Conversation with Khalil Zebdi, Executive Vice President of Federal Business Development, and Hannah Khan, Business Analyst.  

Hannah Khan (HK): Khalil, earlier this year you described healthcare cybersecurity as entering an “autonomy era,” where interoperability, continuous authorization, machine-readable evidence, and security telemetry converge to navigate the evolving cybersecurity landscape. Has that idea evolved further, or has the conversation shifted?

Khalil Zebdi (KZ): It’s the same trajectory, just more in-depth.

Previously, we talked about how cybersecurity functions in a continuously changing environment. You made a great point: it cannot remain periodic; it must become continuous. Evidence must be system-adjacent, authorization must reflect the current state, and security must be driven by telemetry, provenance, and machine-verifiable signals, but once that evidence is accepted, a larger architectural question emerges: Why is cybersecurity the only discipline engineered for continuous change?

Healthcare is modernizing everything at once… the cloud, APIs, FHIR, identity, observability, pipelines… if each evolves independently, we don’t prevent isolation; we multiply it.

The real problem is composition under continuous change.

From Cloud Migration to Platform Architecture

HK: Cloud adoption is now widespread. What actually distinguishes “being in the cloud” from being cloud-anchored?

KZ: The difference is in the way the architecture operates, not just where it's hosted, AKA capability versus location. Running workloads in cloud infrastructure does not, by itself, change architecture. In many cases, it simply relocates legacy systems into a new environment without altering their structural behavior. A cloud-anchored enterprise abstracts shared capabilities into a platform layer that is consumed consistently across the organization. This includes identity, compute orchestration, secrets management, API gateways, observability, configuration management, security policy enforcement, deployment automation, data services, and compliance telemetry.

At ASSYST, this model is implemented through the Green Accelerator, our Application Platform as a Service (aPaaS), which standardizes these capabilities into a governed platform layer designed for reuse and consistency.

This architectural shift is significant; infrastructure becomes code-focused rather than manually configured, environments become reproducible rather than uniquely constructed, configuration drift becomes detectable rather than implicit, artifacts become traceable across their lifecycle, and policy enforcement moves earlier into the build, deployment, and runtime process rather than being applied only after deployment.

In this model, cloud maturity is not measured by migration percentage; it is measured by how effectively shared capabilities are consumed across the enterprise.

Modernization as a Continuous System

HK: How does modernization continue to evolve beyond cloud adoption?

KZ: Traditional modernization assumes systems are static targets that can be incrementally replaced. That assumption breaks down in healthcare because the environment surrounding those systems is also continuously evolving; regulations, clinical workflows, integration requirements, and security expectations all change in parallel.

ASSYST’s modernization platform PhoenixGA treats modernization as a continuous engineering pipeline rather than a discrete project lifecycle. Systems are continuously analyzed for dependencies, decomposed into services where appropriate, reconstructed using API-first principles, embedded with security controls, and refactored as part of an ongoing delivery process. In this model, modernization is no longer a one-time transformation effort; it becomes a runtime capability embedded into the engineering system itself.

Interoperability as a Contract System

HK: Interoperability has been a long-standing goal. What has changed during the push to achieve it?

KZ: The most important change is the level of abstraction at which interoperability is defined. In the past, interoperability was treated as point-to-point data exchange, which led to interface proliferation and weak integration patterns. Modern interoperability is increasingly API-driven, identity-aware, and event-oriented, with FHIR serving as a foundational but still insufficient standard. True interoperability requires more than structural compliance. It requires consistent resource versioning, well-defined terminology binding, reliable identity efforts, enforceable consent mechanisms, traceable provenance, and clearly defined event semantics.

The objective is what we refer to as data liquidity; the ability for authorized data to move across systems without requiring repeated integration work. This aligns with federal direction from the Office of the National Coordinator for Health Information IT (ONC) and the Centers for Medicare & Medicaid Services (CMS), where interoperability is increasingly defined as operational behavior rather than static connectivity. In this context, ASSYST supports ONC eRx and Real-Time Prescription Benefit (RTPB) conformance testing, ensuring systems behave consistently under real-world transaction conditions rather than simply conforming to specifications in isolation.

Therefore, interoperability is not validated by implementation alone; it is validated by behavior under operational conditions.

