PROGRESS.md

# FedRAMP Roadmap Progress Updates

![Roadmap Vibes: a group of folks working on computers while looking out at clouds](https://github.com/user-attachments/assets/5d9b0eac-6241-4fdb-b2bb-c53af2bb8f26)

> Note: As of 2026-01-31, GSA is shutdown due to a lapse in appropriations.

## Sprint 18 (2026-01-19 to 2026-01-30)

### OPEN Issue [#101: FRMR Docs Overhaul](https://github.com/FedRAMP/roadmap/issues/101)

Latest comment (2026-02-02):

This is likely to be released shortly after the current shutdown ends.

### OPEN Issue [#93: 20x Phase 2 Pilot - Cohort 2](https://github.com/FedRAMP/roadmap/issues/93)

Latest comment (2026-02-02):

During the past 2 weeks, we spent a total of ~20 hours collaborating with Cohort 2 participants. 3 of them have completed review of all KSIs with us, and 7 of them will be finishing up shortly.

### OPEN Issue [#79: Agency Requirements and Guidance](https://github.com/FedRAMP/roadmap/issues/79)

Latest comment (2026-02-02):

This continues to slip as less critical than many of the other activities we are working towards, but is quickly approaching the point where it will be completely necessary.

### CLOSED Issue [#34: 20x Phase 2 Pilot - Cohort 1](https://github.com/FedRAMP/roadmap/issues/34)

Latest comment (2026-02-02):

All 3 participants in Cohort 1 have submitted packages - I'm closing this particular item to include their final review and authorization in the overall Phase 2 work.

### OPEN Issue [#32: Agency AI Adoption Pilot for 20x](https://github.com/FedRAMP/roadmap/issues/32)

Latest comment (2026-02-02):

All 3 prioritized providers are currently under review.


## Sprint 17 (2026-01-05 to 2026-01-16)

### OPEN Issue [#101: FRMR Docs Overhaul](https://github.com/FedRAMP/roadmap/issues/101)

Latest comment (2026-01-20):

The final alpha version is saved for posterity here: https://github.com/FedRAMP/docs/releases/tag/v0.4.0-alpha && https://github.com/FedRAMP/docs/tree/ref-v0.4.0-alpha

Work in progress for the significant overhaul is available here: https://github.com/FedRAMP/docs/tree/pwx-v0.9.0-beta

### OPEN Issue [#100: RFC-0019 Reporting Assessment Costs](https://github.com/FedRAMP/roadmap/issues/100)

Latest comment (2026-01-20):

The resulting information will be made available (de-identified) in a new section on the website focused on cost and status reporting.

### OPEN Issue [#99: RFC-0022 Leveraging External Frameworks](https://github.com/FedRAMP/roadmap/issues/99)

Latest comment (2026-01-20):

This RFC is tied into work done during 20x Phase 1 and will be deployed as part of 20x Phase 2.

### OPEN Issue [#98: RFC-0023 Rev5 Program Certifications](https://github.com/FedRAMP/roadmap/issues/98)

Latest comment (2026-01-20):

Please note that program authorizations in this RFC are designed specifically for cloud service providers that have already nearly completed their Rev5 journey. 

### OPEN Issue [#97: FedRAMP Trademark Guidance Updates](https://github.com/FedRAMP/roadmap/issues/97)

Latest comment (2026-01-20):

GSA Office of General Counsel advised us that an RFC will not be necessary for these changes. Stay tuned for updated brand guidance when we're ready to release directly.

### OPEN Issue [#96: RFC-0024 Rev5 Machine-Readable Packages](https://github.com/FedRAMP/roadmap/issues/96)

Latest comment (2026-01-20):

This RFC was released on January 13, 2026. Given the extensive impact, public comment period has been extended to nearly two months.

https://www.fedramp.gov/rfcs/0024/

### OPEN Issue [#95: RFC: New Marketplace and Authorization Designations](https://github.com/FedRAMP/roadmap/issues/95)

Latest comment (2026-01-20):

These RFCs were released on January 13 as:

* https://www.fedramp.gov/rfcs/0020/ FedRAMP Authorization Designations
* https://www.fedramp.gov/rfcs/0021/ Expanding the FedRAMP Marketplace

### OPEN Issue [#93: 20x Phase 2 Pilot - Cohort 2](https://github.com/FedRAMP/roadmap/issues/93)

Latest comment (2026-01-20):

After an **intense** week of pilot proposals that ended with a marathon day of 6 on Friday the 9th, we selected an additional 10 participants in Cohort 2. All of these pilot proposals were so solid that it didn't seem fair to only pick the best 7 - adding 3 more is a fair bit of extra work for us but we decided to make the commitment anyway.

Last week our senior staff spent ~11 hours in collaborative workshops with 7 of these participants and it's definitely a wild ride. The selected participants for both cohorts (including their pilot proposal, if applicable) can be seen at https://www.fedramp.gov/20x/phase-two/participate/

### OPEN Issue [#32: Agency AI Adoption Pilot for 20x](https://github.com/FedRAMP/roadmap/issues/32)

Latest comment (2026-01-20):

One of our AI prioritized participants have submitted their 20x authorization package! We're expecting the other two very soon.

### CLOSED Issue [#19: R5.MAS Minimum Assessment Scope BIR](https://github.com/FedRAMP/roadmap/issues/19)

Latest comment (2025-11-26):

FedRAMP now plans to make the Minimum Assessment Scope available as an optional balance improvement release for Rev5 under Wide Release on January 12, 2026. Instructions for how cloud services may adopt this standard are in the Rev5 Balance version of this standard: https://www.fedramp.gov/docs/rev5/minimum-assessment-scope/

### CLOSED Issue [#16: Rev5 SCN Significant Change Notification Balance Improvement Release](https://github.com/FedRAMP/roadmap/issues/16)

Latest comment (2026-01-20):

The SCN process will go into wide release at the end of February.

## Sprint 16 (2025-12-22 to 2026-01-02)

> FedRAMP spent most of Sprint 16 celebrating the holidays and taking a well deserved
> rest. Please stand by for exciting stuff in Sprint 17!

## Sprint 15 (2025-12-08 to 2025-12-19)

### OPEN Issue [#97: RFC: Updates on the FedRAMP Trademark](https://github.com/FedRAMP/roadmap/issues/97)

Latest comment (2025-12-19):

This planned RFC is new this sprint!

### OPEN Issue [#96: RFC: Rev5 OSCAL adoption](https://github.com/FedRAMP/roadmap/issues/96)

Latest comment (2025-12-19):

Tentatively planning to release this RFC in mid/late January.

### OPEN Issue [#95: RFC: New Marketplace and Authorization Designations](https://github.com/FedRAMP/roadmap/issues/95)

Latest comment (2025-12-19):

Due to the holidays we're tentatively planning to release this RFC on Jan 12-14. We're also going to try something new for this RFC: a short podcast style discussion about the background and motivation as well as an overview of the RFC itself. Some folks like to just read RFCs but we want to provide a bit more for folks who want to listen to us ramble.

### OPEN Issue [#79: Agency Requirements and Guidance](https://github.com/FedRAMP/roadmap/issues/79)

Latest comment (2025-12-19):

This has slipped continuously, especially in the aftermath of the shutdown, but as we change focus of priority towards agency adoption we need to push this over the finish line. It's become one of those things that folks keep having more ideas about adding to or changing things up in a way that hasn't aligned with our external approach of incremental delivery because we're aware that with agencies it's more important to have a complete thing they can take and run with in one go without having to keep learning more.

Based on that, I've reset the target to end of January and we will align this with the Federal AI adoption sprint to ensure folks have this guidance as we engage government-wide on that.

### OPEN Issue [#48: Major redesign of marketplace](https://github.com/FedRAMP/roadmap/issues/48)

Latest comment (2025-12-19):

We're making a significant shift in direction on this: we are going to wait for the outcome of #95 (RFC on new marketplace designations) to launch the new Marketplace so that it aligns with the resulting changes from that RFC.

### OPEN Issue [#34: 20x Phase 2 Pilot - Cohort 1](https://github.com/FedRAMP/roadmap/issues/34)

Latest comment (2025-12-19):

On December 10 we announced the [Phase 2 Cohort 1 participants](https://www.fedramp.gov/2025-12-10-announcing-the-initial-20x-phase-2-pilot-participants/) and published their pilot proposal videos.

As of today we have completed all planned collaborative workshops with the 3 participants (well, the final one is schedule for this afternoon but I'm presuming in advance we'll finish up).

We were able to talk through approaches and theory for every single KSI in 2x 2-hour collaborative sessions with 1 participant and 3x 2-hour sessions with the other 2. A common discussion was transitioning from the typical "boolean" validations from Phase 1 ("is this enabled true / false") towards validations that measured the outcomes from the boolean choice ("how many times per day has this triggered to do something").

Now we're taking a break so all three participants can finalize their packages and we can prep for Cohort 2. Overall these collaborative workshops carved out 16 hours of time out of 5 days for me and FR's senior staff, which was a bit rough - Cohort 2 is going to be bonkers. It was well worth it though as we learned quite a lot and so do the participants, everyone's package will be better off.

### OPEN Issue [#32: Agency AI Adoption Pilot for 20x](https://github.com/FedRAMP/roadmap/issues/32)

Latest comment (2025-12-19):

This was a major topic of discussion in our FedRAMP Board meeting in December; expect January to be a very busy month as we push out materials to support this.

### OPEN Issue [#16: Rev5 SCN Significant Change Notification Balance Improvement Release](https://github.com/FedRAMP/roadmap/issues/16)

Latest comment (2025-12-19):

During our December 18 meeting the FedRAMP Board informally concurred that the SCN process should go into wide release in February; we plan a formal vote in January.


## Sprint 14 (2025-11-24 to 2025-12-05)

### OPEN Issue [#96: RFC: Rev5 OSCAL adoption](https://github.com/FedRAMP/roadmap/issues/96)

Latest comment (2025-12-05):

This roadmap item is new in Sprint 14.

### OPEN Issue [#95: RFC: New Marketplace and Authorization Designations](https://github.com/FedRAMP/roadmap/issues/95)

Latest comment (2025-12-05):

This work in progress RFC is new to the roadmap today.

### OPEN Issue [#79: Agency Requirements and Guidance](https://github.com/FedRAMP/roadmap/issues/79)

Latest comment (2025-12-05):

This will be a topic of conversation at the December 18 FedRAMP Board meeting.

### OPEN Issue [#48: Major redesign of marketplace](https://github.com/FedRAMP/roadmap/issues/48)

Latest comment (2025-12-05):

A final (well, final until release - we'll keep improving it) interface was approved this week and there are only a few minor tweaks necessary to finish this out. We may not be able to launch before Christmas due to the holidays impacting so much but the marketplace is looking a lot nicer!

Here's a little taste of some random demo pages.

<img width="720" height="1016" alt="Image" src="https://github.com/user-attachments/assets/688e1ad4-c73b-4528-849f-c14f45fef23f" />

<img width="721" height="641" alt="Image" src="https://github.com/user-attachments/assets/e9618d98-2ceb-4f20-8086-3ded839ec2a1" />

<img width="373" height="730" alt="Image" src="https://github.com/user-attachments/assets/34df1db0-cb1a-4c27-9aed-1cf885bdd0ae" />

### OPEN Issue [#34: 20x Phase 2 Pilot - Cohort 1](https://github.com/FedRAMP/roadmap/issues/34)

Latest comment (2025-12-05):

As of Friday Dec 5 we have **5** cloud service providers who met the eligibility requirements and applied for Cohort 1 - we expect to publicly announce the resulting decisions for Cohort 1 early next week. So far the pilot proposals have all been quite exciting and we're looking forward to sharing those on youtube so everyone can learn about these cloud service offerings and their approaches.

### OPEN Issue [#32: Agency AI Adoption Pilot for 20x](https://github.com/FedRAMP/roadmap/issues/32)

Latest comment (2025-12-05):

Next week OMB is gathering a broad mix of executives across government (including almost every Chief x Council) at the White House to discuss plans and expectations for government-wide adoption of FedRAMP authorized AI services. It's going to be quite the party, but it's not open to the public.

