3 ms·

> And this announcement is basically just that they're going to massively lower the bar The FedRAMP bar was always dumb. I've been in the cybersecurity indust

> And this announcement is basically just that they're going to massively lower the bar The FedRAMP bar was always dumb. I've been in the cybersecurity industry for more than a decade now, and while FedRAMP was envisioned as a way to streamline Fed cloud and security procurement, it ossified extremely quickly. To get FedRAMP you ended up having to work with a handful of dedicated FedRAMP partners, and your development velocity would dramatically decrease as you spent most of your time dealing with compliance BS that didn't actually affect your security posture. A lot of the innovation on the security vendor side is happening at early-mid stage startups, but sinking $15-20M and 1.5- 2 years just to get FedRAMP compliance became too much of a lift, hence incentivizing consolidation amongst larger vendors.

Spooky23 2y ago
It’s mostly an easy button for procurement officers. You’re required to meet the control standards that FedRAMP requires anyway, and it saves months of the customer’s time to do it once. Startups are always problematic for government procurement, and unless you play in a space that is setup to handle small vendors, your business is going through partners anyway.
- alephnerd 2y ago
  > It’s mostly an easy button for procurement officers I know. I have never had an issue with FedRAMP as a single marketplace. The issue has always been arbitrary compliance requirements > Startups are always problematic for government procurement Absolutely, and ensuring that they are within a verified marketplace such as that which FedRAMP intended to make is good. The issue is the upfront cost to become FedRAMP compliant is so high, that most vendors do not even try until extremely late in their lifecycle. Furthermore, a lack of vendors does lead to extremely suboptimal pricing. There is some cost to recoup from going through FedRAMP compliance hurdles, but a lot of it is also because once you are FedRAMP compliant, depending on the tooling, you have a captive market with maybe 1 or 2 competitors. > Startups are always problematic for government procurement, and unless you play in a space that is setup to handle small vendors, your business is going through partners anyway I'm not talking about SIs or MSSPs. I'm talking about specific FedRAMP compliance partners. They provide no value except checkboxing, but all of vendors need to partner with them.

Spooky23 2y ago

It’s mostly an easy button for procurement officers. You’re required to meet the control standards that FedRAMP requires anyway, and it saves months of the customer’s time to do it once. Startups are always problematic for government procurement, and unless you play in a space that is setup to handle small vendors, your business is going through partners anyway.

alephnerd 2y ago
> It’s mostly an easy button for procurement officers I know. I have never had an issue with FedRAMP as a single marketplace. The issue has always been arbitrary compliance requirements > Startups are always problematic for government procurement Absolutely, and ensuring that they are within a verified marketplace such as that which FedRAMP intended to make is good. The issue is the upfront cost to become FedRAMP compliant is so high, that most vendors do not even try until extremely late in their lifecycle. Furthermore, a lack of vendors does lead to extremely suboptimal pricing. There is some cost to recoup from going through FedRAMP compliance hurdles, but a lot of it is also because once you are FedRAMP compliant, depending on the tooling, you have a captive market with maybe 1 or 2 competitors. > Startups are always problematic for government procurement, and unless you play in a space that is setup to handle small vendors, your business is going through partners anyway I'm not talking about SIs or MSSPs. I'm talking about specific FedRAMP compliance partners. They provide no value except checkboxing, but all of vendors need to partner with them.