The Architecture of Seven Contracts

HK: If we look beyond the basic transport of data, what else is required for true interoperability? 

KZ: Interoperability only becomes meaningful when it is expressed as a system of explicit contracts rather than implicit assumptions embedded in code. These seven contracts are transport, semantic meaning, identity resolution, authorization rules, provenance tracking, data quality expectations, and operational behavior such as latency, availability, and versioning. When these contracts are clearly defined and consistently enforced, integration stops being a collection of custom implementations; it becomes infrastructure that can be reused, governed, and evolved systematically.

Data Products as a Reusable Asset

HK: How do data products change the model?

KZ: Data products shift the focus from storage-centric to meaning-centric architecture. Instead of treating data as raw material stored in centralized systems, a data product defines ownership, semantics, quality expectations, freshness guarantees, lineage, and access policies as part of its design.

Without this structure, every consuming team must reinterpret the same data independently, leading to duplicated logic and inconsistent outcomes. 

With data products, the enterprise begins to reuse meaning itself rather than repeatedly reconstructing it through separate pipelines.

Composability and the Cost of Change

HK: Is composability more important than modernization?

KZ: In healthcare, composability is increasingly more important than traditional modernization because the system is never in a finished state. The primary objective is not architectural elegance in isolation, but reducing the cost of change over time.

Composable systems achieve this by enforcing loose coupling between components, supporting versioned interfaces, enabling observability across services, allowing components to be replaced without systemic disruption, and isolating policy enforcement from application logic. In this context, the value of architecture is not measured by the number of systems deployed, but by how easily those systems can evolve without destabilizing the broader environment.

Cybersecurity as a Runtime Property

HK: How does cybersecurity fit into this model?

KZ: We need to stop treating cybersecurity as a periodic audit and start treating it as a live, runtime feature of the system. Instead of relying on periodic assessments, the system should continuously emit evidence about its own state, including configuration integrity, identity posture, vulnerability exposure, dependency health, runtime behavior, and access patterns. The core risk in modern environments is not change itself, but the separation between documented state and actual state. This is why continuous validation has become central to emerging frameworks, such as FedRAMP 20x, which emphasizes machine-readable evidence and ongoing verification rather than static authorization artifacts.

Within this model, ASSYST’s ComplySyncATO platform connects CI/CD pipelines, vulnerability scanning, control mapping, POA&M workflows, and OSCAL-aligned artifacts into a continuous authorization system. The objective is not just to automate compliance processes, but to reduce the latency between technical change and risk understanding.

Drift: The Hidden System Failure

HK: Why is drift so important?

KZ: Drift represents the divergence between intended system state and actual system state, and it is one of the most significant failure modes in complex environments. It occurs across infrastructure, identity systems, APIs, data schemas, configuration layers, security controls, and dependencies. The risk is not that systems change, but that they change without being detected or reconciled against their expected state. In mature architectures, drift is treated as a first-class metric because it directly reflects system integrity over time.

Observability Beyond Monitoring

HK: Where does observability fit into the picture?

KZ: Observability extends beyond traditional monitoring by focusing not just on system status, but on system behavior. In healthcare environments, this requires correlating metrics, logs, traces, events, data quality signals, and security telemetry into a unified understanding of system performance. A system may appear operational from an infrastructure perspective while simultaneously failing at the level of clinical or operational outcomes. Observability is what allows those discrepancies to be detected and understood.

Continuous Assurance as a System Property

HK: Is continuous assurance a cybersecurity concept?

KZ: Continuous assurance is broader than cybersecurity. It’s a system-level property that ensures confidence in security, data integrity, service reliability, configuration correctness, and software trustworthiness at the same time. It sits at the intersection of engineering, operations, and governance, and depends on continuously correlating technical state with risk and compliance expectations.

Evidence as a By-Product of Engineering

HK: What is the most important design principle?

KZ: That evidence should be produced as a natural by-product of engineering activity rather than reconstructed after the fact. Modern systems already generate the necessary signals, code changes, build outputs, deployment records, test results, runtime behavior, access logs, and configuration states. The architectural requirement is to preserve, correlate, and make this information usable for assurance without requiring manual reconstruction.

From Modernization to Mission Capacity

HK: How do you measure success?