## Sprint 13 (2025-11-10 to 2025-11-21)

> These updates were delayed as things started back up from the longest
> government shutdown in history - the comments were made on 11/26 but
> reflect the status as of the end of Sprint 13.

### OPEN Issue [#94: R5.CCM Collaborative Continuous Monitoring BIR](https://github.com/FedRAMP/roadmap/issues/94)

Latest comment (2025-11-26):

FedRAMP currently plans to release the Collaborative Continuous Monitoring
standard to Rev5 as an optional balance release. This standard will skip Closed
Beta and go straight to Open Beta, currently planned for February 2, 2026.

For more on this standard, the set of requirements, and the sign up forms,
please see our Rev5 Balance docs:
https://www.fedramp.gov/docs/rev5/collaborative-continuous-monitoring/

### CLOSED Issue [#83: FedRAMP 20x Strategic Vision & Implementation Plan](https://github.com/FedRAMP/roadmap/issues/83)

Latest comment (2025-11-26):

Updates to the web page were delayed by the shutdown but published on Nov 18:

https://www.fedramp.gov/20x/

This includes a timeline, overview of Rev5 vs 20x, updated phased approach
cards, review of Phase 1, extensive information on Phase 2, and a new FedRAMP
20x documentation site.

### OPEN Issue [#79: Agency Requirements and Guidance](https://github.com/FedRAMP/roadmap/issues/79)

Latest comment (2025-11-26):

Updating these materials will be an early December priority, balanced against
20x Cohort 1 applications and collaborative workshops.

### OPEN Issue [#78: 20x Phase 3](https://github.com/FedRAMP/roadmap/issues/78)

Latest comment (2025-11-26):

Phase 3 is now expected to begin in FY26 Q3 due to the impact of the longest
government shutdown in history. FedRAMP will prioritize completion of the Phase
2 pilot prior to releasing formal authorization paths for 20x to the public in
likely the second quarter of Phase 3.

Information about the planned phases is available at:
https://www.fedramp.gov/20x/

### OPEN Issue [#50: External data driven marketplace](https://github.com/FedRAMP/roadmap/issues/50)

Latest comment (2025-11-26):

Work on the external data driven marketplace will be delayed until the first
Cohort of 20x Phase 2 pilot participants have completed their work.

### OPEN Issue [#48: Major redesign of marketplace](https://github.com/FedRAMP/roadmap/issues/48)

Latest comment (2025-11-26):

This project did not advance during the shutdown but work is now resuming. The
holiday season will complicate delivery but we are hopeful the updated
marketplace can be released in January.

### CLOSED Issue [#43: Recommended Secure Configuration Standard](https://github.com/FedRAMP/roadmap/issues/43)

Latest comment (2025-11-26):

This RFC did not see a considerable amount of public comment compared to other
submissions but minor changes were made as follows:

- FRR-RSC-02: Changed the mandatory guidance from covering "all settings" for
  top-level administrative accounts to covering only "security-related
  settings."
- FRR-RSC-03: Changed the recommended guidance from covering "all settings" for
  other privileged accounts to covering only "security-related settings."

The final policy is available for 20x here:
https://www.fedramp.gov/docs/recommended-secure-configuration/

For Rev5, this policy is a mandatory balance release that will be effective on
March 1, 2026. Currently authorized Rev5 providers should ensure they meet the
requirements in this standard by that time. The Rev5 version is here:
https://www.fedramp.gov/docs/rev5/recommended-secure-configuration/

### OPEN Issue [#42: Agency Reuse Playbook for 20x](https://github.com/FedRAMP/roadmap/issues/42)

Latest comment (2025-11-26):

This has been delayed until FY26 Q3 as all planned timelines shifted due to the
government shutdown at the beginning of FY26.

### CLOSED Issue [#41: Establish DISA ILx One Way Reciprocity](https://github.com/FedRAMP/roadmap/issues/41)

Latest comment (2025-11-26):

At this point we are considering this plan effectively met by virtue of the
improvements made to the Rev5 review process at FedRAMP. If a cloud service
provider receives an IL3/4 ATO from DISA following the FedRAMP process then that
provider typically receives a formal FedRAMP authorization within 30 days.

### CLOSED Issue [#39: Consolidated R5 Continuous Monitoring Standard](https://github.com/FedRAMP/roadmap/issues/39)

Latest comment (2025-11-26):

The
[FedRAMP ConMon Playbook](https://www.fedramp.gov/resources/documents/Continuous_Monitoring_Playbook.pdf)
is a new publication that consolidates nine standalone documents related to
ConMon activities. By consolidating these documents and retiring the standalone
documents, we were able to eliminate roughly 100 pages of redundant and outdated
content.

The
[Agency Authorization Playbook](https://www.fedramp.gov/resources/documents/Agency_Authorization_Playbook.pdf)
was updated to remove and correct outdated information.

The
[CSP Authorization Playbook](https://www.fedramp.gov/resources/documents/CSP_Authorization_Playbook.pdf)
went through a major revision at the end of September 2025 and has undergone a
second update to account for the updates above.

### CLOSED Issue [#37: Collaborative Continuous Monitoring Standard](https://github.com/FedRAMP/roadmap/issues/37)

Latest comment (2025-11-26):

This RFC received a fair amount of public comment that resulted in some
reworking to underlying requirements and recommendations. Some restrictions were
removed and clarifications were added to expectations of sharing/etc. of agency
questions - the overall shift was to require CSPs to anonymize and make safe any
feedback/questions from specific agencies then share that with all necessary
parties. This generally should be in the CSPs best interest and reduce their
overall burden while ensuring folks are looped in on things that specific
agencies are concerned about.

The 20x final version is available here:
https://www.fedramp.gov/docs/collaborative-continuous-monitoring

This policy is currently planned for a Rev5 Open Beta beginning February 2,
2026: https://www.fedramp.gov/docs/rev5/collaborative-continuous-monitoring/

### OPEN Issue [#36: Finalize FedRAMP 20x Moderate Authorization Standard](https://github.com/FedRAMP/roadmap/issues/36)

Latest comment (2025-11-26):

This has been delayed until FY26 Q3 as all planned timelines shifted due to the
government shutdown at the beginning of FY26.

### CLOSED Issue [#35: FIPS cryptographic module application for commercial services](https://github.com/FedRAMP/roadmap/issues/35)

Latest comment (2025-11-26):

We have released an extremely simplified version of the FedRAMP Policy for
Cryptographic Module Selection and Use for application to FedRAMP 20x as
follows:

https://www.fedramp.gov/docs/using-cryptographic-modules/

It can be summarized as "document what cryptography you use in what parts of
your service so that agencies can make an informed decision about whether or not
to place sensitive information into your service" for impact levels less than
High. At High Impact, providers are expected to use cryptographic modules from
the NIST Cryptographic Module Validation Program for any cryptography protecting
federal customer data.

Recently at FedRAMP we've had a bit of discussion about the fact that agencies
typically do not use FIPS-140 based cryptographic modules for accessing and
transmitting data between agencies and SaaS cloud services that are typically
accessed via a browser over the internet; therefore these AOs have already
accepted the risk of not relying on FIPS-140 based cryptographic modules for
sending information over the public internet and it does not make sense for them
to expect the data to be encrypted by such when stored at a provider facility.
We may revisit this as a wider guidance change via an RFC in the future.

### OPEN Issue [#34: 20x Phase 2 Pilot - Cohort 1](https://github.com/FedRAMP/roadmap/issues/34)

Latest comment (2025-11-26):

The plans for the Phase 2 pilot were adjusted considerably due to the impact of
the longest government shutdown ever. New timelines are available at
https://www.fedramp.gov/20x/phase-two/

This issue will track the progress of Cohort 1 during the 20x Phase 2 pilot. As
of Wed Nov 26, **4** cloud service providers have met the eligibility
requirements and requested an application for Cohort 1.

### CLOSED Issue [#33: Persistent Validation and Assessment Standard](https://github.com/FedRAMP/roadmap/issues/33)

Latest comment (2025-11-26):

This RFC received a fair amount of feedback that resulted in rewording and
restructuring in a number of places. In other places FedRAMP acknowledges that
the requirements and recommendations may be confusing or unclear for a
traditional 3PAO audit perspective, however this set of requirements are
explicitly intended for the Phase 2 pilot and 20x assessments are very much not
a compliance audit.

The largest change is that Persistent FedRAMP Assessment were removed entirely
in the published version; these will be revisited during Phase 3 based on
learnings from the Phase 2 pilot, but currently FedRAMP is leaning towards
requiring these much more frequently than annually and expects assessors to
treat these as ongoing assessments rather than yearly audits.

Gemini in Google Docs has provided this additional AI summary of the changes:

- Definitions: Added two new definitions: Machine-based (information resources)
  and Information Resource.
- Definitions: Clarified All Necessary Assessors (FRD-PVA-01) to explicitly name
  Third-Party Assessment Organizations (3PAO) and exclude agency assessment
  teams by default.
- Definitions: Updated Persistent FedRAMP Assessment (FRD-PVA-04) to explicitly
  limit the scope to only assessing significant changes.
- Requirements: Restructured the entire Requirements section under a new heading
  (FRR-PVR).
- Requirement FRR-PVA-01: Replaced the original requirement with a detailed
  mandate for providers to maintain high-level summaries and a new six-point
  list of required content for each Key Security Indicator.
- Requirement FRR-PVA-02: Reworded to explicitly mandate automated and
  non-automated validation processes.
- Requirement FRR-PVA-03: Clarified that failures in persistent validation, or
  the validation process itself, must be treated as vulnerabilities.

Please note that during the 20x Phase 2 pilot, FedRAMP has temporarily waived
many of the traditional restrictions on assessors:
https://www.fedramp.gov/20x/phase-two/assessment/

The 20x version of this standard is available here:
https://www.fedramp.gov/docs/persistent-validation-and-assessment/

This standard will **not** be applied to Rev5.

### OPEN Issue [#32: Agency AI Adoption Pilot for 20x](https://github.com/FedRAMP/roadmap/issues/32)

Latest comment (2025-11-26):

There are currently 3 cloud service offerings that have met the requirements for
AI Prioritization - we do not expect more at this time. All 3 offerings are
currently working towards a FedRAMP 20x Low authorization with minimal Phase
1-style requirements by January for wide scale agency adoption.

AI Prioritization will continue after their initial authorization and all are
anticipated to update to full Phase 2 requirements shortly after initial pilot
authorization. These AI Prioritized cloud services will likely be widely
deployed across government within months of receiving authorization and will
give us valuable data about agency adoption during Phase 3.

### OPEN Issue [#31: 20x Phase 2](https://github.com/FedRAMP/roadmap/issues/31)

Latest comment (2025-11-26):

20x Phase 2 is now expected to late until at least the end of March, 2026. The
overall phased goal timing for 20x and the specifics for 20x Phase 2 are
available on the updated FedRAMP 20x web site:
https://www.fedramp.gov/20x/phase-two/

We have also finalized the requirements for participation and will be working
with an initial cohort of participants through December and January.

### CLOSED Issue [#30: Finalize Key Security Indicators (KSIs) for FedRAMP Moderate](https://github.com/FedRAMP/roadmap/issues/30)

Latest comment (2025-11-26):

Updated Key Security Indicators, including those for Moderate, were published at
the end of the government shutdown. These can be reviewed here:
https://www.fedramp.gov/docs/key-security-indicators/

There were **considerable** changes to the RFC based on public comment,
including additional changes made to other KSIs that were not included in the
RFC. I had over 11 pages of notes from public comment and we reviewed every
single one in depth over the course of the shutdown. Edits were made continually
and often revisited so it's a bit difficult to directly highlight all of the
changes due to the amount of minor tweaks.

At a high level, we added a new theme called KSI-AFR that tracks the
Authorization by FedRAMP requirements, and removed related KSIs that are
duplicative with those underlying FedRAMP requirements. Elsewhere we tried to
reword KSIs to move them towards value-add metrics-based indicators that enable
companies to set clear goals - for example, saying that the effectiveness of
training programs should be monitored rather than simply requiring training.

