Groklaw - The Google-Microsoft Fight About FISMA Certification
groklaw.net
groklaw.net
There's also this post http://www.geekwire.com/2011/blog-fight-google-calls-microso... which highlights both sides of the story so far.
In short in virtually any dispute where there are allegations of corruption, lying, unfair practices, and the like, past history inclines me against believing whatever version of facts the Department of the Interior chooses to put forth.
The fact that in this case they are on Microsoft's side in a Microsoft vs Google fight does not help their credibility.
I think this move is smarter than that though. Google has a knack for picking fights that not only help their own immediate cause (landing this govt. deal) but also aim for the greater good (fighting corruption, ensuring the better technology wins.)
Whether it's genuine or just a show is impossible to tell, but if you don't have a vested interest in either side then you can't help but root for Google.
GSA certified the Google Apps Premier environment as FISMA compliant in July of 2010. Google Apps for Government uses the Google Apps Premier infrastructure, but adds additional controls in order to meet requirements requested by specific government agencies. The original FISMA certification remains intact while GSA works with Google to review the additional controls to update the existing July 2010 FISMA certification.
It's unclear to me what they're saying with respect to Google Apps for Gov. Are they saying that it is FISMA certified as of today? Or are they saying that its pending recert after the review, but the original Google Apps Premiere is still certified?
It sounds like they're saying its not certified w/ new controls, but they don't have to a full certification process on it as its built on a certified product -- they only need to check the deltas. In which case the DOJ and MS are technically correct.
Or are they saying that if you make a small change that requires recert, you keep you certification as the review takes place and they can revoke cert if they determine there's a problem. I can't believe that would be the case, because it would require pulling down a deployment, which can be expensive.
It would be nice if they simply said, "Google Apps for Gov" is certified. We're doing additional certs on new functionality, but the new functionality can be deployed as the cert is checked. But it's the US gov't, this is probably as clear as they get.
In this case Google is pro-open source because they give away complements to their business model while keeping things that make them money closed source whilst Microsoft gives away complements to their business model while keeping things that make them money closed source which clearly distinguishes Google as good and Microsoft as evil.