KZ: Success should be measured in terms of mission capacity rather than technology deployment. The key question is not how many systems have been modernized, but how effectively the organization can deliver outcomes. This includes improvements in delivery speed, integration efficiency, authorization timelines, system reuse, and responsiveness to change. In government healthcare environments, these improvements directly translate into faster policy execution and reduced operational overhead.

Overall  Perspective

HK: Do you have any final thoughts?

KZ: Healthcare transformation is no longer about modernization programs. It’s about building systems that can evolve continuously without losing control, visibility, or trust. Cloud makes infrastructure programmable, platform engineering makes capabilities reusable, interoperability makes exchange composable, data products make meaning reusable, observability makes system behavior visible, cybersecurity makes change governable, and continuous assurance makes trust continuous.

At ASSYST, these ideas converge across Green Accelerator, PhoenixGA, and ComplySyncATO, each addressing a different layer of the same challenge: operating healthcare systems under continuous change.

Modernization is no longer a transformation event; it is a system property.

ASSYST's Eugene Goldlust will attend the upcoming TechNet Orlando 2026, which brings together leaders from government, the military, industry, and academia to explore how artificial intelligence, cyber capabilities, data, and immersive technologies are transforming military training and readiness. The event will highlight the partnerships and innovations driving the next generation of training, simulation, and mission rehearsal capabilities across the defense enterprise.

TECHNET ORLANDO
Date: September 17, 2026 | Orlando, Florida
Location: UCF, 12809 Science Dr, Orlando, FL 32826, Room 106
Event Website: https://www.federaltrainingpartnership.com/technet-orlando

Eugene Goldlust, Sr. Account Executive
egoldlust@assyst.net
https://www.linkedin.com/in/eugenegoldlust/

I’ll be attending the PAE Maneuver Air Industry Days, August 24–26, 2026, at Fort Rucker, Alabama.

https://rucker.armymwr.com/happenings/pae-maneuver-air-industry-days

I’m looking forward to connecting with Army Aviation leaders, industry partners, and others working to advance aviation capabilities and mission outcomes. The event will be a valuable opportunity to exchange perspectives, learn more about emerging priorities, and explore potential areas for collaboration.

If you’ll be attending, I’d welcome the opportunity to connect.

LinkedIn

The CIO at the Department of War (DoW) recently signaled that significant reforms to the Risk Management Framework (RMF) and Authorization to Operate (ATO) process are officially underway. While initial industry reactions have heavily focused on the promise of trimming bureaucracy and accelerating authorization timelines, the true story lies in a fundamental shift in what compliance is actually supposed to accomplish.

The Overhaul of Traditional ATO

For years, RMF and the traditional ATO process served as the cornerstone for establishing trust in federal systems. This model emerged when infrastructure changed incrementally; security controls could be assessed periodically because the systems themselves evolved at a manageable, predictable pace. Documentation became the primary vehicle through which an Authorizing Official (AO) developed confidence in a system’s risk posture.

But as software engineering accelerates, that document-centric model is struggling to keep pace. Modern defense environments are shaped by cloud infrastructure, DevSecOps pipelines, AI-enabled capabilities, and continuous code deployments. Software and infrastructure are now changing faster than traditional authorization processes were designed to handle. To accurately reflect a system’s real-time risk, the DoW is making a public and structural pivot toward Continuous ATO (cATO), moving away from static paperwork and toward continuous evidence collection and live control monitoring.

A Broadening Web of Compliance: cATO, FedRAMP 20x (CR26), and CMMC

This evolution from a periodic approval process to a continuous risk management function changes the center of gravity for nearly every stakeholder involved in defense technology. But this shift is not happening in a vacuum. The extensiveness of compliance requirements is intensifying across both the public and private sectors, forcing organizations to adapt to a new era of evidence-based security.

• FedRAMP 20x and CR26: The federal government's broader move toward automation is heavily reflected in the finalized FedRAMP Consolidated Rules for 2026 (CR26). CR26 definitively shifts the program away from a paperwork-heavy assessment model and retires the term "FedRAMP Authorization" in favor of "FedRAMP Certification". It relies on automated, machine-readable Key Security Indicators (KSIs) to continuously validate security outcomes. For Cloud Service Providers (CSPs), adapting to these CR26 rulesets is a mandatory reality for operating in the federal market.
• CMMC Level 2: In the private sector, Defense Industrial Base (DIB) contractors are facing the realities of Cybersecurity Maturity Model Certification (CMMC) Level 2. Protecting Controlled Unclassified Information (CUI) requires strict, verifiable adherence to NIST standards. Much like the cATO shift, CMMC demands that compliance operate as an ongoing, demonstrable capability rather than a frantic scramble before an audit.

