Should FedRAMP be the standard for all public sector?

The Federal Risk and Authorization Management Program is the law of the land for federal agencies looking to the cloud, but could FedRAMP become a broader standard for other governments as well?

Wade Daley, Canada's chief technology officer, said on June 26 at the Amazon Web Services Symposium in Washington, D.C., that he'd had "good discussions with the U.S. government on their FedRAMP program," and was looking at how Canada might adopt that approach.

Matt Goodrich, the General Services Administration's FedRAMP director, confirmed that discussions were ongoing. "The FedRAMP PMO has had conversations with Canada," he said, "and we are looking forward to continued discussions in person in July."

Private-sector cloud providers have expressed a desire to leverage FedRAMP approval in other markets. And while GSA has neither the authority nor the desire to mandate FedRAMP compliance at other levels of government, Goodrich told FCW that voluntary adoption was certainly something to encourage.

At the state level, he said, "GSA and FedRAMP have worked with the National Association of State CIOs since inception. Recently GSA briefed many of the state CIOs at NASCIO's DC Fly-In on ways that they could leverage FedRAMP at the state level."

"FedRAMP sets the bar for how to protect federal data when it resides in cloud environment," Goodrich said, and GSA " believes that state and local governments can leverage this security standard for comparable needs at the local level."