Federal Secure Cloud Advisory Committee Aug. 31, 2026 public meeting agenda and minutes

Aug. 31, 2026 open public meeting agenda

Meeting minutes

Call to order

The Federal Secure Cloud Advisory Committee convened a virtual public meeting on Monday, Aug. 31, 2026. The meeting was called to order at approximately 1:03 p.m. Eastern Time by Ryan Hoesing, the Designated Federal Officer for the Federal Secure Cloud Advisory Committee.

The Designated Federal Officer noted that the meeting was being conducted as an open public meeting under the Federal Advisory Committee Act. Participants were informed that the meeting was being recorded and that the recording and meeting materials would be made available on the GSA FSCAC webpage following the meeting. Closed captioning was available through Zoom.

Committee members were asked to remain muted when not speaking and to use the raise-hand feature to participate in discussion.

Membership update and roll call

The Designated Federal Officer provided a committee membership update. Zack Fasnacht was welcomed as a new committee member representing Vanta as a large cloud service provider, with an appointment effective August 1, 2026.

The Designated Federal Officer also recognized and thanked Branko Bokan, who previously served on the committee representing the Cybersecurity and Infrastructure Security Agency. The committee was informed that the CISA representative position was vacant and would be filled as soon as possible.

The Designated Federal Officer stated that the committee had 13 active appointed members. Under the FSCAC bylaws, quorum required half of the active membership plus one, meaning seven members were required for quorum. Following roll call, the Designated Federal Officer confirmed that 12 of 13 members were present, establishing quorum and allowing the committee to conduct official business, including votes.

The committee was reminded that its final scheduled 2026 public meeting would take place on Nov. 2, 2026, with the intent of considering a final recommendation report to the GSA Administrator.

Recap of July 2026 agency adoption and reuse data briefing

The Designated Federal Officer provided a recap of the committee’s July 2026 discussion on agency adoption and reuse under the legacy FedRAMP model. He noted that the July discussion was intended to establish a common baseline for the committee, identify key questions around adoption and reuse, and narrow the committee’s work toward concrete recommendations.

The Designated Federal Officer noted that the data likely understated actual reuse because FedRAMP historically relied on agencies to provide authorization letters, and agencies did not always do so consistently.

The committee also discussed how reuse accumulates over time. The July briefing showed that 62 percent of active ATOs were associated with services that had been certified for more than five years, while 38 percent were associated with services certified within the previous five years. The committee noted that this did not mean newer services were failing to achieve reuse, but rather that reuse tends to grow as agencies gain experience, conduct acquisitions, mature internal processes, and build confidence in available authorization information.

The Designated Federal Officer stated that the central question for FSCAC was whether the committee could help shorten the timeline from FedRAMP Certification to first agency use for FedRAMP 20x services.

The working sessions held after the July meeting produced three recommendation areas for committee consideration:

1. A FedRAMP 20x agency playbook;
2. Continued open collaboration around 20x implementation; and
3. Sustained direct and in-person collaboration with agencies.

Chair opening remarks

FSCAC Chair Larry Hale provided opening remarks. He stated that the central question for the meeting was how to ensure that federal agencies successfully adopt and use FedRAMP 20x Certifications.

The Chair explained that agency adoption and reuse are within FSCAC’s mission, including the committee’s role in increasing agency reuse of FedRAMP Certifications, reducing burden and cost for agencies and cloud service providers, collecting feedback on agency implementation of FedRAMP requirements, and serving as a forum for collaboration among FedRAMP stakeholders.

The Chair emphasized that the committee was not concluding that FedRAMP 20x usage had failed, but rather was identifying a foreseeable adoption risk and considering ways to mitigate it before it became a broader issue.

The Chair noted that August 31, 2026, marked the opening of FedRAMP 20x Class B and Class C certification pathways. These pathways were expected to expand the types of cloud services entering the FedRAMP 20x process, including many services agencies had historically consumed through FedRAMP Low and Moderate models.

The Chair explained that FedRAMP 20x changes the assurance model by introducing elements such as key security indicators, machine-readable information, trust center evidence, risk-based vulnerability information, and continuous evidence. He stated that the committee’s objective should be to help agencies translate the new 20x assurance model into information they can use for risk decisions, while preserving agency responsibility for mission context, risk tolerance, and authorization.

Recommendation 1: FedRAMP 20x agency playbook

The committee considered a recommendation to support the development and publication of a practical FedRAMP 20x agency playbook.

The Chair explained that agencies will need to understand how to consume a new type of FedRAMP certification and translate 20x evidence into existing agency risk management and authorization processes. The playbook would be intended to help authorizing officials, CISOs, system owners, and security teams understand what FedRAMP has established through a 20x certification, what the evidence means, what agencies can rely on, and where agency-specific analysis begins.

Committee members discussed the importance of ensuring that the playbook be consistent with NIST standards and guidelines. Victoria Yan Pillitteri (NIST) proposed adding language to clarify that the playbook should be “consistent with NIST standards and guidelines.” The proposed amendment was accepted.

The final recommendation language considered by the committee was:

The Federal Secure Cloud Advisory Committee recommends that the GSA Administrator support the development and publication of a practical FedRAMP 20x agency playbook consistent with NIST standards and guidelines to help federal agencies consume and use 20x certifications in support of agency risk-based authorization decisions. The playbook should clearly explain what agencies can rely on from a 20x certification, distinguish usable FedRAMP assurance from agency-specific responsibilities, and provide practical guidance for using 20x evidence within existing agency risk management and authorization processes. The playbook should help agencies transition to the 20x assurance model without recreating the Rev. 5 assessment process and without limiting agency responsibility for mission-specific risk analysis and risk acceptance.

