March 11, 2024

 

Re: Public Comment on Draft Emerging Technology Prioritization Framework

 

IBM greatly appreciates the Government Services Administration’s (GSA) effort to establish a
framework for prioritizing emerging technologies (ETs) for FedRAMP authorization, as directed
by the President’s Executive Order (EO) 14110 on Safe, Secure, and Trustworthy Development
and Use of Artificial Intelligence (AI). Emerging technologies such as quantum computing,
machine learning, and AI present a profound opportunity to enhance the critical work of our
government agencies, and the importance of proper governance to manage this transition
cannot be overstated. EO 14110 was a bold step in the right direction, and we are encouraged
by the swift response to the directive.

 

When the President signed EO 14110, it was viewed across private industry as a clear signal
that the U.S. Government (USG) understood the broad potential in leveraging AI in the work of
government. At the heart of this EO is the articulation of a need for processes that prioritizes
the timely adoption of emerging technologies, such as AI, that will enable the USG to serve the
needs of the American People safely and efficiently. IBM was pleased to issue a strong
statement of support for the EO the day it was signed by President Biden. Our Executives are
active in advocating for ethical and trusted AI adoption globally and they serve as externally
recognized subject matter experts on the AI ethics and oversight boards throughout the U.S.
federal government.

 

Well before the EO was signed, IBM was working with our federal clients using AI to help
federal agencies reinvent how they perform important work, and in the process realize
immense savings and efficiencies. For example, we used generative AI to help federal agencies
streamline their human resource line of business, and we have used other forms of AI to help
accelerate claims processing, freeing up hundreds of agency staff for more complex work.
These are just two examples. More than 5,000 IBMers work each day to help Federal agencies
modernize their IT enterprises, and AI is central to that work.

 

IBM is leading industry in developing generative AI solutions that align with the strong
standards for governance mandated in EO 14110. In 2023, IBM released watsonx, a suite of
generative AI tools designed specifically to accelerate large enterprises in responsible and
trusted AI deployment. We like to say that IBM is “client zero” for ethical AI. We have lived this
journey. IBM was one of the first companies to name a Chief Privacy and AI Ethics Officer, and
to create an AI Ethics Board. We use watsonx extensively within our own global enterprise.
Simply put, watsonx embodies our intense journey on ethical AI adoption. Today, we have
dozens of watsonx use case pilots underway across the federal government. Watsonx will align
with FISMA standards in the near term, and IBM is looking to offer all major elements of
watsonx as fully FedRAMP compliant SaaS offerings.

 

Keeping in mind our strong commitment to the federal market, we respectfully suggest three
modifications to the prioritization framework and process:

 

Reconsider the cap on prioritizing capabilities
At IBM, we believe that emerging technologies, like AI, will not only enhance the way the
private sector and government operate, but they will become increasingly essential to keep
pace in the global environment. We also believe that the capabilities available in the market
today represent just the tip of the iceberg. New AI models and other capabilities are emerging
daily. It is critical that the processes governing those products in the federal market are flexible
and consistently open to robust competition. Fully realizing the evolving benefits of emerging
technology, especially AI, across government agencies into the future will require that
government be nimble and open to future innovations.

 

With this in mind, we suggest a change to Section 4.2.5. In this provision, FedRAMP limits the
prioritization to three cloud service offerings (CSOs), leaving additional offerings to the
standard prioritization process. We respectfully assert that limiting prioritization to three CSOs
for a given type of AI capability type is shortsighted and possibly harmful. It is not possible to
clearly ascertain at this time what variety of CSOs will be helpful to agencies. For example, the
nature of large language models makes it very possible that AI developers may develop
specialized AI CSOs in certain areas like health care, financial services, cybersecurity, human
resources, or claims processing. By declaring at the start that prioritization will be limited to
only three per capability, FedRAMP risks creating an artificial bottleneck that may discourage
developers from bringing new capabilities to the federal market once the first three CSOs are
across the finish line. It would be a tremendous disservice if this prioritization limits products
brought to the federal market. For this reason, IBM suggests that FedRAMP either significantly
increase the number of CSOs to be prioritized or eliminate the cap entirely and instead
prioritize based on the judgement of the Federal CIO Council on the need to see new
capabilities be made quickly available.

 

Create a formal avenue for emerging technology education
The value of emerging technology capabilities, especially with AI, can best be understood
through seeing and experiencing. To help educate agencies and to support the prioritization
selection process, we recommend that the Federal CIO Council and GSA establish a formal
mechanism to meet with industry who are bringing these new emerging technologies to the
market such as AI developers to demonstrate and convey capabilities and use cases of the
core technology. Participants in this process should have strong technical capabilities that have
attracted interest, focus on the core technology not selling a product, and be active in the
federal market to connect to relevance and impact.

 

Given the ever-changing nature of technology, this also presents an opportunity for the Council
to stay abreast of new categories of value. Further, the Council can get an up-to-date picture of
how the capability is being piloted in the federal government at the time of application. On that
point, we urge the council to consider whether a particular technology is being widely piloted in
the federal agencies as a metric for whether it should be prioritized. Capabilities that agencies
are actively piloting are most likely to be used as SaaS offerings once through the FedRAMP
process.

 

Accelerating the FedRAMP process overall
The prioritization framework highlights an important need to accelerate the authorization of
new solutions to enable rapid adoption by government agencies. While we support the process
laid out in this framework, we hope that GSA and FedRAMP PMO can work with industry to
implement strategies that accelerate the entirety of the FedRAMP process beyond skipping the
temporary backlog, including adequate funding of the FedRAMP PMO, streamlining and
automation of the FedRAMP process, and harmonization across the government for
maximum reuse and adoption of technology. FedRAMP must continue to evolve to enable the
secure adoption of new capabilities near the pace of innovation.

 

Thank you for the opportunity to comment on this important matter. Government adoption of
emerging and fast-moving technologies, like AI, is an imperative that industry and government
must work together to ensure that regulation protects Americans and fosters innovation while
also avoiding unnecessary burdens.

 

We look forward to working with you. Should you have any questions, please contact Mason
Molesky, Cybersecurity Policy and Cloud Policy Executive, at mason@ibm.com.

 

Sincerely,
Vanessa Hunt
Technology General Manager
U.S. Federal Market

 

 

Share this post: