The federal government is doing a good job establishing cybersecurity requirements for cloud providers and industry looking to do the same should look no further, according to John Pescatore, director of emerging security trends at the SANS Institute.<\/p>\n\n\n\n
Agencies are under mandate to consider cloud services ahead of other options but not at the expense of security. To ensure agencies are procuring secure services, the General Services Administration set up the Federal Risk and Authorization Management Program (FedRAMP), which has created a set of baseline security requirements that all cloud service providers must meet before hosting federal systems.<\/p>\n\n\n\n\n\n
“For example, the GSA FedRAMP program for cloud \u2014 at Gartner, I found myself pointing private industry customers toward that,” he said. “You need good security requirements around procuring cloud? Look what FedRAMP’s done. Not some industry-driven consortium.”<\/p>\n\n\n\n
FedRAMP requirements are based off controls developed by the National Institute for Standards and Technology, though the frameworks developed by the program office offer a streamlined process for assessing a cloud provider’s security.<\/p>\n\n\n\n
Currently, FedRAMP offers baselines for low and moderate security needs, though the office is in the process of finalizing a high security baseline, scheduled for release before the end of the year.<\/p>\n\n\n","protected":false},"excerpt":{"rendered":"
SANS researcher said the private sector should steal FedRAMP security baselines for assessing cloud acquisitions.<\/p>\n","protected":false},"author":7,"featured_media":30607,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"_yoast_wpseo_meta-robots-noindex":"","_yoast_wpseo_meta-robots-nofollow":"","_yoast_wpseo_canonical":"","_acf":"","_yoast_wpseo_primary_category":83,"_jetpack_feature_clip_id":0,"_jetpack_memberships_contains_paid_content":false,"footnotes":"","_smg_distribution_targets":[]},"categories":[83,15,28],"tags":[],"coauthors":[2349],"class_list":["post-10409","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-cybercon","category-management","category-smr"],"acf":{"subheadline":"","legacy_arc_id":"2FE2FKILDBAVFH6WU5ANXKAWIY","arc_canonical_url":"\/smr\/cybercon\/2015\/11\/19\/industry-should-steal-fedramp-cloud-security-baselines\/","remove_feature_photo":false,"is_sponsored":false,"subtype":"","redirect_url":"","disable_inline_ads":false,"native_logo_pretext":"Presented By:"},"yoast_head":"\n