The Paramify Podcast

Today, we’re sitting down with StackArmor’s Martin Rieger — a FedRAMP veteran with over 300 engagements under his belt — for an unfiltered deep dive into the origin, evolution, and future of FedRAMP compliance.

We cover everything from the early days of DIACAP and gold images to today’s world of automation, OSCAL, and AI-powered documentation. Martin shares war stories, explains why so many companies fail audits even with AI, and gives his take on where FedRAMP 20x is headed.

Key takeaways

- Right tools + right people = success: AI and automation can massively accelerate compliance work if handled by professionals who understand the frameworks deeply.

- FedRAMP’s evolution: FedRAMP has matured from infrastructure-heavy beginnings to a focus on SaaS and cloud-native tools, with an increasing push toward automation and standards like OSCAL.

- Common ATO pitfalls: Many companies underestimate the effort required for continuous monitoring (ConMon) and maintaining their ATO, mistakenly thinking the hardest part is getting authorized.

- Martin: FedRAMP may move toward sponsor-less paths (like StateRAMP) for Low/Moderate baselines, and AI + OSCAL will likely reshape how security packages are created, validated, and shared.

This episode is loaded with insights for anyone serious about federal cloud compliance.

⏱️ Timestamps:

🔗 Learn more about StackArmor: https://stackarmor.com/

🔗 Learn more about Paramify: https://www.paramify.com/?utm_medium=social

Today we're sitting down with the Father of FedRAMP himself — Dave Fairburn Jr. — for a raw, detailed, and at times hilarious deep dive into the origin story, evolution, and future of the FedRAMP program. From 16-hour days and bureaucracy battles to 2,500-page documentation drafts reduced by weight tests (yes, really), Dave walks us through how the entire FedRAMP framework was created, challenged, and still, nearly 15 years later, hasn’t been "screwed up" (his words). This episode is packed with insider stories, lessons learned, and real talk about:

Learn more about Dave Fairburn Jr.:   / %e2%98%81%ef%b8%8f-dave-fairburn-jr-cissp-...   🔗 Learn more about Paramify: https://www.paramify.com/?utm_medium=... 👤 Connect with Kenny: Kenny G. Scott:   / kenny-g-scott   👤 Connect with Mike: Mike Schreiner:   / mikecschreiner  

What do DC sneakers, HR-approved marriage advice, and compliance robots have in common? They’re all part of this episode as Kenny and Mike dive into the bold future of FedRAMP 20X — and why it’s finally time to fix the pain points for both private companies and government agencies.

Here’s what they cover:

- The (not) shift in risk ownership — why agencies have always owned the risk and the PMO will focus on standards

- The myth of "set-it-and-forget-it" security — and the need for continuous monitoring

- The problem with screenshot audits — and smarter ways to prove assurance

- The role of auditors vs. automation — balancing trust and verification

- Why developers don’t love security — and how to make it less painful

- The future for faster authorizations, and why you shouldn't wait for the FedRAMP changes to happen to get FedRAMP Authorized.

If you’ve ever yelled at your SSP or cried over a screenshot audit, this one’s for you.

Sign up for the FedRAMP working groups here:

Learn more about Paramify here: https://www.paramify.com/

Learn more about Kenny: https://www.linkedin.com/in/kenny-g-scott/

Learn about Mike: https://www.linkedin.com/in/mikecschreiner/

Today, we're pretending it's August 24, 2024, as Kenny and Mike sit down with Pete Waterman to talk about his backstory and what inspired him to apply to become the new FedRAMP Director. 

Spoiler alert: we discuss frustration, bureaucracy, and a wild career move. Also these things:

- Pete's Origin Story – Every hero has one.

This episode is equal parts insightful, hilarious, and maybe a little chaotic—just the way we like it.

