The Google-Microsoft Fight About FISMA Certification - Updated
If you were as puzzled as I was by the blog fight, as Geekwire calls it, between Google and Microsoft over whether or not Google was FISMA certified, then you will be glad to know I gathered up some of the documents from the case …
Context & Ripple Effects
The fight began with an April 11 TechNet post accusing Google of misleading security claims about its government certifications; Groklaw has now assembled the underlying documents, and the syndicated reaction — including Tim O'Reilly amplifying them — points the accusation back at Microsoft, whose own cloud services reportedly lack the certification Microsoft questioned on Google.
This is also a fresh round in a longer rivalry: Google pressed for a formal role in Microsoft's antitrust case back in 2007 and later made its 2009 EU competition gambit, so both companies arrive at this dispute treating each other's compliance claims as attack surfaces.
First-order effects
- Federal buyers weighing Google Apps against Microsoft's cloud offering are left with two vendors publicly disputing whose FISMA paperwork is real, forcing agencies to recheck the accreditation records themselves before awarding work.
- Microsoft's credibility in government-facing marketing takes a direct hit if, as the documents suggest, its claim about Google does not survive contact with its own certification status.
Second-order effects
- Certification claims become a live competitive weapon in the government cloud market, meaning each vendor now audits the other's compliance language as closely as its pricing.
- Other cloud providers selling to Washington face pressure to state precisely what 'FISMA certified' means for their services, since the term is being shown to cover different things for different vendors.
Third-order effects
- If rival-auditing of compliance claims becomes routine, federal cloud procurement drifts toward stricter, standardized attestation of security credentials — with vendors' marketing claims checked against actual agency authorization documents rather than taken on faith.
The trend: Government cloud contracts are turning into a battleground where competitors police each other's security-compliance claims in public rather than relying on procurement vetting alone.