{"id":2739,"date":"2012-02-24T07:00:12","date_gmt":"2012-02-24T15:00:12","guid":{"rendered":"http:\/\/www.formtek.com\/blog\/?p=2739"},"modified":"2012-02-24T07:00:12","modified_gmt":"2012-02-24T15:00:12","slug":"cloud-computing-gsa-pushes-forward-government-adoption-of-the-cloud-with-fedramp","status":"publish","type":"post","link":"https:\/\/formtek.com\/blog\/cloud-computing-gsa-pushes-forward-government-adoption-of-the-cloud-with-fedramp\/","title":{"rendered":"Cloud Computing: GSA Pushes Forward Government Adoption of the Cloud with FedRaMP"},"content":{"rendered":"

In January, the US Federal government issued a comprehensive list of 168 security control requirements <\/a>in 16 categories\u00a0that cloud providers must first comply with before being able to provide services to any Federal agency. \u00a0 The requirements cover, for example, \u00a0the specifics of software upgrades and backups,\u00a0smartphone access, and security issues. \u00a0While that list of requirements is lengthy, the good news for vendors is that once they are able to prove compliance with those requirements, they then become eligible to sell their services to any federal agency. \u00a0In this way, there is just a single test that must be passed in order to become eligible to sell cloud services into the government.<\/p>\n

The requirements were issued by the Federal Risk and Authorization Management Program (FedRAMP<\/a>), part of the US General Services Administration (GSA<\/a>). \u00a0The charter of the group is to provide a standardized approach in the government to security assessment, authorization, and continuous monitoring for cloud products and services. \u00a0By creating a \u201cdo once, use many times\u201d framework, they expect to be able to save both money and time by centralizing the approval process and avoiding redundant security assessments that would otherwise would have to be made by each individual agency in the government. \u00a0The expectations are that the process can speed the process of getting federal agencies to start using cloud services.<\/p>\n

Department of Homeland Security Chief Information Officer Richard Spires<\/a> wrote that<\/a> “FedRAMP’s unified risk management process will evaluate IT services offered by vendors on behalf of federal agencies, saving agencies from conducting their own risk management programs. \u00a0This baseline serves all federal agencies and [cloud service providers], to which additional controls may be added by agencies to meet specific requirements.”<\/p>\n

The GSA is expected to specify the details of the compliance audit procedure by February 8th. \u00a0A “joint authorization board” (JAB) made up of security experts from the Department of Homeland Security, Pentagon and the GSA is expected to be involved in evaluating cloud products. \u00a0The JAB has said that they will publish three documents over the next six months to further clarify details about each of the requirements and how they will be tested. \u00a0Those publications are:<\/p>\n

\n