OMB Launches FedRAMP Initiative To Increase Efficiency In Cloud Computing Security Authorization And Procurements

On December 8, 2011, Federal Chief Information Officer Steven VanRoekel issued a memorandum introducing the Office of Management and Budget's Federal Risk and Authorization Management Program ("FedRAMP"). FedRAMP is intended to make the government's migration to cloud computing more cost effective and to ensure the safety, security and reliability of the government's data. The program implements a new policy, developed over the past two years, to develop "trusted relationships" between executive departments and agencies and cloud service providers ("CSPs"). The memorandum requires FedRAMP initial operational capability to occur within six months; all federal agencies are expected to use FedRAMP before acquiring cloud-based services and to require vendors to comply with the program's standards.

A major feature of FedRAMP is to establish a standardized approach to security assessment, authorization and continuous monitoring for cloud products and services by all agencies. The government's current practice is for each agency to go through multiple steps, which take anywhere from six to 18 months, to assess and authorize the security of a system before granting authority to transition to the cloud. According to VanRoekel, this practice has imposed a burden on contractors, reducing competition for federal IT business. Under FedRAMP, the government will transition to a "do once, use many times" framework to reduce costs and eliminate redundant agency security assessments.

The General Services Administration ("GSA") will establish a FedRAMP project management office, which will develop templates for executive departments and agencies to satisfy FedRAMP security authorization requirements. The templates will feature standard contract language and service level agreements for use in the acquisition of cloud services. GSA will also work with the National Institute of Standards and Technology ("NIST") to accredit third-party assessment organizations ("3PAOs") to provide independent assessments of how effectively CSPs implement FedRAMP requirements. Each executive department and agency will have to ensure that its acquisitions comply with FedRAMP security authorization requirements and include contract...