6 ms·

I used to work on FedRamp and I’m fine with it. It’s just like SOC2 compliance, mostly dog and pony show for auditors who have conflict of interest and no clue

I used to work on FedRamp and I’m fine with it. It’s just like SOC2 compliance, mostly dog and pony show for auditors who have conflict of interest and no clue what they are auditing.

hoseyor 1y ago
I wish I could vote more for this. You forgot that it costs at min $1M to get certified up to several dozen millions once everything is said and done; and that does not guarantee any government contracts or agency purchases. You have to basically be a big player that can put up the money and because by any number of the various methods of corruption, you already know that you will have government contracts waiting for you on the far side.
- dangus 1y ago
  Honestly if those numbers you’re providing are accurate, that’s not a lot of money. The research I’ve done pegs the cost at $500,000 to $1.5 million. That actually is “small SaaS company” territory. And don’t forget that VCs throw more money than that around for much riskier propositions. The whole VC business is that you’ll have 1 success and 10 failures, throwing $2 million in hopes of landing a government contract (stable revenue above market rates) is probably a great investment for a lot of small/medium sized companies.
  - deleted 1y ago
    [deleted]
- kaydub 1y ago
  You are getting ripped off. The 3paos can do FedRAMP audits for much lower. I've seen as low as $150k. We dropped our auditor for another because we were priced at $X, but when they came into our office and saw that we bring in a ton of money (we used to have our sales info on every screen on every floor of the office) they updated their pricing for next year's audit.
- TranquilMarmot 1y ago
  We got FedRAMP certified at a previous job. At first I balked at you saying it cost $1M but, doing some back-of-the-napkin math, that's probably pretty accurate once you take into account the salaries of everybody involved, time that we had to spend figuring out all the auditing, outside companies we had to hire and involve, and extra cloud costs and setup. Not to mention the ongoing cost of maintaining all of that and ongoing audits. We were also a pretty small startup (~50 people?) but were focused solely on government data storage and management, so it made a lot of sense for us to get the certification. It definitely paid for itself in the number of contracts it unlocked.
- justincormack 1y ago
  Fedramp 20x is an attempt to change this and make it much cheaper and simpler to pass, via modernization.
- dragonwriter 1y ago
  > You have to basically be a big player that can put up the money and because by any number of the various methods of corruption, you already know that you will have government contracts waiting for you on the far side. You seem to working from the faulty premise that FedRAMP only isna concern for durect federal contracting. Because FedRAMP applies to systems with federal data, and because entities other than the federal government often have a mix of federal and non-federal data, it is quite common for a vendor who does not have FedRAMP certification (either at all or for some services) to know by non-corrupt means that some of their customers have workloads that are in-house or with a different vendor due to FedRAMP that they would bring to the first vendor if that vendor was FedRAMP compliant for the services involved.
xvector 1y ago
Anything involving auditors or policy people in tech turns into a clown show. Dunno what it is like for other industries (but my friends in pharmaceutical research feel similarly). These are deeply nontechnical people attempting to enforce regulations drafted by deeply nontechnical people (typically academics that graduated from an Ivy but have zero industry experience, like the folks at modern-day RAND) and it's just a clown show all the way down.
- voidfunc 1y ago
  That's the point. It's all designed to setup a huge moat around products and service providers that can play the game.
tw04 1y ago
That’s just easily and provably not true. FedRamp is absolutely not “mostly dog and pony”. See: Okta being compromised, and their FedRamp High environment remaining secure: https://www.meritalk.com/articles/okta-hack-didnt-touch-fedramp-high-dod-il4-environments/ https://www.meritalk.com/articles/okta-hack-didnt-touch-fedr...
- kaydub 1y ago
  Your example doesn't give details so it doesn't mean much. First FedRAMP high is extremely strict. Most ATOs are NOT for FedRAMP high. Most people are good with a FedRAMP moderate. Also, this doesn't mean the security controls are what stopped those other environments from being hacked. The other systems are just separate, that's why they weren't hacked with everything else. Overall I think FedRAMP is good, because it at least gets somewhat of a baseline. But the other guy was pretty spot on. The auditors generally have no idea what they're looking at, there are a lot of security controls that don't make sense under many contexts and it is mostly a dog and pony show. And really, it's not like these departments didn't have some type of due diligence to acquiring software, FedRAMP just makes it standardized and allows departments/agencies to piggyback off of other department/agency's due diligence.
  - MrDarcy 1y ago
    The dog and pony show isn’t the point. Most companies are not blatantly committing fraud, especially against the federal government. It’s just not worth it. The process of thinking about the controls and speaking to them itself results in demonstrably more secure operating environments.
- sidewndr46 1y ago
  The article points out this is just due to it being a separate system. If anything, your argument is one against cloud computing and SaaS where your data is intermingled with everyone elses.
  - tw04 1y ago
    It’s a separate environment with STRICTER security requirements. That’s the point….