We also tried to emphasize when machine and non-machine resources (or both) are
relevant as it was surprising how many folks thought these indicators would
apply only to machine-based resources.

To give you a headstart, I asked Gemini in Google Docs to draft a summary of the
changes, it misses a lot of the nuance but isn't the worst:

- Replaced seven existing Key Security Indicators (KSIs), including KSI-CMT-05,
  KSI-MLA-04, and KSI-SVC-03, by new controls under the KSI-AFR theme.
- Introduced the new KSI-AFR (Authorization by FedRAMP) theme, adding 11 new
  security indicators focused on FedRAMP authorization standards.
- Added five new security indicators (e.g., KSI-CED-03, KSI-IAM-07) for both Low
  and Moderate baselines.
- Created five new security indicators (e.g., KSI-CNA-08, KSI-SVC-10)
  specifically for the Moderate baseline.
- Updated KSI-CMT-01 to specifically log and monitor modifications to the cloud
  service offering.
- Strengthened KSI-CMT-04 from "Consistently follow" to "Always follow a
  documented change management procedure."
- Broadened KSI-CNA-05 to protect against denial of service and "unwanted
  activity," replacing a more specific term like "unwanted spam."
- Refined KSI-SVC-01 to explicitly require implementing improvements after
  continuous evaluation, not just performing the evaluation.
- Confirmed KSI-CED-01 will be updated to include contingency planning training
  requirements.

KSIs and all other docs are available in a machine readable format in the FRMR
docs repository (which had some considerable reworks during this time):
https://github.com/FedRAMP/docs/blob/main/data/FRMR.KSI.key-security-indicators.json

Human-readable versions are here:
https://www.fedramp.gov/docs/key-security-indicators/

### OPEN Issue [#29: Finalize FedRAMP 20x Low Authorization Standard](https://github.com/FedRAMP/roadmap/issues/29)

Latest comment (2025-11-26):

This has been delayed until FY26 Q3 as all planned timelines shifted due to the
government shutdown at the beginning of FY26.

### OPEN Issue [#28: R5.ADS Authorization Data Sharing Standard BIR](https://github.com/FedRAMP/roadmap/issues/28)

Latest comment (2025-11-26):

FedRAMP now plans to skip closed beta for the Authorization Data Sharing
standard and move straight to a Rev5 Open Beta beginning February 2, 2026. We
will coordinate with the FedRAMP Board and agencies to prepare for this Open
Beta. More information, limitations, and instructions for signup are available
here: https://www.fedramp.gov/docs/rev5/authorization-data-sharing/

### OPEN Issue [#23: R5.VDR Vulnerability Detection and Response Standard BIR](https://github.com/FedRAMP/roadmap/issues/23)

Latest comment (2025-11-26):

FedRAMP now plans to skip closed beta for the Vulnerability Detection and
Response standard and move straight to a Rev5 Open Beta beginning February
2, 2026. We will coordinate with the FedRAMP Board and agencies to prepare for
this Open Beta. More information, limitations, and instructions for signup are
available here:
https://www.fedramp.gov/docs/rev5/vulnerability-detection-and-response/

### OPEN Issue [#19: R5.MAS Minimum Assessment Scope BIR](https://github.com/FedRAMP/roadmap/issues/19)

Latest comment (2025-11-26):

FedRAMP now plans to make the Minimum Assessment Scope available as an optional
balance improvement release for Rev5 under Wide Release on January 12, 2026.
Instructions for how cloud services may adopt this standard are in the Rev5
Balance version of this standard:
https://www.fedramp.gov/docs/rev5/minimum-assessment-scope/

### OPEN Issue [#16: Rev5 SCN Significant Change Notification Balance Improvement Release](https://github.com/FedRAMP/roadmap/issues/16)

Latest comment (2025-11-26):

The Rev5 SCN Closed Beta will continue with current participants through
February of 2026.

At this time, FedRAMP plans to skip Open Beta for the Rev5 SCN process and move
directly to Wide Release beginning February 27, 2026. We will coordinate with
the FedRAMP Board and agencies to prepare everyone for this shift.

More information about the Rev5 SCN Balance Improvement Release can be found
here: https://www.fedramp.gov/docs/rev5/#optional-balance-for-rev5

### CLOSED Issue [#3: 20x Phase 1](https://github.com/FedRAMP/roadmap/issues/3)

Latest comment (2025-11-26):

All critical activities for 20x Phase 1 have completed and FedRAMP has
transitioned to 20x Phase 2. Please note there are still outstanding reviews of
20x Phase 1 pilot participants and that activity will continue as part of
Phase 2.

A summary of Phase 1 is available here: https://www.fedramp.gov/20x/phase-one/

Though this final slide from
[our public event launching Phase 2](https://www.youtube.com/watch?v=KBQb_6pVuS4)
also sums it up:

![Image](https://github.com/user-attachments/assets/c286e417-364c-4f94-9d65-d1f9f5f57470)

## Sprint 12 (2025-10-27 to 2025-11-07)

> The federal government remained shut down during all of Sprint 12; all
> public-facing activities have been halted, requests for comment remain open,
> and the phased implementation of 20x is delayed.
>
> Expected timelines for open roadmap items will be adjusted once the shutdown
> ends.
>
> For more information see https://fedramp.gov/shutdown

## Sprint 11 (2025-10-13 to 2025-10-24)

> The federal government remained shut down during all of Sprint 11; all
> public-facing activities have been halted, requests for comment remain open,
> and the phased implementation of 20x is delayed.
>
> Expected timelines for open roadmap items will be adjusted once the shutdown
> ends.
>
> For more information see https://fedramp.gov/shutdown

## Sprint 10 (2025-09-29 to 2025-10-10)

> Note: A significant amount of activity has been curtailed by the government
> shutdown effective 2025-10-01; more than half of FedRAMP's federal employees
> have been furloughed and non-essential non-excepted activities are limited.
>
> **This has delayed 20x Phase Two.**

### CLOSED Issue [#89: Community Outreach - FY25 Q4](https://github.com/FedRAMP/roadmap/issues/89)

Latest comment (2025-10-09):

During FY25 Q4, FedRAMP managed 13+ major engagements with the community.

### CLOSED Issue [#88: FY25 Summary Blog Post](https://github.com/FedRAMP/roadmap/issues/88)

Latest comment (2025-10-09):

FedRAMP's FY25 end of year report is available on the FedRAMP Blog here:
https://www.fedramp.gov/2025-09-30-fedramp-built-a-modern-foundation-in-fy25-to-deliver-massive-improvements-in-fy26/

Here is just one example of the type of data shared in this report:

<img width="1082" height="620" alt="Image" src="https://github.com/user-attachments/assets/d2490e28-92ea-4a63-a624-d8da780968fb" />

### CLOSED Issue [#81: 20x Six Month Update & Phase Two and Phase Three Announcement Event (Sep 24, Pete)](https://github.com/FedRAMP/roadmap/issues/81)

Latest comment (2025-10-09):

This entire launch event is also now available on youtube here:
https://www.youtube.com/watch?v=KBQb_6pVuS4

### OPEN Issue [#79: Agency Requirements and Guidance](https://github.com/FedRAMP/roadmap/issues/79)

Latest comment (2025-10-09):

This guidance is now delayed indefinitely due the government shutdown. Timeline
will be reassessed when the shutdown ends. This activity has been placed into
the Hold / Pending status.

### OPEN Issue [#48: Major redesign of marketplace](https://github.com/FedRAMP/roadmap/issues/48)

Latest comment (2025-10-09):

All of the federal staff working on this improvement have been furloughed during
the current government shutdown; delivery of these improvements will be delayed.

### CLOSED Issue [#44: Community Outreach - FY25 Q2/Q3 ](https://github.com/FedRAMP/roadmap/issues/44)

Latest comment (2025-10-09):

During FY25 Q2/Q3, FedRAMP managed 10+ engagements with the community, with most
of these taking place in FY25 Q3.

### OPEN Issue [#43: Recommended Secure Configuration Standard](https://github.com/FedRAMP/roadmap/issues/43)

Latest comment (2025-10-09):

[RFC-0015](https://www.fedramp.gov/rfcs/0015/) is still open; finalization is
extremely unlikely to happen as scheduled due to the current government
shutdown. The public is advised to submit comment as quickly as possible because
after the official closing date this RFC may close at any time unexpectedly.

### OPEN Issue [#31: (2/?) 20x Phase Two](https://github.com/FedRAMP/roadmap/issues/31)

Latest comment (2025-10-09):

All previously anticipated Phase Two timelines are likely to shift as a result
of the active government shutdown. Please stand by for updates. For more on how
this shutdown is affecting FedRAMP, please review https://fedramp.gov/shutdown

### OPEN Issue [#30: Finalize Key Security Indicators (KSIs) for FedRAMP Moderate](https://github.com/FedRAMP/roadmap/issues/30)

Latest comment (2025-10-09):

[RFC-0014](https://www.fedramp.gov/rfcs/0014/) is still open; finalization is
extremely unlikely to happen as scheduled due to the current government
shutdown. The public is advised to submit comment as quickly as possible because
after the official closing date this RFC may close at any time unexpectedly.

### OPEN Issue [#3: (1/?) 20x Phase One](https://github.com/FedRAMP/roadmap/issues/3)

Latest comment (2025-10-09):

Phase One will be formally closed out when #30 has been finalized. There are
still many active Phase One participants whose review may continue during Phase
Two. All reviews are temporarily halted due to the ongoing government shutdown:
https://fedramp.gov/shutdown

## Sprint 09 (2025-09-15 to 2025-09-26)

### CLOSED Issue [#83: FedRAMP 20x Strategic Vision & Implementation Plan](https://github.com/FedRAMP/roadmap/issues/83)

Latest comment (2025-09-28):

This implementation plan was shared widely on 9/24 but still needs to be ported
to our web page. We hope to have a youtube link with that presentation soon and
will be updating the webpage next month to align with this plan, however you can
review the powerpoint with dates and goals below if you missed it.

[20x Phase Two, Three, and Beyond (2025-09-24).pdf](https://github.com/user-attachments/files/22583999/20x.Phase.Two.Three.and.Beyond.2025-09-24.pdf)

### CLOSED Issue [#82: [Gov] FedRAMP Day II (Team, Sep 22)](https://github.com/FedRAMP/roadmap/issues/82)

Latest comment (2025-09-28):

I wasn't able to attend FedRAMP Day myself but I listened in to the morning
session and the feedback overall was positive. Agencies are starting to see the
longer term plays and understand the importance of GRC automation tooling, but
also seeing the reality that until we have things like the Authorization Data
Sharing standard implemented there isn't much to do here.

### CLOSED Issue [#81: 20x Six Month Update & Phase Two and Phase Three Announcement Event (Sep 24, Pete)](https://github.com/FedRAMP/roadmap/issues/81)

Latest comment (2025-09-28):

This event was covered by various folks on LinkedIn as well as the traditional
media:

- https://meritalk.com/articles/federal-cio-greg-barbaccia-backs-fedramp-20x-shares-ombs-priorities/
- https://www.meritalk.com/articles/gsa-unveils-fedramp-20x-phase-2-pilot-previews-phases-to-come/
- https://www.nextgov.com/acquisition/2025/09/gsa-launches-second-phase-fedramp-20x-backed-omb/408356/
- https://www.executivegov.com/articles/fedramp-20x-phase-2-pilot

We expect a youtube video to be available soon for folks who missed it as well.

### CLOSED Issue [#80: GRC Engineering Podcast (Pete, Sep 16)](https://github.com/FedRAMP/roadmap/issues/80)

Latest comment (2025-09-28):

This interview was recorded as planned but appears to be still pending release.

### OPEN Issue [#79: Agency Requirements and Guidance](https://github.com/FedRAMP/roadmap/issues/79)

Latest comment (2025-09-28):

Finalization and publication of this guidance has been delayed one sprint as a
result of an unexpected event; it should be formalized soon. I've moved the
likely end date to October 10 to allow some padding.

