Cloud providers should write example implementation statements for their customers

Every agency that uses a cloud service writes the same sentences. For each control it shares with the provider or owns outright, the agency explains how it meets the control on that service. Hundreds of agencies write these statements for the same few hundred services, one agency at a time, mostly from scratch. Cloud service providers know their own services better than anyone. They should publish example implementation statements for the controls their customers share or own.

The work every agency repeats

Take a typical software-as-a-service (SaaS) tool certified at the Moderate level, now called Class C by the Federal Risk and Authorization Management Program (FedRAMP). The provider handles most controls itself. A good share remain hybrid, where the provider and the agency each do part, or customer-owned, where the agency does all of it. Account management (AC-2), audit record review (AU-6), multi-factor sign-in for agency users (IA-2), and backup of agency data (CP-9) are common examples.

For each one, the agency's system security plan (SSP) needs a statement in the agency's own words. Something like: "The Office of the CIO creates accounts in the service only through the agency's identity provider. The service's administrator console blocks local accounts. The system owner reviews accounts every 90 days." The agency has to know which settings exist, which logs the service can export, and what the provider's features can and cannot do. The provider already knows all of this.

FedRAMP reported 760 new agency authorizations to operate (ATOs) and authorizations to use in fiscal year 2026 alone. (FedRAMP, October 8, 2026) Each one means another agency writing the same customer statements for a service someone else already described.

What FedRAMP asks providers for now

Under the Consolidated Rules for 2026, the Secure Configuration Guide replaces the old Control Implementation Summary and Customer Responsibility Matrix (CIS/CRM). (Notice NTC-0013)

The guide is a real improvement. Providers must explain how to access, configure, operate, and decommission top-level administrator accounts. They must also explain the security settings that only those accounts can change. FedRAMP recommends that the guide be public, ship with secure defaults, and come in a machine-readable form. (Secure Configuration Guide rules) Agencies must read it and configure the relevant settings. (Agency Use rules)

But a configuration guide answers "how do I set this up?" It does not answer "how does my agency meet AU-6 on this service?" The rules for the guide say nothing about control implementation statements or customer responsibilities. FedRAMP says it will "separately work with agencies to create standardized baselines that clearly separate the responsibilities." That work has no published date. Until it arrives, the gap the old matrix half-filled is wider, not narrower.

FedRAMP also tells agencies that their SSP should cover only the agency's own implementation, without copying the provider's package. (Initial use) That is the right rule. It also means every sentence about the agency's side is the agency's to write.

The case for provider-written examples

Providers know the facts. Only the provider knows that the service can export audit records to a security information and event management (SIEM) system, which fields the records carry, and how long the service keeps them. An agency writer has to dig these facts out of documentation and support tickets.

Examples improve accuracy. An agency statement written without the provider's knowledge often claims a feature the service lacks, or misses one it has. Assessors then find the gap. A provider example, tied to the Secure Configuration Guide setting it relies on, gives the agency a correct starting point.

It scales. One provider writing 40 examples once saves every customer agency from writing them again. The more agencies that use a service, the larger the saving.

It fits 20x. FedRAMP 20x moves evidence into machine-readable form. Provider examples can follow the same path: published with the guide, versioned, and tied to the setting each one depends on. Agency governance, risk, and compliance (GRC) tools must already read machine-readable files under Office of Management and Budget (OMB) memorandum M-24-15.

What a good example looks like

A useful example names the control and who does what, gives the agency's part as a short statement with blanks for agency facts, and points to the configuration setting it relies on.

The bracketed parts stay the agency's. The provider does not write the agency's SSP. It writes a correct example that the agency adapts, checks, and owns.

Objections, and answers

"Agencies must write their own SSPs." They still will. An example is a starting point, as the old matrix was. The agency confirms each statement against its own setup and signs for it.

"It creates liability." A provider already states, in its package and its configuration guide, what the service does. An example built only on those statements adds no new claim. Labeling it as an example, not a description of any one agency, keeps the line clear.

"FedRAMP will publish baselines." Good. Standardized baselines will say which party owns each control. Examples say how an agency carries out its part on a specific service. The two fit together.

"Agencies vary too much." The variation lives in the blanks: which office, which tool, how often. The facts about the service do not vary between agencies.

What we suggest

For providers:

• Publish example statements for every hybrid and customer-owned control, beside your Secure Configuration Guide.
• Tie each example to the setting it relies on, and version it with the guide.
• Put changes to examples in your significant change notices. FedRAMP already requires each notice to summarize the customer impact, "including changes to services and customer configuration responsibilities." (Significant change rules)

For agencies:

• Ask providers for examples when you compare services. A provider that can explain your part clearly will likely support it well.
• Feed corrections back through the provider's feedback channel for Ongoing Certification Reports, so the next agency starts from a better example.

For FedRAMP:

• Make example customer statements a recommended part of the Secure Configuration Guide, in machine-readable form, as part of the standardized baselines work.

FedXchange writes agency policies and procedures that name the services an agency actually uses. Provider examples would make that kind of tailoring faster and more accurate for every agency.

Sources

• FedRAMP, Secure Configuration Guide rules.
• FedRAMP notice NTC-0013, June 16, 2026: the Secure Configuration Guide replaces the CIS/CRM, and FedRAMP will work with agencies on standardized baselines.
• FedRAMP, Agency Use rules and Initial agency use.
• FedRAMP, Significant Change Notification rules.
• FedRAMP, From foundation to implementation, October 8, 2026 (fiscal year 2026 agency ATO count).
• National Institute of Standards and Technology (NIST), SP 800-53 Rev. 5, for the controls named as examples (AC-2, AU-6, IA-2, CP-9).