It was never about security
Start with this: FedRAMP stands for Federal Risk and Authorization Management Program. Risk. Authorization. Management. Notice what word isn’t in there.
The common misconception is that FedRAMP exists to define what “secure” means and to make sure cloud services clear some security benchmark. It doesn’t, and it never did. FedRAMP’s mission was never to ensure the security of cloud services. It was and is to help agencies manage risk.
Don’t take my word for it. Read the FedRAMP Authorization Act. It’s not long, about 3,500 words. Here is how the law describes the program:
The Administrator … shall establish a Government-wide program that provides a standardized, reusable approach to security assessment and authorization for cloud computing products and services that process unclassified information used by agencies.
A standardized, reusable approach to assessment and authorization. That’s the job. Nowhere in the Act is FedRAMP tasked with, or empowered to, ensure that cloud services are secure.
I counted
I got curious, so I counted. Leave out proper names like “Department of Homeland Security” and the word “security” shows up 17 times in the Act. Look at how it’s used, though: “security assessments,” “security controls,” “security requirements,” “security authorizations.” Almost every time, “security” is describing a process. It’s an adjective attached to paperwork.
By my count, only about three of those 17 are about actually securing anything, like “ensure the security of data stored or processed.” Even those are about FedRAMP reviewing or measuring things, not about FedRAMP guaranteeing an outcome.
The decision belongs to the agency
So who decides what “secure enough” means? The agency does. It always has.
The Act says a FedRAMP authorization package is “presumed adequate” for an agency to use when it issues its own authorization to operate. Then it immediately says that presumption does not change the agency’s responsibility to comply with FISMA, or its authority to require additional security requirements beyond what FedRAMP included.
In other words: FedRAMP hands you a well-organized, reusable body of evidence. What you do with it is your call. The agency owns the risk decision. The agency owns the ATO. FedRAMP owns the framework that makes it possible for many agencies to look at the same evidence instead of each building their own from scratch.
That’s the design. Risk tolerance is mission-specific. What’s acceptable for a public-facing collaboration tool isn’t acceptable for a system handling law enforcement data. There is no single definition of “secure” that works for every agency, and the law doesn’t pretend there is.
So what does that mean for 20x?
I hear a lot of “20x is lowering the bar” and, from the other side, “20x will make cloud services more secure.” Both miss the point.
The changes in 20x are not intended to make systems more secure. They are intended to make the process of assessing and authorizing cloud services faster, cheaper, and more useful to the people who actually have to make risk decisions. Machine-readable evidence, continuous validation, Trust Centers — all of it is aimed at getting better information in front of agencies sooner.
Will that lead to more secure systems? I hope so. Better information usually leads to better decisions, and providers who have to show their work continuously tend to keep their work in better shape. But that’s a side effect. The requirement is better risk management.
If you’re a provider, stop thinking of FedRAMP as a security test you pass. Think of it as the way you explain your risk to the people who have to accept it. If you’re an agency, stop treating a FedRAMP authorization as someone else telling you the system is secure. It’s evidence. The decision is still yours.
It was never about security. It was always about risk.