### OPEN Issue [#50: External data driven marketplace](https://github.com/FedRAMP/roadmap/issues/50)

Latest comment (2025-09-28):

The
[Authorization Data Sharing](https://github.com/FedRAMP/docs/blob/main/markdown/FRMR.ADS.authorization-data-sharing.md)
standard is optional for Phase One and to date no one has begun to implement it.
This standard will be a mandatory requirement for Phase Two and beyond, however,
so we're moving the likely delivery dates on this prototype to some point in the
future where there should at least be a few cloud service providers making this
data available to us in a way that we can prototype properly.

### OPEN Issue [#48: Major redesign of marketplace](https://github.com/FedRAMP/roadmap/issues/48)

Latest comment (2025-09-28):

I got to see a really cool working prototype of this last week, but we're still
not there yet. Based on the work done to date and current estimates from the
team, we might be ready to release this before the end of October but we want to
make sure it's ready and clean first.

### OPEN Issue [#43: Recommended Secure Configuration Standard](https://github.com/FedRAMP/roadmap/issues/43)

Latest comment (2025-09-28):

[RFC-0015](https://github.com/FedRAMP/community/discussions/84) is still open
for two more weeks; this one appears to be relatively straightforward as there
is only one public comment at the moment.

### OPEN Issue [#39: Consolidated R5 Continuous Monitoring Standard](https://github.com/FedRAMP/roadmap/issues/39)

Latest comment (2025-09-28):

We're shifting this later to ensure we can include the results of
[RFC-0016 Collaborative Continuous Monitoring Standard](https://www.fedramp.gov/rfcs/0016/)
into any such guide; expect this to be delivered later in the calendar year.

### OPEN Issue [#37: Collaborative Continuous Monitoring Standard](https://github.com/FedRAMP/roadmap/issues/37)

Latest comment (2025-09-28):

This was published as [RFC-0016](https://www.fedramp.gov/rfcs/0016/) on
September 15! This will be balanced to Rev5 so reviewing and commenting is
critical for Rev5-based providers.

### OPEN Issue [#35: FIPS cryptographic module application for commercial services](https://github.com/FedRAMP/roadmap/issues/35)

Latest comment (2025-09-28):

I'm moving this forward one sprint because it is one of the lowest priority
tasks at the moment; the current
[FedRAMP Policy for Cryptographic Module Selection and Use](https://www.fedramp.gov/resources/documents/FedRAMP_Policy_for_Cryptographic_Module_Selection_v1.1.0.pdf)
is still applicable.

### OPEN Issue [#34: 20xP2 Moderate Pilot Submission and Review Window](https://github.com/FedRAMP/roadmap/issues/34)

Latest comment (2025-09-28):

The [Phase Two](https://fedramp.gov/20x/phase-two) submission window has been
publicly announced as likely to occur the week of October 16 to 23. FedRAMP has
also clarified that Phase Two will not be open to the public and that cloud
service providers must meet specific criteria to participate. This page also has
additional information about the expectations for Phase Two, including that it
will be much more difficult than Phase One and most providers will need more
time and better tools to meet these requirements. We must build 20x together.

### OPEN Issue [#33: Persistent Validation and Assessment Standard](https://github.com/FedRAMP/roadmap/issues/33)

Latest comment (2025-09-28):

This was published as [RFC-0017](https://www.fedramp.gov/rfcs/0017/) on
September 15! This standard adds significant details to FedRAMP's expectations
in Phase Two and beyond; it is a must-review for anyone who is considering
FedRAMP 20x at the moment.

### OPEN Issue [#31: (2/?) 20x Phase Two](https://github.com/FedRAMP/roadmap/issues/31)

Latest comment (2025-09-28):

The details of Phase Two were publicly announced this week, with additional
information to follow over the coming weeks. As always, the source of truth is
the web page, this roadmap, and the Community Working Group discussion forums:
https://www.fedramp.gov/20x/phase-two

It never fails to amaze me how often people email me asking questions about
things that are on our website.

### OPEN Issue [#30: Finalize Key Security Indicators (KSIs) for FedRAMP Moderate](https://github.com/FedRAMP/roadmap/issues/30)

Latest comment (2025-09-28):

Public comment is still open on [RFC-0014](https://www.fedramp.gov/rfcs/0014/)
for another two weeks! So far this RFC has not been particularly active but
there have been some
[really interesting comments overall](https://github.com/FedRAMP/community/discussions/83).

## Sprint 08 (2025-09-01 to 2025-09-12)

### OPEN Issue [#83: FedRAMP 20x Strategic Vision & Implementation Plan](https://github.com/FedRAMP/roadmap/issues/83)

Latest comment (2025-09-14):

The strategic vision and implementation plan will be shared publicly on
September 24 with the announcement of Phase Two and Phase Three of FedRAMP 20x.
For more information and to register for this in-person (and remote) public
event replacing the 20x Community Working Group meeting for September, please
visit https://www.fedramp.gov/20x/phase-two

### OPEN Issue [#81: 20x Six Month Update & Phase Two and Phase Three Announcement Event (Sep 24, Pete)](https://github.com/FedRAMP/roadmap/issues/81)

Latest comment (2025-09-14):

This event will take place on September 24 from 3:30 to 5pm (replacing our
scheduled 20x CWG) at ADI's conference space in downtown Washington DC. Formal
announcement of this event and registration information will be available soon -
keep an eye on https://www.fedramp.gov/20x/phase-two because this event will
likely happen before this Roadmap Issue is updated. ;)

### OPEN Issue [#80: GRC Engineering Podcast (Pete, Sep 16)](https://github.com/FedRAMP/roadmap/issues/80)

Latest comment (2025-09-14):

This interview is scheduled for September 16 and is expected to be published by
the GRC Engineering podcast on September 23.

### OPEN Issue [#79: Agency Requirements and Guidance](https://github.com/FedRAMP/roadmap/issues/79)

Latest comment (2025-09-14):

The draft Agency Implementation Guidance (now tentatively renamed Agency
Requirements and Guidance but likely to shift again because names are
complicated and a lot of people have opinions) will be reviewed and finalized
with the FedRAMP Board on September 18 and published shortly afterwards.

This guidance focuses on clarifying existing agency requirements and is not
considered new guidance that requires public comment, therefore it will be
released much quicker than previously anticipated.

### CLOSED Issue [#75: Billington CyberSecurity Summit (Sep 9, Nicole)](https://github.com/FedRAMP/roadmap/issues/75)

Latest comment (2025-09-14):

Nicole totally crushed it on the main stage in a panel that also included
FedRAMP Board member Dave McKeown.

![Image](https://github.com/user-attachments/assets/32171201-e830-43d5-927c-a89892f82a65)

### OPEN Issue [#43: Recommended Secure Configuration Standard](https://github.com/FedRAMP/roadmap/issues/43)

Latest comment (2025-09-14):

The recommended Secure Configuration Standard was published as RFC-0015 on
September 10 and is now open for public comment.

- [RFC-0015 on fedramp.gov](https://www.fedramp.gov/rfcs/0015)
- [RFC-0015 on GitHub](https://github.com/FedRAMP/community/discussions/84)
- [Q&A and casual discussion on RFC-0015](https://github.com/FedRAMP/community/discussions/85)

This activity is expected to be finalized during the third week of October.

### CLOSED Issue [#40: POA&M Standard](https://github.com/FedRAMP/roadmap/issues/40)

Latest comment (2025-09-14):

All recommendations about changes to POA&Ms have been directly integrated into
the new Vulnerability Detection and Response Standard - for 20x authorizations
and for those who adopt the new VDR during the Rev5 closed beta, POA&Ms are no
longer relevant.

### CLOSED Issue [#38: Vulnerability Detection and Response Standard (prev Continuous Vulnerability Management Standard)](https://github.com/FedRAMP/roadmap/issues/38)

Latest comment (2025-09-14):

This standard has been published as the Vulnerability Detection and Response
Standard with many changes -
[this thread in the FedRAMP Community](https://github.com/FedRAMP/community/discussions/82#discussioncomment-14355795)
summarizes the changes at a high level.

The resulting standard, including the accompanying (and critically important)
FedRAMP Definitions, can be reviewed as follows:

- In the [FedRAMP Docs repository on GitHub](https://github.com/FedRAMP/docs)
  for those who want to see both the latest and how the sausage is made
- On [fedramp.gov](https://www.fedramp.gov/20x/standards) for folks who prefer a
  direct web source

### OPEN Issue [#37: Collaborative Continuous Monitoring Standard](https://github.com/FedRAMP/roadmap/issues/37)

Latest comment (2025-09-14):

The Collaborative Continuous Monitoring Standard is pending final review and
publishing for public comment as RFC-0016 by September 16.

### OPEN Issue [#34: 20xP2 Moderate Pilot Submission and Review Window](https://github.com/FedRAMP/roadmap/issues/34)

Latest comment (2025-09-14):

In this
[Sprint to 20x Phase Two](https://github.com/FedRAMP/community/discussions/82)
thread in the FedRAMP Community we have continued to communicate expected
changes to previously discussed FedRAMP goals and targets.

Criteria for Phase Two is still in development and finalization but as indicated
elsewhere:

[FedRAMP Phase Two will be formally announced on September 24 at 3:30pm.](https://www.fedramp.gov/20x/phase-two)

Participants in Phase Two will be eligible to receive a 12 month FedRAMP 20x
Moderate authorization, however, participation will be limited; Phase Two will
not be entirely open to the public. We currently anticipate opening up formal
20x Low and Moderate authorizations, reviewed directly by FedRAMP (no agency
sponsor required), in February 2026.

### OPEN Issue [#33: Persistent Validation and Assessment Standard](https://github.com/FedRAMP/roadmap/issues/33)

Latest comment (2025-09-14):

Now called the Persistent Validation and Assessment Standard, this draft
includes requirements and recommendations for both providers and assessors for
handling Key Security Indicators. It is planned for release as RFC-0017 as early
as September 16.

### OPEN Issue [#30: Finalize Key Security Indicators (KSIs) for FedRAMP Moderate](https://github.com/FedRAMP/roadmap/issues/30)

Latest comment (2025-09-14):

Moderate and related Phase Two Key Security Indicators have been published for
public comment in RFC-0014:

- [RFC-0014 on fedramp.gov](https://www.fedramp.gov/rfcs/0014)
- [RFC-0014 on GitHub](https://github.com/FedRAMP/community/discussions/83)
- [Casual Q&A and discussion related to RFC-0014 on GitHub](https://github.com/FedRAMP/community/discussions/85)

Completion of this activity is now anticipated to complete by October 14 as we
transition into Phase Two.

## Sprint 07 (2025-08-28 to 2025-08-29)

### OPEN Issue [#79: Agency Implementation Guidance](https://github.com/FedRAMP/roadmap/issues/79)

Latest comment (2025-09-01):

A fair amount of internal work has been done preparing this to date, but
concerted effort to move this forward will begin in September.

### CLOSED Issue [#65: Scope of FedRAMP Guidance / Technical Assistance](https://github.com/FedRAMP/roadmap/issues/65)

Latest comment (2025-09-01):

This guidance was approved by OMB and published on August 28!
https://www.fedramp.gov/scope

(NOTE: This applies to all FedRAMP authorizations)

### CLOSED Issue [#64: Federal Information Technical Assistance](https://github.com/FedRAMP/roadmap/issues/64)

Latest comment (2025-09-01):

The
[Authorization Data Sharing standard](https://github.com/FedRAMP/docs/blob/main/markdown/FRMR.ADS.authorization-data-sharing.md)
includes additional information that was originally included in the draft
Federal Information Technical Assistance. This information is not in the full
depth of that Technical Assistance but reflects the preferred guidance from OGC
at this time. Based on this release, I'm moving this Roadmap item into
Delivered.

**Relevant Snippet from Purpose:**

This security and compliance information (including FedRAMP authorization data)
is the intellectual property of the cloud service provider and is not federal
information in most cases.\* The federal government benefits when the same
security information is shared among all customers and even the public to ensure
maximum transparency and accountability of cloud service providers.

