Agenda
Tuesday, September 29
Coffee & Networking
Sponsored by:
Opening Remarks
Kristine Lam
Executive Director — Cloud Service Providers – Advisory Board (CSP-AB)
Balancing Innovation and Compliance in the AI Era
Chris DeRusha
Director of Global Public Sector Compliance — Google Cloud
Q&A
Chris DeRusha
Director of Global Public Sector Compliance — Google Cloud
Ross Nodurft (Moderator)
Executive Director — Alliance for Digital Innovation
From Checkbox to Continuous: Scaling Security in Large Organizations
Achieving continuous security at scale is a shared challenge for large organizations in both the private and public sectors. This panel will discuss how large, complex organizations move beyond point-in-time compliance checks toward truly continuous security practices. Panelists will share practical lessons on operationalizing continuous monitoring, automating vulnerability management, and managing change at velocity—offering attendees actionable insight into what continuous security looks like in practice, from both the provider and agency perspective.
Sam Aydlette
Engineering Program Manager — Cisco
Stephen Eng
Engineering Manager — Persona
Devin Gordon
Principal Solutions Architect — AWS
Chris Johnson
Chief Technology Officer — Knox Systems
Kenny Scott
Founder & CEO — Paramify
Drew Myklegard (Moderator)
Executive Director of Government Programs — Carahsoft
Vulnerability Reporting, Reimagined: What VDR/VER Means for CSPs and Agencies
As FedRAMP transitions to a risk-based Vulnerability Detection and Response (VDR) model, cloud providers must rethink how they detect, prioritize, remediate, and report vulnerabilities. Panelists will share how they’re approaching implementation, the importance of this approach in ensuring security, and what changes agencies should expect from their CSPs as these requirements take effect.
Nicole Thompson
Security Director, FedRAMP — General Services Administration (GSA)
Mitch Herckis
Global Head of Government Affairs — Wiz
Nino Scimemi
Vice President of Security Operations — Knox Systems
Matthew Venne
CTO — stackArmor
Drew Myklegard (Moderator)
Executive Director of Government Programs — Carahsoft
Lunch & Networking
Sponsored by:
Modernizing DoW Cloud Compliance: Strategies, Challenges, and Collaboration (Industry Perspective)
Industry panelists will share real-world perspectives on navigating DoW cloud compliance, from meeting evolving security requirements to working through complex authorization and connectivity processes such as BCAP. The discussion will explore common challenges, lessons learned, and opportunities for greater collaboration, consistency, and efficiency in bringing secure cloud capabilities to DoW missions.
Michael Cardaci
CEO — FedHIVE
Matt Conner
CISO — Second Front Systems
John Gallagher
GRC Technical Lead — OpenAI
Nic Hall
Technical Program Manager — Wiz
Will Shah
Technical Program Manager — Google Cloud
Drew Myklegard (Moderator)
Executive Director of Government Programs — Carahsoft
Compliance at Speed: A Look at Today's GRC Tooling
Governance, risk, and compliance (GRC) tooling is reshaping how CSPs and federal agencies manage the volume and complexity of today’s compliance requirements. This panel explores how organizations are adopting GRC platforms to automate evidence collection, streamline authorization workflows, and maintain audit-ready documentation across sprawling control sets. Panelists will discuss lessons learned from tool selection and implementation, integration with existing ATO and ConMon processes, and where automation is delivering the biggest return—giving attendees a practical view of how GRC tooling can reduce manual burden without sacrificing rigor.
Dan Chandler
Cloud Security Engineer, FedRAMP — General Services Administration (GSA)
Dale Hoak
CISO — RegScale
Zach Fasnacht
Public Sector Product Manager — Vanta
Mike Kim
CEO & Co-Founder — Mycroft
Isaac Tesuscher
Senior Security Engineer — Paramify
Drew Myklegard (Moderator)
Executive Director of Government Programs — Carahsoft
Coffee & Networking
Sponsored by:
The Independent Assessment Service Perspective: IASs and the Future of Federal ATOs
Independent assessment services play a pivotal role in validating cloud security across the Federal government. This panel brings together leading independent assessment services to discuss how assessment practices are adapting to new requirements and changes in the ATO process. Panelists will share perspectives on maintaining assessment rigor and consistency amid process change, the growing emphasis on continuous assessment over point-in-time reviews, and how independent asessors are working alongside CSPs and agencies to keep pace with an evolving compliance landscape.