Learn more about Pete Waterman: https://www.linkedin.com/in/petewaterman/

Learn more about Paramify: https://www.paramify.com/

Learn more about Kenny: https://www.linkedin.com/in/kenny-g-scott/

Learn more about Mike: https://www.linkedin.com/in/mikecschreiner/

Today Kenny and Mike are talking to the one and only Jason Ford, CEO & Founder of Steel Patriot Partners—a true FedRAMP guru who's been securing systems since digital transformation was still a baby. Jason shares his battle-tested strategies for navigating security audits, implementing encryption the right way, and avoiding common pitfalls that can delay your compliance efforts for months.

Here's what we're tackling in this episode:

- "If You Can't Draw It, You Can't Secure It" – Why mapping your architecture is step one in cybersecurity.

- FedRAMP High vs. Moderate – Why enterprises (not just government) are demanding higher security standards.

- Encryption 101 – What's really required, and why some ciphers belong in the dumpster.

- Privileged Access Done Right – No more random one-off permissions for Jeff! Use roles, not regrets.

- The Future of Security Compliance – Automation, AI, and why FedRAMP is about to change everything.

If you're serious about building a security-first organization, tackling FedRAMP without losing your mind, or just figuring out how to keep your systems locked down like a fortress, this episode is for you.

Learn more about Paramify here: https://www.paramify.com/

Learn more about Steel Patriot Partners here: https://www.steelpatriotpartners.com/

Getting started with risk management is easier than you think- and you don’t need fancy tools to do it.

In this episode, Kenny and Mike break down how a simple Google Sheet can be your secret weapon for designing a great security program. Whether you’re navigating FedRAMP, SOC 2, or ISO 27001, the key is just getting started—no expensive software required.

If you're a startup founder, security pro, or just compliance-curious, this episode is packed with easy, actionable steps to help you kick off your compliance journey—without breaking the bank.

Learn more about Paramify: https://www.paramify.com/

Learn more about Kenny: https://www.linkedin.com/in/kenny-g-scott/

Learn more about Mike: https://www.linkedin.com/in/mikecschreiner/

Eric, the CISO at Federal Cyber Defense Solutions and former Chief FedRAMP Strategist at IBM and FedRAMP Leader at HP, shares his journey from growing up on a farm to becoming a CISO and FedRAMP expert. We dive into the challenges of FedRAMP compliance, the evolution of cybersecurity, and how today's security teams can strike the balance between technical expertise and meeting compliance demands.

In this episode, we cover:

If you're interested in FedRAMP in 2025, compliance innovation, or cybersecurity career growth, this episode is a must-listen!

Learn more about Eric here: 

Learn more about Paramify: 

Learn more about Kenny:  

Whether you’re launching a brand-new security program or fine-tuning your existing one, this episode has everything you need to know.

Kenny and Mike are breaking down the 𝗰𝗼𝗻𝘁𝗿𝗼𝗹 𝗮𝘀𝘀𝗲𝘀𝘀𝗺𝗲𝗻𝘁 𝗽𝗵𝗮𝘀𝗲𝘀 – why they matter and how they can transform your security processes.

Here’s what’s on deck in this episode of The Paramify Podcast:

𝗟𝗶𝘀𝘁𝗲𝗻 𝗻𝗼𝘄 and learn how planning, assessing, and reporting can level up your risk management game.

We’ve heard you. We all want to know just how much it cost The Empire when the first Death Star was blown to oblivion by a young boy from Tatooine? How could the Empire let this happen?

Kenny Scott and Mike Schreiner dive deep into risk management and cybersecurity—all through the lens of Star Wars.

Kenny uses Star Wars analogies to break down key concepts like:

Whether you're looking to build a risk management program OR just geek out over Star Wars references, this episode has something for you.

Today we’re talking to Tony Bai. He’s got 25 years of experience in cyber defense and operations, Tony Bai serves as the Chief Solutions Officer at RISCPoint. A United States Air Force veteran and lots of leadership experience at leading consulting organizations. Tony specializes in FedRAMP, CMMC and other NIST frameworks and is a leading voice on their latest developments that seem to be pretty intense these days. This is a great episode!