Prove It Every Day, Part 2: Why FedRAMP 20x and DoW Cloud Requirements Demand a Secure Managed Service Provider

In Part 1, we looked at a growing problem with the traditional managed services model: security, cloud, compliance, and IT operations have become increasingly interconnected, yet many organizations still manage them through separate providers, platforms, and teams. For Cloud Service Providers (CSPs) pursuing FedRAMP 20x certification or Department of War (DoW) Cloud Service Provider Security Requirements Guide (DoW CSP SRG) Impact Level (IL) authorization, that fragmentation puts the authorization itself at risk.

There needs to be a different model.

We believe the next evolution of managed services is the Secure Managed Service Provider (SMSP).

An SMSP doesn't simply take a traditional MSP and add cybersecurity services to the catalog. It changes the operating model.

The traditional approach can be summarized as:

The SMSP model reverses that:

That distinction matters.

Security becomes part of every operational decision. Cloud architecture is designed with security controls built in. Identity is managed according to least privilege. Logging isn't something added after deployment. Vulnerability management connects directly to remediation. Detection connects directly to response. Compliance evidence is generated through normal operations instead of being assembled months later for an audit.

If that last sentence sounds familiar to a federal CSP, it should. It's essentially what FedRAMP 20x now requires. The SMSP model isn't a nice-to-have for these CSPs anymore. It's the operating model FedRAMP 20x and DoW authorization assume you already have.

The objective is no longer simply to monitor the environment.

The objective is to operate the environment securely.

At InfusionPoints, we have always led with security. We have long said that the environments we build, operate, prove, and defend just happen to be compliant as well.

The SMSP model puts a name around that philosophy.

Security, Operations, and Compliance Become One Continuous Process

This shift becomes even more important in regulated environments.

Historically, compliance was often treated as a periodic event: prepare for an assessment, gather evidence, review controls, fix findings, complete the assessment, and then repeat the process next year.

That model is changing, and the federal market is where it's changing fastest.

FedRAMP 20x moves authorization away from static, narrative documentation and toward measurable outcomes. Under the FedRAMP Consolidated Rules for 2026, CSPs demonstrate security through Key Security Indicators, persistently validate those indicators, treat validation failures as vulnerabilities, and maintain a Security Decision Record in place of the traditional System Security Plan. At the higher certification classes, CSPs must validate each indicator with multiple automated methods and show months of historical validation results. You can't produce that by assembling evidence before an assessment. You can only produce it by operating that way every day.

The DoW is pushing in the same direction. A CSP operating at IL2, IL4, or IL5 under the Cloud Computing Security Requirements Guide (SRG) has to sustain its security posture, support continuous monitoring, and work hand in hand with the MSSP defending the mission owner's workloads for incident detection, reporting, and response. Authorization isn't the finish line. It's the start of an operational commitment. When the SMSP is also the security operations provider, the information that commitment depends on moves without a handoff.

Whether it's FedRAMP 20x, DoW CSP SRG IL, or another framework, modern cybersecurity and compliance programs increasingly require organizations to understand their security posture continuously. Is the asset inventory accurate? Are required logs being collected? Are vulnerabilities being remediated? Are identities appropriately configured? Are security controls functioning as intended? Has the environment changed? Can the organization prove it?

Those aren't questions that should only be asked before an audit.

They are operational questions.

Security operations, infrastructure operations, and compliance operations increasingly need to work from the same information. The SMSP model recognizes that reality. Instead of operating separate silos for IT, security, and compliance, organizations can begin treating them as parts of a single continuous operating model.

The SOC Has to Evolve Too

The same evolution needs to happen inside the Security Operations Center.

A SOC that only generates alerts can actually create more work for the Customer: detect an event, generate an alert, open a ticket, investigate, escalate, hand it back, and repeat.

Detection remains critically important, but detection alone isn't the goal.

Reducing risk is the goal.

If the security operations team has visibility into the environment, understands the architecture and compliance requirements, and can see the Vulnerability Detection and Response (VDR) data, it can work directly with the teams operating the infrastructure. Its role and skill set fundamentally change.

FedRAMP 20x makes this non-negotiable. Under the Consolidated Rules for 2026, Vulnerability Detection and Response (VDR) and Vulnerability Evaluation and Reporting (VER) turn vulnerability management into a time-boxed operational function, with adoption due December 7, 2026. Once a vulnerability is detected, it has to be evaluated for potential agency impact, exploitability, and internet reachability, and the tightest mitigation windows are measured in hours, not weeks. Certain likely exploitable vulnerabilities are treated as FedRAMP Reportable Incidents.

That means vulnerability management has to act like a security operations center. When that clock starts, you can't drop the finding into a monthly patch cycle or a ticket queue. You treat it like incident response: triage it, scope the affected assets, contain or mitigate, communicate, remediate, and validate the fix, around the clock. A vulnerability team that works business hours and a SOC that doesn't own remediation can't meet that bar together. The SMSP model can, because detection, evaluation, remediation, and validation already live in the same operation.

Speed doesn't mean giving up control. A SOC that acts on remediation needs the same discipline as the operations team: least-privilege, role-based access inside the boundary, separation of duties between whoever changes the environment and whoever verifies the change, and change control that catches anything rising to a FedRAMP significant change. The same goes for automation. We're adding agentic capability to VNSOC360°, where agents query logs, baseline activity, check indicators against threat intelligence, and prepare the investigation briefing. Human analysts make the decision.

Security stops being an observer and becomes part of operations.

Instead of stopping at:

the organization can move toward:

And, where appropriate, eventually:

That's a very different managed services relationship.

For a federal CSP, that relationship is no longer optional. FedRAMP 20x and DoW CSP SRG IL requirements assume security, operations, and compliance already run as one process, and they expect the CSP to prove it every day.

In Part 3, we'll look at what it takes to make that real: the common operating layer behind modern GRC, who owns what in an SMSP relationship, and how we put it to work through Build, Operate, Prove, Defend.