The General Services Administration’s (GSA) Federal Risk and Authorization Management Program (FedRAMP) published its final Emerging Technology Prioritization Framework on Thursday, detailing which generative AI capabilities will be the first to be prioritized.
FedRAMP is run by GSA to provide a standardized, government-wide approach to security assessment, authorization, and continuous monitoring for cloud products and services used by Federal government agencies.
The framework meets a requirement set by President Biden’s October 2023 AI executive order (EO). The FedRAMP team first published a draft framework in January, using feedback on the draft to help shape the final framework.
“The framework is designed to expedite the inclusion of emerging technologies in the FedRAMP Marketplace, so agencies can more easily use modern tools to deliver on their missions,” GSA said in a June 27 FedRAMP blog.
“The Emerging Technology Prioritization Framework outlines how FedRAMP will engage with government and industry to identify which emerging technologies to prioritize, how cloud providers can request that their services be prioritized, and how FedRAMP will determine which services to prioritize,” it adds.
The EO called for the framework to prioritize three emerging technologies that include generative AI capabilities: chat interfaces, code-generation and debugging tools, and prompt-based image generators.
However, after receiving feedback on the draft framework, GSA decided to include associated application programming interfaces (APIs) that provide these functions as their own distinct capability.
“FedRAMP wants to prioritize services that offer AI-enabled tools directly to users, as well as services that offer underlying AI-enabled technologies as services that can be incorporated into other applications (whether those applications are agency-run digital services or other cloud service providers),” GSA explains. “Separating API-based offerings into a separate capability allows FedRAMP to prioritize both kinds of services without them competing against each other.”
With the four categories finalized, GSA said cloud service providers (CSPs) whose offerings meet the criteria can now apply for the initial round of prioritization.
CSPs can apply by completing the Emerging Technology Cloud Service Offering Request Form for cloud service offerings and the Emerging Technology Demand Form by Aug. 31. FedRAMP will announce initial prioritization determinations by Sept. 30.
Initially, FedRAMP expects to prioritize up to 12 AI-based cloud services using this framework.
Nevertheless, the requests for prioritization are voluntary, and GSA said CSPs will be able to apply for prioritization requests twice a year.
