FSCAC approves its 2026 report on how agencies adopt FedRAMP 20x Certifications, with resource concerns added

On November 2, 2026, the Federal Secure Cloud Advisory Committee approved, by recorded vote, its report to the GSA Administrator on agency use of FedRAMP 20x Certifications. Members added that agencies face tight budgets and staffing. The report is advice, not a rule.

By FedXchange · November 3, 2026

FedRAMP's video, on its governance tracker page. The player loads from YouTube only when you press play.

On November 2, 2026, the Federal Secure Cloud Advisory Committee (FSCAC) held its last public meeting of 2026. The FSCAC is the advisory committee that the FedRAMP Authorization Act created in 44 U.S.C. 3616. It advises the Administrator of the General Services Administration (GSA), the FedRAMP Board, and agencies. FedRAMP is the Federal Risk and Authorization Management Program. The committee's recommendations are advice. They do not change FedRAMP's rules.

The meeting had one main task: decide whether to approve the committee's written report to the GSA Administrator. The report builds on the three recommendations the committee approved at its August 31, 2026, meeting.

In short:

What the committee decided. The committee approved its 2026 recommendations report, with the changes members made during the meeting, by a recorded vote. The chair announced, "The motion carries." The chair and the Designated Federal Officer will make editorial corrections, send the report to the GSA Administrator, and make it public.
What the report recommends. A FedRAMP 20x agency playbook, continued open collaboration among agencies, cloud service providers, and assessors, and direct engagement with agencies. All three are about helping agencies use the evidence behind a FedRAMP 20x Certification in their own risk decisions.
What members changed. The report now says GSA "should coordinate" the playbook. The earlier draft said "GSA/FedRAMP could coordinate" it. Members also added a statement that agencies are under significant financial and resource constraints.
What it means for agencies and cloud providers. Nothing changes yet. The GSA Administrator decides whether and how to act on the advice. As of November 10, 2026, GSA's FSCAC meetings page did not yet post the report or the minutes for this meeting.
What comes next. The committee began talking about small business participation in FedRAMP as a possible 2027 topic. It took no vote on that topic.

How the FSCAC's 2026 report came together

Sources: GSA's FSCAC meeting pages and the November 2, 2026, meeting video. The report is advice to the GSA Administrator, not a FedRAMP rule.

Read the steps as text

June 8. The committee considered where it could be most useful in 2026, and its work turned to how agencies adopt and use FedRAMP Certifications.
July 27. Members heard a briefing on agency adoption and reuse data.
August 31. The committee approved three recommendations: a 20x agency playbook, open collaboration, and direct agency engagement.
November 2. Members amended the draft report and approved it by recorded vote.
Next. The chair and the Designated Federal Officer send the report to the GSA Administrator and make it public.

Did the committee vote on the report?

Yes. At roll call, the Designated Federal Officer counted 10 of the committee's 13 members present. Seven members make a quorum, which the committee needs for any official action.

Near the end of the review, the chair read the motion. It approves the report with the amendments agreed that day. It also lets the chair and the Designated Federal Officer make non-substantive editorial corrections and send the report on. A member moved it. No member raised discussion. The Designated Federal Officer then called each member's name for a recorded vote of yes, no, or abstain. One member had already left the meeting.

The automatic captions do not capture every member's answer clearly, so this post does not give a vote count. The captions record no "no" vote or abstention. In the meeting, the chair said: "The motion carries, and the committee has approved the report as amended." Before the meeting closed, the chair said again, for the record, that the committee approved the report as amended.

GSA's agenda for the meeting listed a "Vote to finalize FSCAC recommendations adoption and reuse plans to the FedRAMP Director." In the meeting, the chair and the Designated Federal Officer described the report as going to the GSA Administrator.

What does the report ask GSA to do?

The chair said the problem is that agencies use 20x evidence in different ways. That can lead to uneven requests to providers, extra review, and doubt about what an agency can rely on. Each agency still makes its own risk decision.

A 20x agency playbook. The draft lists six proposals. They include explaining who is responsible for what, a usable agency workflow, help reading the different kinds of evidence, checklists and examples for agency roles, how the playbook relates to existing requirements, and a pilot before regular updates. The report says the playbook should be consistent with National Institute of Standards and Technology (NIST) standards and guidelines. A non-federal member asked to add a mapping of Key Security Indicators (KSIs) to the organization-defined parameters (ODPs) in NIST Special Publication 800-53. The committee added it.

Continued open collaboration. The report proposes an open, vendor-neutral way for practitioners to share workflows, decision guides, and lessons learned. It leaves the host and owner open. A federal agency member asked that readers be able to tell vendor contributions from agency contributions. The committee added that they must be clearly distinguishable. Another member asked whether this repeats meetings FedRAMP already holds. The Designated Federal Officer said the recommendation also tells the GSA Administrator that the committee finds this work worthwhile. Members changed "create a transparent process" to "support" one.

Direct agency engagement. The report proposes demonstrations, workshops, office hours, and peer learning through existing forums, including in-person meetings where practical. A federal agency member raised a concern that agencies have no common baseline for using 20x evidence consistently. The committee recorded the concern without changing the text.

What did members say about agency resources?

Federal agency members said agencies do not have the staff or money to build a playbook. One said their agency barely has the resources for its required work. A member said GSA must be named as responsible, in active voice. The committee struck "FedRAMP" so the text says GSA should coordinate the playbook with agency practitioners, the FedRAMP Board, the Office of Management and Budget (OMB), NIST, and relevant councils.

The Designated Federal Officer reminded members of the committee's role: "Your responsibility is to provide advice to the GSA administrator. That does not necessarily mean it becomes a mandate." (Words from the meeting.)

Members added a sentence to the report's implementation section. As read back in the meeting, it says that "given agencies are under significant financial and resource constraints," the suggestions "should take into account these constraints." They also added that FedRAMP should remain responsive to a changing security environment, including federal agencies' needs, and should release new rules and revisit earlier rules as planned.

Why does the FedRAMP Authorization Act's sunset matter?

The Designated Federal Officer said the coming year matters because the FedRAMP Authorization Act, including the provisions that set up the committee, sunsets unless Congress extends or replaces them. The captions garble the date. The law sets it. The note to 44 U.S.C. 3616 says its repeal takes effect 5 years after December 23, 2022, the day the FedRAMP Authorization Act became law. That is December 23, 2027.

What could the committee take up in 2027?

The chair proposed small business participation in FedRAMP as a 2027 topic. The chair listed changes that 20x brought:

Providers can seek a FedRAMP 20x Certification without an agency sponsor.
FedRAMP's timeline shows the 20x Class B and C pipeline opened on August 31, 2026.
KSIs and machine-readable evidence replace many static documents.
FedRAMP's deadlines page says no new applications for FedRAMP Rev5 Certification will be accepted after June 11, 2027.

A long-serving member opposed the topic. The member said agencies do not lack choices and the high security bar is a benefit. Another member disagreed and asked to take it up at another meeting. The chair said the input will help prepare a focused discussion at the committee's first meeting in 2027.

The meeting also included one written public comment, read aloud by the Designated Federal Officer. It suggested measuring the extra time, effort, and reasons for added requests each time an agency adopts a FedRAMP Certified service, including for small providers who withdraw.

Sources

Share this post:LinkedIn X Email

A weekly email on Fridays, an alert on the day the watch finds something new, or both. Free.