Lack of FedRAMP compliance hinders buildings management

The federal government (excluding the Defense Department) owns over 127,000 buildings, ranging from massive office complexes to museums, storage facilities and visitor centers in the national parks system. But according to a recent Government Business Council (GBC) study, only 37 percent of respondents are optimistic about the current state of maintenance for these building assets. Several factors influence this disappointing statistic, but the most significant is the underutilization of the Federal Risk and Authorization Management Program (FedRAMP), a federal initiative designed to help government agencies take advantage of cloud computing, which can help them reach maintenance goals.

What is the issue?

Federal buildings must meet high standards for safety, security and sustainability. There is no room for lackluster compliance with government mandates for extending the lifespan of the facilities. Many federal buildings are landmarks with great historical significance and must be preserved. There are also mission-critical, high-tech environments that demand unparalleled security. Some have practical applications, supporting the work of social agencies, branches of the government and foreign relationships. For the family planning a hard-earned vacation to the Grand Canyon, the reliable access to national parks is no less important.

The broad range of asset types underscores one of the complications government agencies and offices face: There is no finite set of characteristics that apply to all. While offices have a great deal of autonomy when it comes to choosing solutions to help manage asset maintenance, they are subject to federal requirements when doing so.

Is cloud deployment the answer -- or the problem?

Analysts and experts in the enterprise asset management (EAM) industry agree that modern cloud solutions offer tremendous benefits, including functionality that is continually updated, creating a platform that is always modern. The GBC survey asked agency leaders what they saw as the main benefits of cloud deployment, and 46 percent responded the raised visibility into key assets. Improved analytics garnered 45 percent, and agility was identified as another benefit. Forty-two percent of utilities said that the cloud solutions make it possible to automatically adjust sources, tapping alternative energy sources or third-party suppliers to continually balance demand, cost and impact on the environment.

Other government offices would benefit from cloud computing as well, particularly the use of cloud solutions to manage internet-of-things technologies. Any agency with complex machinery or facilities with high-value components would benefit from IoT. Sensors embedded in assets can collect and transmit data about the physical condition of those assets, enabling the agency to identify early signs of a potential performance issue that can be fixed before a major crises or failure occurs. But vast amounts of data are involved, making cloud’s storage capacity a necessity.

Although cloud deployment is the answer, choosing the right cloud solution can be a challenge. As more agencies, applications and assets are connected today, proper security is critical. A data breach in one small agency could be the weak link, opening the door for a series of breaches affecting whole regions and the utility infrastructure.

How does FedRAMP help?

FedRAMP was created in 2012 to help government adopt cloud solutions with confidence by providing authorization and certification for commercial cloud providers serving federal agencies. Cloud companies must meet stringent security requirements defined by the National Institute of Standards and Technology before receiving approval to sell to government agencies. The Joint Authorization Board serves as the primary decision-making body for FedRAMP. It defines security authorization requirements and approves accreditation criteria for third-party assessment organizations.

As of 2018, over 110 FedRAMP-certified cloud offerings have been given authorization to operate, with at least 60 more in progress and more certifications expected.

Adoption by agencies has also grown and will continue so. Agencies spent $1.7 billion on cloud services in 2017 alone, doubling the amount spent five years earlier. Early adopters have praised cloud for its many benefits, from flexibility to speed of implementation and time savings. Because cloud solutions are backed up, secured and automatically upgraded, IT teams can focus their time on more critical tasks.   

Some agencies, however, are sidestepping FedRAMP and making investments in cloud solutions without checking to see if the solution complies with the program's strict requirements. Employees are installing and using cloud capabilities without organizational approval. A NASA inspector general's report, for example, found the agency's employees using 20 cloud services not listed on the FedRAMP registry. An audit of the IRS revealed similar findings. The IRS was cited for its lack of a cloud strategy and failure to adhere to FedRAMP policy when deploying its cloud offerings.

Why the slow ramp-up?

There are two possible reasons for the low levels of FedRAMP adoption: lack of awareness or agencies ignoring the program and investing in their own cloud solutions. According to a GBC survey, 65 percent of respondents are not familiar with the program -- in spite of its nearly seven-year existence. Just 11 percent say they are very or extremely familiar.

Some say the complexity of the FedRAMP process is hindering solution providers from meeting requirements -- and this is keeping agencies from participating. Recently Rep. Gerry Connolly (D-Va.) introduced a bill to streamline the authorization process and encourage agencies to reuse existing authorities to operate.

The legislation codifies the program as law and clearly establishes the roles and responsibilities of agencies and offices. For example, the Office of Management and Budget is responsible for setting high-level guidance for the program management office and agencies, while the General Services Administration is responsible for day-to-day activities.

What should agencies do now?

Maintaining buildings, facilities and assets is a critical element of each agency’s responsibility. Without timely attention to maintenance, assets can lose their value or put users at risk. Connected assets, without proper security, can put other agencies and facilities at risk as well. Taking action should be a priority. With numerous FedRAMP-certified cloud offerings available, agencies can find solutions to meet their specific needs that can be deployed with confidence. Stakes are high. The key is to start now, without further delay or risk.