FedRAMP's assessor roundtable: what changed for independent assessors in the FedRAMP 20x pilots

In a May 2026 community update, assessors from the FedRAMP 20x pilots described work with no templates and more talks with providers. FedRAMP said the provider is responsible for its package and the assessor's job is to verify and validate it.

By FedXchange · May 14, 2026

FedRAMP's video, on its governance tracker page. The player loads from YouTube only when you press play.

On May 13, 2026, the Federal Risk and Authorization Management Program (FedRAMP) held its monthly 20x Community Update as a special event: a roundtable with independent assessors. FedRAMP posted the recording on May 14. The panelists were senior assessors from independent assessment companies that took part in the FedRAMP 20x pilots. FedRAMP said at the start that it does not endorse any of their companies.

FedRAMP 20x is FedRAMP's newer approach to certification, built on Key Security Indicators (KSIs). Panelists described providers showing their KSIs with automated validation. The Phase Two pilot, at the Moderate impact level, ran from November 18, 2025, through March 2026.

In short:

What FedRAMP said. The cloud service provider is the one party responsible for the accuracy, completeness, and correctness of what it submits. The independent assessor double-checks it: it verifies and validates, rather than passing or failing the provider.
What the assessors said. The pilots had no templates and no checklist, and requirements changed often. Assessors could talk with providers during the assessment without giving up their independence. Panelists expect assessment costs to be lower under 20x.
Who it affects. Independent assessors, cloud service providers seeking a FedRAMP Certification, and agencies that read assessment reports to make risk decisions.
What FedRAMP asked. A FedRAMP speaker recommended reading the Consolidated Rules for 2026 and commenting on them. The speaker said assessors had asked for a more specific list of the materials FedRAMP expects, and that FedRAMP was working on that.

Who does what in a FedRAMP 20x certification, as FedRAMP and the panelists described it

Source: FedRAMP 20x Community Update Special Event: Independent Assessor Roundtable (FedRAMP video, May 14, 2026).

Read the steps as text

Cloud service provider. Shows how it meets each Key Security Indicator, and is responsible for the accuracy and completeness of what it submits.
Independent assessor. Verifies and validates that the provider did what it says, and that it works the way the provider thinks.
Assessor's report. Describes what the provider does and does not do. In 20x, a panelist said, it makes no recommendation on the decision.
FedRAMP and agencies. FedRAMP makes the certification decision. Agencies use the package to make their own risk decisions.

What changed for assessors in the 20x pilots?

One panelist said the biggest change was that no one had defined what a good package looks like, and another agreed. Under Rev5, FedRAMP's process built on Revision 5 of National Institute of Standards and Technology (NIST) Special Publication (SP) 800-53, assessors had parameters and templates. In 20x, they had room to decide how to approach each provider. One assessor said that, between providers and assessors, not having a clear target "was definitely unique." Another said the next-hardest part was reading scripts of about 1,500 lines that checked KSIs, instead of reading policies and screenshots. A third said requirements kept changing during the pilots.

Asked what they liked most, one assessor named the lack of office-suite templates and being able to report directly in the provider's trust center, the service where the provider shares its certification data. Another said the work became asynchronous. Providers put evidence in machine-readable files, and assessors could study it on their own instead of collecting screenshots on long calls.

Can an assessor talk with the provider during an assessment?

Yes, a FedRAMP speaker said, and FedRAMP is starting to apply this to Rev5 too. The speaker said an assessor should never tell a provider, "If you do X, Y, or Z, I will pass you." The speaker said this was the main reason for keeping assessors apart from providers. In 20x, the speaker said, FedRAMP removed the idea of passing or failing. In the speaker's words from the video, "now the role of the assessor is to double-check the work, verify and validate that the CSP did what they thought they were doing." (CSP means cloud service provider.)

The assessors said these conversations helped. One met with a provider every few days to go through evidence. Another said the team helped providers understand what assessors look for "without sacrificing our independence."

Who is responsible for the package?

A FedRAMP speaker said one party is responsible for the accuracy, completeness, and correctness of the materials submitted for FedRAMP Certification: the cloud service provider. The 2026 rules make the same point. Rule FRC-CSO-MRA in the FedRAMP Certification rules says providers "MUST maintain responsibility and accountability for the accuracy and completeness of all information in the FedRAMP Certification Package."

The speaker also explained the name change from "third-party assessment organization" (3PAO) to independent assessor. The speaker said 3PAO came from FedRAMP's 2011 memo. The FedRAMP Authorization Act, in 44 U.S.C. 3607, defines an "independent assessment service." Office of Management and Budget (OMB) memo M-24-15 uses the same term. M-24-15, issued July 25, 2024, rescinded the 2011 memo.

The speaker read FedRAMP's definitions of verification and validation. The current definitions read: verification is "Confirmation through objective evidence that specified FedRAMP Practices have been fulfilled for a cloud service offering." Validation is confirmation through objective evidence that implemented security capabilities and related certification data "are suitable for their intended FedRAMP Certification use and support the expected security outcomes for a cloud service offering."

How do you assess one KSI tied to many controls?

An audience member asked about a KSI on just-in-time access that relates to 38 controls from NIST SP 800-53. The assessors agreed: they assess the one KSI. One said, "I'm not assessing 38 different controls. I'm assessing one KSI." They said the related controls give context; they are not a list to check.

Will 20x assessments cost less?

The panelists expected lower costs. One said that, by that panelist's count, a Rev5 Moderate assessment covered 323 controls, against roughly 40 to 60 KSIs, so there is less documentation to review. Another said providers should expect a lower cost from their assessor but more up-front engineering to build automated validation.

What else did FedRAMP announce?

A FedRAMP speaker described the new FedRAMP Cybersecurity Service: two-year terms in Washington, D.C., with work in the office five days a week. The speaker said four General Schedule grade 15 (GS-15) lead cloud security engineer postings were open. The speaker said three rounds of hiring were planned in 2026, for about 15 people across lead, senior, and engineer roles. The speaker described a first year of training, a six-month rotation at another agency, and six months back at FedRAMP. As of November 2026, the FedRAMP Cybersecurity Service page describes hiring in rolling cycles every two weeks and lists other GSA office locations as well as Washington, D.C.

Sources

Share this post:LinkedIn X Email

A weekly email on Fridays, an alert on the day the watch finds something new, or both. Free.