A Paradigm Shift Felt Across the Delivery Lifecycle

This evolution from a periodic approval process to a continuous risk management function changes the center of gravity for nearly every stakeholder involved in defense technology. Compliance is no longer a late-stage checkpoint; it is a live operational capability that impacts the entire delivery lifecycle.

Here is who needs to be paying attention, and why:

• Program Managers & Mission Owners: Authorization bottlenecks directly affect mission delivery. A cATO state means getting capability to the warfighter at the speed of relevance, not the speed of paperwork.
• Acquisition Leaders: As compliance requirements shift, they directly influence how quickly new technologies can be evaluated, procured, and deployed across the department.
• DevSecOps & Security Teams: Continuous authorization depends entirely on security evidence being natively generated and maintained as systems change. Security cannot be a paused event; it must be built into the daily deployment pipeline.
• Cloud Service Providers & Vendors: Providing reusable, machine-readable, and continuously updated compliance artifacts will become a critical differentiator—and likely a prerequisite—for federal buyers.
• AOs and CISOs: Instead of signing off on historical documentation and accepting point-in-time risk, leadership will transition to making data-driven decisions based on true operational outcomes and real-time control effectiveness.

Transitioning to a Continuous Risk Posture

For agencies, contractors, and cloud vendors, preparing for this web of extensive compliance shifts means treating authorization as an ongoing operating capability rather than an annual documentation event. The evidence supporting RMF, FedRAMP, and CMMC decisions needs to become more current, more accessible, and directly connected to real system behavior.

This requires moving away from manual artifact curation and operationalizing a few key capabilities:

1. Automated Evidence Collection: Establishing pipelines that continuously pull security telemetry from the live environment.
2. Continuous Control Monitoring: Implementing tools for dynamic drift detection that can instantly flag control deviations and automatically generate Plan of Action and Milestones (POA&Ms).
3. Machine-Readable Artifacts: Ensuring that compliance artifacts (like NIST OSCAL) can sync seamlessly with primary GRC tools, which is a core necessity for frameworks like FedRAMP 20x.
4. AI-Enabled Visibility: Leveraging automation and AI not to replace human risk defenders, but to drastically reduce repetitive manual work, organize vast volumes of telemetry, and translate technical data into strict compliance frameworks.

Engineering Real-Time Compliance with ComplySyncATO

The organizations that succeed in this new era will be those that build authorization processes capable of keeping pace with rapid technological change while preserving absolute trust, accountability, and security.

This is exactly where AI-enabled compliance automation becomes a mission-critical asset, and it is the exact environment ASSYST’s ComplySyncATO was built to support. The solution is designed to bridge the gap between traditional requirements and emerging continuous models. It helps agencies and cloud service providers streamline complex ATO workflows.

Whether you are navigating the automated KSIs of FedRAMP 20x, preparing for CMMC Level 2 audits, or shifting a DoW program to cATO, ComplySyncATO natively automates evidence collection and enables real-time continuous monitoring. It ensures that compliance is no longer a destination you reach once a year. It transforms security authorization into a dynamic, data-driven, and continuously informed operational capability.

https://www.assyst.net/cATO

Recently, the U.S. Department of Labor (DOL) Headquarters Frances Perkins Building in Washington, DC, was buzzing with energy as federal technology leaders, mission stakeholders, and industry innovators gathered for the 2026 DOL Tech Expo. ASSYST was thrilled to be right in the middle of the action. The event sparked incredible discussions about the future of government service delivery, the evolving role of the Chief Information Officer, and, perhaps most importantly, how to successfully move AI use cases out of the pilot phase and into full-scale production. Here is a look back at our time at the Expo, the solutions we showcased, and the key takeaways from our conversations with federal tech leaders.

