FSCAC August 2026: the committee approves three recommendations to help agencies use FedRAMP 20x Certifications

At its August 31, 2026, meeting, the Federal Secure Cloud Advisory Committee approved three recommendations to the GSA Administrator: a FedRAMP 20x agency playbook, open collaboration on 20x practice, and sustained direct work with agencies. They are advice; a report was to follow in November.

By FedXchange · November 3, 2026

FedRAMP's video, on its governance tracker page. The player loads from YouTube only when you press play.

On August 31, 2026, the Federal Secure Cloud Advisory Committee (FSCAC) held its third public meeting of 2026. The FSCAC is the advisory committee that 44 U.S.C. 3616, part of the FedRAMP Authorization Act, created to advise the Administrator of the General Services Administration (GSA), the FedRAMP Board, and agencies. The Federal Risk and Authorization Management Program (FedRAMP) is GSA's program for cloud security. A Federal Register notice announced the meeting, and GSA posted the recording on November 3, 2026. Twelve of the committee's 13 active members attended, more than the seven needed for a quorum.

In short:

What the committee decided. Members approved three recommendations to the GSA Administrator, each in its own vote: a FedRAMP 20x agency playbook, continued open collaboration, and direct and in-person agency collaboration. GSA's minutes record all three as approved.
What they aim at. The recommendations try to shorten the time between a service's FedRAMP Certification under 20x and the first agency authorization to operate (ATO) that uses it.
What they are not. They are recommendations, not rules. The first and third say each agency keeps its own risk decision. The second must complement, not replace, FedRAMP's requirements. No source shows that GSA or FedRAMP has acted on them yet.
What it could mean. Agencies may get a playbook and more direct contact on how to read 20x evidence. Cloud service providers, assessors, and agencies may get a shared place to trade practical 20x approaches.
What comes next. GSA staff were to draft a written FSCAC report from the three recommendations for the committee's November 2, 2026, meeting.

How the August recommendations move toward a report

Sources: the FSCAC meeting of August 31, 2026, and GSA's minutes of that meeting.

Read the steps as text

July briefing. The committee reviewed data on how agencies adopt and reuse FedRAMP Certified services under the older Rev. 5 process.
Three working sessions. Members met three times after July and shaped three recommendations on 20x adoption and use.
August 31 votes. The full committee discussed each recommendation in public, changed the wording of two, and approved all three.
Draft report. GSA staff draft an FSCAC report with the reasons, guardrails, and implementation ideas behind each recommendation.
November 2 review. The committee reviews the draft report, changes it where needed, and considers it at its last 2026 meeting.
Advice to GSA. The report goes to the GSA Administrator as the committee's advice. It is not a FedRAMP rule.

Why did the committee focus on agency adoption of 20x?

The Designated Federal Officer opened with a recap of the July 27, 2026, meeting. At the time of that briefing, FedRAMP had tracked 590 unique certified services and 3,320 active agency ATOs, an average of 5.6 for each service. The officer said the numbers likely understate reuse, because not every agency sends FedRAMP its authorization letters. The briefing found that 62% of active ATOs were for services certified more than five years earlier. The officer said this shows that reuse builds up over time, not that newer services fail to get it.

The committee chair said adoption and reuse are part of the committee's job under the law. The chair said the question was whether the committee could find a foreseeable adoption risk and help reduce it early, and that there is no evidence today that 20x use has failed.

The chair said FedRAMP opened the 20x Class B and Class C certification paths on the day of the meeting, after the Class A path earlier that month. The chair said 20x asks agencies to use different evidence than the system security plans, assessment reports, and plans of action they know: Key Security Indicators (KSIs), machine-readable information, and Trust Center evidence. In the chair's words from the meeting, "Our objective should not be to recreate Rev5 around 20x."

What is the 20x agency playbook recommendation?

The committee recommends that the GSA Administrator support a practical FedRAMP 20x agency playbook. It would help agencies use 20x certifications in their own risk-based authorization decisions. It would explain what an agency can rely on from FedRAMP, what stays the agency's job, and how to use 20x evidence in the agency's current risk process without repeating the Rev. 5 assessment.

A member who represents the National Institute of Standards and Technology (NIST) asked that the text name the NIST standards it rests on. The committee added the words "consistent with NIST standards and guidelines." An agency member agreed, saying agencies must still authorize systems under the NIST Risk Management Framework, as the Federal Information Security Modernization Act (FISMA) requires. Members voted in the meeting chat. The chair said, "I think we're unanimous," and added the chair's own yes. The minutes record the recommendation as approved and give no count.

What would open collaboration look like?

The second recommendation asks the GSA Administrator to support an open, vendor-neutral model in which agencies, cloud service providers, assessors, and other practitioners share practical 20x resources. Examples named in the text include operational playbooks, implementation patterns, evidence reuse examples, decision guides, reusable templates or schemas, and lessons learned. The text says the work must "complement, not replace, authoritative FedRAMP requirements and guidance."

It lists guardrails: clear governance, transparency, attribution to the official source, no implied endorsement, vendor neutrality, conflict-of-interest controls, and legal and ethics review. The committee "does not recommend a specific host or owner at this stage."

Two members asked who would moderate the shared material and who would approve templates and schemas, so that agencies do not receive files they cannot accept. Another member said these were implementation details for later. The chair said the words "clear governance" leave room to address those concerns. Members voted in the chat. While the votes came in, a speaker noted that one member's vote had not appeared and said, "We have a majority either way." The minutes record it as approved and give no count.

How would GSA work directly with agencies?

The third recommendation asks the GSA Administrator to support a sustained program of direct and, where practical, in-person work with agency Chief Information Officers (CIOs), Chief Information Security Officers (CISOs), authorizing officials, acquisition officials, and security and compliance staff. It would include regular sessions with the federal CIO and CISO councils, working sessions with single agencies, and ways to find shared barriers, such as different readings of the same rule or duplicate requirements. GSA would raise issues that affect many agencies with the FedRAMP Board, the Office of Management and Budget (OMB), or agencies, "while preserving each agency's responsibility for its own mission-specific risk and authorization decisions."

Members said the councils reach only some of the right people. An agency member noted that the councils cover the larger agencies and asked that small agencies be included. Another member suggested joint meetings with the Chief Acquisition Officers Council. After a first vote in the chat, a member asked whether "security and compliance practitioners" meant agency staff. The committee made the text say that federal agency applies to every role listed, then approved the changed text by voice vote.

What did the public say?

One member of the public, from a cloud service provider, made two comments. First, the Department of Defense (DoD) has not adopted 20x, and the commenter said differences between FedRAMP and DoD views of risk add burden for providers that serve both. Second, the commenter asked the committee to take up artificial intelligence (AI) security, noting that agencies are building their own AI governance programs after OMB memo M-25-21.

What happens next?

The minutes say GSA staff will draft an FSCAC report based on the three approved recommendations and bring it to the committee's last 2026 meeting, on November 2, 2026, to consider as its final recommendation report to the GSA Administrator. The chair said the August votes set the committee's direction, and the report would add the reasons, guardrails, and implementation details.

Sources

Share this post:LinkedIn X Email

A weekly email on Fridays, an alert on the day the watch finds something new, or both. Free.