_\* Providers with questions about this should consult with a lawyer who
specializes in procurement law. Typically a contract with the government
granting ownership of information is required to transfer ownership to the
government._

### CLOSED Issue [#63: GovCIO GovCast Podcast (Pete, Aug 12)](https://github.com/FedRAMP/roadmap/issues/63)

Latest comment (2025-09-01):

You can listen to this podcast here: https://www.youtube.com/watch?v=zos-4B18J2U

### OPEN Issue [#48: Major redesign of marketplace](https://github.com/FedRAMP/roadmap/issues/48)

Latest comment (2025-09-01):

Our AppDev team has been performing user research and mapping out necessary
improvements to the marketplace - it's really quite exciting and hopefully we
will have more to share with explicit goals and possible timelines son!

### OPEN Issue [#43: Recommended Secure Configuration Standard](https://github.com/FedRAMP/roadmap/issues/43)

Latest comment (2025-09-01):

A simplified Recommended Secure Configuration Standard should be available as an
RFC by September 16.

### OPEN Issue [#42: Agency Reuse Playbook for 20x](https://github.com/FedRAMP/roadmap/issues/42)

Latest comment (2025-09-01):

FedRAMP will be focusing primarily on agency AI adoption at the end of this year
as outlined in #32 Agency AI Adoption for 20x - part of that project will
include creating playbooks for adoption of specific FedRAMP 20x Authorized
systems. As part of Phase Three, preparing for wider adoption of all FedRAMP 20x
systems, those playbooks and related capabilities will be expanded for general
systems and made available to agencies.

### OPEN Issue [#38: Continuous Vulnerability Management Standard](https://github.com/FedRAMP/roadmap/issues/38)

Latest comment (2025-09-01):

Public comment on RFC-0012 was extensive; based on considerable feedback,
FedRAMP is aggressively working to update this standard prior to release. All
activities in progress are subject to change, but current significant changes in
progress include:

- Rename to Vulnerability Detection and Response Standard
- Updated potential adverse impact estimation criteria that makes more sense for
  a third-party commercial service provider
- Separation of numerous best practices into a separate best practice section
- Different timeframe requirements based on the FedRAMP authorization impact
  level of a cloud service offering
- Increased focus on holistic vulnerability management to clarify that this
  standard is NOT just about scanning
- Built-in replacement process for POA&Ms

Current target is to release by September 11 for FedRAMP 20x.

### OPEN Issue [#37: Collaborative Continuous Monitoring Standard](https://github.com/FedRAMP/roadmap/issues/37)

Latest comment (2025-09-01):

This has been moved to Phase Two to align with work on #33 (Continuous
Validation Standard) and #43 (Recommended Secure Configuration Standard).
Current target is to publish this standard as an RFC by September 23, though
September 16 would be ideal.

### OPEN Issue [#36: Finalize FedRAMP 20x Moderate Authorization Standard](https://github.com/FedRAMP/roadmap/issues/36)

Latest comment (2025-09-01):

Finalization of the 20x Moderate authorization standard for wide release has
been moved to Phase Three.

### OPEN Issue [#35: FIPS cryptographic module application for commercial services](https://github.com/FedRAMP/roadmap/issues/35)

Latest comment (2025-09-01):

Intent for this guidance has been mildly re-scoped to focus on clarification and
guidance based on current
[FedRAMP Policy for Cryptographic Module Selection and Use](https://www.fedramp.gov/resources/documents/FedRAMP_Policy_for_Cryptographic_Module_Selection_v1.1.0.pdf)
that is optimized for FedRAMP 20x. This will allow us to bypass public comment
and release this clarified technical assistance as part of 20x Phase Two.

### OPEN Issue [#34: 20xP2 Moderate Pilot Submission and Review Window](https://github.com/FedRAMP/roadmap/issues/34)

Latest comment (2025-09-01):

The 20xP2 Moderate submission window is now expected to open in mid-October and
close in early December. FedRAMP will be publishing additional information about
the expectations for Phase Two soon: https://fedramp.gov/20x/phase-two

### OPEN Issue [#33: Continuous Validation Standard](https://github.com/FedRAMP/roadmap/issues/33)

Latest comment (2025-09-01):

Current target is to publish this standard as an RFC by September 23, though
September 16 would be ideal. Aligns with #37 Collaborative Continuous Monitoring
Standard.

### OPEN Issue [#32: Agency AI Adoption Pilot for 20x](https://github.com/FedRAMP/roadmap/issues/32)

Latest comment (2025-09-01):

This roadmap item has been renamed to focus on Agency AI Adoption and will align
with the AI Prioritization Process outlined at https://www.fedramp.gov/ai - it
has been moved to Phase Two and shifted to match some expected timelines for AI
prioritization, but may begin as late as November depending on real world
implementations. More information on this shift in priorities will follow over
the coming weeks.

### OPEN Issue [#31: (2/?) 20x Phase Two](https://github.com/FedRAMP/roadmap/issues/31)

Latest comment (2025-09-01):

Phase Two planning and preparation has begun internally at FedRAMP.

### OPEN Issue [#30: Finalize Key Security Indicators (KSIs) for FedRAMP Moderate](https://github.com/FedRAMP/roadmap/issues/30)

Latest comment (2025-09-01):

FedRAMP's KSI team is planning a focused two-day sprint on September 8 and 9 to
finalize updates for Moderate KSIs and minor changes to Low KSIs (this will
primarily be the addition of a few KSIs as we plan to keep changes to existing
KSIs to a minimum).

The goal will be to publish by September 16.

### OPEN Issue [#29: Finalize FedRAMP 20x Low Authorization Standard](https://github.com/FedRAMP/roadmap/issues/29)

Latest comment (2025-09-01):

Based on the success of the 20x Phase One (Low) pilot, the FedRAMP team does not
have the resources to simultaneously open 20x Low authorizations to the public
while running the Phase Two (Moderate) pilot. To optimize for wide release of
20x Low AND Moderate authorizations at the same time, these will both be the
focus of 20x Phase Three beginning at the end of Phase Two.

### OPEN Issue [#28: R5.ADS Authorization Data Sharing Standard BIR](https://github.com/FedRAMP/roadmap/issues/28)

Latest comment (2025-09-01):

We are planning to launch this balance improvement release for Rev5 at the Sep 3
Community Working Group meeting for Rev5.

### OPEN Issue [#19: R5.MAS Minimum Assessment Standard BIR](https://github.com/FedRAMP/roadmap/issues/19)

Latest comment (2025-09-01):

This may be overcome by events in September due to the focus of the FedRAMP
Board on AI prioritization. I'm moving this into a Hold / Pending status and
deferring until later in the year with a shorter window.

### CLOSED Issue [#15: 20xP1 Low Pilot Submission Window](https://github.com/FedRAMP/roadmap/issues/15)

Latest comment (2025-09-01):

The 20x Phase One pilot window was closed for submissions on August 19. **26**
submissions passed initial completeness checks.

The FedRAMP team will be reviewing these submissions during September and plans
to announce details on next steps later in the month.

### CLOSED Issue [#14: Authorization Data Sharing Standard](https://github.com/FedRAMP/roadmap/issues/14)

Latest comment (2025-09-01):

The Authorization Data Sharing standard was published on August 24, 2025 and is
available as follows:

| Markdown                                                                                                                               | PDF                                                                                            | Description                                                | Version | Published Date |
| -------------------------------------------------------------------------------------------------------------------------------------- | ---------------------------------------------------------------------------------------------- | ---------------------------------------------------------- | ------- | -------------- |
| [Authorization Data Sharing Standard (ADS)](https://github.com/FedRAMP/docs/tree/main/markdown/FRMR.ADS.authorization-data-sharing.md) | [[PDF]](https://github.com/FedRAMP/docs/blob/main/pdf/FRMR.ADS.authorization-data-sharing.pdf) | Initial release of the Authorization Data Sharing Standard | 25.08A  | 2025-08-24     |

A
[machine-readable version](https://github.com/FedRAMP/docs/blob/main/FRMR.ADS.authorization-data-sharing.json)
is also available; it's important to note that
[FedRAMP Definitions](https://github.com/FedRAMP/docs/blob/main/markdown/FRMR.FRD.fedramp-definitions.md)
are now a separate document as well.

**Effective Date(s) & Overall Applicability:**

- **FedRAMP 20x**:

  - This release is effective **2025-09-01** for **20x**.
  - These requirements apply to all participants in the FedRAMP 20x Phase One
    pilot.
  - 20xP1 participants do not need to fully align with this policy to receive
    pilot authorization.
  - Participants in the 20xP1 pilot who receive pilot authorizations must
    demonstrate progress towards the adoption of this policy and be in full
    alignment by the expiration date of their pilot authorization.

- **FedRAMP Rev5**:
  - This release is effective **2025-09-01** for **R5.ADS.B1** _(tentatively)_.
  - This release is effective 2025-09-01 for R5.ADS.B1 for FedRAMP Rev5
    Authorized or In Process services.
  - These requirements will be initially tested and evaluated for Rev5 in the
    ADS Closed Beta (B1).
  - Providers MUST participate in a Balance Improvement Test to transition to
    the Authorization Data Sharing Standard process prior to wide release of
    this process for Rev5. Providers should participate in the FedRAMP Rev5
    Community Working Group at https://www.fedramp.gov/community/ to follow this
    process.
  - Providers MUST NOT adopt changes to meet these requirements unless they
    inform the FedRAMP PMO and participate in a Balance Improvement Test.

### OPEN Issue [#4: Ongoing Rev5 Balance Improvement](https://github.com/FedRAMP/roadmap/issues/4)

Latest comment (2025-09-01):

Instead of maintaining separate FY25 and FY26 issues as we begin to prepare for
FY26, we'll consolidate all ongoing Rev5 activities under this Epic.

### OPEN Issue [#3: (1/?) 20x Phase One](https://github.com/FedRAMP/roadmap/issues/3)

Latest comment (2025-08-16):

Based on the demand during the phase one pilot, I expect the review period will
continue through at least the end of September.

---

## Sprint 06 (2025-08-04 to 2025-08-15)

### CLOSED Issue [#74: Federal Secure Cloud Advisory Committee (FSCAC) on POA&Ms (Public, August 14)](https://github.com/FedRAMP/roadmap/issues/74)

Latest comment (2025-08-16):

This committee meeting was completed as planned - keep an eye out on the
[USGSA YouTube channel for the recording](https://www.youtube.com/playlist?list=PLvdwyPgXnxxV63RYNfhfIjDLlRLT1nxp_)
if you missed it.

### OPEN Issue [#64: Federal Information Technical Assistance](https://github.com/FedRAMP/roadmap/issues/64)

Latest comment (2025-08-16):

As of the end of Sprint 6 we are considering moving in a different direction to
provide this support. The Authorization Data Sharing Standard incorporates some
of the guidance related to federal information that clarifies the intellectual
property of cloud service providers is not federal information. We may also
update the definition of federal information in FRD-MAS-01 with minor changes to
language.

Overall GSA Counsel has concerns about creating separate assistance and
information that may be misinterpreted by stakeholders who decide not to consult
a lawyer as a result of technical assistance, and advise due to the nature of
procurement law we should encourage folks to manage this properly.

I will keep this on the Roadmap moved into Hold / Pending for the moment until
we've completed other activities that provide this support.

### CLOSED Issue [#63: GovCIO GovCast Podcast (Pete, Aug 12)](https://github.com/FedRAMP/roadmap/issues/63)

Latest comment (2025-08-16):

This podcast interview should be available in a couple weeks!

### OPEN Issue [#48: Major redesign of marketplace](https://github.com/FedRAMP/roadmap/issues/48)

Latest comment (2025-08-16):

Our newly expanded AppDev team is coming up to speed and starting to make plans
for this!

### CLOSED Issue [#47: Major redesign of fedramp.gov](https://github.com/FedRAMP/roadmap/issues/47)

Latest comment (2025-08-16):

The updated site was launched last week! There are a number of gaps, including
missing search and some issues with redirects as well as some general
opportunities for content improvement but we wanted to get this out so folks
could start getting used to it.

This past week we also were able to expand our AppDev team to include a few more
folks so we can move towards a more intentional approach from here. The team is
getting up to speed and working to establish new norms, but we hope to see
continuous progress on the website and movement towards updates to the
marketplace soon.

