Rep. James Walkinshaw, D-Va., said on Thursday that Congress has an opportunity to strengthen the Federal Risk and Authorization Management Program (FedRAMP) as lawmakers prepare to reauthorize the cloud security program before its statutory authorization expires next year.
Speaking on July 23 at GovForward’s Carahsoft FedRAMP Summit in Washington, D.C., Walkinshaw said the upcoming reauthorization should build on recent modernization efforts while ensuring the program continues to maintain rigorous cybersecurity standards.
“As Congress drafts that reauthorization, I think we have an opportunity to consider what changes or clarifications to the statutory framework could help us to fully realize the program’s original goals and adapt to the changing environment and rapidly evolving technology that exists today,” Walkinshaw said.
FedRAMP – a program overseen by the General Services Administration – aims to provide a standardized, government-wide approach to security assessment, authorization, and continuous monitoring for cloud products and services used by federal agencies.
In March 2025, the program launched FedRAMP 20x, a revamp effort that places a heavy focus on automation to speed the approval process for secure cloud services authorized by the program.
Congress passed the FedRAMP Authorization Act in late 2022, which codified the FedRAMP program into federal law. However, FedRAMP’s authorization expires at the end of fiscal year 2027, meaning Congress will need to pass legislation reauthorizing the program before that date.
Walkinshaw said Congress should use the reauthorization process to evaluate whether the FedRAMP Program Management Office (PMO) has the resources it needs to recruit and retain highly technical staff. He also said lawmakers should ensure the program’s reforms are measured by outcomes.
“The purpose of FedRAMP is not just to produce a large number of certifications. It’s not about numbers,” Walkinshaw said. “The goal is to make it easier for agencies to securely adopt and reuse modern cloud services.”
Walkinshaw also said Congress should explore measures that encourage and provide greater transparency around the transition from FedRAMP certification to agency authorizations to operate (ATOs).
“Without the right incentives for agency participation, I think there’s a risk that progress stalls at the PMO level due to staffing shortages, maybe agency unfamiliarity with the new process or lack of enthusiasm for the new process, and if that happens, we won’t fully realize the benefits of the progress that’s been made,” he said.
Walkinshaw added that Congress should continue looking for ways to reduce the time and cost of FedRAMP certification through technology while requiring the PMO to engage regularly with industry.
“I think it should be in statute that the PMO engage regularly with industry to get feedback,” he said. “Those of us in government shouldn’t be in walled gardens or ivory towers.”
“We need to be engaging regularly with stakeholders who understand our programs from a different perspective,” the lawmaker added. “I want to ensure that FedRAMP is doing that now and into the future.”
At the same time, Walkinshaw cautioned that streamlining the process should not weaken security reviews.
“Our goal should be a faster, more predictable process that reduces or eliminates duplication while maintaining the strong and, in some cases, specific security standards that agencies need and the public relies on,” he said.
As the reauthorization deadline approaches, Walkinshaw said Congress is already working in a bipartisan way on the House Oversight Committee on FedRAMP reform.
He said Congress should use the process to evaluate whether FedRAMP is reducing the time and cost of adopting secure cloud services, encouraging agencies to reuse existing security assessments, and ensuring the PMO and agency chief information officer offices have the personnel and expertise needed to support the program.
Closing his remarks, Walkinshaw said reauthorization should be viewed as part of an ongoing effort to ensure the program continues delivering on its mission.
“We can’t just pass the law and then wipe our hands of it,” Walkinshaw said. “It requires sustained oversight, commitment to building capacity, accountability, and a willingness to revisit whether our program is accomplishing what it was created to do and look for ways to make improvement.”