The 2 Things I Wish I Could Change About FedRAMP

How could FedRAMP improve without lowering security standards? Kenny's got thoughts.

Kenny Scott
|
53
min read

In This Article

If I had the Elder Wand, here’s how I'd immediately change FedRAMP:

1- Eliminate the Agency Sponsorship Requirement

Empower companies to pursue FedRAMP independently – no more waiting for the stars to align. Removing this barrier would accelerate innovation without sacrificing quality.

2- PMO Oversight of 3PAOs (Not CSPs) 

The FedRAMP PMO should borrow a page from the AICPA's playbook for CPA firms and directly audit and oversee 3PAOs. 

This change would streamline approvals while maintaining the rigorous standards FedRAMP demands.

Why These Changes to FedRAMP Could Help

These two simple shifts would dramatically improve accessibility without lowering FedRAMP’s high security standards

Achieving FedRAMP compliance means operating at the highest levels of security – beneficial even if you never directly sell to the government. Your customers that do sell to the government will thank you.

What would you change? Share your ideas over on LinkedIn.

PS, if you've been scared of FedRAMP – it's faster, less expensive, and easier than ever with Paramify. Check out a demo today to see how much better it can be.

Kenny Scott
Kenny is an accomplished leader with a two decade tenure in Information Security and IT Audit. He's widely acknowledged in the industry and has a profound dedication to it. In addition to his technical expertise, Kenny's portfolio includes substantial experience in business strategy, investment, and programming. On the personal side, Kenny is a devoted husband to Angie Scott and a proud father of five. A music enthusiast, he relishes playing the guitar and enjoys surfing when a beach is within reach.
Mar 2025
Related posts

Paramify blog

Interviews, tips, guides, industry best practices, and news.

Top FedRAMP 3PAO Assessors to Use With Paramify

Find the best audit partner for your FedRAMP authorization with this list of the top 8 3PAO assessors, perfectly paired with Paramify to accelerate your compliance journey and save time and costs.
Read post

FedRAMP vs. ITAR: Key Differences and Compliance Considerations

Understand the critical differences between FedRAMP and ITAR , and how they work together, to master compliance for federal cloud security and defense tech exports.
Read post

3 Parts of the FedRAMP Compliance Process You Can Automate — And How to Do It.

Your SaaS organization can drastically reduce the time and costs of the traditionally lengthy and expensive FedRAMP compliance process by using automation tools to streamline the process.
Read post