I used to work on FedRamp and I’m fine with it. It’s just like SOC2 compliance, mostly dog and pony show for auditors who have conflict of interest and no clue what they are auditing.

hoseyor 1y ago

I wish I could vote more for this. You forgot that it costs at min $1M to get certified up to several dozen millions once everything is said and done; and that does not guarantee any government contracts or agency purchases. You have to basically be a big player that can put up the money and because by any number of the various methods of corruption, you already know that you will have government contracts waiting for you on the far side.

dangus 1y ago
Honestly if those numbers you’re providing are accurate, that’s not a lot of money. The research I’ve done pegs the cost at $500,000 to $1.5 million. That actually is “small SaaS company” territory. And don’t forget that VCs throw more money than that around for much riskier propositions. The whole VC business is that you’ll have 1 success and 10 failures, throwing $2 million in hopes of landing a government contract (stable revenue above market rates) is probably a great investment for a lot of small/medium sized companies.
- deleted 1y ago
  [deleted]
kaydub 1y ago
You are getting ripped off. The 3paos can do FedRAMP audits for much lower. I've seen as low as $150k. We dropped our auditor for another because we were priced at $X, but when they came into our office and saw that we bring in a ton of money (we used to have our sales info on every screen on every floor of the office) they updated their pricing for next year's audit.
TranquilMarmot 1y ago
We got FedRAMP certified at a previous job. At first I balked at you saying it cost $1M but, doing some back-of-the-napkin math, that's probably pretty accurate once you take into account the salaries of everybody involved, time that we had to spend figuring out all the auditing, outside companies we had to hire and involve, and extra cloud costs and setup. Not to mention the ongoing cost of maintaining all of that and ongoing audits. We were also a pretty small startup (~50 people?) but were focused solely on government data storage and management, so it made a lot of sense for us to get the certification. It definitely paid for itself in the number of contracts it unlocked.
justincormack 1y ago
Fedramp 20x is an attempt to change this and make it much cheaper and simpler to pass, via modernization.
dragonwriter 1y ago
> You have to basically be a big player that can put up the money and because by any number of the various methods of corruption, you already know that you will have government contracts waiting for you on the far side. You seem to working from the faulty premise that FedRAMP only isna concern for durect federal contracting. Because FedRAMP applies to systems with federal data, and because entities other than the federal government often have a mix of federal and non-federal data, it is quite common for a vendor who does not have FedRAMP certification (either at all or for some services) to know by non-corrupt means that some of their customers have workloads that are in-house or with a different vendor due to FedRAMP that they would bring to the first vendor if that vendor was FedRAMP compliant for the services involved.

xvector 1y ago

Anything involving auditors or policy people in tech turns into a clown show. Dunno what it is like for other industries (but my friends in pharmaceutical research feel similarly). These are deeply nontechnical people attempting to enforce regulations drafted by deeply nontechnical people (typically academics that graduated from an Ivy but have zero industry experience, like the folks at modern-day RAND) and it's just a clown show all the way down.

voidfunc 1y ago
That's the point. It's all designed to setup a huge moat around products and service providers that can play the game.

tw04 1y ago

That’s just easily and provably not true. FedRamp is absolutely not “mostly dog and pony”. See: Okta being compromised, and their FedRamp High environment remaining secure: https://www.meritalk.com/articles/okta-hack-didnt-touch-fedramp-high-dod-il4-environments/ https://www.meritalk.com/articles/okta-hack-didnt-touch-fedr...

kaydub 1y ago
Your example doesn't give details so it doesn't mean much. First FedRAMP high is extremely strict. Most ATOs are NOT for FedRAMP high. Most people are good with a FedRAMP moderate. Also, this doesn't mean the security controls are what stopped those other environments from being hacked. The other systems are just separate, that's why they weren't hacked with everything else. Overall I think FedRAMP is good, because it at least gets somewhat of a baseline. But the other guy was pretty spot on. The auditors generally have no idea what they're looking at, there are a lot of security controls that don't make sense under many contexts and it is mostly a dog and pony show. And really, it's not like these departments didn't have some type of due diligence to acquiring software, FedRAMP just makes it standardized and allows departments/agencies to piggyback off of other department/agency's due diligence.
- MrDarcy 1y ago
  The dog and pony show isn’t the point. Most companies are not blatantly committing fraud, especially against the federal government. It’s just not worth it. The process of thinking about the controls and speaking to them itself results in demonstrably more secure operating environments.
sidewndr46 1y ago
The article points out this is just due to it being a separate system. If anything, your argument is one against cloud computing and SaaS where your data is intermingled with everyone elses.
- tw04 1y ago
  It’s a separate environment with STRICTER security requirements. That’s the point….