An official website of the United States government
Here’s how you know
Official websites use .gov
A .gov website belongs to an official government organization in the United States.
Secure .gov websites use HTTPS
A lock
( )
or https:// means you’ve safely connected to the .gov website. Share sensitive information only on official, secure websites.
March 28 from 10 p.m.- 2:30 p.m. Eastern time
In-person location: 1800 F St NW, Room 1461, Washington D.C. 20004
| ALLOTTED TIME | TOPIC | PRESENTER |
|---|---|---|
| 10-10:10 a.m. | Call to order Welcome and roll call FACA public meetings | Designated Federal Officer Michelle White |
| 10:10-10:20 a.m. | Public comment (limit of three minutes per speaker) | Members of the public |
| 10:20-10:25 a.m. | Chair remarks | Federal Secure Cloud Advisory Committee Chair Ann Lewis |
| 10:25-10:45 a.m. | Presentation - OMB draft memo updates | Deputy Federal CIO, Office of the Federal CIO, Office of Management and Budget Drew Myklegard |
| 10:45-11:05 a.m. | Presentation - FedRAMP roadmap in response to updates on OMB draft memo | Eric Mill, Executive Director for Cloud Strategy at General Services Administration (GSA); Zaree Singer, Agency Engagement Lead at FedRAMP; and Ryan Palmer, Senior Technical and Strategic Advisor at FedRAMP |
| 11:05-11:30 a.m. | Committee-question-and-answer | FSCAC members |
| 11:30-11:45 a.m. | Break (15 min) | |
| 11:45-12:30 p.m. | Panel Discussion — 3PAO Stakeholder Experience | Kratos’ Vice President of Cybersecurity Services Jim Neidich; A-Lign’s Director of Quality Management Lee Neeper; and FSCAC members |
| 12:30-1:40 p.m. | Lunch break | |
| 1:40-2:55 p.m. | Deliberations and vote on committee’s next priorities | FSCAC members |
| 2:55-3:00 p.m. | Closing remarks & adjourn | FSCAC Chair Ann Lewis and DFO Michelle White |
Michelle introduced the purpose of the meeting and background information on FSCAC’s creation and scope, and then went through roll call. A quorum was established. Michelle then reviewed the purpose, outcome and agenda for the day. She announced that the members had successfully submitted their final recommendations to the GSA Administrator, and the Chair had briefed the Administrator on the details. The recommendations were further sent from the Administrator to the FedRAMP PMO for their review. Lastly, she reminded the members of the speaking etiquette for this meeting.
Ann Lewis, FSCAC Chair, level set and provided more background and context for the meeting today, as well as restated the overall purpose, outcome and process for this meeting. She also congratulated the members on submitting their first set of recommendations to the GSA Administrator, who had been briefed on the specific recommendations by the Chair.
There was one public comment from Josh Blaher representing RedHat who offered guidance on what RedHat believes the FSCAC Committee’s priorities should be this year. Josh Blair highlighted two recommended focus areas: the reestablishment of the Joint Authorization Board (JAB) or a similar body as well as a refocus on vulnerability management to identify risks. Public comment portion concluded at 10:10 a.m.
Drew Myklegard spoke about the level of OMB leadership that is committed to FedRAMP and its mission, and how OMB is committed to building further relationships with the Committee members on the FSCAC board. He also gave updates on the OMB policy and asked for feedback from FSCAC on three specific areas: 1) FedRAMP and small businesses, 2) cost around the FedRAMP process (how much it costs for an agency to bring in a CSP and how much it costs for a CSP), and 3) metrics, specifically around transparency on the OMB side to improve FedRAMP over time while also providing the most value to CSPs.
