Microsoft Cloud-Based Apps Pass FISMA Scrutiny -- Redmondmag.com

Microsoft Cloud-Based Apps Pass FISMA Scrutiny

By Kurt Mackie
04/21/2011

Microsoft announced on Wednesday that its cloud-based suite of applications has passed muster for government use per Federal Information Security Management Act (FISMA) standards.

Microsoft's Business Productivity Online Suite for the federal government, or BPOS-Federal, now can be used by government agencies. BPOS-Federal received an "authorization to operate" clearance from the U.S. Department of Agriculture.

"The certification and accreditation has resulted in an official 'Authorization to Operate' (ATO) issued on April 19 by the U.S. Department of Agriculture (USDA) for Microsoft's Business Productivity Online Services-Federal, which includes Exchange Online, SharePoint Online, and Office Communications Online," a Microsoft blog explains.

Government IT systems must meet security certification and accreditation standards specified by the 2002 FISMA law (PDF). Software products aren't certified as "FISMA-compliant" per se, but the systems running them do have to meet FISMA standards.

Microsoft had received authorization for its datacenters in November based on FISMA requirements. However, it had lacked such authorization for its hosted applications that ran in those datacenters. Now, with the added authorization, the way is cleared for BPOS-Federal applications to be rolled out to 120,000 USDA employees.

Still, a legal tussle could dog Microsoft along the way -- at least in terms of obtaining some government contracts. A lawsuit filed by Google in October against the U.S. Department of Interior alleges that Google was excluded from competitive-bidding contract considerations when Microsoft won a BPOS-Federal contract with that government organization.

Microsoft has since returned fire. Earlier this month, a Microsoft attorney asserted that Google Apps for Government lacks FISMA certification. However, the U.S. General Services Administration (GSA), which issues FISMA certification and accreditation approvals, weighed in, stating that Google Apps Premier was "FISMA compliant in July of 2010" and that Google Apps for Government uses the same controls. The GSA currently is just assessing some added security controls in the Google Apps for Government suite.

Microsoft will update its BPOS line of hosted applications with a new offering called "Office 365," which is currently available for testing as a beta release. Microsoft expects to roll out Office 365 services commercially sometime this summer. After that commercial release, Microsoft plans "to pursue FISMA certification and accreditation for Office 365," according to Microsoft's blog post.

About the Author

Kurt Mackie is senior news producer for 1105 Media's Converge360 group.

Featured

Cisco Warns of Brute Force Attacks Targeting VPNs and Firewalls

Cisco has revealed that a global increase in brute force attacks targeting Virtual Private Networks (VPNs) and other devices is currently taking place.
What's Inside Microsoft 365's Security Toolbox?

Microsoft provides plenty of native tools to secure Microsoft 365. IT pros just have to know where to look.
Microsoft Kills 30-Day Data Retention Policy for Copilot in Fabric

Microsoft this week announced several usability improvements coming to Copilot in Fabric in preparation of its general availability release later this year.
Using Microsoft Office to Build a Network Diagram 2

Now that we've set up our process, let's dig in with the actual execution.
Microsoft Graph 'Activity Logs' Feature Goes Live

Microsoft announced the general availability of the "activity logs" capability in Microsoft Graph, giving administrators more options to track user activity and identify patterns of potential misuse.