What the FSCAC is: FedRAMP's advisory committee, and why FedRAMP wants its advice aimed at everyone
The Federal Secure Cloud Advisory Committee advises GSA, the FedRAMP Board, and agencies on secure cloud adoption. In a June 2026 video, FedRAMP said it wants the committee's advice to help agencies and industry act, not to ask FedRAMP to spend more.
By FedXchange ·
Play the video: The Federal Secure Cloud Advisory Committee (FSCAC)On June 8, 2026, the Federal Risk and Authorization Management Program (FedRAMP) posted a short video that explains the Federal Secure Cloud Advisory Committee (FSCAC). The committee's Designated Federal Officer and FedRAMP staff speak in it. It came out on the day of the committee's June 8, 2026, meeting, which a speaker said was its first meeting since August of the year before.
In short:
- What the FSCAC is. An advisory committee set up by 44 U.S.C. 3616, part of the FedRAMP Authorization Act. It advises the Administrator of the General Services Administration (GSA), the FedRAMP Board, and agencies on the secure adoption of cloud services.
- What FedRAMP said. A FedRAMP speaker said past meetings focused too much on asking GSA to spend more money and do more, which was not helpful. FedRAMP wants advice that agencies, cloud service providers, and FedRAMP can act on.
- Who it affects. Agencies that adopt and reuse FedRAMP Certified services, and cloud service providers that hold or seek a FedRAMP Certification.
- What they can do. Attend the public meetings and send comments through GSA's FSCAC page.
Sources: 44 U.S.C. 3616, the Federal Register notices of May 18 and May 21, 2026, and GSA's FSCAC page.
Read the steps as text
- Members are appointed. The GSA Administrator appoints up to 15 members from government and industry, in consultation with the Director of the Office of Management and Budget (OMB).
- It meets in public. The law requires at least three meetings each calendar year. GSA announces the meetings in the Federal Register, and the public can attend.
- It examines FedRAMP. Members look at how FedRAMP works and how it could improve, such as increasing agency reuse and reducing cost and burden.
- It gives advice. The committee advises the GSA Administrator, the FedRAMP Board, and agencies. Its recommendations are advice, not rules.
Who sits on the committee?
The law and GSA's May 21, 2026, Federal Register notice set the makeup. The committee has up to 15 members. The GSA Administrator or a designee chairs it. Seats include at least one member each from the Cybersecurity and Infrastructure Security Agency (CISA) and the National Institute of Standards and Technology (NIST), at least two agency Chief Information Security Officers, at least one agency Chief Procurement Officer or equivalent, at least one independent assessment organization, and at least five cloud businesses, two of them small businesses.
Members serve three-year terms. In the video, one speaker said the committee brings together the people who build and run cloud services, the people who assess their security, and the people who use them.
What does FedRAMP want from the committee?
A FedRAMP speaker said the committee's early focus was mostly recommending that GSA spend more money and take on more work, and that this made it hard to get value from the meetings. The speaker said FedRAMP's job is to work within the policies, regulations, and laws set for it.
The speaker read the committee's duties in a new way. For example, the law asks the committee to help increase agency reuse of FedRAMP authorizations, which are now called FedRAMP Certifications. The speaker said that means giving agencies advice on how they can increase reuse, not giving FedRAMP advice on how to do it. The same applies to ideas for reducing burden: FedRAMP wants ideas that industry and agencies can work on together, not new spending on FedRAMP's side.
The speaker said FedRAMP has been trying to redirect the committee to advise everyone, including agencies and cloud service providers, and not only FedRAMP.
Sources
- FedXchange tracker: The Federal Secure Cloud Advisory Committee (FSCAC) video (June 8, 2026)
- YouTube: The Federal Secure Cloud Advisory Committee (FSCAC)
- 44 U.S.C. 3616: Federal Secure Cloud Advisory Committee
- FedRAMP Authorization Act (Public Law 117-263, section 5921)
- Federal Register: FSCAC accepting open membership applications (May 21, 2026)
- Federal Register: FSCAC notification of upcoming meetings for 2026
- GSA: Federal Secure Cloud Advisory Committee
- FedXchange tracker: FSCAC Meeting, June 8, 2026
Get new posts and federal governance by email
A weekly email on Fridays, an alert on the day the watch finds something new, or both. Free.