Risk Reporting to Management on Federal Offers and How to Navigate the Conundrum?

Abstract

Technology firms mainly based out of U.S, in and around Silicon valley, in addition to a few firms on the U.S west coast, have products primarily catering to commercial customers across the globe, these are known as Commercial offers but there is another variant catering to the federal agencies and organizations known as Federal offers or Govt offers, the reason to keep this portfolio of products separate is because of the different set of criterias that need to be met and more stringent requirements. Since we are stepping into the government sector, the products in use for this sector have to be rock solid from a risk posture standpoint and in the case of cybersecurity threats hence the need for such criterias and requirements. Management and Senior leadership of these technology firms are constantly interested in viewing the security and risk posture of all the products designed, developed and marketed to customers, risk reports of commercial offers have no regulatory obstruction or confidentiality requirements hence it’s easier to present the risk overview along with the underlying details if requested , however, for federal offers, depending on the level of certification pursued and market access, there are some overarching regulations and confidentiality requirements around personnel viewing the metrics , storage locations. This article sheds some light on the afore mentioned restrictions and a simple solution or rather an abstraction approach that helps navigate this problem, at the same time, ensuring no impact to the federal product or its customers.