FedRAMP 20x Workshop

This two-session, immersive workshop provides Federal employees, cloud service providers, contractors, assessors, and cybersecurity professionals with a practical understanding of FedRAMP 20x and the modernization of the Federal Risk and Authorization Management Program. The workshop is designed to help participants understand how FedRAMP is evolving from a predominantly document- and control-centric authorization model toward an approach that emphasizes measurable security outcomes, reusable security evidence, automation, continuous assurance, and machine-readable certification information.

Participants will examine the policy and operational foundations of FedRAMP 20x, including OMB Memorandum M-24-15, the FedRAMP Consolidated Rules for 2026, FedRAMP certification types, certification classes, authorization boundaries, certification packages, Key Security Indicators (KSIs), Security Decision Records (SDRs), independent verification and validation, vulnerability management, and ongoing certification requirements. The workshop also explains the continuing relationship between FedRAMP 20x, FedRAMP Rev5, Federal agency authorization responsibilities, and the NIST Risk Management Framework.

The workshop emphasizes the practical differences between traditional FedRAMP practices and the emerging FedRAMP 20x model. Participants will explore how security assertions are increasingly supported by measurable evidence, how certification information can be maintained and shared continuously, how automation can strengthen verification and validation, and how Federal agencies can reuse FedRAMP certification evidence while remaining responsible for their own authorization and risk-acceptance decisions.

The workshop combines instructor-led presentations, case studies, guided discussions, and applied exercises that bridge policy, security engineering, assessment, and authorization practice. Participants will analyze realistic cloud-service scenarios, evaluate certification scope and evidence, examine Key Security Indicators, assess vulnerabilities using risk-based information, and consider how cloud service providers, independent assessors, and Federal agencies interact throughout the certification and authorization lifecycle.

By the conclusion of the workshop, participants will possess the knowledge and practical skills needed to understand the FedRAMP 20x model, interpret current FedRAMP requirements, distinguish certification from agency authorization, evaluate security evidence and assurance information, and support the implementation, assessment, use, and ongoing oversight of FedRAMP-certified cloud services.

Intended audience: This workshop is intended for Federal employees, cloud service providers, government contractors, cybersecurity professionals, assessors, risk management personnel, and compliance professionals who want to understand the evolving FedRAMP 20x model and its impact on Federal cloud security and authorization. It is particularly relevant for cloud security engineers, system owners, security architects, 3PAO personnel, assessors, GRC professionals, program managers, Authorizing Officials, and technology leaders involved in the implementation, assessment, authorization, or oversight of Federal cloud services. The course is also well suited for personnel responsible for security evidence, continuous monitoring, vulnerability management, certification packages, and the reuse of FedRAMP assurance information across Federal agencies. No prior experience with FedRAMP 20x is required, although a general understanding of Federal cybersecurity, cloud computing, risk management, system authorization, security controls, or compliance concepts is helpful.

Virtual Event: The event will be held using Teams.  The instructor will provide logistics details and the Teams link prior to the event.