Hacker News Reader

They’d need to be very careful in doing so, as they both operate services that are certified and audited to meet US Gov FedRAMP High control standards, and doing that would violate several audited control standards.

A breach in that area would cost them potentially billions in losses.

View on HN

Public clouds are separated from their gov versions, with gov versions using older, modified versions of what everyone else uses. public clouds ARE NOT fedramp compliant

Not necessarily. Lots and lots of .gov operates in commercial clouds. Google doesn’t even have a distinct offering - just support add-ons for things like CJIS compliance. Microsoft’s footprint is a lot more complex.

Outside of the DoD space, the main distinctions between these offerings is where data can be stored and where and to what level of vetting vendor employees are.

This is not true. Google Cloud ‘s FedRAMP offering uses the same regions, zones and binaries and configurations as the regular public cloud offering.

Source: I work on FedRAMP compliance for GCP Databases.

For reference, this is also the same case for AWS: https://aws.amazon.com/compliance/services-in-scope/

AWS US East-West (Northern Virginia, Ohio, Oregon, Northern California) is FedRAMP compliant at moderate impact level.

Reply on news.ycombinator.com