FedRAMP 20x Workshop

This two-session, immersive workshop provides Federal employees, cloud service providers, contractors, assessors, and cybersecurity professionals with a practical understanding of FedRAMP 20x and the modernization of the Federal Risk and Authorization Management Program. The workshop is designed to help participants understand how FedRAMP is evolving from a predominantly document- and control-centric authorization model toward an approach that emphasizes measurable security outcomes, reusable security evidence, automation, continuous assurance, and machine-readable certification information.

Participants will examine the policy and operational foundations of FedRAMP 20x, including OMB Memorandum M-24-15, the FedRAMP Consolidated Rules for 2026, FedRAMP certification types, certification classes, authorization boundaries, certification packages, Key Security Indicators (KSIs), Security Decision Records (SDRs), independent verification and validation, vulnerability management, and ongoing certification requirements. The workshop also explains the continuing relationship between FedRAMP 20x, FedRAMP Rev5, Federal agency authorization responsibilities, and the NIST Risk Management Framework.

The workshop emphasizes the practical differences between traditional FedRAMP practices and the emerging FedRAMP 20x model. Participants will explore how security assertions are increasingly supported by measurable evidence, how certification information can be maintained and shared continuously, how automation can strengthen verification and validation, and how Federal agencies can reuse FedRAMP certification evidence while remaining responsible for their own authorization and risk-acceptance decisions.

The workshop combines instructor-led presentations, case studies, guided discussions, and applied exercises that bridge policy, security engineering, assessment, and authorization practice. Participants will analyze realistic cloud-service scenarios, evaluate certification scope and evidence, examine Key Security Indicators, assess vulnerabilities using risk-based information, and consider how cloud service providers, independent assessors, and Federal agencies interact throughout the certification and authorization lifecycle.

By the conclusion of the workshop, participants will possess the knowledge and practical skills needed to understand the FedRAMP 20x model, interpret current FedRAMP requirements, distinguish certification from agency authorization, evaluate security evidence and assurance information, and support the implementation, assessment, use, and ongoing oversight of FedRAMP-certified cloud services.

This event takes place on December 7 and December 9 from 6:00PM – 9:30PM ET.

Registration closes on December 6 @ 5pm. Click the link below for the event agenda, presenters, and registration.

Event Information