5 ms·

It's a bland title for a key thing: It sets compliance standards for government use of cloud computing. Even companies like Google have had massive projects to

It's a bland title for a key thing: It sets compliance standards for government use of cloud computing. Even companies like Google have had massive projects to get FedRAMP compliant so that the federal government can use their services. See for example: https://fedscoop.com/google-earns-fedramp-high-authorization-for-more-than-100-additional-commercial-services/ https://fedscoop.com/google-earns-fedramp-high-authorization... And this announcement is basically just that they're going to massively lower the bar.

estebarb 1y ago
It feels like enforcing that everything must be written in Ada. And then relaxing the requirement... history always repeats itself, it seems.
solardev 1y ago
Sounds like a good time to invest in Russian VPS hosts.
- cowboylowrez 1y ago
  oof if thats the solution I'll stick with the problem lol
alephnerd 1y ago
> And this announcement is basically just that they're going to massively lower the bar The FedRAMP bar was always dumb. I've been in the cybersecurity industry for more than a decade now, and while FedRAMP was envisioned as a way to streamline Fed cloud and security procurement, it ossified extremely quickly. To get FedRAMP you ended up having to work with a handful of dedicated FedRAMP partners, and your development velocity would dramatically decrease as you spent most of your time dealing with compliance BS that didn't actually affect your security posture. A lot of the innovation on the security vendor side is happening at early-mid stage startups, but sinking $15-20M and 1.5- 2 years just to get FedRAMP compliance became too much of a lift, hence incentivizing consolidation amongst larger vendors.
- Spooky23 1y ago
  It’s mostly an easy button for procurement officers. You’re required to meet the control standards that FedRAMP requires anyway, and it saves months of the customer’s time to do it once. Startups are always problematic for government procurement, and unless you play in a space that is setup to handle small vendors, your business is going through partners anyway.
  - alephnerd 1y ago
    > It’s mostly an easy button for procurement officers I know. I have never had an issue with FedRAMP as a single marketplace. The issue has always been arbitrary compliance requirements > Startups are always problematic for government procurement Absolutely, and ensuring that they are within a verified marketplace such as that which FedRAMP intended to make is good. The issue is the upfront cost to become FedRAMP compliant is so high, that most vendors do not even try until extremely late in their lifecycle. Furthermore, a lack of vendors does lead to extremely suboptimal pricing. There is some cost to recoup from going through FedRAMP compliance hurdles, but a lot of it is also because once you are FedRAMP compliant, depending on the tooling, you have a captive market with maybe 1 or 2 competitors. > Startups are always problematic for government procurement, and unless you play in a space that is setup to handle small vendors, your business is going through partners anyway I'm not talking about SIs or MSSPs. I'm talking about specific FedRAMP compliance partners. They provide no value except checkboxing, but all of vendors need to partner with them.
stackskipton 1y ago
I used to work on FedRamp and I’m fine with it. It’s just like SOC2 compliance, mostly dog and pony show for auditors who have conflict of interest and no clue what they are auditing.
- hoseyor 1y ago
  I wish I could vote more for this. You forgot that it costs at min $1M to get certified up to several dozen millions once everything is said and done; and that does not guarantee any government contracts or agency purchases. You have to basically be a big player that can put up the money and because by any number of the various methods of corruption, you already know that you will have government contracts waiting for you on the far side.
  - dangus 1y ago
    Honestly if those numbers you’re providing are accurate, that’s not a lot of money. The research I’ve done pegs the cost at $500,000 to $1.5 million. That actually is “small SaaS company” territory. And don’t forget that VCs throw more money than that around for much riskier propositions. The whole VC business is that you’ll have 1 success and 10 failures, throwing $2 million in hopes of landing a government contract (stable revenue above market rates) is probably a great investment for a lot of small/medium sized companies.
    - deleted 1y ago
      [deleted]
  - kaydub 1y ago
    You are getting ripped off. The 3paos can do FedRAMP audits for much lower. I've seen as low as $150k. We dropped our auditor for another because we were priced at $X, but when they came into our office and saw that we bring in a ton of money (we used to have our sales info on every screen on every floor of the office) they updated their pricing for next year's audit.
  - TranquilMarmot 1y ago
drivingmenuts 1y ago
Well, it explains why all the SV billionaires were so hot to get Trump in office. Basically, a taxpayer funded payday for them.
- mindslight 1y ago
  Trump is basically living the dream of every computer illiterate boomer who responds to a text message asking for their bank account details so stolen money can be deposited. "This cyber thing is pretty great. I've been saying this for a long time, thanks J-Kush. By the way, I said, I'm sorry for calling you 'mid' yesterday. Am I am I using that right? I am using that right. I'm not doing that to brag, because, you know what, I don't have to brag."

