The best cloud partnership: More security, savings and innovation

As private companies race each other to replace outmoded IT systems with cloud services, the federal government falls further and further behind in cloud adoption.  The usual culprits are easy to find: byzantine procurement and cloud certification requirements, IT and security leaders overestimating risks while underestimating savings and a culture that rewards outsourcing IT strategy -- and responsibility -- to the lowest bidder. But there are other factors as well.

Lost in all this noise are the unique challenges of federal IT. The first is scale -- with a forecasted 2017 budget of $89.9 billion, the sheer number of programs and systems and data centers dwarfs not just private companies, but even some private markets. A second obvious challenge is accountability -- every purchase decision is subject to audit, protest and the political process. And the third, security and compliance, pose a third vital challenge also shared by the private sector, but uniquely burdensome for federal CIOs.

The private sector is poised to step up to help alleviate these challenges, but often faces roadblocks that make it difficult to get agencies where they want to go in the cloud. However, when the day comes that the federal government can entrust private-sector companies with maintaining its cloud environments, some magical things could happen:

The cloud becomes more secure

The high stakes involved in protecting federal government data from hackers entail more than just protecting finances and resisting the resources of nation state adversaries. We may count the cost of a corporate data breach in pennies per share, but losing federal data (as in the recent Office of Personnel Management hack) may compromise national security and even endanger lives.

Enter FedRAMP, or the Federal Risk and Authorization Management Program. Unlike past federal certification efforts that felt like paperwork exercises or that offered a false sense of security by allowing companies to merely document that their products were operating as designed, FedRAMP is different. It sets clear and robust baseline standards and best practices like penetration testing and continuous monitoring. Security is an arms race against hackers that we cannot win, but properly implemented, FedRAMP is speeding cloud adoption and helping federal IT keep security losses smaller and less destructive.

FedRAMP is delivering this -- it has already certified 60 cloud service providers, and recent program changes will greatly accelerate the review and approval of hundreds more by reducing the initial  paperwork required from new, innovative cloud service providers. While the upfront cost of FedRAMP compliance is not trivial, this is by design. We should be careful not to lower the bar for compliance at the expense of better security.

Because of the size and scope of the federal IT market, FedRAMP has the real potential to elevate the security posture of American cloud service providers. This will be of at least indirect benefit to everyone, but a greater potential exists for building a more robust commercial IT infrastructure on the shoulders of FedRAMP standards. Increased cloud security could become a market-driven reality as more banks, health care providers and private companies are educated on the value of demanding FedRAMP-compliant cloud services and even innovative startups have access to the expertise required to deliver it.

The cloud becomes cheaper

We all understand that cloud services offer better innovation at lower cost than traditional IT. Letting private-sector experts patch one cloud data center is easier, cheaper and more reliable than leaving the patching of hundreds of government data centers to the lowest bidders. 

The problem is simple. The private cloud environments to which agencies are migrating still require the vendors to spend considerable time and money to configure to and meet the requirements of each unique environment. This causes costs to increase across the board, meaning the cloud becomes more expensive for everyone.

If agencies agree to host their data in highly secure commercial cloud environments certified by FedRAMP, it allows companies in the private sector to keep costs low, which in turn lets government take true advantage of the now seemingly mythical cost savings that were promised when the technology was first introduced.

We can do cooler stuff

Wearable technology. Virtual reality. Mobile. The Internet of Things.

Government IT workers will be the first to admit that these technologies are exciting and represent the future, but the government’s inability to innovate often puts them beyond the realm of possibility.

A world in which federal agencies operate out of shared, secured public cloud environments is a world that is ripe with possibilities for agencies to be just as cutting age in these areas as its private-sector counterparts.