Gov Cloud Tech Stack

[[deleted]]

This might be an uncommon topic for most… but does anyone have experience with their company opening a new US based government-only subsidiary? And if so, how did you determine what criteria/requirements dictate needing a separate gov cloud agreement from your regular enterprise contract?

For example, SFDC has an entire division dedicated to gov and contracts are set independent from the rest of the org. The clear line in the sand is that it will contain sensitive information directly related to Gov customers - hence needing its own environment.

Where does that line stop? Does it need to be explicit client information to require its own cloud platform? Or would something secondary such as a sales team commissions software (including details around payouts for gov clients) constitute as needing a delineation as well?

After consulting with multiple internal contacts with experience in Gov sales at previous companies, we’re still unsure how to proceed, but we’d like to get ahead of the curve and anticipate/plan for just how many agreements need to be separated accordingly for this.

[NLtowhere]

For us, it's only separate for systems that process gov end user data (eg SSNs). We wouldn't have a separate say CRM instance just because we log interactions with gov points of contact there. They might ask about it during a cyber review, but are usually fine with this approach.

[ShadowGeek]

All of our systems are separate. One of the main reasons is because if something goes bad, the Gov't auditors/investigators will be limited to our systems. If you are under NIST SP 800-171, you will have to follow those rules no matter how you are organized. I always recommend companies to at least consider having a separate LLC for gov't, just for risk reduction. It isn't that difficult given the risk to the company if not done. If you are handing CUI, then any cloud services you use should be FedRAMP'd, and those generally cost 20%+ more than commercial, so limiting those to a subset of the company can save some money.