Agenda

As expectations for government services continue to evolve, agencies are embracing artificial intelligence and automation to deliver faster, more personalized, and more accessible experiences. This keynote will explore how public-sector leaders are moving from CX strategy to execution, leveraging AI and emerging technologies to modernize service delivery, improve outcomes, and strengthen public trust.

A candid conversation featuring senior government leaders on the future of secure cloud adoption and federal technology modernization. Looking beyond today's priorities, they'll reflect on the lasting changes they hope to leave behind, the evolution of FedRAMP including the vision behind FedRAMP 20x, the realities of leading technology policy from inside OMB, and what it takes to successfully partner with the federal government. Attendees will gain firsthand insights into where federal technology is headed, how government is rethinking trust, security, and acquisition, and what these changes mean for agencies and industry alike.

FedRAMP is more than a certification process, it is a trust framework that enables agencies to confidently adopt shared cloud services. This panel brings together agency leaders to discuss how FedRAMP supports mission outcomes, reduces duplicative assessments, and enables faster procurement while maintaining strong security postures.

Join industry leaders for a candid discussion on how FedRAMP modernization is playing out one year in. As the FedRAMP Consolidated Rules for 2026 and FedRAMP 20x reshape the program, panelists will share how CSPs are adapting in real time; what’s working, what’s challenging, and what it means for the future of cloud security in the federal market.

As FedRAMP evolves towards automation, machine‑readable security data, and continuous assurance, the FedRAMP community is redefining what risk management and compliance looks like. Pete Waterman will discuss what is next for FedRAMP and what it means to all FedRAMP stakeholders.

As federal agencies navigate increasingly complex security and compliance requirements, traditional Governance, Risk, and Compliance (GRC) approaches are struggling to keep pace. Disconnected tools, manual processes, and static documentation are no longer sufficient in an era defined by continuous monitoring, automation, and machine-readable evidence. This session explores what a modernized GRC environment could—and should—look like for federal agencies and industry stakeholders. Panelists will examine the concept of a “single pane of glass” for security, where real-time visibility, integrated data, and automated workflows converge to provide a unified view of risk and compliance posture across systems and environments. The conversation will also address the growing imperative for machine readability within frameworks like FedRAMP 20x, and how agencies can evolve their internal capabilities to ingest, validate, and act on continuous data streams rather than point-in-time assessments.

**this session is not being recorded and is subject to Chatham House Rules, meaning there is no attribution to individuals or organizations. This ensures a candid and open discussion environment.**

Achieving a FedRAMP Authorization to Operate (ATO) is a major milestone—but it’s only the beginning of a successful public sector journey. This session explores how cloud service providers and ISVs can effectively leverage their FedRAMP authorization to drive adoption across multiple agencies, turning initial authorization into sustained growth. Panelists will share practical insights into “land and expand” strategies used by leading vendors, including how to position reuse packages, navigate agency-specific procurement processes, and build credibility with mission owners and acquisition teams. The discussion will also highlight what federal buyers expect to see in a strong reuse package—from clear security documentation to evidence of operational maturity and customer success.

**this session is not being recorded and is subject to Chatham House Rules, meaning there is no attribution to individuals or organizations. This ensures a candid and open discussion environment.**

As FedRAMP 20x continues to reshape the authorization landscape, organizations are seeking clarity on what the future state truly looks like—and how to get there. This session moves beyond high-level vision to examine the FedRAMP roadmap in practice, providing a grounded view of where the program stands today, what changes are actively underway, and how both agencies and cloud service providers can align to emerging expectations. Panelists will unpack the current state of FedRAMP 20x initiatives, including the shift toward automation, continuous validation, and Key Security Indicators (KSIs) as a mechanism for demonstrating security posture. The discussion will address one of the most pressing questions facing the ecosystem: how KSIs can be trusted as a reliable, secure, and scalable alternative to traditional control-based assessments.

**this session is not being recorded and is subject to Chatham House Rules, meaning there is no attribution to individuals or organizations. This ensures a candid and open discussion environment.**

As cyber threats multiply, AI accelerates innovation, and technology ecosystems become increasingly interconnected, risk is no longer something any organization - private or public - can manage alone. Yet many security programs still treat risk management as an individual organization's responsibility. GovRAMP was built on a different premise: security is a shared responsibility, and risk management must be shared as well. More than a certification program, GovRAMP brings together governments, providers, assessors, and security leaders around a common framework for trust, accountability, and continuous improvement. This session explores the GovRAMP difference—how a shared risk management model helps organizations navigate a rapidly changing threat landscape, promotes consistent and practical interpretations of security requirements, and creates a stronger foundation for innovation, including the adoption of AI and emerging technologies.

**this session is not being recorded and is subject to Chatham House Rules, meaning there is no attribution to individuals or organizations. This ensures a candid and open discussion environment.**

As demand for secure, cloud-based solutions continues to grow across the federal landscape, a central question emerges: how do we scale the FedRAMP marketplace to meet it? With ambitious goals to dramatically expand the number of authorized products, success will depend on deeper collaboration between government and industry to streamline pathways to authorization and accelerate adoption.

This session explores what it will take to move from today’s state to a future where thousands of secure solutions are readily available to agencies. Panelists will examine how FedRAMP 20x initiatives—including automation, reuse, and machine-readable validation—can reduce friction in the authorization process while maintaining trust in security outcomes. The discussion will also focus on the shared responsibilities required to scale: how agencies can modernize procurement and embrace reuse, and how industry can deliver standardized, high-quality security evidence that supports faster evaluation and broader adoption.

**this session is not being recorded and is subject to Chatham House Rules, meaning there is no attribution to individuals or organizations. This ensures a candid and open discussion environment.**

As the Federal government faces persistent and increasingly sophisticated malicious cyber campaigns agencies must improve how they protect their networks and continuously ensure the security of IT assets. CISA’s recent Binding Operational Directive (BOD) changes how agencies prioritize vulnerability patching and a result FedRAMP is requiring CSPs to implement new Vulnerability Detection and Response and Vulnerability Evaluation and Reporting rules by December 7, 2026. This session explores how agencies and CSPs are approaching this new era of vulnerability management, how responsibilities are shared between CSPs and government stakeholders, and how both sides can work together to maintain a strong security posture without duplicating effort or creating bottlenecks. The discussion will also highlight lessons learned from agencies successfully implementing continuous monitoring at scale—demonstrating how automation, telemetry, and standardized data can reduce manual burden while improving visibility and trust.

**this session is not being recorded and is subject to Chatham House Rules, meaning there is no attribution to individuals or organizations. This ensures a candid and open discussion environment.**