### OPEN Issue [#43: Recommended Secure Configuration Standard](https://github.com/FedRAMP/roadmap/issues/43)

Latest comment (2025-08-16):

Work on the RSCS was not advanced during Sprint 6. This is not being moved to
Hold / Pending because we still intend to publish this prior to ending the 20xP1
pilot.

### OPEN Issue [#40: POA&M Standard](https://github.com/FedRAMP/roadmap/issues/40)

Latest comment (2025-08-16):

The FSCAC meeting on August 14 generated considerable discussion and a
significant amount of sound advice and general recommendations. FedRAMP is
drafting updates to this policy that heavily factor the FSCAC discussion and
conform to the goals outlined in the 20x Announcement
_[Aligning FedRAMP POA&Ms with M-24-15: A POA&M for POA&Ms](https://github.com/FedRAMP/community/discussions/70)_.

Intent is to publish these updates as an RFC within the month.

### OPEN Issue [#38: Continuous Vulnerability Management Standard](https://github.com/FedRAMP/roadmap/issues/38)

Latest comment (2025-08-16):

There has been quite a lot of activity and public discussion about this RFC, but
overall public comment has been surprisingly weak. We are expecting next week to
be busy for comment.

### OPEN Issue [#32: Agency Adoption Pilot for 20x Low](https://github.com/FedRAMP/roadmap/issues/32)

Latest comment (2025-08-16):

The primary progress to set the stage for the Agency Adoption Pilot has been the
appointment of new FedRAMP Board members by OMB on August 8. There are
additional unannounced priorities that will influence this as well. Stand by for
public updates over the coming weeks about this pilot. The start date of August
21 reflects the upcoming Board meeting where this will be discussed and planning
will begin, but it may be some time after that before this pilot formally
begins.

### OPEN Issue [#31: 20x Phase Two](https://github.com/FedRAMP/roadmap/issues/31)

Latest comment (2025-08-16):

There are going to be some prioritization changes over the coming weeks, however
our goal now is to begin Phase Two starting in October.

### OPEN Issue [#30: Finalize Key Security Indicators (KSIs) for FedRAMP Moderate](https://github.com/FedRAMP/roadmap/issues/30)

Latest comment (2025-08-16):

We're putting activity on Moderate KSIs on hold briefly to focus on completing
the Phase One pilot and other unannounced emerging priorities for the team. At
this time we still intend to start the Phase Two pilot in October, however
similar to Phase One it may start with draft updates to Moderate KSIs in play.

### OPEN Issue [#29: Finalize FedRAMP 20x Low Authorization Standard](https://github.com/FedRAMP/roadmap/issues/29)

Latest comment (2025-08-16):

As this task is a rollup of #14 / #43 / #38 / #37 I'm moving this into Hold /
Pending status and will block updates on this until those issues are completed.

### OPEN Issue [#16: R5.SCN Significant Change Notification BIR](https://github.com/FedRAMP/roadmap/issues/16)

Latest comment (2025-08-16):

The Rev5 SCN Closed Beta is in full swing with Open Beta planning on kicking off
soon. Follow our Rev5 Community Working Group for updates and next steps.

### OPEN Issue [#15: 20xP1 Low Pilot Submission and Review Window](https://github.com/FedRAMP/roadmap/issues/15)

Latest comment (2025-08-16):

At the end of Sprint 6, here's where we stand:

- 15 pilot packages have been submitted
- 6 packages are FedRAMP Authorized
- 2 packages are FedRAMP In Process

The remaining packages are in various states of early review.

As listed on
[the FedRAMP 20x Phase One pilot web page](https://www.fedramp.gov/20x/phase-one/),
the submission window for 20xP1 submissions will be closed on 2025-08-19. Stand
by for updates in the August 27's 20x Community Working Group meeting.

### OPEN Issue [#14: Authorization Data Sharing Standard](https://github.com/FedRAMP/roadmap/issues/14)

Latest comment (2025-08-16):

The Authorization Data Standard is ready for final internal review. There is one
minor issue that is pending feedback from the GSA Office of the General Counsel.
Once cleared, FedRAMP plans to publish quickly.

### OPEN Issue [#3: 20x Phase One](https://github.com/FedRAMP/roadmap/issues/3)

Latest comment (2025-08-16):

Based on the demand during the phase one pilot, I expect the review period will
continue through at least the end of September.

---

## Sprint 05 (2025-07-21 to 2025-08-01)

### OPEN Issue [#74: Federal Secure Cloud Advisory Committee (FSCAC) on POA&Ms (Public, August 14)](https://github.com/FedRAMP/roadmap/issues/74)

Latest comment (2025-08-01):

This meeting has been scheduled and posted to the Federal Register, announcing
the first FACA meeting for calendar year 2025.

### CLOSED Issue [#73: GovForward FedRAMP Board Panel (Pete, August 24)](https://github.com/FedRAMP/roadmap/issues/73)

Latest comment (2025-08-01):

If you missed it, you can apparently see it On Demand at the following link:
https://events.govexec.com/ato-and-cloud-security-summit-2025/

### CLOSED Issue [#72: FedRAMP Special Vulnerability Management Event](https://github.com/FedRAMP/roadmap/issues/72)

Latest comment (2025-08-01):

This event was awesome! We had a stacked panel including folks from Palo Alto
Networks, Okta, Cisco, Wiz, Salesforce, GitHub, Amazon, StackArmor, UberEther,
and Google. If you missed it, you can see the recording on YouTube here:
https://www.youtube.com/watch?v=Z8-9Ef2cnNQ

### CLOSED Issue [#71: BSA Sync on RFC-0012 (Pete/Nicole, July 28)](https://github.com/FedRAMP/roadmap/issues/71)

Latest comment (2025-08-01):

We had an excellent discussion focused on RFC-0012 and the potential impact for
Rev5 cloud service providers.

### CLOSED Issue [#70: CSP-AB Sync On RFC-0012 (Pete, July 29)](https://github.com/FedRAMP/roadmap/issues/70)

Latest comment (2025-08-01):

We had an excellent discussion focused on RFC-0012 and the potential impact for
Rev5 cloud service providers with CSP-AB too!

### CLOSED Issue [#67: [Gov Only] FFIEC IT Conference (Hoesing/Nicole, July 29)](https://github.com/FedRAMP/roadmap/issues/67)

Latest comment (2025-08-01):

The FFIEC IT Conference brought together over 500 participants from across the
financial regulatory and supervisory community from organizations like the
Federal Reserve, OCC, FDIC, NCUA, CFPB, and state agencies. Attendees included
IT examiners, cybersecurity experts, and risk professionals focused on staying
current with federal efforts around cloud oversight and security.

We shared how FedRAMP is evolving into a faster, automation-first framework
designed to accelerate secure cloud adoption specifically highlighting the work
underway through FedRAMP 20x. The session was well received, with strong
engagement and real-time Q&A with FedRAMP. We underscored that FedRAMP’s future
is about enabling innovation, not slowing it down, and invited continued
collaboration across agencies to help shape and scale the 20x model.
[View the slide deck from the briefing here!](https://github.com/user-attachments/files/21553660/FedRAMP.Presentation.pdf)

### OPEN Issue [#65: Scope of FedRAMP Guidance / Technical Assistance](https://github.com/FedRAMP/roadmap/issues/65)

Latest comment (2025-08-01):

We're expecting to get a final version of this back and ready for publishing
over the next two weeks. 🤞

### CLOSED Issue [#57: 930gov (Pete, July 31)](https://github.com/FedRAMP/roadmap/issues/57)

Latest comment (2025-08-01):

I had a small panel discussion with Tom Tenin - I don't think there will be a
video version, so you had to be there. ;)

### OPEN Issue [#47: Major redesign of fedramp.gov](https://github.com/FedRAMP/roadmap/issues/47)

Latest comment (2025-08-01):

We are so close!! Just working through a few final bugs in the mobile version
and then we'll be able to push this site live. There is still a bunch of
improvement to be made but the initial launch will hopefully clean up a lot of
unnecessary stuff.

You can get a sneak peak here: https://demo.fedramp.gov

### OPEN Issue [#38: Continuous Vulnerability Management Standard](https://github.com/FedRAMP/roadmap/issues/38)

Latest comment (2025-08-01):

[RFC-0012](https://www.fedramp.gov/rfcs/0012/) was published on July 15, with a
closing date of August 21.

- Public Comments: https://github.com/FedRAMP/community/discussions/59
- GitHub Casual Discussion Thread:
  https://github.com/FedRAMP/community/discussions/60
- Rev5 focused special events:
  https://github.com/FedRAMP/community/discussions/62

### OPEN Issue [#28: R5.ADS Authorization Data Sharing Standard BIR](https://github.com/FedRAMP/roadmap/issues/28)

Latest comment (2025-08-01):

Shifting the planned start date to August 18.

### OPEN Issue [#15: 20xP1 Low Pilot Submission and Review Window](https://github.com/FedRAMP/roadmap/issues/15)

Latest comment (2025-08-01):

During this sprint, we completed 4 20x Low authorizations and moved two more
folks into In-Process - with another batch expected over the next two weeks.

We've also formally announced that the Submission window will close on
August 19.

### OPEN Issue [#14: Authorization Data Sharing Standard](https://github.com/FedRAMP/roadmap/issues/14)

Latest comment (2025-08-01):

Finalization of the Authorization Data Standard was temporarily de-prioritized
to focus efforts on the Continuous Vulnerability Management Standard in
RFC-0012; we'll be back to finalizing the ADS and publishing this for our 20x
pilot participants by August 15.

---

## Sprint 04 (2025-07-07 to 2025-07-18)

Sprint 04 ended with some big wins but also some clear delays as we've started
to move and shift expected timelines to account for our reduced front office. On
the bright side, Sprint 04 ended with authorization to recruit some internal and
contract staff to offset the unexpected attrition.

### OPEN Issue [#72: FedRAMP Special Vulnerability Management Event](https://github.com/FedRAMP/roadmap/issues/72)

Latest comment (2025-07-18):

We've reached out to a few folks about this and are expecting to announce more
details next week!

### OPEN Issue [#71: BSA Sync on RFC-0012 (Pete/Nicole, July 28)](https://github.com/FedRAMP/roadmap/issues/71)

Latest comment (2025-07-18):

This community outreach session for July 28 has been tentatively scheduled.

### OPEN Issue [#70: CSP-AB Sync On RFC-0012 (Pete, July 29)](https://github.com/FedRAMP/roadmap/issues/70)

Latest comment (2025-07-18):

This community outreach session has been confirmed.

### CLOSED Issue [#69: GovCIO Federal IT Efficiency Summit / Flywheel Awards (Pete)](https://github.com/FedRAMP/roadmap/issues/69)

Latest comment (2025-07-12):

FedRAMP was the recipient of Innovation Champion reward! You can read more about
the award and event here:
https://govciomedia.com/events/archive/federal-it-efficiency-summit-recap-2025/

### CLOSED Issue [#66: FRMR - Machine-Readable Requirements & Information](https://github.com/FedRAMP/roadmap/issues/66)

Latest comment (2025-07-18):

We will continue to add FRMR documents as they are finalized - so far the
feedback has been mild but positive, and no one is particularly upset about the
simple nature of our new documents not having fancy letterheads/etc. ;)
Sufficient work has been done on this roadmap item to move it into standard
operational procedure moving forward.

### OPEN Issue [#65: Scope of FedRAMP Guidance / Technical Assistance](https://github.com/FedRAMP/roadmap/issues/65)

Latest comment (2025-07-12):

The "final draft" for the updated guidance on the Scope of FedRAMP required by
M-24-15 has been sent to OMB for final review.

### OPEN Issue [#64: Federal Information Technical Assistance](https://github.com/FedRAMP/roadmap/issues/64)

Latest comment (2025-07-18):

Due to other shifting priorities and general related issues, this draft
technical assistance hasn't move forward in the past three weeks. I'm shifting
the likely the delivery date and will look to rebuild some momentum on this
during the next sprint.

