CMS taking a three step approach to using more SaaS: Discover, manage, secure
Summary
We identified a tool that will help us manage the discovery of SaaS in our environment,” Singletary said at a recent event sponsored by the Digital Government Institute. “With that discovery, we would love to evaluate those SaaS products, categorize them and make sense of what their usage are because we don’t want to call out things as unsanctioned if everybody’s using it and therefore it’s not shadow IT. We’ve got to understand who’s using it, why are they using it and what type of sensitive data is going in it.” Over the last four or five years, CMS has implemented more software services in the cloud, including sponsoring them through the Federal Risk Authorization Management Program (FedRAMP). “That’s where we are right now, just identifying the tool and doing the discovery, and having those meaningful conversation with our counterparts within the operations on what we can do better to manage these platforms across the agency.” Like many agencies, CMS wants the FedRAMP approval process to move faster so they have more access to the software services in the cloud. “Because we’re all still remote for the most part and we don’t see all of our stakeholders, our customers, and even our groups coming back together collectively in the office, we’re really stuck with trying to figure out how to collaborate, how to give people tools and resources in a secure way,” she said.