Proposed Delta Assessment aims to align FedRAMP 20x with GovRAMP requirements while reducing duplicative assessment efforts.
INDIANAPOLIS (Nov. 2, 2026) – GovRAMP today announced the launch of the public comment period for Request for Comments (RFC) GR-2601, which proposes a 20x Delta Assessment to support alignment between FedRAMP 20x and the GovRAMP security verification requirements.
The proposed approach seeks to reduce duplicative assessment effort while maintaining the security assurance, consistency, and risk-based validation that government agencies rely on when evaluating cloud products and services.
The public comment period is open through Dec. 4, 2026, at 5p.m. ET. GovRAMP invites government agencies, cloud service providers, third-party assessment organizations (3PAOs), consultants, and other interested stakeholders to review the proposal and submit feedback.
Government agencies and cloud service providers often navigate overlapping cybersecurity requirements and assessment processes. Improving alignment across frameworks may help reduce unnecessary work, encourage evidence reuse and support more consistent security assessments.
The proposed approach builds on discussions within GovRAMP's Framework Harmonization Working Group, Standards & Technical Committee, Appeals Committee, and broader stakeholder engagement efforts.
The proposed Delta Assessment is designed to harmonize FedRAMP 20x and GovRAMP verification requirements, serving as a bridge between the modernized assessment concepts introduced through FedRAMP 20x and the established NIST-based requirements that underpin GovRAMP and many of the security frameworks relied upon by state, local, tribal, and territorial (SLTT) governments. The approach is intended to complement the FedRAMP 20x vision while maintaining the consistency and confidence government agencies require when evaluating cybersecurity risk.
GovRAMP leadership remains committed to engaging the community throughout this process and welcomes feedback to help ensure the program balances security, operational practicality, and trust across the public sector ecosystem.
The proposed 20x Delta Assessment is designed to define consistent scoping for FedRAMP 20x Key Security Indicators (KSIs) leveraging NIST assessment objectives guidance.
It includes two primary components:
Part A: Aligning FedRAMP 20x KSIs with NIST Assessment Guidance
This component proposes guidance and assessment objectives based on the crosswalk analysis of FedRAMP’s 20x KSIs to NIST controls to support consistent, repeatable assessments.
Part B: Addressing Outstanding NIST Controls
This component proposes a risk-based approach to evaluating NIST controls that are not currently mapped to FedRAMP 20x KSIs, helping identify where additional validation may be needed.
The proposed approach would apply to cloud and service providers pursuing GovRAMP Core, Ready, or Authorized verification, with assessment expectations based on the applicable security requirements.
Through RFC GR-2601, GovRAMP is seeking feedback on the proposed assessment methodology, its alignment with government security requirements, and potential implementation considerations. The RFC also invites input on specific assessment requirements, including System Security Plan (SSP) documentation, annual penetration testing, and supplemental evidence for malicious code protection.
Feedback from public and private sector stakeholders will help inform GovRAMP's evaluation of the proposal and potential next steps. Participation is open to GovRAMP members and non-members.
GovRAMP encourages all interested stakeholders to review the proposed 20x Delta Assessment and share their perspectives during the public comment period.
Public Comment Deadline: Dec. 4, 2026, at 5 p.m. ET
Review RFC GR-2601 | Download GR 20x Delta Analysis Record | Submit feedback
Stakeholders may also submit feedback by emailing rfc@govramp.org with the subject line "RFC for 20x Delta Assessment." Email submissions should include the respondent information and feedback requested in the RFC.
For additional background on GovRAMP's framework harmonization efforts, visit the Framework Harmonization Working Group page to access the Oct. 9 session recording.
GovRAMP welcomes stakeholder input to help evaluate the proposed Delta Assessment and inform an approach that balances assessment efficiency with meaningful security assurance.
GovRAMP is a nonprofit membership organization dedicated to advancing consistent, trusted cybersecurity practices across state, local, tribal, and educational government. Guided by its mission to make cybersecurity easier to understand, implement, and maintain, GovRAMP provides a standardized framework, independent validation, and community-driven education that help governments adopt secure cloud solutions with confidence while enabling service providers to demonstrate trusted security through clear, evidence-based practices. By bringing together public and private sector partners, GovRAMP supports policy collaboration, strengthens shared assurance, and helps build a more resilient cybersecurity ecosystem that protects government services, data, and the communities they serve. Learn more at GovRAMP.org.