estebarb 1y ago

It feels like enforcing that everything must be written in Ada. And then relaxing the requirement... history always repeats itself, it seems.

solardev 1y ago

Sounds like a good time to invest in Russian VPS hosts.

cowboylowrez 1y ago
oof if thats the solution I'll stick with the problem lol

alephnerd 1y ago

> And this announcement is basically just that they're going to massively lower the bar The FedRAMP bar was always dumb. I've been in the cybersecurity industry for more than a decade now, and while FedRAMP was envisioned as a way to streamline Fed cloud and security procurement, it ossified extremely quickly. To get FedRAMP you ended up having to work with a handful of dedicated FedRAMP partners, and your development velocity would dramatically decrease as you spent most of your time dealing with compliance BS that didn't actually affect your security posture. A lot of the innovation on the security vendor side is happening at early-mid stage startups, but sinking $15-20M and 1.5- 2 years just to get FedRAMP compliance became too much of a lift, hence incentivizing consolidation amongst larger vendors.

Spooky23 1y ago
It’s mostly an easy button for procurement officers. You’re required to meet the control standards that FedRAMP requires anyway, and it saves months of the customer’s time to do it once. Startups are always problematic for government procurement, and unless you play in a space that is setup to handle small vendors, your business is going through partners anyway.
- alephnerd 1y ago
  > It’s mostly an easy button for procurement officers I know. I have never had an issue with FedRAMP as a single marketplace. The issue has always been arbitrary compliance requirements > Startups are always problematic for government procurement Absolutely, and ensuring that they are within a verified marketplace such as that which FedRAMP intended to make is good. The issue is the upfront cost to become FedRAMP compliant is so high, that most vendors do not even try until extremely late in their lifecycle. Furthermore, a lack of vendors does lead to extremely suboptimal pricing. There is some cost to recoup from going through FedRAMP compliance hurdles, but a lot of it is also because once you are FedRAMP compliant, depending on the tooling, you have a captive market with maybe 1 or 2 competitors. > Startups are always problematic for government procurement, and unless you play in a space that is setup to handle small vendors, your business is going through partners anyway I'm not talking about SIs or MSSPs. I'm talking about specific FedRAMP compliance partners. They provide no value except checkboxing, but all of vendors need to partner with them.

stackskipton 1y ago

I used to work on FedRamp and I’m fine with it. It’s just like SOC2 compliance, mostly dog and pony show for auditors who have conflict of interest and no clue what they are auditing.

hoseyor 1y ago
I wish I could vote more for this. You forgot that it costs at min $1M to get certified up to several dozen millions once everything is said and done; and that does not guarantee any government contracts or agency purchases. You have to basically be a big player that can put up the money and because by any number of the various methods of corruption, you already know that you will have government contracts waiting for you on the far side.
- dangus 1y ago
  Honestly if those numbers you’re providing are accurate, that’s not a lot of money. The research I’ve done pegs the cost at $500,000 to $1.5 million. That actually is “small SaaS company” territory. And don’t forget that VCs throw more money than that around for much riskier propositions. The whole VC business is that you’ll have 1 success and 10 failures, throwing $2 million in hopes of landing a government contract (stable revenue above market rates) is probably a great investment for a lot of small/medium sized companies.
  - deleted 1y ago
    [deleted]
- kaydub 1y ago
  You are getting ripped off. The 3paos can do FedRAMP audits for much lower. I've seen as low as $150k. We dropped our auditor for another because we were priced at $X, but when they came into our office and saw that we bring in a ton of money (we used to have our sales info on every screen on every floor of the office) they updated their pricing for next year's audit.
- TranquilMarmot 1y ago

drivingmenuts 1y ago

Well, it explains why all the SV billionaires were so hot to get Trump in office. Basically, a taxpayer funded payday for them.

mindslight 1y ago
Trump is basically living the dream of every computer illiterate boomer who responds to a text message asking for their bank account details so stolen money can be deposited. "This cyber thing is pretty great. I've been saying this for a long time, thanks J-Kush. By the way, I said, I'm sorry for calling you 'mid' yesterday. Am I am I using that right? I am using that right. I'm not doing that to brag, because, you know what, I don't have to brag."