FSCAC public comments

We encourage you to share your insights and perspectives with us by submitting a public comment. Your input is valuable!

We review public comments to inform our recommendations and ensure that FedRAMP remains effective and responsive to the evolving cloud security landscape. Public comments are essential to the Federal Advisory Committee Act, which ensures transparency, accountability, and public participation in the process by which federal agencies obtain advice and recommendations from expert groups.

We’ll post submitted comments for public review, typically within 3-5 business days. Our designated federal officer will review all comments before each scheduled public meeting and read relevant comments during the meeting. We’ll share all comments with committee members prior to the next scheduled meeting. Please note that while we consider all comments, we may not be able to respond to each one individually.

We appreciate your contributions!

Date	Name	Public comment
10/24/2026	Gustavo H. R. Pessoa	Measuring the value of FedRAMP reuse Public comment to the Federal Secure Cloud Advisory Committee For the November 2, 2026 meeting Gustavo H. R. Pessoa Economist and professor, Fundação Getulio Vargas, São Paulo, Brazil Submitted in a personal capacity A second agency should be able to build on security assessment work already performed through FedRAMP. The economic question is how much additional work remains, why it is needed, and whether the process gives smaller providers a practical route to additional customers. A count of certifications or agency uses cannot answer those questions on its own. The Committee’s November agenda includes agency adoption and reuse data and final recommendations on this subject.[1] I suggest a small set of measures to connect that work to public spending, administrative effort and supplier participation. These are proposals for measurement, rather than estimates of savings already achieved. The starting point should be the distinction in FedRAMP’s 2026 guidance: certification provides reusable security evidence about a cloud service, while an agency authorizes its information system and accepts the risk associated with its particular use.[2] Agency-specific assessment can therefore be necessary. The relevant test is whether additional work addresses an actual difference in use, configuration, integration or responsibility. First, record the additional time and effort required for each agency adoption. A common record could capture when the agency defines its use, obtains access to the relevant certification materials, requests further information, receives a complete response and reaches an authorization decision. Calendar time should be reported separately from staff hours. Waiting for a procurement decision, configuring the agency’s system and repeating an assessment are different activities, with different remedies. The initial cost of obtaining FedRAMP certification should also remain separate from the additional cost of a later agency adoption. Second, give additional requests a short, usable explanation. For example, a request might concern an agency-specific integration, a change in the service, an unresolved clarification or information already present in the current package. The record should identify the existing evidence considered and the remaining question. This would help reviewers distinguish justified additional assurance from avoidable repetition. A reason code and a brief explanation would be more useful than a new parallel reporting system. They should be drawn from existing workflow records wherever possible. Third, report economic benefits carefully. Agency staff hours released for other work represent capacity that can be redeployed; they are not automatically a reduction in budget expenditure. Provider hours, external assessment charges and other direct costs should be reported separately, with a method that prevents double counting. Where a savings estimate depends on what would have happened without reuse, that baseline and its uncertainty should be stated. Measured effort and estimated savings should remain distinguishable in public reporting. Fourth, examine participation beyond completed cases. For small providers, the additional cost of serving another agency may affect whether pursuing that customer is worthwhile. Data limited to successful authorizations could miss providers that withdraw or never proceed after an initial inquiry. A limited pilot could record withdrawals, the stage reached and the reason voluntarily reported. Comparisons should account for differences in service scope and agency needs. Higher completion rates alone would not establish that smaller firms face lower costs. The Committee could recommend testing this approach through a limited set of agency adoption cases, using existing records and feedback from participating agencies and providers. A compact public report could show distributions of elapsed time, additional effort, reasons for further requests and completion or withdrawal. Sensitive security details and commercially confidential material should remain protected, and small groups should be aggregated where disclosure could identify a provider. These measures would need to be read alongside evidence about security and agency responsibility. Faster processing cannot, by itself, demonstrate that an agency has accepted the right risks. The aim is to identify where common assessment work genuinely reduces additional effort and where a particular use still requires a justified decision. That would give the Committee a more useful basis for judging the public value of reuse and the ability of smaller suppliers to participate. Sources [1] GSA, Federal Secure Cloud Advisory Committee November 2, 2026 public meeting agenda. https://www.gsa.gov/technology/government-it-initiatives/federal-secure-cloud-advisory-committee/federal-secure-cloud-advisory-committee-meetings/fscac-nov-2-2026-public-meeting-agenda [2] FedRAMP Consolidated Rules for 2026, Using a FedRAMP Certified Cloud Service. https://www.fedramp.gov/2026/agencies/use/ [2a] FedRAMP Consolidated Rules for 2026, Initial Agency Authorization. https://www.fedramp.gov/2026/agencies/use/initial/
