3 ms·

Can you provide some specifics? I am not refuting your claim. GCP is my favorite cloud platform to develop on, but obviously the needs of the US government are

Can you provide some specifics? I am not refuting your claim. GCP is my favorite cloud platform to develop on, but obviously the needs of the US government are different from the needs of an individual software consultant.

tw04 6y ago
I would imagine it's more a matter of contracts and relationships than strictly features. Doing business with the government generally requires a dedicated business unit - not because their requirements are markedly different (although they can definitely be more strict on security requirements) but more because there's just a mountain of paperwork to be a qualified vendor. Google or not.
moandcompany 6y ago
Google/Alphabet employee here, but not affiliated with GCP. One quick way to get a grasp of this is to take a look at the FedRamp page for various Cloud services providers with IaaS and other offerings to see how many authorizations exist, and at what level: https://marketplace.fedramp.gov/#/products?sort=productName&providers=Amazon;Google;Microsoft;Oracle;Rackspace%20Government%20Solutions https://marketplace.fedramp.gov/#/products?sort=productName&... What is FedRamp? "The Federal Risk and Authorization Management Program (FedRAMP) is a government-wide program that provides a standardized approach to security assessment, authorization, and continuous monitoring for cloud products and services. This approach uses a “do once, use many times” framework that saves cost, time, and staff required to conduct redundant Agency security assessments." Not all DoD work is classified, but classified data storage, transmission, and processing has strict standards defined by the National Security Agency. There are many levels of information classification, and generally these information levels are not allowed to comingle or information systems are run at a system-high level (i.e. everything in and about a system is handled at the highest level of classification for information the system may contain). Generally, information systems used by the Department of Defense must be certified and accredited for use by the information owner / equivalent of a CIO-level role (G6/A6/N6/etc). Not all cloud service providers have facilities and systems designed and certified for classified information storage and processing. https://fcw.com/articles/2017/11/20/aws-secret-region.aspx https://fcw.com/articles/2017/11/20/aws-secret-region.aspx https://www.nextgov.com/it-modernization/2018/03/defense-agency-begin-moving-classified-data-amazons-secret-cloud-after-protest/146619/ https://www.nextgov.com/it-modernization/2018/03/defense-age... https://www.nextgov.com/it-modernization/2020/03/microsoft-upgrades-classified-cloud-offering/164169/ https://www.nextgov.com/it-modernization/2020/03/microsoft-u...

tw04 6y ago

I would imagine it's more a matter of contracts and relationships than strictly features. Doing business with the government generally requires a dedicated business unit - not because their requirements are markedly different (although they can definitely be more strict on security requirements) but more because there's just a mountain of paperwork to be a qualified vendor. Google or not.

moandcompany 6y ago

Google/Alphabet employee here, but not affiliated with GCP. One quick way to get a grasp of this is to take a look at the FedRamp page for various Cloud services providers with IaaS and other offerings to see how many authorizations exist, and at what level: https://marketplace.fedramp.gov/#/products?sort=productName&providers=Amazon;Google;Microsoft;Oracle;Rackspace%20Government%20Solutions https://marketplace.fedramp.gov/#/products?sort=productName&... What is FedRamp? "The Federal Risk and Authorization Management Program (FedRAMP) is a government-wide program that provides a standardized approach to security assessment, authorization, and continuous monitoring for cloud products and services. This approach uses a “do once, use many times” framework that saves cost, time, and staff required to conduct redundant Agency security assessments." Not all DoD work is classified, but classified data storage, transmission, and processing has strict standards defined by the National Security Agency. There are many levels of information classification, and generally these information levels are not allowed to comingle or information systems are run at a system-high level (i.e. everything in and about a system is handled at the highest level of classification for information the system may contain). Generally, information systems used by the Department of Defense must be certified and accredited for use by the information owner / equivalent of a CIO-level role (G6/A6/N6/etc). Not all cloud service providers have facilities and systems designed and certified for classified information storage and processing. https://fcw.com/articles/2017/11/20/aws-secret-region.aspx https://fcw.com/articles/2017/11/20/aws-secret-region.aspx https://www.nextgov.com/it-modernization/2018/03/defense-agency-begin-moving-classified-data-amazons-secret-cloud-after-protest/146619/ https://www.nextgov.com/it-modernization/2018/03/defense-age... https://www.nextgov.com/it-modernization/2020/03/microsoft-upgrades-classified-cloud-offering/164169/ https://www.nextgov.com/it-modernization/2020/03/microsoft-u...