FedRAMP | The Contracting Education Academy

November 7, 2019 By cs

Civilian vendor cybersecurity certification would look very different from DoD

A civilian counterpart to the Pentagon’s Cybersecurity Maturity Model Certification would need to suit the varying missions across government, according to federal deputy CIO Margie Graves.

The Defense Department is working on a new policy that will require its vendors to obtain a certification confirming the contractor’s own systems have strong enough cybersecurity to protect the department’s secrets. A civilian agency counterpart to that would look very different than what the Pentagon is developing, according to the second-ranking civilian IT official.

While the government does have a method for certifying the cybersecurity of vendors’ products — through the authority to operate, or ATO, process and the Federal Risk and Authorization Management Program, or FedRAMP — it does not have a program for assessing the security of the systems used by the vendors.

The Defense Department’s Cybersecurity Maturity Model Certification, or CMMC, looks to change that with a set of 18 “key sets of capabilities for cybersecurity,” according to the draft released in September.

Keep reading this article at: https://www.nextgov.com/cybersecurity/2019/10/civilian-vendor-cybersecurity-certification-would-look-very-different-dod/160982/

June 12, 2015 By AMK

GSA to agencies: Don’t use FedRAMP to screen-out potential bidders

Some federal agencies are beginning to require that contracting vendors have FedRAMP authorizations before bidding on cloud computing contracts.

At first blush, it seems like a good thing that agencies would require contractors to adhere to the Federal Risk and Authorization Management Act, the government’s standardized approach to ensuring security in cloud computing.

Yet because FedRAMP is still only a few years old, making compliance with FedRAMP a prerequisite to bidding on contracts could limit competition.

“Agencies – contracting officers – are starting to require FedRAMP authorizations as a condition for bidding on work,” said Stan Kaczmarczyk, director of the Cloud Computing Services Program Management Office in the General Services Administration’s Federal Acquisition Service.

Keep reading this article at: http://www.nextgov.com/emerging-tech/emerging-tech-blog/2015/06/gsa-agencies-dont-use-fedramp-screen-out-potential-bidders/114256

December 21, 2012 By AMK

GSA has yet to approve any cloud products under FedRAMP

Up against a self-imposed Dec. 31 deadline, the government’s purchasing arm has yet to endorse any cloud products for quick acquisition. Some applicants and testers say the General Services Administration has been mum about the hoped for announcement on approvals.

Confusion over paperwork has complicated efforts for the Federal Risk and Authorization Management Program, or FedRAMP, according to interviews with cloud vendors and inspectors. FedRAMP, a security evaluation process, is intended to certify services for immediate use in any government agency. Inspections began in June.

Last week, GSA, which runs the program, released rules on the color scheme, placement and permitted uses of the FedRAMP seal of approval. Several auditors said constructive discussions about the contents of their evaluation reports and providers’ security plans have consumed more time than expected.

April 18, 2012 By AMK

Cloud system contracts dictate updated acquisition strategy

As core enterprise systems move to the cloud, provisioning services in that environment could require revised training for acquisition officers. Existing rules, processes and culture need to be re-thought, said Dave McClure, associate administrator at the GSA’s office of citizen services and innovative technologies.

“The existing way in which we contract both for products and services in the government goes right up against the model for cloud, which is price elasticity, demand elasticity, so there’s still some hiccups there,” said McClure March 3 at the FOSE conference in Washington, D.C.

Some cloud computing contracts don’t have pricing elasticity truly built in, which could be a challenge as programs look to layer their applications and scale out an existing cloud infrastructure, said McClure.

Acquisition officers are “kind of hacking through, right now,” said Rob Carey, Defense Department deputy chief information officer. But it’s something the FedRAMP joint authorization board is acutely aware of, he added.

“In our pilots we have going, we’re finding those challenges,” said Carey. “We’re trying to make sure those lessons learned are poured into the Chief Acquisition Officers Council to say, how do you do this.”

Carey said this is simply what happens with the adoption of disruptive technology.

“You will continue to find challenges as we break through the edges of what some bright engineer thinks he can do or wants to do, and the contracting officer says, ‘Let me figure out how we can actually get that done for you,’” said Carey.

— by Molly Bernhart Walker. This article appeared in Fierce Government IT on Apr. 4, 2012 at http://www.fiercegovernmentit.com/story/mcclure-cloud-services-require-acquisition-officers-retool/2012-04-04.

A civilian counterpart to the Pentagon’s Cybersecurity Maturity Model Certification would need to suit the varying missions across government, according to federal deputy CIO Margie Graves.

Some federal agencies are beginning to require that contracting vendors have FedRAMP authorizations before bidding on cloud computing contracts.

Search this Website