Spotlight on the Green Accelerator Portfolio
At our exhibit, we focused on how automation can reduce friction and speed up digital service delivery to citizens. To demonstrate this, we showcased two core solutions from our Green Accelerator portfolio designed to help software teams build, test, and sustain mission applications securely:

• ComplySyncATO: Our FedRAMP Certified ATO (Authority to Operate) automation solution. As agencies introduce modern, AI-enabled capabilities, ComplySyncATO makes security authorization faster and more transparent. It reduces manual compliance efforts, streamlines evidence management, and strengthens audit readiness so agencies can maintain continuous monitoring without slowing down mission delivery.
• PhoenixGA: Our AI-assisted code development solution. PhoenixGA is built to help software teams use AI to write code faster, improve engineering consistency, and support broader modernization efforts. It ensures that speed, governance, and security work hand-in-hand across the entire software delivery lifecycle.

What We Heard from Federal Leaders
Throughout the event, our team engaged in deep-dive discussions regarding secure software engineering, compliance automation, and responsible AI adoption. If there was one overarching theme from the attendees, it was the urgent need to deliver services at mission speed. John Kimberl, our Business Development Specialist for ComplySyncATO, summed up the mood on the floor perfectly:

"The conversations at the DOL Tech Expo reinforced a clear message: agencies are looking for practical ways to move secure innovation into mission use faster. ComplySyncATO is built for that exact need by helping teams reduce ATO friction, strengthen compliance visibility, and support continuous authorization as modernization and AI adoption accelerate."

Innovation with a Purpose
At ASSYST, our continued investment in cybersecurity automation and cloud modernization is driven by a desire to see these technologies make a tangible impact. We aren't just building tech for tech's sake. As our Chief Operating Officer, Joe Anderson, noted during the event:

"AI and automation are most valuable when they help agencies deliver real operational outcomes. Our focus is not simply to demonstrate emerging technology, but to help agencies use it securely, responsibly, and effectively in mission environments."
 

A Sincere Thank You
We want to extend a huge thank you to the Department of Labor, the event organizers, our fellow industry participants, and all the federal attendees who stopped by the ASSYST table. It was a highly productive day of collaboration, and we left feeling more inspired than ever to keep pushing the boundaries of practical federal innovation.

ASSYST will be represented  by Diego White and Ram Prasad

https://www.assyst.net/team/Diego-White

https://www.assyst.net/team/ram-prasad

connect@assyst.net

ASSYST will participate in the upcoming U.S. Department of Labor (DOL) Tech Expo, joining government and industry leaders in celebrating 250 years of American innovation under the theme "Empowering the Future of Public Service."

• Date & Time: Wednesday, July 22, 2026, 10 a.m.– 4 p.m. ET
• Venue: U.S. Department of Labor, Frances Perkins Building (FPB), Washington, DC
• Audience: All Federal Workforce 
• Website: www.dol.gov/TechExpo

The event brings together the federal workforce and leading technology innovators to explore emerging solutions that modernize service delivery, improve operational excellence, and enhance mission outcomes across government.

At the expo, ASSYST will demonstrate how Artificial Intelligence is transforming application modernization, cybersecurity, and software engineering through solutions designed specifically for the public sector.

Featured demonstrations include:

• Green Accelerator Program – Accelerating legacy modernization with AI, cloud, DevSecOps, and intelligent engineering.
• PhoenixGA – AI-powered legacy application modernization that helps agencies rapidly analyze, understand, and transform legacy systems.
• ComplySyncATO – AI-enabled Continuous Authorization supporting automated cybersecurity compliance and FedRAMP 20x-aligned modernization.
• AI-Integrated Engineering – Intelligent architectures that embed AI throughout the software lifecycle to improve productivity, security, and mission delivery.

"Our focus is helping agencies modernize faster while strengthening cybersecurity and increasing mission capacity," said Joe Anderson, Chief Operating Officer at ASSYST. "The DOL Tech Expo provides an outstanding opportunity to demonstrate practical AI solutions that empower government teams and improve public service."

ASSYST will be represented by Joe Anderson (COO), Eugene Goldlust (Senior Account Executive), John Kimberl (Business Development Specialist), and Meetansh Gupta (AI Engineer), who will be available at the event to discuss modernization strategies and provide live demonstrations.

There is a different kind of energy in the FedRAMP conversations I am having with CISOs, federal program teams, cloud service providers, and industry groups.

The discussion is no longer only about how to prepare a package, how to survive an assessment, or how to keep documentation current. The more important conversation is about whether security evidence can become operational: continuously collected, machine-readable, mapped to real cloud assets, and strong enough to support agency risk decisions without months of manual reconstruction.

