VA Drops FedRAMP Pre-Cert for Vendors, GSA Flips Standards Playbook

VA drops the gate, keeps the lock

The Department of Veterans Affairs issued a memo telling acquisition teams that vendors no longer need FedRAMP certification before competing for VA business. The ATO process stays (still targeted at 60 days) but the pre-competition FedRAMP requirement is gone. For cloud vendors who've been locked out of VA opportunities because authorization pipelines ran slower than procurement cycles, this is a meaningful operational shift: you can now bid while your authorization is in flight.

The memo doesn't lower the security bar. VA's ATO rigor remains intact, and nothing in the policy suggests the agency is relaxing its assessment standards. What it does is decouple the procurement timeline from the FedRAMP timeline, a pragmatic move that mirrors broader signals from GSA and OMB about making FedRAMP less of a gate and more of a continuous validation process.

Which brings us to GSA.

GSA flips the standards sequence

GSA CIO David Shive described a deliberate inversion: instead of spending two to three years developing standards and then testing technology against them, GSA now tests technology first and feeds results back into the standards process. OneGov has signed more than two dozen tech companies and identified $1.18 billion in savings. The "move fast" cliché has an actual government office behind it now, and the FedRAMP 20x push toward machine-readable, continuous security validation (backed explicitly by Federal CIO Greg Barbaccia) provides the underlying architecture that makes a test-first approach viable rather than reckless.