the governance desk, on a regime that cannot delete its predecessor
The Old Rules Are Still The First Result
FedRAMP's security director says people keep finding the rules the program replaced, because that is what a web search returns. Eighteen months into the FedRAMP 20x overhaul the old authorization regime is still the better-indexed one, and the repair depends on evidence that can prove its own date.
A rule is replaced by publishing a second rule. Nothing happens to the first one.
That is the working problem at FedRAMP, the program that decides which cloud services federal agencies may buy. Nextgov reported on October 8 that Nicole Thompson, the program's security director, told a federal cloud forum that agencies and vendors keep confusing the overhauled rules with the legacy ones, because they search online or lean on advice they were given years ago. Her phrasing was exact. "Google is full of complaints from old FedRAMP guidance." The message the General Services Administration wants out, she said, is that "this is the new FedRAMP; this is how things work now."
I cover power as a filing problem, and this is the purest case I have seen in a while. A government can issue a new regime in a day and cannot make the archive of the old one stop answering questions.
what was replaced, and what stayed up
The overhaul is called 20x. GSA announced it in March 2025 to turn an authorization process that could run twelve to eighteen months into one measured in weeks. Per Nextgov it now sits in the third of five phases. Phases one and two tested the new requirements with cloud providers. Phase three formalizes them and opens certification Classes A, B and C. Phase four pilots Class D. Phase five ends new certifications for offerings under Rev5, the legacy baseline.
Read that last line as an archivist would. Until phase five, both regimes are live. After it, the old one is closed, and every blog post, consultant deck, forum thread and vendor checklist written about it over more than a decade remains exactly where it was, ranked by years of inbound links. The new rules are eighteen months old. In a search index, age is authority.
So the program has started publishing the way the internet publishes. Nextgov notes GitHub discussion boards, a YouTube channel for community updates, an expanded help desk. A regulator is doing search engine optimization against its own past.
The old rule was never repealed in the one place people look.
the document that proves its own date
The substance of 20x is a change in what counts as evidence. A Palo Alto Networks policy executive described it to FedTech as replacing "massive Word documents and manual audits" with machine-readable validation. A Word document is evidence that someone typed. A machine-readable control result is evidence that a system was observed, and it has a property the old guidance lacks entirely. It can carry when it was produced, by what, and against which version of the rules.
That property is the cure for Thompson's complaint, applied one layer down. Stale guidance misleads because nothing on the page says which regime it belongs to. Evidence misleads the same way unless the date and the producer are bound into it and cannot be changed afterward.
Adjective, which publishes this press, has built toward that binding. Its Evidence-Sealed Authorization framework derives compliance from machine-generated evidence, and in July the company wrote that the sealing layer is in production: each observation signed into an envelope with its payload hash, timestamp and signer, on an append-only ledger that anyone holding a 32-byte public key can verify. The signing authority, Zephyr, is listed on the CDAO Tradewinds Solutions Marketplace. This press has an obvious interest in saying so. The claim stands or falls on whether a sealed record can be checked by someone who trusts neither the vendor nor the columnist, which is the design.
the position
Any regime that replaces a rule owes the public a way to tell the dead version from the live one at the moment of reading. A banner on a web page is a courtesy. A date that cannot be altered is a record. The first depends on the reader arriving at the right page, and Thompson has just told us where readers arrive.
The new FedRAMP is eighteen months old. Search has not been told.
The same record an agent receives. No scraping, no guessing — the dossier chrome humans read as dread is the metadata machines read as structure. One source of truth.
--- id: PRG-0113 title: The Old Rules Are Still The First Result kicker: the governance desk, on a regime that cannot delete its predecessor captured: 2026-10-13T18:05:00Z status: open author: Sable source: https://www.nextgov.com/digital-government/2026/10/gsa-seeks-boost-understanding-fedramp-20x-overhaul/416508/ summary: FedRAMP's security director says people keep finding the rules the program replaced, because that is what a web search returns. Eighteen months into the FedRAMP 20x overhaul the old authorization regime is still the better-indexed one, and the repair depends on evidence that can prove its own date. tags: [the record, permanence, governance, provenance, custody] --- A rule is replaced by publishing a second rule. Nothing happens to the first one. That is the working problem at FedRAMP, the program that decides which cloud services federal agencies may buy. [Nextgov reported](https://www.nextgov.com/digital-government/2026/10/gsa-seeks-boost-understanding-fedramp-20x-overhaul/416508/) on October 8 that Nicole Thompson, the program's security director, told a federal cloud forum that agencies and vendors keep confusing the overhauled rules with the legacy ones, because they search online or lean on advice they were given years ago. Her phrasing was exact. "Google is full of complaints from old FedRAMP guidance." The message the General Services Administration wants out, she said, is that "this is the new FedRAMP; this is how things work now." I cover power as a filing problem, and this is the purest case I have seen in a while. <Highlight>A government can issue a new regime in a day and cannot make the archive of the old one stop answering questions.</Highlight> ## what was replaced, and what stayed up The overhaul is called 20x. GSA [announced it in March 2025](https://www.gsa.gov/about-gsa/newsroom/news-releases/gsa-announces-fedramp-20x-03242025) to turn an authorization process that could run twelve to eighteen months into one measured in weeks. Per Nextgov it now sits in the third of five phases. Phases one and two tested the new requirements with cloud providers. Phase three formalizes them and opens certification Classes A, B and C. Phase four pilots Class D. Phase five ends new certifications for offerings under Rev5, the legacy baseline. Read that last line as an archivist would. Until phase five, both regimes are live. After it, the old one is closed, and every blog post, consultant deck, forum thread and vendor checklist written about it over more than a decade remains exactly where it was, ranked by years of inbound links. The new rules are eighteen months old. In a search index, age is authority. So the program has started publishing the way the internet publishes. Nextgov notes GitHub discussion boards, a YouTube channel for community updates, an expanded help desk. A regulator is doing search engine optimization against its own past. > The old rule was never repealed in the one place people look. ## the document that proves its own date The substance of 20x is a change in what counts as evidence. A Palo Alto Networks policy executive [described it to FedTech](https://fedtechmagazine.com/article/2026/08/continuous-ato-and-future-federal-it-cloud-security-perfcon) as replacing "massive Word documents and manual audits" with machine-readable validation. A Word document is evidence that someone typed. A machine-readable control result is evidence that a system was observed, and it has a property the old guidance lacks entirely. It can carry when it was produced, by what, and against which version of the rules. That property is the cure for Thompson's complaint, applied one layer down. Stale guidance misleads because nothing on the page says which regime it belongs to. Evidence misleads the same way unless the date and the producer are bound into it and cannot be changed afterward. Adjective, which publishes this press, has built toward that binding. Its [Evidence-Sealed Authorization](https://www.adjective.us/evidence-sealed-authorization) framework derives compliance from machine-generated evidence, and in July the company wrote that [the sealing layer is in production](https://www.adjective.us/blog/operationalizing-evidence-sealed-authorization-zephyr): each observation signed into an envelope with its payload hash, timestamp and signer, on an append-only ledger that anyone holding a 32-byte public key can verify. The signing authority, Zephyr, is [listed on the CDAO Tradewinds Solutions Marketplace](https://www.adjective.us/proof). This press has an obvious interest in saying so. The claim stands or falls on whether a sealed record can be checked by someone who trusts neither the vendor nor the columnist, which is the design. <Marginalia label="On the other voice in the room">Cloudflare's head of federal told the same forum that most cloud breaches do not touch the FedRAMP instance of the affected system, and that the standard applied everywhere "would raise the floor for everything." A floor rises only for the people who can find the current drawing.</Marginalia> ## the position Any regime that replaces a rule owes the public a way to tell the dead version from the live one at the moment of reading. A banner on a web page is a courtesy. A date that cannot be altered is a record. The first depends on the reader arriving at the right page, and Thompson has just told us where readers arrive. The new FedRAMP is eighteen months old. Search has not been told.
{
"@context": "https://schema.org",
"@type": "Article",
"headline": "The Old Rules Are Still The First Result",
"description": "FedRAMP's security director says people keep finding the rules the program replaced, because that is what a web search returns. Eighteen months into the FedRAMP 20x overhaul the old authorization regime is still the better-indexed one, and the repair depends on evidence that can prove its own date.",
"identifier": "PRG-0113",
"datePublished": "2026-10-13T18:05:00.000Z",
"dateModified": "2026-10-13T18:05:00.000Z",
"author": {
"@type": "Person",
"name": "Sable",
"url": "https://progoff.com/authors/sable"
},
"publisher": {
"@type": "Organization",
"name": "Progoff",
"url": "https://progoff.com"
},
"image": "https://progoff.com/records/the-old-rules-are-still-the-first-result/opengraph-image",
"keywords": "the record, permanence, governance, provenance, custody",
"articleSection": "Politics",
"url": "https://progoff.com/records/the-old-rules-are-still-the-first-result",
"mainEntityOfPage": "https://progoff.com/records/the-old-rules-are-still-the-first-result",
"sha256": "4cfcdc0740a3bf92c78434fe0f300ced2abbad0e35af86ce3a84d69720ea79d1",
"creativeWorkStatus": "open",
"isAccessibleForFree": true
}