Elisha "Emu" Crow
Cloud Security Engineer and Lead 20x Assessor — General Services Administration (GSA)
Gary Guercio
VP of Operations — Fortreum
Matt Hungate
Managing Principal — Schellman
Lee Neeper
Director of Quality Management — A-LIGN
Marshall Gray
Senior Manager — Coalfire
Drew Myklegard (Moderator)
Executive Director of Government Programs — Carahsoft
FedRAMP and Cross-Sector Standards: Enhancing Clarity and Harmonization Across Regulated Industries
The panel, “FedRAMP and Cross-Sector Standards: Enhancing Clarity and Harmonization Across Regulated Industries,” will explore how standards and regulatory frameworks can keep pace with technology-driven advancements. The panel will include discussion of FedRAMP, which serves as the bedrock cloud security framework for the federal marketplace, along with other regulatory requirements and standards-setting initiatives across sectors. We’ll discuss how these frameworks can serve as a foundation for regulatory harmonization, helping satisfy compliance requirements, and clarifying compliance burdens for regulated entities across sectors.
Trey Maust
Chief Innovation Officer — Federal Deposit Insurance Corporation (FDIC)
Denyette DePierro
US Financial Services, Public Policy — AWS
Lisa Gold
Founder and Principal — GoldStandard Advisors
Daniel Gorfine
Founder & CEO — Gattaca Horizons
Senior Advisor — CSP-AB
Josh Magri
CEO — Cyber Risk Institute
Reception
Stay after the closing remarks for a networking reception. It’s a chance to unwind, discuss what you’ve learned from the day’s speakers, and connect with peers from across the federal cloud community.
Sponsored by:
RAMP UP Happy Hour
Join Paramify, A-LIGN, and Carahsoft for free drinks, food, live professional skateboarding, and a chance to win a custom RAMP NIGHT skateboard. Whether you’re in FedRAMP, GovRAMP, DoW ILX, RMF, FISMA, or CMMC we want you there!
Space is limited, RSVP to save a spot:
Hosted by:
Wednesday, September 30
Coffee & Networking
Come early and talk with FedRAMP over coffee and network.
Sponsored by:
Opening Remarks
Ryan Hoesing
Chief of Staff, FedRAMP — General Services Administration (GSA)
Nicole Thompson
Security Director, FedRAMP — General Services Administration (GSA)
Behind the Certification: How the FedRAMP Ecosystem Works Together To Ensure Security
The FedRAMP ecosystem brings together a diverse range of expertise, technology, assessment, and operational capabilities to support both cloud providers and government agencies. This panel will explore how accelerators, 3PAOs, advisors, and technology providers contribute at different stages and in different ways—helping organizations navigate evolving requirements, strengthen ongoing security operations, make informed risk decisions, and accelerate the secure adoption of cloud technologies across government.
Michael Cardaci
CEO — FedHIVE
Michael Carter
President — Fortreum
Matt Earley
Founder & President — 38North Security
Irfan Nawaz
Senior Director, Government Technology Accreditation — Salesforce
Ben Ware
Head of Public Sector Compliance — Oracle
Drew Myklegard (Moderator)
Executive Director of Government Programs — Carahsoft
Ask the FedRAMP PMO
This is your chance to get straight answers from the people leading FedRAMP. Bring your questions on 20x, CR26, and agency reuse. The FedRAMP PMO will be on hand to respond live to audience questions.
