January 26–28, 2027 · Free and online

We compete on features. We collaborate on security.

The No Cap Workshop is three days of free, practical, practitioner-led sessions to support teams working on compliance with FedRAMP's VDR requirements. No sales pitches and no low-effort lectures. The people who have successfully met these challenges will share the strategies and tactics they are using right now, because at the end of the day it's our government that we're all protecting.

Why “No Cap”? CAP is a Corrective Action Plan, the status a Cloud Service Provider lands in if it misses the December 7 deadline for implementing FedRAMP’s CR-26 rules for Vulnerability Detection and Response (VDR). Offerings under a CAP are at risk of having their FedRAMP certification revoked if they are not compliant by March 7, 2027.

This workshop is about staying out of a CAP, or getting out if you’re already in.

How it works

Free, open, and accessible.

This is a free online event open to anyone who wants to take part. There is no registration and no identification. Show up, watch, learn, ask questions, and participate at whatever level of engagement works for you. Each session will be recorded and posted online for everyone to use afterward.

Schedule

Three days, One Goal.

Session times are shown in your local time.

  1. Tuesday, January 26, 2027

    Data Collection

    What to collect, from where, and how often. Scanner coverage, asset inventory, and the evidence that shows both are complete.

    Sessions announced soon.

  2. Wednesday, January 27, 2027

    Vulnerability Evaluation

    Internet-reachability, likely exploitability, and the Potential Agency Impact N Rating.

    Sessions announced soon.

  3. Thursday, January 28, 2027

    Remediation and Reporting

    Driving decisions. Fixing and mitigating on the clock, then reporting it to agencies and auditors.

    Sessions announced soon.

Audience

Who should attend

  1. Teams under a CAP

    Learn the strategies and approaches that get you out from under it by March 7, 2027.

  2. Teams not under a CAP

    Find new ways to strengthen what you already do, and borrow from the experience of others.

  3. Teams in a Good Place

    Show up to share what is working, and learn a few new tricks along the way.

Speakers

Who speaks

Speakers are active practitioners from Cloud Service Providers, auditors, advisors, and vendors. We organize tracks and sessions around the work. If your product has answers, this is a forum to let everyone know.

Speakers and call for speakers →

Success

The Mission

Support teams to come off a CAP, or avoid going on one, then position everyone to succeed by the March 7 deadline and beyond.

Sponsors

Sponsors

The workshop is free to attend because sponsors make it happen. Sponsors fund logistics, time, and publication, and share the room with a security-minded audience that is working on this exact problem.

Founder

Open

Gold

Open

Silver

Open

Talk to us about sponsoring →

This is bigger than the rules.

The VDR refactor is a dramatic, complex change to security compliance, and something that many teams are struggling to understand, implement, and maintain. It's also one of the most timely changes we could be facing. Think about it this way - at some point in the future we'll look back on the 12-hour SLA and chuckle that we used to have so much time to respond.