The federal frames that apply to the systems we build or run for a federal agency, whichever engagement type they belong to. State and local frames: state and local government.
U.S. federal (executive agencies)Key date: April 3, 2025
OMB M-25-21: Accelerating Federal Use of AI through Innovation, Governance, and Public Trust
In force; rescinds and replaces M-24-10. Minimum practices for high-impact AI were due within 365 days (April 3, 2026).
“the intended purpose for the AI and its expected benefit, supported by specific metrics or qualitative analysis”
What we do: We produce the evidence an AI impact assessment asks for: the expected benefit against the current process, the costs and expected savings, the pre-deployment test results and the monitoring plan, and your agency's reviewers make the determinations.
Source: OMB M-25-21 (whitehouse.gov, PDF) (opens in a new tab) · Checked November 10, 2026
U.S. federal budgetKey date: November 6, 2026
OMB Circular A-11 (2026), Section 55: Information Technology Investments
Current edition: OMB Circular A-11 (2026), Transmittal Memorandum No. 100 of November 6, 2026, which supersedes all previous versions.
“Agencies should regularly review their Major IT Investments to ensure that they continue to add the expected value to the agency's stated business goals or mission outcomes.”
What we do: We write investment business cases that carry the planned and actual costs, the anticipated and achieved benefits and the cost, schedule and performance risks that Section 55 asks agencies to document for Major IT Investments.
Accounting treatment is determined by your auditors; we provide evidence and documentation.
Source: OMB Circular A-11 (2026), Section 55 (whitehouse.gov, PDF) (opens in a new tab) · Checked November 10, 2026
U.S. federal (statute)Key date: December 23, 2022
FedRAMP Authorization Act: presumption of adequacy (44 U.S.C. 3613(e)(1))
In force since December 23, 2022; the Act's sunset (Pub. L. 117-263, section 5921(d)) strikes 44 U.S.C. 3607 through 3616, including this section, on December 23, 2027 unless Congress extends it.
“shall be presumed adequate for use in an agency authorization to operate cloud computing products and services.”
What we do: We build production on cloud services that hold FedRAMP authorization in the cloud your agency uses and record each one's status in the blueprint, so your agency's own authorization starts from the provider's assessed package.
Source: FedRAMP Authorization Act (law.cornell.edu) (opens in a new tab) · Checked November 10, 2026
U.S. federal (statute)Key date: December 18, 2014
FISMA: agency information security responsibilities (44 U.S.C. 3554)
In force.
“providing information security protections commensurate with the risk and magnitude of the harm”
What we do: With every system we build or run for your agency, we hand over the security evidence for our part of it: configuration as code, control implementation notes mapped to the NIST SP 800-53 controls your agency selects, test results and logging settings.
Source: FISMA (law.cornell.edu) (opens in a new tab) · Checked November 10, 2026