### CLOSED Issue [#60: Paramify Podcast 20x Roundtable (Pete, June 30)](https://github.com/FedRAMP/roadmap/issues/60)

Latest comment (2025-07-18):

Folks can find this podcast in their favorite podcast app or watch it on youtube
here: https://www.youtube.com/watch?v=hy6wdXmfqS8

### CLOSED Issue [#49: Marketplace Data Standard](https://github.com/FedRAMP/roadmap/issues/49)

Latest comment (2025-07-18):

The planned Marketplace Data Standard will now be integrated into the
Authorization Data Sharing Standard (#13), and initially simplified. As such I'm
resetting the timeline for this and closing this issue as delivered (even though
the ADS Standard isn't fully delivered, the fact that we've chosen to integrate
kinda counts?).

### OPEN Issue [#48: Major redesign of marketplace](https://github.com/FedRAMP/roadmap/issues/48)

Latest comment (2025-07-18):

Based on changes in staffing, I'm moving this out to Aug - Sep. We may be
filling out our web dev team with some more full time folks soon to hopefully
build up a bit more consistency here. 🤞

### OPEN Issue [#47: Major redesign of fedramp.gov](https://github.com/FedRAMP/roadmap/issues/47)

Latest comment (2025-07-18):

This isn't quite ready for release yet but it's getting close! Our part time web
devs are doing a great job, and I even jumped in a bit myself this week to help
with some server hooks to redirect archived pages. I'm moving the target end
date to July 31 and we'll keep plugging away.

### OPEN Issue [#43: Recommended Secure Configuration Standard](https://github.com/FedRAMP/roadmap/issues/43)

Latest comment (2025-07-18):

Like many of the other draft standards in progress, this was impacted by
unexpected staffing changes and delayed. It is a lower priority than some of the
other standards at the moment, so I am moving the likely end date out quite a
bit. I don't expect to post the RFC for this prior to August.

### OPEN Issue [#42: Agency Reuse Playbook for 20x](https://github.com/FedRAMP/roadmap/issues/42)

Latest comment (2025-07-12):

The planned timeline for this has been changed to reflect changes in #32 and the
planned collaboration with the new FedRAMP Board.

### OPEN Issue [#41: Establish DISA ILx One Way Reciprocity](https://github.com/FedRAMP/roadmap/issues/41)

Latest comment (2025-07-18):

Updating the projected end date for this initiative to more realistically
capture how long this might take us to implement and the likelihood of success.
As this is an internal government action we won't be publishing details about
the ongoing status.

### OPEN Issue [#38: Continuous Vulnerability Management Standard](https://github.com/FedRAMP/roadmap/issues/38)

Latest comment (2025-07-14):

We have decided to integrate the Continuous Reporting Standard with plans for an
updated Continuous Monitoring Performance Standard to create a single Continuous
Vulnerability Management Standard.

The draft Continuous Vulnerability Management Standard results from extensive
internal discussion, review with stakeholders, and consideration of public
comment; it simply makes the most sense to combine both the reporting
requirements AND the monitoring requirements in the same standard. As such, this
issue has been renamed and prioritized to continue this work, while #13 will be
closed as the review of the Continuous Reporting Standard has been completed.

### OPEN Issue [#37: Collaborative Continuous Monitoring Standard](https://github.com/FedRAMP/roadmap/issues/37)

Latest comment (2025-07-18):

The Collaborative Continuous Monitoring Standard has been re-prioritized and
shifted to likely begin work in August.

### OPEN Issue [#34: 20xP2 Moderate Pilot Submission and Review Window](https://github.com/FedRAMP/roadmap/issues/34)

Latest comment (2025-07-18):

Moving the tentative launch for Phase Two (Moderate) to October based on current
progress.

### OPEN Issue [#32: Agency Adoption Pilot for 20x Low](https://github.com/FedRAMP/roadmap/issues/32)

Latest comment (2025-07-12):

We have moved the planned start date for the Agency Adoption Pilot to the
beginning of August and are expecting this activity to be predominantly
sponsored by the new FedRAMP Board.

### OPEN Issue [#30: Finalize Key Security Indicators (KSIs) for FedRAMP Moderate](https://github.com/FedRAMP/roadmap/issues/30)

Latest comment (2025-07-18):

I'm now expecting to publish the Moderate KSIs as an RFC in early/mide August,
which pushes the end date out a bit.

### OPEN Issue [#28: R5.ADS Authorization Data Sharing Standard BIR](https://github.com/FedRAMP/roadmap/issues/28)

Latest comment (2025-07-18):

If we're able to finalize the Authorization Data Sharing Standard next sprint, I
expect to immediately move to a beta test on this standard for Rev5. As soon as
the ADS is posted we will include information for interested participants to
sign up for the closed beta.

### OPEN Issue [#23: R5.CRS Continuous Vulnerability Management Standard BIR](https://github.com/FedRAMP/roadmap/issues/23)

Latest comment (2025-07-12):

The Continuous Reporting Standard is now being folded into a new Continuous
Vulnerability Management Standard that will require a new RFC and further
adjustments. As such, this Rev5 BIR has been shifted forward to track the
projected completion of the new Continuous Vulnerability Management Standard.

### OPEN Issue [#19: R5.MAS Minimum Assessment Standard BIR](https://github.com/FedRAMP/roadmap/issues/19)

Latest comment (2025-07-18):

I'm moving consideration of the Minimum Assessment Standard BIR to September
based on a continued lack of interest. We'll work with the FedRAMP Board in
August or September to determine if we want to just move this into wide release
as an optional approach for Rev5 Agency Authorizations and let CSPs just
identify whether they are using the MAS or the legacy boundary concept.

### OPEN Issue [#16: R5.SCN Significant Change Notification BIR](https://github.com/FedRAMP/roadmap/issues/16)

Latest comment (2025-06-30):

We now have approximately ~8 candidates who have accepted invitations to the
closed beta, though we are waiting for additional information for some of those
candidates and a few others. The plan currently is to begin working with closed
beta participants next week to discuss the approach and their upcoming changes
in more detail, then to host group discussions and align folks on best practices
and lessons learned as we deliver. Stay tuned for updates in an upcoming Rev5
working group session that will hopefully include discussion with participants!

### OPEN Issue [#15: 20xP1 Low Pilot Submission and Review Window](https://github.com/FedRAMP/roadmap/issues/15)

Latest comment (2025-07-18):

As of the end of Sprint 04, here's where we stand with the FedRAMP 20x Pilot:

- 11 total 20x pilot submissions
- 4 have been moved to In Process

We'll keep moving these forward! It is likely we will close the pilot to
submissions on August 15 as planned, then spend some time focusing on
formalizing requirements for open submissions.

### OPEN Issue [#14: Authorization Data Sharing Standard](https://github.com/FedRAMP/roadmap/issues/14)

Latest comment (2025-07-18):

We're about 2/3 of the way through a rewrite of this standard - it is taking
longer than expected but barring the unexpected we should be able to close this
up for initial pilot and beta testing at the end of next sprint.

This standard is now internally designated as the Authorization Data Sharing
Standard (Designator: ADS).

### CLOSED Issue [#13: Continuous Reporting Standard](https://github.com/FedRAMP/roadmap/issues/13)

Latest comment (2025-07-12):

We have decided to integrate the Continuous Reporting Standard with plans for an
updated Continuous Monitoring Performance Standard to create a single Continuous
Vulnerability Management Standard.

The draft Continuous Vulnerability Management Standard results from extensive
internal discussion, review with stakeholders, and consideration of public
comment; it simply makes the most sense to combine both the reporting
requirements AND the monitoring requirements in the same standard. As such,
Issue #38 has been renamed and prioritized to continue this work, while this
issue will be closed as the review of the Continuous Reporting Standard has been
completed.

---

## Recovery Sprint (2025-06-30 to 2025-07-04)

The week of July 4 was a recovery sprint for the FedRAMP team, focusing on team
tasks such as:

- Realigning teams based on staffing changes
- Building out some processes for tasks that were onerous in the previous month
  of delivery sprints

> Note: A flaw in the script that generates this progress report meant only OPEN
> issues were reported. I've regenerated previous updates to include progress on
> CLOSED issues.

### CLOSED Issue [#60: Paramify Podcast 20x Roundtable (Pete, June 30)](https://github.com/FedRAMP/roadmap/issues/60)

Latest comment (2025-06-30):

I recorded this discussion in official capacity earlier today! It was an
interesting discussion about 20x, how it has landed amongst the community, what
folks learned so far, and how this is leading us towards creating a new
ecosystem of tooling to support real security across the entire government. I
hope folks find it interesting when it's released.

---

## Delivery Sprint 2 (2025-06-16 to 2025-06-27)

### CLOSED Issue [#68: [Gov Only] Interagency FedRAMP Day (Team, June 24)](https://github.com/FedRAMP/roadmap/issues/68)

Latest comment (2025-06-25):

OMB hosted nearly a hundred agency liaisons for the entire day in the first of
what may become quarterly events. The message from OMB and GSA executive
leadership was strong and consistent support of FedRAMP and modernizing agency
processes to improve the government wide approach to assessment and
authorization of cloud services.

### OPEN Issue [#66: FRMR - Machine-Readable Requirements & Information](https://github.com/FedRAMP/roadmap/issues/66)

Latest comment (2025-06-30):

Ongoing improvements to FRMR continue - last week, control mappings for Key
Security Indicators were added and the template process updated to create human
readable versions both with and without control mappings.

https://github.com/FedRAMP/docs/blob/main/markdown/FRMR.KSI.key-security-indicators-with-controls.md

### OPEN Issue [#65: Scope of FedRAMP Guidance / Technical Assistance](https://github.com/FedRAMP/roadmap/issues/65)

Latest comment (2025-06-30):

Finalization of this guidance has been delayed due to unexpected staffing
changes. We're now anticipating updates through early July with approval from
OMB sometime that month.

### OPEN Issue [#64: Federal Information Technical Assistance](https://github.com/FedRAMP/roadmap/issues/64)

Latest comment (2025-06-30):

Finalization of the RFC justification and approval by OGC has been delayed due
to unexpected staffing changes. Updated goal is to release this for public
comment during the second week of July, which extends predicted finalization to
the third or fourth week of August.

### CLOSED Issue [#62: FSCAC - Administrative Work (June 27)](https://github.com/FedRAMP/roadmap/issues/62)

Latest comment (2025-06-30):

This was strictly an administrative meeting where we met some of the new members
of the Federal Secure Cloud Advisory Committee (FSCAC) and discussed changes to
the committee's priorities under the new administration.

The FAS Commissioner, TTS Director, and FedRAMP Director have been delegated
authority for the Administrator's functions in 44 USC § 3616 and directed to
ensure the committee provides measurable value on specific topics where the
members of the committee are best positioned to represent stakeholders. This is
in-line with the Federal Advisory Committee Act, 44 USC § 3616, and the FSCAC
charter.

**For an upcoming meeting in August (still to be scheduled), the FSCAC has been
charged as follows:**

The next public meeting will focus on advice and recommendations for reducing
the burden and cost of managing Plans of Action and Milestones (POA&Ms) for
cloud services and agencies. FedRAMP requires cloud service providers to
maintain POA&Ms
[in a very specific way](https://www.fedramp.gov/assets/resources/documents/CSP_POAM_Template_Completion_Guide.pdf)
to assist agencies in identifying, assessing, prioritizing, and monitoring the
progress of corrective efforts for security weaknesses but this approach has not
been revisited in depth for over twenty years.

FedRAMP intends to prepare an updated draft POA&M standard that FedRAMP
authorized cloud service providers would follow to effectively demonstrate their
ongoing plans to remediate weaknesses while giving agency customers the
information they need to make continuous authorization decisions and assess
their overall posture. FedRAMP is asking the FSCAC to propose key elements of
this standard by addressing at least the following questions:

1. What are the major pain points with the current POA&M implementation for CSPs
   and agencies?
2. What are the security gaps and increased risks (including missed
   opportunities) that result from the current model?
3. What are the benefits of the current model?
4. What would a new set of POA&M requirements for FedRAMP that addresses the
   major pain points, and gaps while maintaining or increasing the benefits of
   such a process for all parties look like?