That is why FedRAMP 20x matters.

FedRAMP’s June 25, 2026, launch of the Consolidated Rules for 2026 marked a major program transition. FedRAMP positioned itself 20x as a certification path beyond the pilot phase and established the Consolidated Rules as the stable reference point for evaluating new submissions and ongoing certification expectations.

The Shift Is Bigger Than a New FedRAMP Path

The most important thing to understand about FedRAMP 20x is that it is not simply a faster version of the traditional process. It changes the center of gravity from documentation assembly to evidence engineering.

OMB M-24-15 set the policy direction in July 2024 by calling for greater automation, machine-readable artifacts, API-enabled exchange where feasible, and stronger reuse across agencies and cloud service providers. FedRAMP 20x is one of the clearest implementations of that policy direction.

From a technical standpoint, this means the future FedRAMP operating model will depend on evidence pipelines, source-system integrations, validation logic, structured authorization data, and continuous reporting. The compliance team will still matter, but the engineering, security operations, product, cloud infrastructure, and data teams will matter just as much.

What CISOs Are Excited About

What excites CISOs about FedRAMP 20x isn’t necessarily the elimination of documentation rigor, but rather the compatibility of authorization processes with daily operations in cloud environments.

A cloud service is not static, and we need a compliance model that mirrors this dynamic environment. Identity assignments change. Containers are rebuilt. Infrastructure-as-code templates are modified. Software dependencies are updated. Runtime configurations drift. New vulnerabilities appear. Access patterns shift. Incidents generate lessons learned. Agencies need assurance that reflects these realities.

That is why security leaders are focused on three questions:

Is the evidence current?
They want to know whether a security claim reflects the current environment, not just a prior assessment window.

Is the evidence traceable?
They want evidence connected to authoritative systems such as identity providers, CI/CD platforms, cloud APIs, vulnerability tools, ticketing systems, SIEMs, CNAPP platforms, and asset inventories.

Is the evidence actionable?
They want failed validations to trigger remediation, exception handling, risk acceptance, or operational review.

This is where FedRAMP 20x becomes less of a compliance exercise and more of a security data architecture challenge.

The Timeline Security Leaders Need to Track

FedRAMP 20x has moved quickly, but the timeline is now becoming concrete enough for providers to plan against. The milestones published by FedRAMP should be treated as roadmap triggers, not just policy dates. One I think Agencies should pay the most attention to, though, is on July 28th later this month, when FedRAMP will stop accepting new FedRAMP Ready submissions, pushing new entrants toward the 20x Class A path. Additionally, on January 1st of next year, FedRAMP will begin enforcing the Consolidated Rules broadly, and existing Rev5-certified providers must adopt applicable new rules before June 11th of 2027, when they will no longer accept Rev 5. Applications. The signal is clear that cloud service providers and sponsoring agencies will need to prepare for this shift!

Rev5 Is Not Gone, But the Direction Is Clear

One of the biggest misunderstandings I hear is that Rev5 disappears the moment 20x opens. That is not the case. Rev5 remains part of the certification landscape during the transition, especially for providers already working through legacy processes.

However, Rev5 is clearly being moved onto a modernization track. The practical implication is straightforward: Rev5 providers should not treat 2026 as business as usual. The Consolidated Rules introduce changes to ongoing certification, package structure, vulnerability management, significant change handling, authorization data sharing, and the way providers represent security decisions. After January 1, 2027, enforcement of the Consolidated Rules begins, so providers should plan to adopt them before that date rather than wait until their next assessment cycle, which could expose the gap.

The Package Is Becoming a Data Product

One of the most consequential changes is the movement away from traditional document-centric packages toward structured and semi-structured authorization data.

FedRAMP has indicated that every 20x certification package will include machine-readable authorization data across the certification scope, including initial materials and ongoing reports such as significant changes and vulnerability information. For Rev5, FedRAMP is also moving away from legacy document and spreadsheet-heavy formats, with new package constructs such as the Certification Package Overview, Security Decision Record, and Secure Configuration Guide.

That may sound purely administrative, but it is actually very significant from a technical standpoint.

