CLOUD COMPUTING

New Federal Cloud Program to Mandate Security

Rebecca Kutzer-Rice | Date: 12-15-11 | Comments

FedRAMP, a new federal cloud-standards program, aims to improve the security of cloud products and services. Over the next two years, standards set by the program will be mandatory for all federal agencies.

With its future-focused IT goals, the federal government has been emphasizing growing technological trends like cloud computing. New cloud standards released by the White House underscore the government�s interest in the cloud.

This month, federal CIO Steven VanRoekel announced the Federal Risk and Authorization Management Program (FedRAMP). The government-wide program will provide and enforce cloud standards for security, authorization and monitoring.

FedRAMP aims to accelerate the adoption of and confidence in cloud products and services by improving security. The program also intends to increase practices of automation for constant monitoring of real-time data.

�With FedRAMP, we have established a standardized approach to security assessment, authorization, and continuous monitoring for cloud products and services which every agency will be required to use,� VanRoekel said in a statement. �This approach uses a �do once, use many times� framework that will save cost, time and staff required to conduct redundant agency security assessments so no one has to reinvent the wheel.�

VanRoekel estimates that the new program will reduce federal cloud costs by 30 percent to 40 percent.

The FedRAMP assessment process works in four key steps. Agencies or cloud service providers must first apply for assessment, in which FedRAMP will provide recommendations for new and existing cloud architectures. Next, a third-party assessment organization must provide an independent assessment. Third, the system will be authorized and, finally, security will be leveraged with continuous monitoring.

FedRAMP was developed by collaboration between many different agencies, including the General Services Administration, the National Institute of Standards and Technology, the Department of Homeland Security and the Department of Defense. Private industry experts were also consulted.

FedRAMP will eventually be mandatory for all federal agencies. Once the program is operational, agencies will have two years to ensure that all their cloud operations meet the program�s standards. The federal government anticipates that FedRAMP will reach initial operational capacity by the third quarter of 2012.

According to VanRoekel, FedRAMP �will fundamentally change the way the cloud is secured and procured within the Federal Government. FedRAMP enables agencies to deploy cloud technologies, while realizing efficiencies of scale to substantially reduce costs and transition time.