FedRAMP 20x Masterclass Everything you need to know

Описание: FedRAMP 20x is here—and it’s changing compliance from point-in-time paperwork to continuous, machine-readable assurance. In this webinar, Sarah (Director, U.S. Federal Practices at Cression Security) and Isaac (Security Engineer and FedRAMP SME at Paramify) break down what 20X really is, what’s staying, what’s changing, and how to prepare—covering KSIs, OSCAL/YAML evidence, dashboards, RFC-12 vulnerability management, RFC-13 boundary protection, automation tooling, business case and ROI, and the upcoming Moderate pilot.

You’ll learn

What FedRAMP 20X changes (KSIs, machine-readable packages, dashboards)

Why 20X is not easier—it’s more technical and automation-first

The new agency-sponsor dynamic and what it means for GTM

How to build the business case and avoid common ROI mistakes

How to operationalize continuous monitoring (RFC-12)

What to expect from boundary protection updates (RFC-13)

Readiness tips for the Moderate pilot, plus common PMO pushbacks

Speakers

Sarah — Director, U.S. Federal Practices, Cression Security (FedRAMP, StateRAMP, CMMC, CIS 3PAO leadership)

Isaac — Security Engineer and FedRAMP SME, Paramify (led AWS GovCloud build; FedRAMP High-ready in under 4 months)

Timestamps

00:00 Welcome and agenda (housekeeping, chat and Q&A, recording and slides)

01:19 Speaker intros: Sarah and Isaac (backgrounds plus fun facts)

03:44 FedRAMP 20X at a glance: why modernization matters

04:36 What’s new: machine-readable packages (OSCAL or YAML), KSIs, API-driven evidence

06:09 Misconceptions: 20X isn’t easier; assessor validation still required

07:31 Is FedRAMP right for you? The business case and sales implications

10:07 Agency sponsor shift: how 20X changes risk and GTM motion

12:11 Where automation reduces cost and effort (DevSecOps, shift-left)

13:16 Tooling stack: GRC, continuous monitoring, CSPM, CI/CD, evidence generation

15:20 Audit efficiency: why transparency beats green checkmarks

17:05 From point-in-time to continuous monitoring (credit-score analogy)

19:04 Automating POA&M and EMASS-type work; focus on real risk

20:36 RFC-12: risk-based vulnerability management (exploitability, internet-facing, speed)

21:57 Shift-left examples: distroless containers, serverless, vendor selection

22:54 Picking transparent tools; FedRAMP-authorized vs self-hosted options

23:54 Dashboards: real-time posture, trends, and agency-specific focus

25:56 Trends over snapshots: what agencies actually look for

27:55 Ending the pre-audit sprint cycle: operational from day one

29:29 Why 20X dashboards require deeper transparency than SOC 2

30:29 Pilot status: what’s likely to stick (OSCAL or YAML, KSIs, dashboards)

31:22 What may evolve: KSI sets, trust centers, POA&M handling

31:59 What’s changing now: RFC-12 timeline and cultural shift to risk-based

32:18 RFC-13: boundary protection alignment (SC-7 modernization)

33:28 Moderate pilot coming: lessons from Low phase, what to expect

34:55 Readiness tips: study public repos, plan now for Moderate

36:00 Pace and collaboration with PMO; the new FedRAMP law context

40:33 AI Prioritization: emergency tech track, EO 14110 alignment

42:15 Q&A intro

Q&A

42:32 Low to Moderate: how big is the jump in practice

44:13 Is OSCAL required and where YAML fits today

46:08 ROI mistakes: hidden costs, over-insourcing, partner ecosystem

50:12 Common PMO pushbacks: completeness of coverage and evidence mapping

54:02 What evidence counts for KSIs: layers of abstraction and raw data

57:15 Final takeaways and what’s most exciting about 20X

1:00:03 Closing and next steps (recording and slides via email)