A modern FedRAMP package needs to behave more like a governed data product. It should be versioned and traceable, support machine processing, and be human-readable when needed, but the human-readable view should be generated from structured source material where practical. We’re seeing the adoption of data standards such as NIST’s OSCAL to facilitate interoperability of machine-readable information.

That changes the work required from cloud providers. The question is no longer, “Who can update the Word document?” The question becomes, “Which systems produce the evidence, what schema represents it, and how do we keep it current?”

Key Security Indicators Are the New Engineering Conversation

Key Security Indicators are at the heart of FedRAMP 20x. They are not merely control labels with new names. They are intended to show whether important security capabilities are operating effectively in the provider’s real environment.

FedRAMP describes KSIs as a way for providers to demonstrate desired security capabilities through meaningful measurements tied to operational outcomes. The KSI guidance also emphasizes continuous evidence collection, drift detection, control-effectiveness monitoring, deviation alerts, and trend visibility.

A strong KSI implementation should connect the following chain:

Security assertion

   ↓

Authoritative source system

   ↓

In-scope asset or service component

   ↓

Validation rule or measurement logic

   ↓

Result with timestamp and context

   ↓

Exception, remediation, or acceptance workflow

   ↓

Agency-facing evidence view

For example, if a provider claims privileged access is controlled, the supporting evidence should not be a static screenshot. It should be derived from identity systems, role assignments, MFA status, access review records, administrative activity logs, exception approvals, and remediation workflows.

If a provider claims vulnerability management is effective, the evidence should show scanner coverage, asset scope, authenticated scan status, vulnerability age, exploitability context, remediation SLA performance, accepted weaknesses, and closure verification.

If a provider claims secure software delivery, the evidence should connect source control, branch protections, code review, SAST, SCA, secrets detection, infrastructure-as-code checks, container scanning, artifact signing, change approvals, and deployment records.

That is why the most successful FedRAMP 20x programs will look more like assurance engineering programs than traditional compliance reporting teams.

Where ComplySyncATO Fits in the Operating Model

In my work with ComplySyncATO, the conversations increasingly center on orchestration. Most organizations already own many of the tools they need. They have cloud platforms, identity systems, vulnerability scanners, SIEMs, DevSecOps pipelines, GRC platforms, ticketing systems, and asset inventories.

The problem is that those systems often do not speak the same authorization language.

ComplySyncATO’s role is to help close that gap by supporting the connection between security evidence, workflow, control context, KSI alignment, remediation status, and certification reporting. As an OSCAL-Native platform, ComplySyncATO can import and export machine-readable artifacts and nest telemetry within the schema. This enables automation through evidence collection and report generation, so CSPs can manage their Authorization Status and Packages at a point in time. The value is not in creating yet another manual repository; it’s in helping organizations build a living evidence layer that can support both internal security operations and FedRAMP-facing assurance.

That is the subtle but important difference. FedRAMP 20x is not asking providers to upload more artifacts faster. It is asking them to demonstrate that their evidence model is current, measurable, and defensible.

What Providers Should Do Now

For providers evaluating FedRAMP 20x or Rev5 transition planning, I would organize the work into three horizons.

Now Through August 2026: Decide the Path and Inventory the Evidence

Providers should identify whether their near-term path is 20x Class A, 20x Class B, 20x Class C, temporary Rev5, or continued agency-sponsored Rev5. That decision should be tied to federal demand, product maturity, current security program maturity, commercial certifications, engineering capacity, and customer assurance requirements.

At the same time, providers should inventory the systems that already produce useful evidence. Identity, vulnerability, logging, configuration, CI/CD, incident response, ticketing, and asset management data should be mapped to likely KSI and certification package needs.

By January 1, 2027: Align to the Consolidated Rules

The January 1, 2027, mandatory adoption date should be treated as a program deadline, not a documentation deadline. Providers should have an operating model for structured certification materials, ongoing reporting, evidence freshness, exception management, and rule traceability before enforcement begins.

For Rev5 providers, this also means understanding how the new rules affect existing authorization materials, ongoing certification reporting, significant changes, vulnerability handling, and expectations for machine-readable or semi-structured data.

Before June 11, 2027: Reassess Any New Rev5 Investment

Because FedRAMP will stop accepting new Rev5 certification applications on June 11, 2027, providers should be careful about starting a new Rev5 path without a clear business justification. In many cases, the more strategic investment will be in building toward the 20x evidence model, even if the organization must continue to support Rev5 during the transition.