### CLOSED Issue [#61: 20x CWG Pilot Panel Discussion (Team, June 25)](https://github.com/FedRAMP/roadmap/issues/61)

Latest comment (2025-06-30):

This panel was a huge success with broadly positive feedback. It showed the
value in investing more time and effort into building intentional community
working group meetings and extending them to an hour. Moving forward we'll be
shifting to a monthly cadence for our two working groups so we can plan more
quality content like this.

More background on the panel is available here:
https://github.com/FedRAMP/community/discussions/47

You can watch the entire panel on youtube here:
https://www.youtube.com/watch?v=t2RHRWXcsIs

### CLOSED Issue [#60: Paramify Podcast 20x Roundtable (Pete, June 30)](https://github.com/FedRAMP/roadmap/issues/60)

Latest comment (2025-06-30):

I recorded this discussion in official capacity earlier today! It was an
interesting discussion about 20x, how it has landed amongst the community, what
folks learned so far, and how this is leading us towards creating a new
ecosystem of tooling to support real security across the entire government. I
hope folks find it interesting when it's released.

### CLOSED Issue [#59: ADI Progress Report / Q&A (Pete, June 25)](https://github.com/FedRAMP/roadmap/issues/59)

Latest comment (2025-06-30):

In general, FedRAMP tries to accept all reasonable meeting invites for industry
trade associations and similar opportunities to have frank conversations with a
number of stakeholders at the same time. The Alliance for Digital Innovation
(https://alliance4digitalinnovation.org/) invited me to speak with their members
at a recent quarterly meeting and we spent this time discussing the changes to
FedRAMP and reviewing our public content.

This was the first time maybe ever that I spoke with a group of cloud service
providers without them constantly beating up on FedRAMP or asking FedRAMP to do
more stuff. It was mostly informational and focused on how our improvements
would be rolled out and how adoption would work. I think this is an excellent
sign that FedRAMP is on the right track, confirmed by similar discussions with a
different group the next day.

### CLOSED Issue [#58: CSP-AB Progress Report / Q&A (Pete, June 26)](https://github.com/FedRAMP/roadmap/issues/58)

Latest comment (2025-06-30):

In general, FedRAMP tries to accept all reasonable meeting invites for industry
trade associations and similar opportunities to have frank conversations with a
number of stakeholders at the same time. The Cloud Service Providers - Advisory
Board (https://www.csp-ab.com/) invited me to speak with their members at a
recent quarterly meeting and we spent this time discussing the changes to
FedRAMP and reviewing our public content.

This meeting focused primarily on questions about timelines and impacts to
currently authorized providers. It was appreciated that FedRAMP had recently
released this Roadmap giving insight into our realistic working targets and I
hope the members and other folks in the community will continue to refer to
these materials for the latest plans.

### OPEN Issue [#47: Major redesign of fedramp.gov](https://github.com/FedRAMP/roadmap/issues/47)

Latest comment (2025-06-30):

<img width="1198" alt="Image" src="https://github.com/user-attachments/assets/04e51599-ff60-4b64-b38e-a0c4a3ef3b16" />

Pushing out target release to July 22 due to unexpected staffing changes but the
team has been making great progress in spite of this. We're looking at options
internally to boost momentum on these improvements overall. This is primarily a
look and feel update designed to make it easier to make further improvements
later, so we're excited to be getting closer to release.

### OPEN Issue [#43: Recommended Secure Configuration Standard](https://github.com/FedRAMP/roadmap/issues/43)

Latest comment (2025-06-30):

An initial internal draft policy for the RSCS has been started. This needs
additional work before sharing with the TAG and CISA; current plans are to ship
to key stakeholders by the end of next week (July 11).

### OPEN Issue [#40: POA&M Standard](https://github.com/FedRAMP/roadmap/issues/40)

Latest comment (2025-06-30):

We've decided to do something different with the updated POA&M standard; instead
of the FedRAMP team directly developing this standard, the Federal Security
Cloud Advisory Committee (FSCAC) has been formally charged with providing advice
and recommendations on how the POA&M process should be shifted for cloud service
providers and agencies specific to FedRAMP requirements. That meeting will take
place in early August.

As such, we have moved this to 20x Phase Two with a start date of shortly before
the to-be-scheduled FSCAC meeting with a plan to draft and publish an updated
standard for public comment within two weeks of that meeting.

### OPEN Issue [#38: Continuous Monitoring Performance Standard](https://github.com/FedRAMP/roadmap/issues/38)

Latest comment (2025-06-30):

Due to unexpected changes in staffing, work on the CMPS update was not started
in Sprint 02 as planned. It will shift to Sprint 04, with a goal of beginning
work July 7 and public release by July 22. This will shift the planned end date
to approximately September 12.

### OPEN Issue [#30: Finalize Key Security Indicators (KSIs) for FedRAMP Moderate](https://github.com/FedRAMP/roadmap/issues/30)

Latest comment (2025-06-30):

A significant amount of internal work has already been done to draft moderate
KSIs but further effort on finalizing and publishing these KSIs will be delayed
to allow staff to focus on reviewing 20xP1 submissions due to the success of the
20xP1 pilot.

### OPEN Issue [#28: R5.SSAD Storing and Sharing Authorization Data BIR](https://github.com/FedRAMP/roadmap/issues/28)

Latest comment (2025-06-30):

Planning for this balance improvement test has been delayed due to delays on #14
(Storing and Sharing Authorization Data Standard). All timelines are shifting at
least two weeks later.

### OPEN Issue [#23: R5.CRS Continuous Reporting Standard BIR](https://github.com/FedRAMP/roadmap/issues/23)

Latest comment (2025-06-30):

Planning for this balance improvement test has been delayed due to delays on #13
(Continuous Reporting Standard). All timelines are shifting at least two weeks
later.

### OPEN Issue [#19: R5.MAS Minimum Assessment Standard BIR](https://github.com/FedRAMP/roadmap/issues/19)

Latest comment (2025-06-30):

Due to a general lack of interest in participation and to ensure the team can
focus on the Rev5 SCN closed beta, I'm re-prioritizing this and pushing it to
later in July. We'll revisit at the end of next month to see if moving
immediately towards an open beta might make more sense.

In the interim, if you or anyone you know is interested in shifting their Rev5
approach to be based around the Minimum Assessment Standard, please drop us a
note at rev5@fedramp.gov so we can track your interest. Thanks!

### OPEN Issue [#16: R5.SCN Significant Change Notification BIR](https://github.com/FedRAMP/roadmap/issues/16)

Latest comment (2025-06-30):

We now have approximately ~8 candidates who have accepted invitations to the
closed beta, though we are waiting for additional information for some of those
candidates and a few others. The plan currently is to begin working with closed
beta participants next week to discuss the approach and their upcoming changes
in more detail, then to host group discussions and align folks on best practices
and lessons learned as we deliver. Stay tuned for updates in an upcoming Rev5
working group session that will hopefully include discussion with participants!

### OPEN Issue [#14: Storing and Sharing Authorization Data Standard](https://github.com/FedRAMP/roadmap/issues/14)

Latest comment (2025-06-30):

Initial review of public comment has been completed and a fair bit of change is
necessary to prepare this for testing and evaluation. Due to unexpected staffing
changes, estimated completion of this task has been delayed. It is now targeted
for the end of Sprint 04 on July 18.

### CLOSED Issue [#12: Significant Change Notification Standard](https://github.com/FedRAMP/roadmap/issues/12)

Latest comment (2025-06-17):

The Significant Change Notification Requirements, including technical
assistance, have been published as Release 25.06A on fedramp.gov and in the
FedRAMP Machine-Readable Docs repository:
https://www.fedramp.gov/20x/standards/scn/

These requirements will be continuously tested and evaluated during the 20x
Phase One Pilot and Rev5 Balance Improvement Test and improved prior to wide
release.

---

## Delivery Sprint 1 (2025-06-02 to 2025-06-13)

### CLOSED Issue [#54: RAMPCon Closing Keynote (Pete, June 10)](https://github.com/FedRAMP/roadmap/issues/54)

Latest comment (2025-06-11):

Event was completed as planned June 10. Unsure if a recording will be available
at a future date.

Generally this discussion did not cover any new ground, but summed up the last
few months of work, the direction, and other information shared in community
working groups.

### CLOSED Issue [#55: FNN Cloud Exchange (Pete, June 2)](https://github.com/FedRAMP/roadmap/issues/55)

Latest comment (2025-06-11):

Interview was completed as planned on June 2. Seemed to go ok?

### Issue [#65: Scope of FedRAMP Guidance / Technical Assistance](https://github.com/FedRAMP/roadmap/issues/65)

Latest comment (2025-06-12):

This RFC will close next sprint and go through final review. Prior to publishing
as formal guidance, it must be approved by OMB. This may happen next sprint or
the sprint after.

### Issue [#64: Federal Information Technical Assistance](https://github.com/FedRAMP/roadmap/issues/64)

Latest comment (2025-06-12):

This draft technical assistance is still going through final review with OGC but
publishing as an RFC is anticipated in Sprint 02.

### Issue [#61: 20x CWG Pilot Panel Discussion (Team, June 25)](https://github.com/FedRAMP/roadmap/issues/61)

Latest comment (2025-06-12):

During Sprint 01, the team identified four cloud service providers and two
independent assessors that were active participants in the 20x pilot to invite
to a panel discussion on June 25. The team began planning for the event,
including agendas, pre-work, questions, etc. Additional information about the
event will be shipped to the community next week!

### Issue [#47: Major redesign of fedramp.gov](https://github.com/FedRAMP/roadmap/issues/47)

Latest comment (2025-06-12):

Team continues to move forward on new look and feel but is no longer on track
for mid-June due to our senior engineer needing to take extended leave. Shifting
the nominal end date / release to Sprint 3/4 and will reassess prioritized
changes.

### Issue [#41: Establish DISA ILx One Way Reciprocity](https://github.com/FedRAMP/roadmap/issues/41)

Latest comment (2025-06-12):

During Sprint 01, the team continued to discuss reciprocity with DISA and will
continue discussions next sprint. There is no detailed information about this to
make public at this time beyond the intent to establish this reciprocity. 🤞

### Issue [#19: R5.MAS Minimum Assessment Scope BIR](https://github.com/FedRAMP/roadmap/issues/19)

Latest comment (2025-06-12):

During Sprint 01:

- Identified potential candidates for R5.MAS.B1
- Drafted Beta Test requirements and guidelines for participation
- Completed initial outreach to some potential candidates

Initial outreach identified less appetite from likely candidates. Team will
reassess priority and approach to R5.MAS.B1 and may consider an open application
process instead. During the next sprint, team will focus on refining the
requirements and making a decision on how to start the next phase.

### Issue [#16: R5.SCN Significant Change Notification BIR](https://github.com/FedRAMP/roadmap/issues/16)

Latest comment (2025-06-12):

During Sprint 01:

- Identified potential candidates for R5.SCN.B1
- Drafted Beta Test requirements and guidelines for participation
- Drafted communications for authorizing officials and agency participants
- Completed initial outreach to some potential candidates

Next sprint the team will focus on refining requirements, getting folks ready
for the Beta Test, and preparing for launch of R5.SCN.B1.

### Issue [#15: 20xP1 Low Pilot Submission and Review Window](https://github.com/FedRAMP/roadmap/issues/15)

Latest comment (2025-06-12):

During Sprint 01, the Vanguard team:

- Received 2 submissions
- Completed initial review of 1 submission
- Held 1 collaborative review meeting

During Sprint 02, we anticipate at least two cloud service providers moving to
FedRAMP In Process.

### Issue [#14: Storing and Sharing Authorization Data Standard](https://github.com/FedRAMP/roadmap/issues/14)

Latest comment (2025-06-12):

Public comment on this RFC will close during Sprint 02 and initial review will
take place by June 27.

### Issue [#13: Continuous Reporting Standard](https://github.com/FedRAMP/roadmap/issues/13)

Latest comment (2025-06-12):

This RFC closed this week. There were approximately ~40 public comments to
review. Updated standard for 20x expected to be published next sprint.

### Issue [#12: Significant Change Notification Standard](https://github.com/FedRAMP/roadmap/issues/12)

Latest comment (2025-06-12):

Updated standard for initial 20x release and R5 Beta has been finalized and will
be published next week.