{"id":12039,"date":"2016-05-23T14:59:26","date_gmt":"2016-05-23T14:59:26","guid":{"rendered":"https:\/\/one.sightlinemg.com\/federaltimes\/uncategorized\/2016\/05\/23\/survey-feds-see-frustration-in-fedramp-not-security\/"},"modified":"2026-08-08T04:36:07","modified_gmt":"2026-08-08T04:36:07","slug":"survey-feds-see-frustration-in-fedramp-not-security","status":"publish","type":"post","link":"https:\/\/one.sightlinemg.com\/federaltimes\/management\/2016\/05\/23\/survey-feds-see-frustration-in-fedramp-not-security\/","title":{"rendered":"Survey: Feds see frustration in FedRAMP, not security"},"content":{"rendered":"\n

The Federal Risk and Authorization Management Program (FedRAMP) \u2014\u00a0the program charged with managing security accreditations for cloud vendors selling to the government \u2014\u00a0is in the midst of a renaissance but federal managers have yet to be impressed, according to a new survey.<\/p>\n\n\n\n

A poll of 150 federal IT managers conducted by MeriTalk showed less than half \u2014\u00a045 percent \u2014\u00a0believe the program has led to better cybersecurity at their agency and the vast majority \u2014\u00a079 percent \u2014\u00a0view FedRAMP as just another frustrating exercise in compliance.<\/p>\n\n\n\n

Download:\u00a0<\/strong>FedRAMP Fault Lines<\/a><\/p>\n\n\n\n

After the administration instituted the Cloud First policy in 2010, many agencies were wary of moving to the cloud out of security concerns. And rightly so \u2014\u00a0giving agency data to a third party could lead to significant problems if that vendor does not have appropriate security controls in place.<\/p>\n\n\n\n\n\n

FedRAMP was created to give agencies a level of assurance that the cloud provider they are contracting with meets a certain level of security. However, since its inception the program has been mired with problems, most notably the long and expensive accreditation process.<\/p>\n\n\n\n

Nonetheless, FedRAMP compliance is a mandate for agencies using cloud services. To ensure the program doesn’t continue to be a millstone for agencies moving to the cloud, the program office recently launched FedRAMP Accelerated \u2014\u00a0a set of reforms intended to speed up the process and make better use of shared authorities to operate (ATOs), in which one agency’s authorization can be used by others.<\/p>\n\n\n\n

Despite these efforts, 17 percent of survey respondents said FedRAMP is not a factor in their cloud decisions and 59 percent said they would consider a cloud solution that isn’t in compliance.<\/p>\n\n\n\n

Additionally, 41 percent said they weren’t aware of the program office’s efforts to improve the process.<\/p>\n\n\n\n\n\n

“Despite efforts to improve, FedRAMP remains cracked at the foundation,” MeriTalk founder Steve O’Keeffe said of the survey results. “We need a FedRAMP fix \u2014\u00a0the PMO must improve guidance, simplify the process and increase transparency.”<\/p>\n\n\n\n

Along with the survey results, MeriTalk published three recommendations for the program office:<\/p>\n\n\n\n