Vendors must pass federal information security test before offering IaaS products to agencies

The GSA selected 11 vendors to offer cloud-based IaaS to federal, state, and local governments through its Apps.gov cloud services storefront. Under the five-year contracts, known as blanket purchase agreements (BPAs), the vendors will be able to offer cloud storage, virtual machines, and web hosting services to agencies. Although the GSA did not disclose the value of the BPAs, one of the winners, GCI Federal, said its BPA was valued at $76 million.

However, before the vendors can offer their IaaS products, they must complete the certification and accreditation process of the Federal Information Security Management Act's moderate impact data security level. According to the National Institute of Standards and Technology, certification and accreditation involves a six-step risk management process: categorize information systems; identify the organization’s security controls; implement security controls; conduct a security controls assessment; prepare a plan of action and milestones based on the assessment; and monitor the impact of proposed and actual changes to security controls.

The 11 vendors and partners approved to offer cloud-based IaaS products through Apps.gov are: Apptis (partnered with Amazon), AT&T, Autonomic Resources (partnered with Carpathia, Enomaly, and Dell), GCI Federal, Computer Literacy World (partnered with Electrosoft, XO Communications, and Secure Networks), Computer Technologies Consultants (partnered with Softlayer), Eyak Tech, General Dynamics Information Technology (partnered with Carpathia), Insight Public Sector (partnered with Microsoft), Savvis Federal Systems, and Verizon Federal.

“Through offerings such as IaaS, GSA is providing government entities with easy access to cost-saving, high-value, more efficient technology solutions by doing a major part of the procurement processes upfront. By continuously working with industry, GSA’s cloud-based services available through Apps.gov are secure, compliant, and save taxpayer dollars by reducing duplication of security processes across government”, said Dave McClure, GSA associate administrator of citizen services and innovative technologies.

What’s hot on Infosecurity Magazine?