastructure.

Disclosure of interest. Through its Cybersecurity Professional Services unit, Excentium performs independent assessments under the accreditation required by REC-IAS-ACC and supplies advisory services, maintaining the separation REC-IAS-SEP requires for each cloud service offering. Excentium could be engaged by a Phase 4 participant, and we disclose that interest here. These recommendations focus on review integrity, clear responsibilities, and reliable agency reuse of certification evidence.

Excentium supports RFC-0034. Embedding agency practitioners with FedRAMP addresses the capacity problem the RFC describes. Details of up to 6 months, with 4 days per week at FedRAMP and 1 at the home agency, combine sustained package review with regular knowledge transfer. AGU-AGC-GRC requires agency tools to produce and ingest machine-readable artifacts, including OSCAL and JSON. SDR-CSO-FRR requires Security Decision Records in human-readable and JSON formats. TAG experience can help agencies develop that capability.

These six recommendations draw on our experience as an accredited inspection body operating under ISO/IEC 17020 and the A2LA R311 requirements incorporated by REC-IAS-PSC. They address interactions among TAG members, providers, and Independent Assessment Services. CR26 references use the canonical machine-readable ruleset, version 2026.10.08.01, verified on October 9, 2026. RFC provisions are proposals. Clear decision authority, information access, and assessment communications will strengthen embedded agency participation. The recommendations build on existing CR26 mechanisms and identify additional operating expectations for TAG members.

R1. State the disclosure and role assignment expectations for TAG members participating in certification review

Ref: Agency Pilot Participation

CR26 states a separation requirement for independent assessment services. REC-IAS-SEP prohibits an assessor from performing a FedRAMP independent assessment of a cloud service offering within 2 years after supplying advisory or consulting services for that offering, subject to a specific exception published by FedRAMP for a limited pilot or other explicitly scoped process. FRD-ADV defines an advisor as an entity that helps a provider understand, prepare for, or maintain FedRAMP Certification without replacing the provider's responsibility or the assessor's independence. These provisions offer a useful reference for role clarity. TAG members have a distinct role, and their operating expectations should reflect that role. The relevant principle is that responsibilities and relationships affecting independent judgment should be identified and managed explicitly.

RFC-0034 enables TAG members to support, review, and participate in certification activities for services their agencies intend to use. Clear disclosure and role assignment expectations would strengthen that participation.

Recommendation: Publish disclosure and role assignment expectations for TAG members whose home agencies intend to use a service under review. The policy should identify who retains certification decision authority and establish a process, developed with agency ethics counsel, for determining when particular relationships or responsibilities require recusal or reassignment. These expectations should preserve the agency participation the proposal seeks to encourage while giving providers, assessors, and relying agencies a clear understanding of each member's role.

R2. State the capacity in which a TAG member participates

Ref: Agency Pilot Participation

CR26 defines the parties to the certification process precisely. A TAG member may contribute as part of FedRAMP's review function and also support their home agency as a prospective customer. FRD-ASR establishes that FedRAMP is the final assessor for FedRAMP Certification, and FRD-ANA places FedRAMP within All Necessary Assessors. FRD-ANP includes agency customers using the service within All Necessary Parties and says potential agency customers should be included in most cases, subject to the provider's choice of whom to do business with. These definitions provide a basis for describing each activity and its associated information access.

Recommendation: Identify each TAG member's assigned capacity by activity: participation in FedRAMP's assessment and review function under FRD-ANA, participation for a prospective agency customer under FRD-ANP, or both with defined responsibilities. State the package information a member may access for the assigned FedRAMP duties and the permitted use of that information. The RFC conditions early access by the home agency on provider agreement. The policy should therefore explain how access granted for FedRAMP duties relates to information shared with the home agency, including any required provider consent and restrictions on onward sharing. Clear assignments let providers and assessment services respond appropriately to information requests.

R3. Define technical communication routes and record material clarifications

Ref: Agency Pilot Participation

TAG review will generate questions about assessment evidence and findings. SDR-CSO-FRR requires the Security Decision Record to include responses or clarifications to independent verification or validation comments for each applicable rule. IVV-IAS-SUM places the assessment service's per-Practice summary in that record. IVV-IAS-OSA places its overall summary, including failures and disputes, in the Certification Package Overview.

