New federal program sets cloud computing security regulations

Friday, January 13, 2012

The United States government recently implemented the new Federal Risk and Authorization Management Program (FedRAMP) in response to growing concerns over information security in the government cloud.

FedRAMP is considered to be upgraded legislature from the older Federal Information Security Management Act (FISMA), which mandated standards on federal data security plans, among many other things. FedRAMP is different from FISMA in that it targets the new challenges associated with the industry of cloud computing, which was not in place when FISMA was passed in 2002.

FedRAMP's website says that the program provides a standardized approach to security assessment, authorization and continuous monitoring for cloud products and services. The idea is that a cloud services provider will only have to receive certification from one government agency to save the time and cost of getting approval from all of them. For this to happen, cloud security has to be top notch. FedRAMP's goal is to increase confidence in managed security services, and to introduce a "do once, use many times" policy that will improve productivity across the government cloud.

Unauthorized access to secure government data could be disastrous for the United States, so security procedures must be standardized in order to enjoy the benefits that cloud computing offers.