Cybersecurity Today TV - Ep 80 - FedRAMP 20x: The Future of Federal Cloud Security

In this episode of Cybersecurity Today, host Jim Wiggins interviews Gary Guercio, VP of Operations at Fortreum, about FedRAMP 20x, the next evolution of the Federal Risk and Authorization Management Program. The discussion begins with an overview of FedRAMP’s original purpose: to streamline cloud security authorization for federal agencies by establishing a single baseline, reducing the burden on cloud service providers (CSPs) who previously had to meet varying requirements per agency. Guercio explains that FedRAMP 20x aims to address the program’s shortcomings, such as lengthy timelines (18 months to 3 years), the need for federal-specific cloud builds, and the challenge of finding an agency sponsor. The new approach shifts from document-heavy compliance to outcome-based, automated evidence and continuous validation. Key Security Indicators (KSIs) are introduced as outcome-driven metrics that CSPs must report on in near real-time, replacing traditional control-based assessments. The program introduces a new classification system (Class A, B, C, D) based on the amount of information provided, with Class A allowing reciprocity with other frameworks like SOC 2, and Class D remaining similar to the old high baseline. The role of assessors (formerly 3PAOs) changes to validating the processes that produce KSIs rather than checking controls. Guercio advises agencies to carefully match data sensitivity with the appropriate class level and highlights that CSPs can now bring commercial products to the federal market more easily. The episode also covers recent cybersecurity news, including a Chrome zero-day and a DentaQuest breach.