FSCAC June 8, 2026 meeting: the committee picks agency reuse as its 2026 focus and names what stands in the way

At its first 2026 meeting, the Federal Secure Cloud Advisory Committee heard FedRAMP's update and named barriers to agency reuse: unclear terms, auditors, old tools, and contractor incentives. Members proposed guides and FAQs. It took no votes and made no recommendations.

By FedXchange · June 17, 2026

FedRAMP's video, on its governance tracker page. The player loads from YouTube only when you press play.

The Federal Secure Cloud Advisory Committee (FSCAC) met in public on June 8, 2026, from about 1:00 to 3:00 p.m. Eastern time. It was the committee's first meeting of 2026, and its first since August 2025. The recording was published on YouTube on June 17, 2026. The FSCAC advises the Administrator of the General Services Administration (GSA), the FedRAMP Board, and agencies on the Federal Risk and Authorization Management Program (FedRAMP). Its advice is not a FedRAMP rule.

In short:

What the committee discussed. The committee chair proposed that the 2026 work focus mainly on how agencies adopt and reuse FedRAMP Certified services. The FedRAMP Director gave a program update. Members then named what still stops agencies from relying on a FedRAMP Certification.
What it decided. Nothing formal. GSA's minutes record no votes and no decisions. The 2026 focus was the chair's proposal.
What members proposed. Possible work products: a reuse best practices guide, frequently asked questions (FAQs) for each audience, outreach to the Inspector General (IG) community, model acquisition language, common principles for judging risk, and advice on tools and automation.
What it could mean. Agencies may later get plain guidance on what a certification covers and what the agency still owns. Cloud service providers may get material they can show an agency that asks for an old process.

How the June 8 meeting moved from barriers to proposed work

Sources: GSA's minutes of the June 8, 2026, FSCAC meeting and the meeting recording.

Read the steps as text

Focus. The chair proposed agency adoption and reuse of FedRAMP Certified services as the main 2026 focus.
Briefing. The FedRAMP Director described staffing, review times, FedRAMP 20x, and the end of new Rev5 certifications.
Barriers. Members named unclear terms, IG and audit pressure, old tools and manual work, contractors' incentives to keep manual work, and providers' fear of pushing back.
Proposed work. Members suggested a reuse guide, FAQs for each audience, IG outreach, acquisition language, risk principles, and tool advice.
Next steps. Committee leaders will review the notes and pick focus areas for the next meetings. No votes were taken.

Who was there, and what was the meeting for?

The Designated Federal Officer opened the meeting. All 11 active members were present, so the committee had a quorum (6 were needed). The committee had three open seats: two for agency Chief Information Security Officers (CISOs) and one for a large cloud service provider. GSA was taking applications until 5:00 p.m. Eastern time on June 12, 2026.

The Federal Register notice said FedRAMP would brief members and the committee would set its agenda for the rest of 2026, including agency adoption and reuse. It set three more meetings: July 27, August 31, and November 2, 2026. One member of the public spoke during public comment, to thank the committee for bringing the meeting to the community.

The chair said the 2026 meetings would be shorter because a smaller team supports the committee. The chair said the questions should be what would help agencies trust and reuse certifications more consistently, and what would cut duplicate agency reviews.

What did FedRAMP tell the committee?

The FedRAMP Director said this would be the last long briefing FedRAMP plans to give the committee, because members can follow FedRAMP's public material. The Director gave these figures:

FedRAMP has about 30 staff, is hiring about 15 more, and expects a budget of about $10 million a year.
Reviews now average 22 to 25 days. In August 2024 more than 100 systems waited for review, with expected waits of 12 to 16 months.
More than 500 services are FedRAMP Certified.
FedRAMP 20x removes the need for an agency sponsor. The rules set Classes A, B, and C, with a Class D pilot for high-impact services to follow.
FedRAMP set June 11, 2027, as the target for the last new certifications under the older Rev5 process. The Director said the end date for current Rev5 certifications depends on direction from the White House.

The Director said the FedRAMP Consolidated Rules for 2026 would be final at the end of June. FedRAMP issued them on June 25, 2026.

The Director also said fewer than a quarter of FedRAMP Certified providers had adopted significant change notifications, which let a provider tell agencies about a change instead of asking permission first. The Director's advice to providers was to read their contracts. The Director said most contracts FedRAMP has seen require the provider to keep its FedRAMP Certification by following FedRAMP's rules.

The Director said most agencies have not met deadlines in Office of Management and Budget (OMB) Memorandum M-24-15, such as having a governance, risk, and compliance (GRC) tool. FedRAMP plans to publish simple JavaScript Object Notation (JSON) schemas for some materials, so tools can read them.

Why do agencies still not reuse a FedRAMP Certification?

The chair said in the meeting that "Reuse is not just a FedRAMP process issue." The chair called it also an agency behavior, policy, procurement, risk management, and trust issue. Members named these barriers:

Unclear terms. A member said a certification only informs an agency's own authorization, so the word "reuse" confuses people. The FedRAMP Director answered: "What is reused are the assessment materials and the process." The law says those materials are presumed adequate for an agency's authorization to operate (44 U.S.C. 3613(e)). The agency head can still decide there is a demonstrable need for more security requirements. The Director said M-24-15 requires the agency to document that and share it with FedRAMP.
Auditors. The same member called the IG community the biggest barrier, because agencies follow what their auditors expect. A member from a cloud service provider suggested working through the Council of the Inspectors General on Integrity and Efficiency (CIGIE).
Skills, budget, and tools. A member from the Securities and Exchange Commission said agencies lost skilled staff. "The problem is skills and budget," the member said. The member said staff still copy data from spreadsheets into old GRC tools, and asked how tools could take in provider data directly.
Fear of pushing back. A member from a cloud service provider said most providers will not tell an agency it is not following FedRAMP's rules, because they fear for the contract. The member said a correction "won't come from the CSPs" (cloud service providers).
Mapping to controls. The Department of War authorizing official for cloud said a mapping from FedRAMP 20x to National Institute of Standards and Technology (NIST) controls could help agencies see where the risks are.

What could the committee produce in 2026?

The independent assessor member proposed two sets of material: FAQs and white papers to teach agencies, and matching material that providers and assessors can send to an agency that pushes back. A member from NIST suggested FAQs for each audience that explain roles, the presumption of adequacy, and what the agency still owns. The minutes list six possible products: a reuse best practices guide, FAQs for each audience, outreach to the IG community through CIGIE, acquisition guidance and model language, common principles for judging risk that keep agency discretion, and advice on tools and automation.

Two members questioned the framing. The member from the Securities and Exchange Commission asked why GSA sees reuse as a problem when agencies must already reuse certifications, and what the committee adds. The chair said the committee's value is its mix of agency, industry, and assessor members. Another member said the aim should be to certify services agencies need, not to push adoption of any certified service.

The chair closed by naming education of all stakeholders, the IG community, and fitting agency risk together with certification as the strongest themes. The minutes say committee leaders will review the notes and pick focus areas for the next meetings. The committee met next on July 27, 2026.

Sources

Share this post:LinkedIn X Email

A weekly email on Fridays, an alert on the day the watch finds something new, or both. Free.