Feds Changing Rules for Cloud Security

According to reports issued in the first part of December (2011), cloud providers for the federal government will have until June to comply with a new set of rules governing cloud services and IT security they provide to federal agencies. The rules are good news for cloud providers, despite the fact that we typically think of government regulation as a bad thing. The rules are designed to streamline security certifications in order to allow multiple government agencies access to similar vendors without having to re-certify everyone individually.

If we understand the language of the regulations correctly, this plays out to the advantage of both the providers and the federal agencies themselves. The rules replace the current antiquated system which requires each federal agency to set its own standards which it then passes on to cloud suppliers in the form of necessary IT security certifications. Current cloud suppliers must interact separately with each agency and meet that agency’s individual security requirements.

The system has led to an often confusing set of guidelines that are made that much worse when cloud providers serve multiple agencies. Oftentimes providers aren’t sure exactly what security requirements apply, forcing them to spend money and resources on certifications that might be overlapping. Such overlapping has long been a problem for vendors of the federal government. Hopefully the changes in cloud services will start the stage for helping solve this problem across the board.

Multiple Agencies, One Certification

The new program is slowly being implemented and, as such, no cloud providers have yet been certified. But once fully implemented a provider will be able to meet the federal standards, known as FedRAMP, and then be eligible to provide cloud services to any number of federal agencies. This streamlined system will enable companies to dedicate specific individuals for government contracts; those individuals will receive the special security certifications they need to handle such contracts.

When a company meets the requirements of FedRAMP it becomes that company’s responsibility to make sure its workers are properly certified in security protocol. But because FedRAMP standardizes security among federal agencies, there’s no need to train and re-train individual workers to perform services for multiple agencies. For once it seems the federal government has made a decision that actually streamlines things and cuts costs.

The Necessity of Streamlining

Remarking on the reasons for the new rules, federal Chief Information Officer Steven VanRoekel said. “Cloud computing has become an integral part of the government’s DNA. One of the main challenges that people have identified is around security and using security as a barrier to entry around cloud computing.”

Mr. VanRoekel’s comments seem to indicate that a lack of security standards is preventing many vendors from offering cloud services to federal agencies. This is obviously not good for business, as it limits the number of bids that come in on any given job. It also prevents federal agencies from finding the best candidates for a particular service if some of those candidates are not bidding simply because they’re confused about security issues. By streamlining and standardizing, the feds hope to increase the pool of service providers and drive down the cost.

The entire program is part of cost-cutting measures designed to slice more than $5 billion from the government’s $80 billion IT budget. At just over 6%, that’s quite a hefty savings that can be achieved simply by standardizing vendor requirements. If the federal government succeeds in its goals, perhaps they can apply this method to other areas of our bloated bureaucracy and save a whole lot more money. Leave it to IT professionals to lead the way!