How FedRAMP Lifts All Cloud Ships

Wyatt Kash| Informationweek

FedRAMP’s role in making cloud services more secure also helps agencies offset some of the complexity of their IT operations, says NIST’s Ron Ross.

If you spend any time listening to what government IT executives are talking about in Washington these days — besides the NSA’s data-collection practices and what everyone should have learned from HealthCare.gov — it’s hard to ignore at least some discussion about secure cloud computing and a federal program called FedRAMP.

Talk to IT executives outside of Washington, however, and it’s evident that discussions about FedRAMP  and its impact on cloud service providers are reaching far beyond the Beltway and rippling through the boardrooms of IT services providers. As Amazon Web Services VP Teresa Carlson said in a recent interview: “Cloud companies won’t be able to participate in any [government] procurement or award without being able to achieve the FedRAMP standards.”

For those new to the discussion, FedRAMP is a program cooked up by a group of savvy bureaucrats who grasped the potential of cloud computing, but also understood that, without help in overcoming the government’s own red tape, federal agencies faced a long road to cloud adoption. The reason stems from the fact that every federal agency must assess and certify the security risks of its IT systems. Cloud computing added a new layer of complexity to the government’s security requirements and procurement contracts.

How FedRAMP — the Federal Risk Authorization and Management Program — succeeded in greasing the policy skids for agencies and creating a set of baseline security standards now gaining attention from cloud computing providers, and even some of their commercial customers, is the subject of an InformationWeek Government special report released this week.

Ron Ross, one of FedRAMP’s architects from the National Institute of Standards and Technology, believes FedRAMP is important to agencies and cloud computing service providers for a couple of reasons.

“It sets very clear expectations on what security controls are needed” to minimize an enterprise’s IT security risks, Ross says. He points to FedRAMP’s insistence on third-party assessment organizations to “validate that cloud service providers have implemented those controls. That’s good for industry and it’s good for federal agencies,” he says.

Ross also sees a greater good in the way FedRAMP helps support cloud computing and offsets IT complexity. “The more we can address our complexity problem by moving as much IT as is appropriate to the cloud, the more that frees up our remaining resources. That’s an important part of the equation in trying to lock down our critical infrastructure,” he argues.

While federal agencies placed down payments on $17 billion worth of cloud computing projects this past fiscal year, FedRAMP officials know they must do more to attract a wider range of cloud services — and to persuade agencies to use FedRAMP-certified services.

More also needs to be done to educate federal officials about the potential savings and false promises that come with cloud computing. That’s one reason behind the announcement, made last week, by Congressmen Darrell Issa (R-Calif.) and Gerry Connolly (D-Va.) that they and a group of industry supporters had agreed to launch the Cloud Computing Caucus Advisory Group, which they hope will enlighten the discussion on cloud computing.

But this much is clear: FedRAMP is a program more people will be talking about, and not just in Washington.