FSCAC, July 27, 2026: FedRAMP's reuse data, two barriers for working groups, and a first look at the law's reuse rules

▶ Play the video: FSCAC Meeting - July 27, 2026

On July 27, 2026, the Federal Secure Cloud Advisory Committee (FSCAC) held the second of its four 2026 meetings. The FSCAC is the advisory committee the FedRAMP Authorization Act created to advise the Administrator of the General Services Administration (GSA). Its focus for 2026 is how agencies adopt and reuse services that hold a FedRAMP Certification. The General Services Administration posted the recording on July 30, 2026.

In short:

• What the committee heard. FedRAMP briefed members on its data: 590 certified services, 6,004 agency authorizations to operate (ATOs) on record over FedRAMP's life, and 3,320 ATOs treated as active. Recorded ATO activity in fiscal year 2026 was much lower than in earlier years.
• What the committee chose. Members named two barriers to reuse for working groups to address before the August 31 meeting: a lack of awareness and shared understanding of the new FedRAMP, and a lack of agency tooling and automation. Five members volunteered.
• What it did not do. The committee took no votes and made no recommendations. It began a review of the reuse sections of the FedRAMP Authorization Act and moved the rest of that discussion to a later meeting.
• What it could mean. Agencies may later get advice on what a FedRAMP Certification covers and what they still must review themselves. Cloud service providers heard the chair ask what they can do to make reuse easier. Any advice is a recommendation to the GSA Administrator, not a rule.

What did FedRAMP's data show about agency reuse?

The Designated Federal Officer, who also serves as FedRAMP's Chief of Staff, gave the briefing. The minutes record these figures:

• 590 unique certified services, and 3,320 active agency ATOs, an average of 5.6 for each service. The Designated Federal Officer said the average is not typical: some services have hundreds of ATOs, and some have none.
• 140 services certified in the prior year, and 79 so far in the current fiscal year.
• Recorded ATO activity peaked in fiscal year 2024, stayed about level in fiscal year 2025, and fell sharply in fiscal year 2026, with about two months left. The Designated Federal Officer and a FedRAMP official named possible causes, such as workforce reductions, contract consolidation, the government shutdown, and incomplete reporting. The minutes say the discussion did not establish a single cause.
• 57 percent of active ATOs (1,908) have no fixed expiration date, and 43 percent (1,412) do.
• A small group of agencies accounts for much of the recorded activity. Software as a Service (SaaS) offerings far outnumber Platform as a Service (PaaS) and Infrastructure as a Service (IaaS) offerings.

The Designated Federal Officer said the data is likely incomplete. Under 44 U.S.C. 3613, agencies must send FedRAMP a copy of each ATO letter, but they do not always do so. A FedRAMP official added that many staff who used to send those letters have left, and that agencies did hundreds of ATOs this year, including for FedRAMP 20x services, without sending them.

The Designated Federal Officer said services hold more ATOs the longer they are certified. For FedRAMP 20x, the speaker said in the meeting that the lack of visible agency ATOs "should not be treated as evidence that this model has failed or agencies are uninterested." Until the FedRAMP Consolidated Rules for 2026 (CR26), 20x services were in pilots. The minutes record that Class A was set to open on August 3 and Classes B and C on August 31. The speaker said visible agency ATOs for these services may appear during fiscal year 2027.

Which barriers will the working groups take on?

The chair framed the discussion as a call to action for industry. In the meeting, the chair said the goal was to find practical steps cloud service providers can take to "help make reuse the default and not the exception."

Members raised several barriers:

• Education. A member from the National Institute of Standards and Technology (NIST) said many agency staff do not understand how the new FedRAMP differs from the old one. The member suggested a comparison between the Rev5 Moderate baseline and the 20x Key Security Indicators (KSIs). Another member said agencies still must map to NIST controls.
• Measurement and demand. A member from a cloud service provider asked whether the data shows a real adoption problem, and suggested comparing agency system inventories to find where agencies did not use FedRAMP. A member from the Cybersecurity and Infrastructure Security Agency (CISA) said the committee should hear directly from agencies about their barriers.
• Risk acceptance. An agency Chief Information Security Officer member asked how agencies can tell which risks they accept for themselves and which a sponsoring agency accepts for others.
• Tooling. A member from a cloud service provider said agencies lack the tooling and automation to keep pace as more services are certified, after staff reductions.

The committee picked two: a lack of awareness and shared understanding, and a lack of agency tooling and automation. The Designated Federal Officer said the working sessions do not have to be public, but any decision on their output must happen in an open meeting.

Will the committee recommend changes to the FedRAMP Authorization Act?

Not yet. The Designated Federal Officer walked members through the reuse sections of 44 U.S.C. 3613. The law uses the term FedRAMP authorization, which is now called FedRAMP Certification. Before starting a new one, an agency must check whether a FedRAMP Certification already exists. It must use existing assessments where practicable, and document its reasons if it finds them wholly or substantially deficient. It must send FedRAMP its ATO letter. The assessments in a FedRAMP package are presumed adequate.

The Designated Federal Officer listed possible topics, which the speaker said were not FedRAMP or FSCAC positions. These included what the presumption of adequacy means in practice and when an agency's extra requirements are justified. The chair said the committee advises the GSA Administrator, not Congress. The minutes record no working group and no recommendation on the law. Members were asked to review the materials, consult their counsel, and bring possible recommendations to the August 31 meeting.

In the public comment period, a member of the public asked whether agencies could get guidance on judging continuous monitoring evidence the same way, to avoid duplicate reviews. The Designated Federal Officer said the committee cannot answer questions, but members can use the comment in their work.

What comes next?

The Federal Register notice set the remaining meetings for August 31 and November 2, 2026, and says the November meeting will finalize any recommendations. Anyone can send written comments through the form on GSA's FSCAC page. At its earlier June 8 meeting, the committee reviewed how FedRAMP has changed and named areas where it could help.

Sources

• FedXchange tracker: FSCAC Meeting - July 27, 2026
• YouTube: FSCAC Meeting - July 27, 2026
• GSA: FSCAC July 27, 2026, public meeting agenda and minutes
• GSA: Federal Secure Cloud Advisory Committee meetings
• GSA: Federal Secure Cloud Advisory Committee
• Federal Register: FSCAC notification of upcoming meetings for 2026
• 44 U.S.C. 3613
• FedRAMP Authorization Act (Public Law 117-263, section 5921)
• FedRAMP Consolidated Rules for 2026
• FedXchange tracker: FSCAC Meeting, June 8, 2026
• FedXchange tracker: FSCAC Meeting, August 31, 2026