Recently, FedRAMP announced that, per stakeholder feedback, the federal market’s needs for cloud SaaS products are not being met. A significant part of this is the program’s bottleneck.
To address this issue, the Office of Management and Budget (OMB) has released a draft memo offering significant program changes, including updates to infrastructure, leadership, and authorization.
This article will briefly overview this new roadmap based on the information currently available to the public.
Why the New Roadmap for FedRAMP?
“While SaaS applications are used in government, and FedRAMP does have some in its marketplace, it’s not nearly enough and it’s not working the way that it should. We know that for many companies, especially software-focused companies, it takes too much time and money to get a FedRAMP authorization.”
The blog is quite frank in its assessment that the FedRAMP program isn’t authorizing SaaS products as fast as needed and that the marketplace isn’t nearly as robust as it should be. As such, it is rolling out this new roadmap to foreground new priorities and processes to grow the program and the marketplace.
The Primary Goals of the New Roadmap
To support the goals of this new approach to FedRAMP, program leadership has defined four specific priorities:
- Customer Experience: Simplifying the process for cloud providers and making the results more useful for agencies. The goal is to align the perceived time and cost of going through FedRAMP with customers’ actual experience.
- Cybersecurity Leadership: Ensuring FedRAMP remains a security and risk management program by making security expectations more transparent and consistent for all FedRAMP authorizations. This involves updating policies to balance security requirements with real-world security needs.
- Scaling the Marketplace: Develop clear processes with trusted authorizing partners to reduce unnecessary reviews and streamline the process. Additionally, FedRAMP will support scalability by taking on more post-authorization monitoring and automation.
- Smarter, Tech-Forward Operations: Implementing tools, specifications, and services to create and share digital authorization packages and other information will build a data-first, API-first foundation for FedRAMP, modernizing operations and enabling automation.
What Initiatives Are Being Put in Place to Follow These Priorities?
To support these priorities, the program will see significant changes… and it looks like these changes might be coming very soon.
The initiatives that the program has identified as necessary to support the new program priorities include:
- Agile Change Management: FedRAMP plans to replace the significant change request process with a more agile approach that doesn’t require advance approval for each change. This will enable more rapid improvements and updates to the program’s processes.
- Customer-Oriented Metrics: The program will introduce customer-oriented metrics to understand better the cost and time involved in FedRAMP authorizations. Customer feedback will inform these metrics and help refine the program’s performance measurement.
- Defining Security Expectations: FedRAMP aims to clearly define the security outcomes expected for all types of authorizations. This involves collaborating with the Cybersecurity and Infrastructure Security Agency (CISA) to develop and deploy the best protections for the federal enterprise.
- Focusing on Outcomes: FedRAMP will focus on outcomes rather than just requirements, ensuring that security standards are applied reasonably and effectively. This includes updating guidance in FIPS 140, DNSSEC, and external service integrations.
- Increasing Authorization Capacity: FedRAMP plans to work with trusted authorizing partners to streamline processes and eliminate unnecessary reviews. This includes piloting approaches with partners such as the Defense Information Systems Agency (DISA) to align processes and reduce review burdens.
- Digital Authorization Practices: FedRAMP aims to transition to machine-readable authorization packages to facilitate automation and scalability. This involves defining machine-readable packages, providing guidance and tools, and piloting the approach with interested cloud providers and agencies.
These initiatives are designed to address specific challenges and opportunities identified in the FedRAMP program, ultimately improving the authorization process’s efficiency, effectiveness, and security for cloud service providers and federal agencies.
What Is the Timeline for These Changes?
FedRAMP has released a timeline for rolling out this new roadmap, but it is still a high-level timeline that’s broad in scope and involves cloud service providers receiving updates over the next 18 months.
This plan seems to break down into three distinct phases:
- FY 2024 (Q2-Q4): This phase sees a significant push to release new knowledge and expertise into the market, including expanded guidance on approaching monitoring, FIPS compliance, and program navigation. It will also see the start of a “low-review” process with trusted authorization partners.
- FY 2025 (Q1-Q2): This phase focuses on integrating more advanced review capabilities into the program and publishing new criteria for authorization (including the low-review authorization criteria). This phase will also include migration to a new FedRAMP platform with associated pilot programs.
- FY 2025 (Q3-Q4): This phase will include releasing programs for a “crosswalk” between FedRAMP Low and external frameworks and drafting an Expert Risk Assessment Framework. It will also open up low-review authorization for more agencies.
