Microsoft moves ahead on process to get classified cloud certification

Microsoft has taken another step in gaining the ability to host classified data in a commercial cloud environment, a move intended to better position the global software giant for some of the federal government’s big-ticket cloud contracts.

In a blog post Wednesday, Microsoft unveiled its Azure Government Secret offering intended to meet the Defense Department’s requirements for an Impact Level 6 authorization to host sensitive information.

If and when Microsoft receives the Impact Level 6 distinction, the company can host essentially the highest levels of classified data for defense agencies. That would make Microsoft only the second commercial cloud provider to have the IL6 authorization alongside Amazon Web Services, who already has it.

The timing of this process coincides with the Defense Department’s pair of multibillion dollar procurements: the much-touted $10 billion “JEDI” commercial cloud infrastructure contract, plus the $8 billion Defense Enterprise Office Solution buy of cloud-based email, calendar, other communications and other collaboration tools.

AWS and Microsoft are the final contenders for the Joint Enterprise Defense Infrastructure cloud contract currently in the source selection phase and also the subject of an ongoing lawsuit in Court of Federal Claims, which this week lifted a stay on that case and approved a new schedule.

All JEDI bidders have to be certified to host top secret information, of which only AWS is approved to do.

DEOS is being run by the General Services Administration and also has similar classified data hosting requirements, but bidders with an Impact Level 5 certification can be in the process of getting the IL6 designation.

Microsoft still has work to do in order to get to Impact Level 6. Azure Government Secret is in an ongoing “private preview and pending accreditation” phase prior to getting the IL6 designation.

“Since Azure Government Secret is pending accreditation, Private Preview is for existing Microsoft customers and evaluated on a case by case basis,” a company spokesperson told WT in an emailed statement. “We are working closely with our government partners on the accreditation process.”

In the blog post, Microsoft’s Azure Global General Manager Lily Kim wrote the company is also in the process of getting an Intelligence Community Directive 503 accreditation. That would let them host similar levels of classified data for IC agencies not unlike I6 for the defense community.

Kim added Microsoft has also expanded Azure Government’s coverage up to DOD Impact Level 5 that covers highly-sensitive and controlled but unclassified information.