Eric Mill introduced the FedRAMP 2024-2025 Roadmap and stated that this is what the program will use to help prioritize their goals this year. Zaree Singer explained that the roadmap is meant to be a response to FedRAMP’s stakeholders, and will help to organize FedRAMP’s strategic goals and will help to publicly communicate these changes in the program. She then introduced the four specific goals of the roadmap: customer experience, being a leader in cybersecurity, scaling the size and scope of a trusted FedRAMP Marketplace, and increasing the program’s effectiveness. Ryan Palmer then presented a detailed overview of each of these four goals, listing the challenges of each goal and what FedRAMP will deliver first within each goal. Zaree then explained the benefits this roadmap will provide to FedRAMP’s customers.
Questions from FSCAC members centered around funding, timelines around the roadmap, the use of SaaS with the changes in the roadmap, automation efforts and how FedRAMP assesses technical controls to inform compliance, centralizing ConMon, reciprocity, interpretations of controls and requirements to maintain common language, the revision process of the roadmap, the Red Teaming Assessment Framework, and pushing Moderate and High impact levels of Authority to Operate (ATOs).
Jim and Lee discussed their experiences as 3PAO stakeholders. Questions from FSCAC members centered around their experiences with assessments without consultation, showstoppers that CSPs encounter and communication challenges during authorization process, challenges during the authorization phase itself,
challenges unique to small businesses, FIPS, MFA concerns, gaining and maintaining trust between vendor and assessor, improving package quality to help CSPs get through the authorization process faster, showing the value of the 3PAO to the PMO and consensus on what a 3PAO recommendation means, conditions needed for a CSP to build out a cloud offering, Cybersecurity Maturity Model Certifications (CMMCs), how to quickly communicate FedRAMP guidance and current requirements, metrics and data collection, incorporating binding operational directives (BODs) into compliance assessments, software attestation requests, how can AI assist CSPs and affect FedRAMP controls, updated Rev 5 templates, and Red Team Pen Test.
The Committee deliberated on which priorities to focus on going forward. Numerous priorities were drafted, to include reviewing the implementing and communicating the OMB memo, following through on 2023 initiatives, and recommending metrics for FedRAMP. Members proposed additional ideas around small business concerns, AI privacy and BOD compliance concerns, addressing current baseline issues before focusing on improvement, how the FedRAMP roadmap will be implemented, transitioning to new authorization paths such as agile authorizations, modular risk acceptance, a knowledge base organically built from multi-stakeholders, and how to grow the 3PAO marketplace. The Committee also discussed implications of the establishment of the FedRAMP Board, including authorizations previously done by the JAB, and the benefits and drawbacks of reciprocity. Mike Varcica proposed tallying top priorities via Smartsheet ahead of the next meeting.
Branko Bokan made a motion to delay selecting a priority until additional information is received. Jackie Snouffer seconded.
Ann Lewis began closing remarks by complimenting the Committee on a great discussion. Michelle White adjourned the meeting at 2:59 p.m.
Error, The Per Diem API is not responding. Please try again later.
No results could be found for the location you've entered.
Rates for Alaska, Hawaii, and U.S. territories and possessions are set by the Department of Defense.
Rates for foreign countries are set by the Department of State.
Rates are available between 10/1/2023 and 09/30/2026.
The End Date of your trip can not occur before the Start Date.
Traveler reimbursement is based on the location of the work activities and not the accommodations, unless lodging is not available at the work activity, then the agency may authorize the rate where lodging is obtained.
Unless otherwise specified, the per diem locality is defined as "all locations within, or entirely surrounded by, the corporate limits of the key city, including independent entities located within those boundaries."
Per diem localities with county definitions shall include"all locations within, or entirely surrounded by, the corporate limits of the key city as well as the boundaries of the listed counties, including independent entities located within the boundaries of the key city and the listed counties (unless otherwise listed separately)."
When a military installation or Government - related facility(whether or not specifically named) is located partially within more than one city or county boundary, the applicable per diem rate for the entire installation or facility is the higher of the rates which apply to the cities and / or counties, even though part(s) of such activities may be located outside the defined per diem locality.
U.S. General Services Administration