Stay Aligned with the Latest FedRAMP Updates with Lazarus Alliance
Knowing this new roadmap is essential if you’re preparing for your FedRAMP Authorization. Work with Lazarus Alliance to ensure you’re always ahead of FedRAMP updates and changes.
If you’re looking to kickstart your assessment, contact Lazarus Alliance.
- FedRAMP
- StateRAMP
- NIST 800-53
- FARS NIST 800-171
- CMMC
- SOC 1 & SOC 2
- HIPAA, HITECH, & Meaningful Use
- PCI DSS RoC & SAQ
- IRS 1075 & 4812
- ISO 27001, ISO 27002, ISO 27005, ISO 27017, ISO 27018, ISO 27701, ISO 22301, ISO 17020, ISO 17021, ISO 17025, ISO 17065, ISO 9001, & ISO 90003
- NIAP Common Criteria – Lazarus Alliance Laboratories
- And dozens more!
What Is Autonomous Malware?
We’re reaching the end of 2025, and looking ahead to 2026, most experts are discussing the latest threats that will shape the year ahead. This year, we’re seeing a new, but not unexpected, shift to autonomous threats driven by state-sponsored actors and AI. With that in mind, a new generation of threats, broadly known as...Continue reading→
What CISA’s Emergency Directive 26-01 Means for Everyone
In mid-October 2025, the CISA issued one of its most urgent orders yet: Emergency Directive 26-01. The directive calls on all Federal Civilian Executive Branch (FCEB) agencies to immediately mitigate vulnerabilities in devices from F5 Networks following a state-sponsored breach of F5’s systems and access to portions of BIG-IP source code and vulnerability data. The event...Continue reading→
Cybersecurity and Vetting AI-Powered Tools
A recent exploit involving a new AI-focused browser shone a light on a critical problem–namely, that browser security is a constant issue, and AI is just making that threat more pronounced. Attackers discovered a way to use that browser’s memory features to implant hidden instructions inside an AI assistant. Once stored, those instructions triggered unwanted...Continue reading→
Shutdown Security And Cyber Vulnerability
When the federal government shuts down, the public sees closed monuments, unpaid workers, and halted programs. What they do not see is the silent surge of cyberattacks targeting agencies already operating on fumes. During the most recent shutdown, attacks against U.S. government systems spiked by nearly 85%. Cybersecurity failures during government disruptions rarely start with...Continue reading→
Identity and the Shift from Malware
The world of cyber threats is rapidly evolving, and while we can see these changes more generally, it’s always crucial to understand them concretely. As the 2025 CrowdStrike Global Threat Report shows us, the landscape of our industry is changing. We’re digging into this report to discuss a challenging trend: the move of hackers foregoing...Continue reading→
Maintaining Compliance Against Prompt Injection Attacks
The increasing adoption of AI by businesses introduces security risks that current cybersecurity frameworks are not prepared to address. A particularly complex emerging threat is prompt injection attacks. These attacks manipulate the integrity of large language models and other AI systems, potentially compromising security protocols and legal compliance. Organizations adopting AI must have a plan...Continue reading→
Are We Already Talking About CMMC 3.0?
The ink has barely dried on the CMMC final rule, and already the defense contracting community is buzzing with speculation about what comes next. Just when contractors thought they had a moment to catch their breath after years of regulatory limbo, whispers of CMMC 3.0 have begun circulating through the industry. But is this just...Continue reading→
Centralizing Identity-Based Risk
As the traditional network boundary dissolves and remote work becomes standard practice, identities are the major frontier for security. Whether we’re talking about human users, service accounts, or machine identities, these have emerged as both the primary access mechanism and the most targeted attack vector. It has become imperative for providers to centralize identity management...Continue reading→
Deviation and Significant Change Requests in FedRAMP: A Comprehensive Guide
FedRAMP provides a standardized approach to security assessment, authorization, and continuous monitoring for cloud products and services used by federal agencies. While the program’s rigorous baseline requirements ensure consistent security, the reality is that this consistency calls for a little flexibility. This is where deviation requests and significant change requests come into play. These two...Continue reading→
The Costs of Compliance and Data Breaches
Data is possibly one of the most valuable assets any organization holds. Customer information, employee records, and proprietary business intelligence present challenges because the data flowing through modern enterprises represents both significant opportunities and serious risks. Businesses face a challenging balance: investing in compliance measures to protect sensitive information while also preparing for the real...Continue reading→
Related Posts