Recommendation: Identify technical communication routes for each capacity described in R2. Members acting for FedRAMP should use its review process; members acting for prospective agency customers should coordinate through the provider. Preserve direct technical exchanges among TAG members, providers, assessors, and the PMO within those arrangements. Document material clarifications affecting assessment findings or the certification basis in the appropriate Security Decision Record or Certification Package Overview, preserving assessor responses and unresolved disputes. Explain how material TAG questions use the SDR-CSO-FRR clarification mechanism. REC-IAS-PST supports independent, risk-based review, assessment integrity, and evidence chain of custody. A shared record gives relying agencies a consistent review basis while supporting timely technical discussion.

R4. Define the scope and terms of early access

Ref: Agency Pilot Participation

RFC-0034 offers agencies early access to “the FedRAMP materials” when the cloud service provider agrees. CR26 draws a distinction worth carrying into the final policy. FRD-CRP defines the Certification Package by reference to 44 USC 3607(b)(8), the essential information an agency uses to decide whether to authorize operation. FRD-CRD defines Certification Data as the collective information required for initial and ongoing Certification, including the Package.

FRD-TRC establishes trust centers as the complete and definitive source for FedRAMP Certification Data, and CDS-CSO-UTC requires providers to use one to store and share that data with All Necessary Parties. FRD-ANP recognizes provider choice regarding prospective customers, while CDS-CSO-RPS permits responsible sharing of Certification Package information with other parties under its stated condition. As proposed, RFC-0033 requires Track 1 Class D pilot participants to hold a CR26-compliant FedRAMP 20x Class C Certification before December 1, 2026, providing an existing trust center mechanism for those participants. Certification Data may contain proprietary information and assessment evidence subject to confidentiality obligations. REC-IAS-PST requires assessment services to preserve the integrity and chain of custody of provider-supplied evidence. Defined scope, status, and terms give providers a clear basis for consenting to early access.

Recommendation: Identify whether early access covers the Certification Package, broader Certification Data, or specified portions of either, and route access through the provider's FedRAMP-compatible trust center. State the permitted uses, confidentiality terms, and restrictions on onward sharing, including which information may be shared with the TAG member's home agency. Identify draft materials by version and date, describe their review status, and distinguish them from the package supporting a completed Certification.

R5. Confirm the certification and agency authorization authorities

Ref: Agency Pilot Participation

A TAG member may participate in the certification review for a service and then support their home agency's authorization of that same service. RFC-0034 sets a goal of at least 3 agencies completing an agency ATO based on a Phase 4 pilot package during the pilot itself, placing these decisions close together in time. CR26 assigns distinct responsibilities. FRD-ASR identifies FedRAMP as the final assessor for FedRAMP Certification. FRD-CRP frames the Certification Package as information an agency uses to make its own determination. AGU-USE-ABU requires agencies to complete the Authorization to Operate process for federal information systems that use FedRAMP Certified cloud service offerings, and AGU-USE-RCF requires collaboration with FedRAMP when agency-specific security determinations and the Certification Package conflict. Clear role assignments help a TAG member support both processes appropriately.

Recommendation: Confirm that FedRAMP retains authority for the FedRAMP Certification determination and the agency's authorizing official retains authority for the agency ATO determination. TAG participation informs those decisions through the member's assigned responsibilities. Stating these authorities strengthens confidence in the resulting packages for every agency that reuses them.

R6. Stagger cohorts and publish what the TAG produces

Ref: Technical Advisory Group Changes, Agency Pilot Participation

Details run up to 6 months, the initial cohort is capped at 10 members, and positions stay open throughout FY27. Continuity between cohorts determines how much of that capability the program retains across the fiscal year.

Recommendation: Stagger start dates and provide overlap between details where staffing capacity permits, supported by a documented handoff of ongoing reviews, tools, and lessons learned. Also share the agency adoption practices, tools, and techniques TAG detailees develop through the Agency Liaison Program referenced in AGU-AGC-LIA, and publicly where appropriate. Useful outputs include machine-readable data ingestion examples, package review guides, reusable tools, and lessons from agency authorization activities, with provider-sensitive information protected. This would help agencies build the capability described in AGU-AGC-GRC and extend the value of the details across government.

Closing

RFC-0034 supplies agency expertise to support the Phase 4 Class D assurance goal. Clear responsibilities, controlled information sharing, and documented material clarifications will help agencies engage confidently during the pilot. Handoffs and shared tools will extend that capability across details and throughout government. Developing those practices during the pilot supports our shared mission to reduce the vulnerabilities of our Nation.

Excentium appreciates the opportunity to comment on RFC-0034 and welcomes further discussion of these recommendations with the FedRAMP PMO.

Respectfully submitted,

Colin Corlett
President and Chief Executive Officer
Excentium, Inc.
1768 Business Center Drive, Suite 220
Reston, VA 20190

[rhoesing]

Again.