Hacker News Reader

Comment by echelon | Hacker News Reader

What is this, exactly?

Is this Oracle (or whomever) getting government cloud contracts without a bidding / RFP process?

Is there adequate security review being done?

The point here is to avoid the oracles of the world getting everything. Please trust me on this one: fedramp isn’t really about security. Compliance with it doesn’t ensure it and noncompliance doesn’t preclude it. It was okay when originally released but that’s not been the case for years now.

Oracle was already on the FedRAMP list I think. AFAIK this is about getting smaller cloud providers approved to host government projects so there’s more options available.

This is about changing the way FedRAMP accreditation is done for any cloud service, like Box (or a new SaaS that you may create tomorrow). The FedRAMP process requires you go through a certain set of audits, meet a certain set of standards, etc., in order to be approved to host CUI (IL4/5) or SECRET (IL6) information.

Normally this can take a lot of time and monetary investment. On one hand, these processes encode cybersecurity best practices. On another hand, it keeps new companies out of the market.

It seems this effort is doing away with a lot of those processes. I hope the level of compliance stays the same.

IL 4/5/6 actually add a bunch of additional controls and parameters on top of standard fedramp baselines

I'm pretty sure IL4/5/6 are all outside the scope of FedRAMP

But why would any agency chooses smaller cloud providers other than Oracle, AWS, Azure and Google? They are the lowest risk selection in terms of responsibility.

Edit: Another comments actually replied it is much more than hosting but cloud services like BOX. I assume even SaaS could fall into this category.

To stay off the radar. To do shady stuff at a small company that you can easily control/manipulate.

Saas is most common use case

They tend to converge on each other. Also the Feds may have particular needs for connectivity, location, etc.

SaaS companies, not just cloud providers.

Serious question: Why don't you spend a few minutes learning about it, rather than throwing negative comments out?

Do you think vomiting a negative talking point without understanding it is considered "smart"?

FedRAMP is a set of technologies vetted by a common standard by GSA. It assists in moving technologies from one-off authority to operate (ATO) with a specific CIO office in an agency or department to a shared standard.

It takes some investment, but it is cheaper than each company jumping through arbitrary hoops and opens most of the federal government as a client.

It was part of the brainchild of GSA's 18F, recently DOGE'd.

Reply on news.ycombinator.com