The committee voted by chat on the recommendation. The recommendation was approved.

Recommendation 2: Continued open collaboration

The committee next considered a recommendation to support an open, vendor-neutral collaboration model for sharing practical FedRAMP 20x implementation resources.

The Chair explained that FedRAMP should remain the authoritative source for program requirements, rules, and official implementation guidance. However, as agencies, cloud service providers, assessors, and practitioners begin operating under 20x, they will identify practical implementation questions involving evidence reuse, trust centers, automation, machine-readable artifacts, continuous validation, and related workflows.

The committee discussed the need for guardrails to ensure that any collaboration model would not become a second source of FedRAMP policy or create confusion about official requirements. Members also discussed the importance of governance, transparency, source attribution, vendor neutrality, conflict-of-interest controls, and appropriate legal and ethics review.

The final recommendation language considered by the committee was:

The Federal Secure Cloud Advisory Committee recommends that the GSA Administrator support development of an open, vendor-neutral collaboration model through which federal agencies, cloud service providers, assessors, and other practitioners can develop and share practical resources that support the implementation and reuse of FedRAMP 20x. The collaboration should complement, not replace, authoritative FedRAMP requirements and guidance, and should focus on operational playbooks, implementation patterns, evidence reuse examples, decision guides, reusable templates or schemas, and lessons learned. Any collaboration model should include clear governance, transparency, authoritative source attribution, non-endorsement, vendor neutrality, conflict-of-interest controls, and appropriate legal and ethics review. The Federal Secure Cloud Advisory Committee does not recommend a specific host or owner at this stage.

The committee voted by chat on the recommendation. The recommendation was approved.

Recommendation 3: Direct and in-person agency collaboration

The committee then considered a recommendation to support sustained direct and, where practical, in-person collaboration with federal agencies on FedRAMP 20x adoption and use.

The Chair explained that written guidance, playbooks, and technical resources are necessary but may not be sufficient to drive adoption of a fundamentally different assurance model. He stated that direct engagement with agency CIOs, CISOs, authorizing officials, acquisition teams, system owners, and security and compliance practitioners would help identify barriers early and create a feedback loop around implementation.

Committee members discussed the importance of engaging not only the federal CIO and CISO councils, but also relevant working groups, acquisition officials, authorizing officials, security and compliance practitioners, and small agencies. Members noted that different stakeholders participate in different councils and forums, so engagement should be broad and recurring.

The initial recommendation language was approved by chat vote. Following the vote, a committee member raised a clarification regarding whether “security and compliance practitioners” referred to agency personnel or industry participants. The committee agreed to clarify the language to make clear that the referenced roles were within federal agencies. The clarified language was approved by voice vote.

The final recommendation language was:

The Federal Secure Cloud Advisory Committee recommends that the GSA Administrator support a sustained program of direct and, where practical, in-person collaboration with federal agencies, including CIOs, CISOs, authorizing officials, acquisition officials, and security and compliance practitioners, focused on successful adoption and reuse of FedRAMP 20x. This engagement should include recurring interaction with the federal CIO and CISO councils and relevant working groups, agency-level working sessions, and mechanisms to identify and share successful practices, inconsistent interpretations, duplicative requirements, and other recurring barriers to reuse. GSA should use these engagements to identify systemic issues that may warrant broader action or coordination by GSA, the FedRAMP Board, OMB, or agencies, while preserving each agency’s responsibility for its own mission-specific risk and authorization decisions.

The committee approved the recommendation.

Public comment

The Designated Federal Officer opened the public comment period. Members of the public were invited to provide oral comments, with speakers asked to state their name and affiliation and limit remarks to three minutes.

One public commenter, Rob, provided comments. He stated that FedRAMP 20x was an exciting development but raised concerns about alignment between FedRAMP and the Department of Defense. He noted that DoD had not adopted 20x and that divergence between FedRAMP and DoD could create additional burden and confusion for cloud service providers operating across federal and DoD environments.

The commenter also encouraged the committee to consider AI security as part of FedRAMP or FedRAMP 20x standards. He stated that agencies are developing independent AI governance programs and requirements, which may create inconsistent and additional burdens for cloud service providers. He suggested that FedRAMP could play a role in helping align security requirements related to AI.

No additional public comments were provided. The Designated Federal Officer closed the public comment period.

Closing remarks

The Chair thanked committee members for their participation and for the work completed during the working sessions held between the July and August meetings. He stated that the committee had made meaningful progress by formally advancing the three recommendations discussed during the meeting.

The Chair explained that the approved recommendations would provide direction for the next phase of work. The recommendations, along with supporting discussion and implementation considerations, would be developed into a more complete FSCAC report. The report would provide rationale for each recommendation, identify implementation considerations, and distinguish where actions may appropriately fall to GSA, the FedRAMP Board, agencies, or other federal cloud community participants.

The Chair emphasized that the votes established the committee’s direction but did not resolve every implementation detail. The draft report would provide an opportunity to develop those details and bring a complete work product back to the committee for final consideration.

Next steps

The Designated Federal Officer stated that the committee’s votes and discussion would be documented as part of the official meeting record.

GSA staff will begin developing a draft FSCAC report based on:

• The three recommendations approved by the committee;
• The language adopted during the meeting;
• The work produced during the three working sessions; and
• The discussion held during the August 31, 2026 meeting.

The draft report will be brought back to the full committee for review and consideration at the next scheduled public meeting on Nov. 2, 2026. Members will have an opportunity to review the complete work product, deliberate on remaining issues, and make changes as needed.

The Designated Federal Officer thanked the committee members, members of the public, and public commenters for their participation.

Adjournment

There being no further business, the meeting was adjourned at approximately 2:30 p.m. Eastern Time.