Cloud Safe Task Force: Reciprocity and ATO Process Reengineering

Consistent with its Recommendation Roadmap, the Cloud Safe Task Force (CSTF) is meeting to address Authorization-to-Operate (ATO) Reciprocity in cloud security practices on November 13th. The meeting, entitled “Reciprocity and ATO Process Reengineering” is structured to engage industry and government stakeholders in identifying the challenges and solutions for achieving “Reciprocity-at-Scale”.  Operating to dissuade service upgrades and create a barrier to small business entry, the cost of security assessment and authorization (A&A) practices in the Cloud Services industry has become an impediment to technological innovation. Today, many Cloud Service Providers (CSPs) must demonstrate compliance to multiple control frameworks specific to market sector and international boundaries. As a result, a single cybersecurity control could be assessed multiple times creating costs without improvements in security. While reciprocity in A&A is not a new objective, it continues to present challenges for industry and the US Government has renewed is focus to address the objective through recent actions including the 2023 National Defense Authorization Act (NDAA) FedRAMP Authorization Act, DoD Reciprocity Playbook, and M-24-15 FedRAMP Modernization memo. Join us as we collaborate to define a Whole-of-Nation approach to solving issues preventing reciprocity in A&A for Cloud Security.