8/10/2026	Rudy Morales	I am a contractor quality control manager working on federal construction projects. I am submitting this comment in my personal capacity. I do not represent any agency, and nothing here reflects the position of any employer or customer. I want to offer a perspective the Committee may not be receiving much of — that of the person at the far end of the systems being discussed. The June 8, 2026 minutes record that many agencies still rely on legacy governance, risk, and compliance tools, that agencies “copy and paste data from FedRAMP documents into internal systems,” and that contractors may have incentives to preserve manual processes. That finding has a direct downstream analog in field execution, and I would ask the Committee to consider it when framing recommendations on reuse, structured information, and agency adoption. In practice, at the working level: Duplicative review is not only an agency-to-agency problem. The same information is frequently reviewed independently by the government and by the contractor, in separate systems, against separate copies. Reuse breaks down at the working level for the same reason it breaks down at the authorization level — the receiving party either does not trust, or cannot ingest, what already exists. Manual re-entry is the default rather than the exception. The same inspection, deficiency, and closeout information is commonly re-keyed across several disconnected systems in a single day. Every re-entry is an opportunity for divergence between records that are later expected to agree with one another. Contractual records and field-execution records are not the same thing, and systems that conflate them create work rather than reduce it. Requirements, submittals, and correspondence run on a contractual clock. Inspections, deficiencies, commissioning, and closeout run on a physical one, with sequencing dependencies that do not respect document workflow. Field conditions are not office conditions. Work happens offline, in low-connectivity areas, and inside facilities where device, camera, and network restrictions apply. Handling limitations on controlled information and installation-specific security rules further constrain what a field system is permitted to do. A cloud service that assumes continuous connectivity and unrestricted capture is not usable where the work actually occurs, regardless of its authorization status. Evidence has a custody dimension. Records generated in the field are later relied upon as documentation. Structured-data recommendations that do not account for provenance and chain of custody will produce information that is machine-readable but not defensible. The practical result is that a system can be fully compliant and still fail operationally. When it does, the people performing the work route around it — and the manual processes this Committee identified reappear one layer further down. I would encourage the Committee, in developing its 2026 recommendations on reuse and agency adoption, to seek input from field-level practitioners alongside policy, cybersecurity, acquisition, and technology stakeholders. Recommendations on structured data and reuse are more likely to survive contact with operations if the people executing the work are represented while those recommendations are being written. Thank you for the opportunity to comment.
6/3/2026	Kim Hernandez	TekRamp is a women-led, USAF veteran-founded company building an OSCAL-native FedRAMP and CMMC compliance platform. We submit this comment as a CSP-side tooling developer with a direct stake in the success of FedRAMP modernization. With CR26 publishing this month and FedRAMP 20x advancing a machine-readable, KSI-driven model, the tooling layer that produces and maintains authorization artifacts becomes structurally important to the program’s goals. Three observations for the Committee’s consideration: The re-authoring tax is the real barrier for small CSPs. The friction is less in the controls than in producing SSP narratives, evidence, and assessment responses as static documents and rebuilding them for each assessment and agency. A machine-readable mandate only delivers its efficiency if the data model is authored once and reused — not exported to OSCAL after the fact. Continuous monitoring and initial authorization are still separate workflows. Building ConMon on the same data model as the SSP, rather than as parallel spreadsheets, is where 20x’s automation potential is realized or lost. Multi-party collaboration remains email- and document-bound. Modernization that addresses the shared workspace among CSP, 3PAO, and agency, not just the file format, would meaningfully lower the barrier for resource-constrained CSPs. Especially with our companion SI built into the process to help anyone secure their software or offering to the standard of FedRAMP with practical steps and agentic implementation is the exact modernization that would enable our governmnet be more effective. We would welcome the chance to provide more detailed written input on OSCAL-native workflows and reusable-evidence models, and to serve as a CSP-side resource as the Committee weighs implementation. Our interest is in making the OSCAL ecosystem work end-to-end for small CSPs. Thank you for the Committee’s work supporting secure cloud adoption.
5/11/2026	Kim Hernandez	The Federal Secure Cloud Advisory Committee’s mandate to advise on FedRAMP modernization aligns with several policy questions worth surfacing from the perspective of small and emerging CSPs. For context, I am the founder of TekRamp, an OSCAL-native FedRAMP and CMMC compliance acceleration platform, currently with three federal-cyber design partners on paid pilots. The observations below come from direct work alongside CSPs navigating the authorization process today. 1. The OSCAL readiness gap is wider than program documentation suggests. FedRAMP 20x and the CR26 machine-readable mandate set the right strategic direction, but the operational reality across CSPs, 3PAOs, and agency reviewers is still Word documents and email attachments. The tooling layer — workspaces that produce OSCAL-native packages natively rather than as a post-hoc export — is years behind the policy. The Committee may wish to advise the PMO on realistic sequencing of the machine-readable mandate, paired with ecosystem-wide investment in OSCAL-native tooling and 3PAO assessor readiness. 2. Evidence reuse is the highest-leverage policy lever the Committee can advocate for. Today, every CSP authoring its package builds evidence artifacts from scratch — even where the same controls and the same evidence types apply across hundreds of CSPs. A FedRAMP-blessed framework for evidence reuse across CSPs (or within a CSP across multiple offerings) would materially reduce the 18-month, $2M authorization burden that disproportionately blocks small and emerging CSPs from federal markets. 3. The CMMC–FedRAMP alignment opportunity is time-bound. With CMMC enforcement beginning November 2026 and CR26 publishing this June, the federal cloud and DIB compliance ecosystems are converging on a shared evidence model. The Committee is well-positioned to advise the PMO on shared OSCAL primitives between FedRAMP and CMMC — eliminating duplicate work for CSPs that serve both pipelines and removing one of the most common obstacles small contractors cite for not pursuing federal markets. I would welcome the opportunity to contribute written input in greater depth or to brief the Committee directly. As an early-stage company building tooling in this space, my interest is in making the OSCAL ecosystem work end-to-end across vendors, assessors, and agencies. Thank you for the Committee’s work supporting secure cloud adoption across federal government.

FSCAC public comments

1 Choose a location

2 Choose a date