TLDR Tech / InfoSec
Federal cyber experts called Microsoft's cloud a "pile of shit," approved it anyway
FedRAMP spent nearly five years, 480 hours of review time, and 18 technical deep-dive sessions attempting to obtain basic data flow diagrams from Microsoft for its Government Community Cloud High (GCC High) offering, used by the Justice and Energy departments to protect information whose exposure "could be expected to have a severe or catastrophic adverse effect" on government operations. Microsoft's third-party assessors, Coalfire and Kratos, privately back-channeled to FedRAMP that it was "difficult to impossible" to obtain sufficient documentation, while a 2024 review team found fundamental issues with vulnerability remediation and scanning in Exchange Online and Teams alone, yet FedRAMP authorized GCC High on December 26, 2024, solely because widespread federal and defense-sector deployment made rejection impractical. DOGE has since gutted FedRAMP to a $10M annual budget with a skeleton staff, effectively reducing the program to a rubber stamp. At the same time, agencies are being pushed to adopt cloud-based AI tools handling reams of sensitive government data.
Read the full story