Cloud computing became a major technology strategy for the government more than 10 years ago. To help agencies ensure cloud security, the GSA set up a program called FedRAMP, Federal Risk and Authorization Management Program. The basic idea was, a vendor with FedRAMP certification for one agency could be trusted by other agencies for a given product. The program has come a long way. For an update, the Federal Drive with Tom Temin spoke with the acting FedRAMP director, Brian Conrad…
Tom Temin: I guess originally FedRAMP was for the major cloud services providers as they existed more than 10 years ago. But really, it’s almost the entire industry now, isn’t it?
Brian Conrad: Yeah, absolutely. If you look back at the history of the program, obviously, the big players, the infrastructure players, where everything lives on were sort of the first ones through the process. But now we’re seeing an increase of software as a service applications coming through, agencies finding this unique capability out in a commercial marketplace that fits their mission need. And so they bring it into the FedRAMP marketplace. And that’s contributed to the growth of the FedRAMP marketplace over the years…
Tom Temin: And what else is ahead?
Brian Conrad: We are looking at incorporating a GRC tool that will enable automated package handling, automated validations. So one of the things that we’re trying to avoid, for example, is our agency review teams having to go back and forth with cloud providers to make sure that the package is of optimal quality. And so with this automated validations, before the package even comes to the government, we’ll have some level of confidence that the quality is spot on. All the little things that normally can get overlooked or trip up CSPs or 3PIOs. And it’s human error. It’s okay. But we want to make sure that we’re having machines do what machines do best with regards to that. And so we’re really excited about that… Read the interview here.
