GSA CISO Bo Berlas, FedRAMP and the federal CISO role

What the documents say about the role

The two primary documents are a GSA news release dated May 14, 2024 and the minutes of a Federal Secure Cloud Advisory Committee meeting held July 20, 2023. Neither is a job description. Neither lists the internal security duties of GSA's chief information security officer, such as incident response, system inventories or staffing. They do show the outward-facing part of the job: Bo Berlas sits on two bodies that shape how the federal government buys and authorizes cloud services.

The news release identifies him in one line. It lists "Bo Berlas , Chief Information Security Officer, U.S. General Services Administration." The meeting minutes list him on the roll call of a separate advisory committee.

The agency he secures

The release describes GSA's footprint in its closing paragraph, and it gives a sense of the scale a GSA CISO works within. The release says GSA is "managing a nationwide real estate portfolio of nearly 370 million rentable square feet, overseeing about $100 billion in products and services via federal contracts."

The same paragraph says GSA delivers "technology services that serve millions of people across dozens of federal agencies." GSA is a central procurement and shared-services agency, and the release describes it that way. It is also the agency that runs FedRAMP. The documents do not state how these facts divide the CISO's workload, so this page does not guess.

The FedRAMP Board

The May 14, 2024 release says GSA announced a new board to serve as the governing body for the Federal Risk and Authorization Management Program. It says the board replaces the Joint Authorization Board.

The release names the source of the board's authority. It says the Office of Management and Budget set it up. Berlas is one of the inaugural members.

The release lists what the board does. Eric Mill, GSA's executive director for cloud strategy, is quoted saying the board "will approve and help guide FedRAMP policies."

The release also gives the board's first jobs. It says the first focus is the handoff from the old body. It adds that the board is working on metrics, authorizations and monitoring.

Who else sits on the board

The release says the membership is deliberately broad. Deputy Federal Chief Information Officer Drew Myklegard is quoted: "The FedRAMP Board intentionally comprises members from across government, bringing diverse perspectives from the frontlines of cyber and IT modernization efforts."

Fellow security leaders are on the list. Hemant Baidwan is named as the Department of Homeland Security's CISO. David McKeown is named in a security role at the Department of Defense.

The release also lists chief information officers and a technical director from the Cybersecurity and Infrastructure Agency. So the board mixes security and technology executives, and the CISO role at GSA sits next to CIO roles at other agencies.

Berlas's own statement in the release describes his aim. He says he looks forward to "realizing opportunities to modernize the program and help expand the secure and efficient adoption of cloud technologies in government."

The Federal Secure Cloud Advisory Committee

The minutes from July 20, 2023 show a different forum, held before the new board was announced. The meeting ran by Zoom, and the agenda shows a briefing from the FedRAMP program, a briefing from the Cloud Security Alliance, public comment and a committee vote. The chair, Ann Lewis, is described as committed to carrying feedback to the GSA Administrator.

The FedRAMP briefing came from Brian Conrad, the acting director. The minutes say he described the two authorization paths. The minutes record the program's stated top priority.

Members then asked about the program's future. The minutes say many questions concerned automation.

What Berlas did at the meeting

The minutes show Berlas taking part in the committee's priority-setting. Three topics were put forward as priorities, and he seconded the third.

The committee then voted on pursuing all three topics together. The minutes record his vote as yes. The three topics were CSP authorization improvements, continuous monitoring process improvements, and automation initiatives and opportunities.

The meeting also took public comment. One speaker urged the committee to consider budget and workforce.

What the documents leave out

The question asks how NIST forums shape the role. The two documents provided do not mention NIST, and they do not describe any NIST forum. The minutes list a committee member named Matt Scholl as absent, but they give no employer or title for him. Nothing here supports a claim about NIST's influence on Berlas's work.

What the documents do support is narrower. A federal agency CISO at GSA is named to a board that approves and guides FedRAMP policies, and to an advisory committee that sets priorities for the program and reports to the GSA Administrator. The first is a government body with members from across agencies. The second mixes government and industry voices, and its minutes name guests and members of the public from a wide range of companies. In both, the documents show Berlas as a participant who helps decide where the program puts its effort, with cloud adoption, authorization and automation as the recurring subjects.