The Evolution of FSCAC: FedRAMP explains why its advisory committee exists and why its talks with industry now happen in public

In a June 2026 video, FedRAMP speakers said Congress created the Federal Secure Cloud Advisory Committee so FedRAMP would hear from industry and assessors, and that FedRAMP now holds its discussions in public. They want the committee to work on something actionable for agencies.

By FedXchange · June 8, 2026

FedRAMP's video, on its governance tracker page. The player loads from YouTube only when you press play.

On June 8, 2026, the Federal Risk and Authorization Management Program (FedRAMP) posted a short video, "The Evolution of FSCAC." The Federal Secure Cloud Advisory Committee (FSCAC) is the advisory committee that the FedRAMP Authorization Act created in 44 U.S.C. 3616, and the General Services Administration (GSA) announces its meetings. In the video, FedRAMP speakers talk about why the committee exists, how FedRAMP now talks with the public, and what they want the committee to work on. This video is not a recording of a committee meeting.

In short:

What FedRAMP said. A FedRAMP speaker said the intent of the law was for FedRAMP to engage more with industry and with independent assessors, through an official committee. A speaker said FedRAMP no longer takes private meetings and holds its discussions in public to the maximum extent possible.
Who it affects. Cloud service providers, independent assessors, and agencies that want to raise issues with FedRAMP.
What they can do. Follow the committee's public meetings on GSA's FSCAC meetings page. The video says the 2026 meetings were already listed there.
When. A Federal Register notice of May 18, 2026, set four virtual public meetings for 2026: June 8, July 27, August 31, and November 2.

How the FSCAC went from the law to its 2026 recommendations

Sources: 44 U.S.C. 3616, the video, the Federal Register notice of May 18, 2026, and GSA's FSCAC meeting pages. The committee gives advice; it does not set FedRAMP rules.

Read the steps as text

The law. The FedRAMP Authorization Act creates the committee to advise the GSA Administrator, the FedRAMP Board, and agencies.
Public talks. FedRAMP says it now holds its discussions with industry in public instead of in private meetings.
Public notice. GSA announces the committee's 2026 meetings in the Federal Register, and the meetings are open to the public.
Recommendations. On August 31, 2026, the committee approved three recommendations on agency use of FedRAMP 20x.
Report. On November 2, 2026, the committee approved its report to the GSA Administrator.

Why did Congress create the FSCAC?

In the video, one speaker said the committee came about because industry lobbied Congress, since companies felt FedRAMP was not paying attention and they did not have a voice. A speaker said they did not think that was ever the case, but that many government rules limit how a program can interact with people outside it.

The law sets the committee's job. Under 44 U.S.C. 3616, it examines FedRAMP's operations to find ways to keep improving the process, collects feedback, and serves as a forum for communication. It advises the GSA Administrator, the FedRAMP Board, and agencies. It has no more than 15 members and must meet at least 3 times a calendar year. The law requires members from agencies and from industry, including at least 5 from businesses that mainly provide cloud services, at least 2 of them small businesses, and at least one from an independent assessment service.

A speaker said the committee's purposes held nothing surprising. They match what FedRAMP had long heard: it is hard to find an agency sponsor, the process is hard to follow, and small businesses cannot afford it. The speaker said FedRAMP introduced FedRAMP 20x, its newer path to certification, to help with that.

How does FedRAMP talk with industry now?

A speaker said FedRAMP worked extensively with the Office of General Counsel to find a way to engage the public without breaking the Administrative Procedure Act. In the video, the speaker said FedRAMP does not "take private meetings with people," and that "We only have discussions in public to the maximum extent possible." A speaker added that everyone has the same access to the same information.

A speaker said the committee has its own law, so its meetings follow even stricter steps. There is an agenda, and notices go in the Federal Register. GSA's FSCAC page says full committee meetings are open to the public, and attendees must register in advance.

What do FedRAMP's speakers want the committee to work on?

A speaker said FedRAMP wants to focus the committee's attention on something actionable that helps FedRAMP deliver for its agency customers. The speaker said the committee is about half government and half industry, and that bringing the two together can produce ideas and solutions. As of November 2026, GSA's FSCAC page listed 13 members, 7 federal and 6 non-federal, with one federal seat vacant.

FedRAMP's May 28, 2026, announcement said that for the rest of 2026, FedRAMP would use the committee as a forum to find practical ways to improve how agencies adopt and reuse FedRAMP cloud security packages.

The video also touches on terms. Speakers joked about the committee's name and compared it to "FedRAMP authorization versus certification." A speaker said FedRAMP certification is the official label. Under the FedRAMP Consolidated Rules for 2026 (CR26), FedRAMP's definitions call a cloud service offering that has received a FedRAMP Certification "FedRAMP Certified."

What did the committee do after the video?

According to the August 31, 2026, minutes, the committee approved three recommendations: a FedRAMP 20x playbook for agencies, continued open collaboration among agencies, providers, and assessors, and direct work with agencies on 20x adoption and reuse. At its November 2, 2026, meeting, the committee approved its report to the GSA Administrator, as amended, built on those recommendations.

Does the FSCAC set FedRAMP rules?

No. The committee gives advice. Its recommendations go to the GSA Administrator. They do not change FedRAMP's rules by themselves.

Sources

Share this post:LinkedIn X Email

A weekly email on Fridays, an alert on the day the watch finds something new, or both. Free.