New Report Outlines Steps to Upgrade FedRAMP, the Federal Program Helping Government Agencies Adopt Secure Cloud Computing Services

OMB should require that federal agencies participate in the Digital Analytics Program (DAP) hosted by GSA. OMB and GSA also should expand DAP to include additional metrics, such as page-load speed, mobile friendliness, and accessibility.

To Do: Require Agencies to Report on Their Websites’ Performance

To Do: Require Agencies to Report on Their Websites' Performance

Congress should require that law enforcement obtain a probable-cause warrant to access communications cloud service providers store.

To Do: Require Probable Cause to Access Communications Stored in the Cloud

Congress should modify FISMA to require federal agencies to use continuously-monitored, performance-based security metrics.

Improved Metrics Should be Primary Goal of FISMA Reform

OMB should develop voluntary standard terms for AI contracts to make procurement more efficient and expand federal contract access to a diverse and large pool of vendors.

To Do: Streamline AI Procurement

Congress should fund a pilot program supporting experimental approaches to technology transfer and commercialization, and the administration should require labs to collect metrics, identify barriers, and hold labs accountable. 

To Do: Support Experimental Approaches to Tech Transfer and Commercialization

Congress should allow agencies to reach out to customers who affirmatively opt in to ask their views on the quality of government services and to give them timely information.

To Do: Allow Federal Agencies to Talk to “Customers”

To Do: Allow Federal Agencies to Talk to "Customers"

The EU’s new cloud cybersecurity regime should focus on good security practices, as the U.S. FedRAMP regime does. Emulating China’s protectionist focus on firm nationality is a bad security practice that weakens transatlantic influence over cybersecurity issues globally.

Europe’s Cloud Security Regime Should Focus on Technology, Not Nationality

Europe's Cloud Security Regime Should Focus on Technology, Not Nationality

Watch this panel discussion focusing on federal IT modernization, the merits of custom versus COTS solutions, and how federal leaders can evaluate which approach is best for a particular initiative.

To Do: Require FedRAMP to Track More Granular Metrics

Recommendation

Details

Editors’ Recommendations

Reforming FedRAMP: A Guide to Improving the Federal Procurement and Risk Management of Cloud Services

Related

New Report Outlines Steps to Upgrade FedRAMP, the Federal Program Helping Government Agencies Adopt Secure Cloud Computing Services

To Do: Require Agencies to Report on Their Websites’ Performance

To Do: Require Probable Cause to Access Communications Stored in the Cloud