Hacker News Reader

Comment by throwaway892238 | Hacker News Reader

Late last year Google got FedRAMP High certification for Workspaces and Public Cloud. What this means is that, rather than have to use a "Government" version of Office365, and a "Government" version of AWS, and potentially even other versions for contractors, you can instead just use regular Google services for everything, at the highest levels. Managing different vendors and products and clearance is a nightmare. This is a potential game changer.

View on HN

No no no no no. This is not true. Google Workspace is FedRAMP compliant for government customers. It is NOT possible to configure Google Workspace in a FedRAMP compliant way as a regular customer. You can't even get NIST 800-171 on Google Workspace without additional tools.

Yeah, and the whole certification process is way more complex than that. To use the example I’m familiar with, Azure as a whole is FedRAMP High for all US regions. However, if you need to you need to handle DoD IL5 data or justice data, you need to go to Azure Government because they have even stricter personnel screening requirements than FedRAMP. Except the DoD didn’t like sharing a region even with other US Government customers, so there are also a exclusive DoD regions as well.

That’s not because Microsoft is trying to market segment. Turns out different parts of the government love making things hard on their suppliers by insisting they are special. I seriously doubt google actually manages to negotiate the minefield that is contracting and CISOs with conflicting requirements like the GP is dreaming of, but cool if they can.

It looks like two provisions it doesn't natively support, but you can slap on a 3rd party tool and you're in business. This is still much better than using two completely different vendors for your collaboration and cloud tools.

For NIST, yes. For FedRAMP, no.

Google: Nationalized-lite?

Reply on news.ycombinator.com