4 ms·

What is this, exactly? Is this Oracle (or whomever) getting government cloud contracts without a bidding / RFP process? Is there adequate security review bein

What is this, exactly? Is this Oracle (or whomever) getting government cloud contracts without a bidding / RFP process? Is there adequate security review being done?

tcfunk 2y ago
Oracle was already on the FedRAMP list I think. AFAIK this is about getting smaller cloud providers approved to host government projects so there’s more options available.
- ritwikgupta 2y ago
  This is about changing the way FedRAMP accreditation is done for any cloud service, like Box (or a new SaaS that you may create tomorrow). The FedRAMP process requires you go through a certain set of audits, meet a certain set of standards, etc., in order to be approved to host CUI (IL4/5) or SECRET (IL6) information. Normally this can take a lot of time and monetary investment. On one hand, these processes encode cybersecurity best practices. On another hand, it keeps new companies out of the market. It seems this effort is doing away with a lot of those processes. I hope the level of compliance stays the same.
  - tguvot 2y ago
    IL 4/5/6 actually add a bunch of additional controls and parameters on top of standard fedramp baselines
  - kaydub 2y ago
    I'm pretty sure IL4/5/6 are all outside the scope of FedRAMP
- ksec 2y ago
  But why would any agency chooses smaller cloud providers other than Oracle, AWS, Azure and Google? They are the lowest risk selection in terms of responsibility. Edit: Another comments actually replied it is much more than hosting but cloud services like BOX. I assume even SaaS could fall into this category.
  - cyberge99 2y ago
    To stay off the radar. To do shady stuff at a small company that you can easily control/manipulate.
  - tguvot 2y ago
    Saas is most common use case
  - Spooky23 2y ago
    They tend to converge on each other. Also the Feds may have particular needs for connectivity, location, etc.
  - justincormack 2y ago
    SaaS companies, not just cloud providers.
tw04 2y ago
[flagged]
- deleted 2y ago
  [deleted]
tomrod 2y ago
FedRAMP is a set of technologies vetted by a common standard by GSA. It assists in moving technologies from one-off authority to operate (ATO) with a specific CIO office in an agency or department to a shared standard. It takes some investment, but it is cheaper than each company jumping through arbitrary hoops and opens most of the federal government as a client. It was part of the brainchild of GSA's 18F, recently DOGE'd.
_bin_ 2y ago
The point here is to avoid the oracles of the world getting everything. Please trust me on this one: fedramp isn’t really about security. Compliance with it doesn’t ensure it and noncompliance doesn’t preclude it. It was okay when originally released but that’s not been the case for years now.
ecb_penguin 2y ago
Serious question: Why don't you spend a few minutes learning about it, rather than throwing negative comments out? Do you think vomiting a negative talking point without understanding it is considered "smart"?

What is this, exactly? Is this Oracle (or whomever) getting government cloud contracts without a bidding / RFP process? Is there adequate security review being done?

tcfunk 2y ago

Oracle was already on the FedRAMP list I think. AFAIK this is about getting smaller cloud providers approved to host government projects so there’s more options available.

ritwikgupta 2y ago
This is about changing the way FedRAMP accreditation is done for any cloud service, like Box (or a new SaaS that you may create tomorrow). The FedRAMP process requires you go through a certain set of audits, meet a certain set of standards, etc., in order to be approved to host CUI (IL4/5) or SECRET (IL6) information. Normally this can take a lot of time and monetary investment. On one hand, these processes encode cybersecurity best practices. On another hand, it keeps new companies out of the market. It seems this effort is doing away with a lot of those processes. I hope the level of compliance stays the same.
- tguvot 2y ago
  IL 4/5/6 actually add a bunch of additional controls and parameters on top of standard fedramp baselines
- kaydub 2y ago
  I'm pretty sure IL4/5/6 are all outside the scope of FedRAMP
ksec 2y ago
But why would any agency chooses smaller cloud providers other than Oracle, AWS, Azure and Google? They are the lowest risk selection in terms of responsibility. Edit: Another comments actually replied it is much more than hosting but cloud services like BOX. I assume even SaaS could fall into this category.
- cyberge99 2y ago
  To stay off the radar. To do shady stuff at a small company that you can easily control/manipulate.
- tguvot 2y ago
  Saas is most common use case
- Spooky23 2y ago
  They tend to converge on each other. Also the Feds may have particular needs for connectivity, location, etc.
- justincormack 2y ago
  SaaS companies, not just cloud providers.

tw04 2y ago

[flagged]

deleted 2y ago
[deleted]

tomrod 2y ago

FedRAMP is a set of technologies vetted by a common standard by GSA. It assists in moving technologies from one-off authority to operate (ATO) with a specific CIO office in an agency or department to a shared standard. It takes some investment, but it is cheaper than each company jumping through arbitrary hoops and opens most of the federal government as a client. It was part of the brainchild of GSA's 18F, recently DOGE'd.

_bin_ 2y ago

The point here is to avoid the oracles of the world getting everything. Please trust me on this one: fedramp isn’t really about security. Compliance with it doesn’t ensure it and noncompliance doesn’t preclude it. It was okay when originally released but that’s not been the case for years now.

ecb_penguin 2y ago

Serious question: Why don't you spend a few minutes learning about it, rather than throwing negative comments out? Do you think vomiting a negative talking point without understanding it is considered "smart"?