Cloud

The three-month FedRAMP approach

Shutterstock image

After an overhaul, the Federal Risk and Authorization Management Program expects to offer cloud service providers a dramatically shorter time frame for reviews.

"We're hoping it's going to take three months," FedRAMP Director Matt Goodrich said at Amazon Web Services' Public Sector Summit on June 20. "My team kind of hates me because sometimes I make crazy goals for us, but I actually really think it's possible."

The focus on speed would be a welcome improvement on the current state of affairs. Goodrich has acknowledged that the process currently takes most CSPs nine to 18 months to complete, while some parties in the private sector peg the timeline at closer to two years.

The faster turnaround will be thanks to capabilities assessments built into FedRAMP Accelerated, a push Goodrich announced in March. He told FCW that CSPs would need to complete capabilities assessments first -- which should take less than a month -- and then move through a three-month FedRAMP authorization process.

The FedRAMP office has been testing the accelerated approach with a few CSPs, and Goodrich said a recent meeting with a Microsoft team drove home the value of FedRAMP Accelerated's prep work.

In the traditional model, a first meeting between FedRAMP's assessors and a CSP would take 90 minutes and discuss only broad, high-level points of the system under review, Goodrich said. But the latest meeting with Microsoft officials to discuss the company's Customer Relationship Management product lasted two days and featured deep dives into system details.

FedRAMP's Joint Authorization Board members -- the Defense Department, Department of Homeland Security and General Services Administration -- were particularly impressed.

"When we left, the members from the DOD, DHS and GSA teams said, 'We actually believe that two-day conversation took off at least a month of our review time because we now understand what's going on, we understand where to dig in,'" Goodrich said.

The pre-vetting process should save time for successful CSPs and reduce headaches for those destined to be unsuccessful. Goodrich said one vendor went all the way through the process only to realize near the end that its non-replaceable Britain-based jump servers made its system impossible to reconcile with FedRAMP standards.

The FedRAMP office also plans to release a final version of its long-awaited "high" baseline standards.

About the Author

Zach Noble is a staff writer covering digital citizen services, workforce issues and a range of civilian federal agencies.

Before joining FCW in 2015, Noble served as assistant editor at the viral news site TheBlaze, where he wrote a mix of business, political and breaking news stories and managed weekend news coverage. He has also written for online and print publications including The Washington Free Beacon, The Santa Barbara News-Press, The Federalist and Washington Technology.

Noble is a graduate of Saint Vincent College, where he studied English, economics and mathematics.

Click here for previous articles by Noble, or connect with him on Twitter: @thezachnoble.


Featured

  • Cybersecurity
    Shutterstock photo id 669226093 By Gorodenkoff

    The disinformation game

    The federal government is poised to bring new tools and strategies to bear in the fight against foreign-backed online disinformation campaigns, but how and when they choose to act could have ramifications on the U.S. political ecosystem.

  • FCW PERSPECTIVES
    sensor network (agsandrew/Shutterstock.com)

    Are agencies really ready for EIS?

    The telecom contract has the potential to reinvent IT infrastructure, but finding the bandwidth to take full advantage could prove difficult.

  • People
    Dave Powner, GAO

    Dave Powner audits the state of federal IT

    The GAO director of information technology issues is leaving government after 16 years. On his way out the door, Dave Powner details how far govtech has come in the past two decades and flags the most critical issues he sees facing federal IT leaders.

Stay Connected

FCW Update

Sign up for our newsletter.

I agree to this site's Privacy Policy.