Elisha "Emu" Crow
Cloud Security Engineer and Lead 20x Assessor — General Services Administration (GSA)
Paul Agosta
Cloud Security Officer & Rev5 Lead — General Services Administration (GSA)
Ryan Hoesing
Chief of Staff, FedRAMP — General Services Administration (GSA)
Nicole Thompson
Security Director, FedRAMP — General Services Administration (GSA)
Dan Chandler
Cloud Security Engineer, FedRAMP — General Services Administration (GSA)
Edward Graham (Moderator)
Managing Editor — NextGov/FCW
Lunch & Networking
Sponsored by:
Best Practices for Federal Agencies to Strengthen Cloud Security
Representatives from the Council of the Inspectors General on Integrity and Efficiency (CIGIE) will present on their report “Best Practices for Federal Agencies to Strengthen Cloud Security”.
Matthew Akers
United States Postal Service Office of the Inspector General
Eric Rivera
Assistant Inspector General for Audits — Export-Import Bank, Office of the Inspector General
Decoding FedRAMP 20x: How KSIs Correspond to NIST 800-53 Controls
FedRAMP 20x introduced Key Security Indicators (KSIs) as a streamlined alternative to traditional control-by-control assessment. This panel brings together NIST and the FedRAMP PMO to discuss how KSIs correspond to existing NIST SP 800-53 controls, where the mapping is straightforward, and where interpretation or additional guidance is still needed. Panelists will address the reasoning behind the KSI framework, implications for continuous monitoring, and what CSPs and Federal agencies should expect as the FedRAMP moves to 20x.
Dan Chandler
Cloud Security Engineer, FedRAMP — General Services Administration (GSA)
Victoria Yan Pillitteri
Manager, Security Engineering and Risk Management Group — National Institute of Standards and Technology (NIST)
Nicole Thompson
Security Director, FedRAMP — General Services Administration (GSA)
Kristine Lam (Moderator)
Executive Director — Cloud Service Providers – Advisory Board (CSP-AB)
Beyond Acceleration: Navigating the Future of FedRAMP and Compliant Security Operations
FedRAMP modernization is changing more than how cloud services achieve authorization—it is reshaping how compliant security operations must function in an environment of continuous change. As FedRAMP 20x advances, Class D (High) emerges, and AI accelerates the complexity and pace of security threats and requirements, hosted accelerators can play an increasingly critical role in helping technology companies and government agencies understand, operationalize, and continuously adapt to what comes next.
Hemant Baidwan
CISO — Knox Systems
Rene Tshiteya
Senior Director, Cybersecurity & Compliance — stackArmor
Robert Wilkinson
Lead Security Compliance Analyst — FedHIVE
Ross Nodurft (Moderator)
Executive Director — Alliance for Digital Innovation
Coffee & Networking
Sponsored by:
Moving from Rev5 to 20x
FedRAMP’s shift from the Rev5 baseline to the 20x framework represents the most significant change to the authorization process in years.This panel brings together the FedRAMP PMO and CSPs to unpack what this transition actually means in practice — procedurally and for the underlying security posture of cloud products. Panelists will help CSPs and federal agencies alike understand what’s changing, what’s staying the same, and how to prepare for the shift.
Christian Baer
Technical Fellow — Schellman
Gary Daemer
Founder & CEO — InfusionPoints
Kylie Hunter
Solutions Advisor — RegScale
Ken Palmer
Engineering Manager — Confluent
Mike Schreiner
COO — Paramify
Drew Myklegard (Moderator)
Executive Director of Government Programs — Carahsoft
Closing remarks
Kristine Lam
Executive Director — Cloud Service Providers – Advisory Board (CSP-AB)
Reception
Stay after the closing remarks for a networking reception. It’s a chance to unwind, discuss what you’ve learned from the day’s speakers, and connect with peers from across the federal cloud community.
Sponsored by:
Shaping the future of secure trusted resilient scalable cloud adoption
September 29-30, 2026
Fuse at Mason Square
3401 Fairfax Drive
Arlington, VA 22201
USA
The CSP-AB Summit is a high-impact forum bringing together Federal policy leaders, industry stakeholders, and security experts around a single mission: accelerating secure cloud adoption across the Federal enterprise.