The CSP-AB supports the proposed changes in RFC-0004, praising FedRAMP’s efforts to enhance monitoring, streamline assessments, and improve efficiency. It reaffirms the value of the “do once, use many” model and welcomes continued collaboration to advance federal cloud security.

CSP-AB, with industry partners, urges the DoD to revise its proposed DFARS rule, warning it could hinder innovation and overreach. The submission calls for a narrower scope, clearer terms, and protection for commercial and open-source technologies.

In September 2024, FedRAMP proposed updates to cryptography standards and performance metrics, introducing a more flexible, risk-based approach. While welcomed by CSPs, concerns remain around implementation challenges and validation delays ahead of the planned January 2025 rollout.

The CSP-AB supports CISA’s proposed CIRCIA rules but urges refinements to better focus on critical incidents, avoid redundant reporting, and protect sensitive data—while promoting cooperation over punitive enforcement.

The CSP-AB supports security-focused IaaS regulations but urges a more practical approach. It warns against overly broad identity checks, vague ownership definitions, and burdensome AI reporting, calling instead for targeted, collaborative solutions that safeguard both innovation and privacy.

In February 2024, the CSP-AB responded to FAR Cases 2021-017 and 2021-019, supporting cybersecurity goals but urging use of existing FedRAMP accreditations and regulatory alignment to avoid unnecessary burdens on IT companies.

The CSP-AB supports OMB’s updated FedRAMP guidance and urges faster, more automated processes to align with modern cloud needs. Its recommendations focus on streamlining authorizations, enhancing monitoring, and fostering secure, scalable cloud adoption.

CSP-AB urges CISA to align its draft Secure Software Attestation Form with FedRAMP, reduce duplication, and allow flexibility. Our response stresses practicality to ensure strong security without overburdening providers.