How a mature FedRAMP sets the stage for more ambitious cloud projects

Government agencies are picking up the pace in adopting cloud solutions and modernizing their IT environments. At the center of this movement is the Federal Risk and Authorization Management Program. FedRAMP drives the convergence of cloud computing, cybersecurity and government technology needs by providing the rigorous cybersecurity standards a cloud solution must meet to be qualified for use by a government agency.

While the federal government has traditionally lagged the private sector in cloud adoption, agencies are increasingly steering their considerable purchasing power toward secure cloud solutions. Our recent research strongly indicates this trend will increase over the next 24 months, due to a variety of complementary factors that are making the federal agency community view cloud services as an increasingly attractive buy and turning federal agencies into more attractive buyers for cloud service providers (CSPs) looking for market opportunities.

In the past three years, the number of FedRAMP-authorized cloud services has grown at a steady rate, with federal cloud spending increasing apace: in FY2018, both increased by nearly a third year over year. That is not to say the federal market is at all saturated; one recent report noted that over 50% of agencies are in the early stages of cloud maturity, with most adoption yet to come. And the relevant oversight bodies are paying attention: the ambitious goals laid out in the original Office of Management and Budget cloud-first policy have only been reinforced in 2018's cloud-smart update, both of which direct agencies to look for yet more ways to drive efficiency in their IT portfolio and innovation in the way they provide citizen services and achieve their missions. The FedRAMP program itself has also provided new ways for agencies to migrate high-risk systems, leaving little room for agency cybersecurity concerns to hamper their ability to quickly adopt new cloud services.

More importantly for agencies, OMB and FedRAMP are no longer the only drivers of cloud adoption in the federal government. The 2017 passage of the Modernizing Government Technology Act has given legislative teeth to past efforts to subsidize high-priority IT modernization at agencies that are historically strapped for cash. In addition, members of Congress recently reintroduced the draft FedRAMP Reform Act that aims to formally establish FedRAMP in the federal code and tie the program and OMB cloud adoption objectives to the Federal Information Security Management Act, the Federal Information Technology Acquisition Reform Act and the MGT Act. The bill also proposes oversight controls for FedRAMP and cloud adoption above and beyond current OMB policy and memoranda.

From a CSP's perspective, this means potential agency customers are now experiencing broader, more aggressive pressure to adopt cloud than in previous years. It also means agency points of contact are more informed, more motivated and more willing to entertain novel and innovative solutions to their IT problems than ever before. For CSPs, these agency drivers represent only a partial picture of the federal cloud landscape, as there are several other changes to FedRAMP to keep in mind.

The introduction of the FedRAMP high baseline provides CSPs an avenue to attract business from federal agencies with information systems previously considered too high risk to migrate to the cloud. Even though the high baseline is now more than two years old, many CSPs are only now beginning to see the benefit of their lengthy and rigorous authorization efforts to meet the baseline's requirements. It has also taken time for federal agencies to fully vet eligible, authorized cloud services to which they would be comfortable migrating systems.

The FedRAMP program has also made a tremendous effort in the past few years to make the authorization process more accessible to CSPs of all shapes and sizes and more achievable for CSPs that are not targeting high-risk systems or handling high-risk data types. The FedRAMP Tailored baseline gives CSPs with significant capacity or cost constraints (read: small to medium-sized businesses) the ability to offer their low-risk cloud services to agency customers without the notorious cost and complexity a FedRAMP authorization often entails – a reputation that the program has gone to great lengths to improve upon.

This increase in accessibility and continued focus on the reduction of cost and complexity is reflected in the program's authorization statistics. At the outset of the FedRAMP program in the early 2010s, the vast majority of authorized CSPs were large infrastructure-as-a-service providers, many of which operated at hyperscale. Today, 84% of CSPs that are publicly preparing or undergoing FedRAMP authorization are software-as-a-service providers, many of which are categorized as small or medium-sized businesses. FedRAMP's 2019-2020 focus on agency standardization and education is only expected to improve upon this accessibility, clearing the path for CSPs that are engaging with multiple agency customers.

For cloud providers and agency buyers alike, the next 24 months represent a tremendous opportunity to capitalize on the apparent groundswell of change driving more aggressive cloud adoption within the agency community, helping the federal government usher in the next phase of government IT.