The Architecture Pattern to Build Toward

The target architecture is not complicated to describe, but it requires discipline to implement.

Cloud, Identity, DevSecOps, Security, and ITSM Tools

       ↓

Evidence Collection and API Integration

       ↓

Normalization and Asset Boundary Mapping

       ↓

KSI / Control / Rule Traceability

       ↓

Validation Logic and Evidence Scoring

       ↓

Exception, Remediation, and Risk Workflow

       ↓

Certification Package and Agency-Facing Reporting

       ↓

Ongoing Certification and Continuous Assurance

This architecture has to answer assessor and agency questions clearly:

• What is the source of truth?
• Which assets are in scope?
• What rule or metric was applied?
• When was the evidence collected?
• What failed?
• Who owns remediation?
• Which exceptions are active?
• Which risks were accepted?
• What changed since the last reporting cycle?
• Can the result be reproduced?

Those are not just compliance questions. They are security operations questions.

The Bottom Line

FedRAMP 20x is not a paperwork shortcut. It is a modernization forcing function.

The providers that benefit most will be those that treat authorization as an evidence-based system. They will connect live security telemetry to structured certification data. They will turn manual evidence gathering into repeatable workflows. They will use KSIs to show measurable security outcomes. They will help agencies make faster and more informed risk decisions.

The Rev5 transition timeline gives current providers time, but it does not justify the delay. The direction is clear: FedRAMP is moving toward automation, machine-readable evidence, reusable certification data, and continuous assurance.

From the CISO conversations and industry forums I cover, that is where the excitement comes from. Security leaders are not asking for less rigor. They are asking for evidence they can trust.

That is the real promise of FedRAMP 20x.

As the United States marks its 250th year, the Semiquincentennial, we pause to celebrate a remarkable journey of sacrifice, resilience, opportunity, and service. Generations of Americans have rolled up their sleeves, working through incredible challenges to bring our nation's founding promises closer to reality for all. It is this bold, unwavering drive that continues to inspire progress providing endless possibilities.

Founded in the National Capital Region, ASSYST is honored to pay tribute to America’s legacy by advancing federal, state, and local government missions. Each day, our teams, equipped with our Green Accelerators, work alongside our customers to strengthen the public services and national security that millions of Americans rely on.

Our work reflects this commitment by:

• Protecting public health through trusted digital regulatory systems.
• Empowering armed forces, veterans, their families, and caregivers with resilient digital services.
• Advancing national security readiness through mission-focused technology.
• Modernizing state and local government systems to better serve communities.
• Investing in solutions that bring efficiency to government operations.

This milestone is not only a celebration of our past but also an opportunity to reaffirm our commitment to the future. As the government continues to evolve to meet new challenges, we remain dedicated to delivering trusted solutions, fostering innovation, and supporting the missions that strengthen our nation and improve the lives of the people they serve.

We are grateful to our employees, customers, partners, and communities whose dedication and collaboration make this work possible. Together, we honor the achievements of the past 250 years and look forward to contributing to the next stage of American progress, public service, and innovation.

Happy 250th, America!

The recent issuance of NSPM-12, the latest National Security Presidential Memorandum focused on cybersecurity governance for National Security Systems, has generated considerable discussion across the federal cybersecurity community. While much of the early attention has centered on governance changes and the expanded role of the National Security Agency in overseeing National Security Systems, many cybersecurity leaders are asking a broader question: What does this memorandum signal about the future direction of federal cybersecurity?

To explore the implications of NSPM-12, John Kimberl, Business Development Specialist (ComplySyncATO), is joined by Joe Anderson, Chief Operating Officer at ASSYST, who leads and directs ASSYST's focus on cybersecurity modernization, Continuous Authorization, cloud governance, and AI-driven compliance automation initiatives. Joe has been closely following the evolution of federal cybersecurity policy, including Executive Order 14028, Zero Trust initiatives, Cybersecurity Supply Chain Risk Management (C-SCRM), FedRAMP 20x modernization, and CMMC, while leading the solution roadmap for ASSYST’s ComplySyncATO.

Read More

https://www.linkedin.com/pulse/decoding-nspm-12-key-implications-national-security-systems-defense-rma7e