CSP-AB转发了
#FedRAMP fam, it's time for some spoilers. Here's what you need to know coming into this week: (1) Rev 5 Agency Authorization is the only supported path to FedRAMP authorization right now. This path is not changing. Keep calm and authorize on. We're even working on significantly reducing the burden on everyone for continuously monitoring these authorizations! (2) FedRAMP isn't going to announce an alternative path to FedRAMP authorization that replaces agency ATOs with some weird thing where third parties get paid to accept risk on behalf of the federal government or CSPs become their own authorizing officials or something. That's, uh, not how the law works, but I think I understand how that rumor started... (3) Because FedRAMP *is* going to announce our intent to work with industry to develop a new approach to abstracting technical security controls with a goal of explicitly identifying security indicators that can easily and reliably be validated by code. We want proof that encryption is enabled on that device 1000x a day all year long to replace the proof you showed that one time last year to an auditor. And we're going to work with industry to build that and continuously improve it, year after year, with a constantly evolving and improving set of key security indicators and general expectations for validation that will ensure government information is secure while making it easier, faster, and cheaper for cloud service providers to get authorized. Let's take a crack at assessing modern systems as the complex automated code-driven systems they already are, and drive real security improvements together!