Posted by pattyz on March 24, 2014 at 9:21pm
I am helping out, and possibly at one point working for, a federal contractor who is switching a federal agency's sites over to Drupal, and needs to know which companies are handling hosting service for federal Drupal sites in addition to Acquia. And, in fact, this seems to also be a good thing to know.
Feel free to contact me at email3@pbzproductions.com. Many thanks!
Patty Zevallos
web architect/content producer
www.pbzproductions.com
Comments
federal hosting system
Some federal agencies have their own private web hosting system on cloud such as AWS, Azure. Somes have contract with private sector companies which provide governance server system in order to maintain the securities.
It's usually in-house
I've worked on a bunch of fed sites and they're almost always hosted in house. A couple years ago, there was a directive put out that suggested that federal agencies begin looking at cloud solutions, but I'm not sure how far that's gotten yet. Government sites, especially ours, have a more security requirements than your average private site and for private hosts to prove they can live up to those requirements takes a lot of paperwork. There is a standard called FedRAMP that was developed that laid out all the processes and precautions a given host must adhere to to host federal websites. Since you mentioned Acquia, you should know they're not yet FedRamp approved, but are currently working to be so. AWS is, as well as a bunch of other IAAS providers. You can find the list here: http://cloud.cio.gov/fedramp/
Project Hosts is a FedRAMP SaaS Drupal provider
Johnny,
I completely understand what you are saying. But I just wanted to let you know that my company, Project Hosts, is a FedRAMP accredited for doing SaaS Drupal deployments. If you have any questions please feel free to go to our website, www.projecthosts.com, and you can leave your info there and I will reach back out to you.
Regards,
Sean Barkey
Project Hosts
BlackMesh
BlackMesh in Ashburn hosts some bigger Drupal sites...don't know specifically about government, though.
Blackmesh is great -- very
Blackmesh is great -- very responsive. They host several of the government sites we work on.
BlackMesh Hosting Solutions for Government
Thanks for the good word! I reached out to Patty shortly after she posted here to confirm that we do, indeed, support both government and non-government clients on our dedicated and cloud *aaS environments. Because BlackMesh's infrastructure is in-house (as opposed to being a reseller of AWS), we are able to accommodate compliance requirements all the way up to FISMA–High, as well as PCI–DSS and other security needs. We have multiple government clients to whom we provide fully-managed hosting and support, including some very high profile and sensitive organizations.
Please don't hesitate to reach out to me directly to discuss what solutions we can bring to the table for your next project, even if you're still in the very early stages of planning. We've been around for over a decade, and working with Drupal at enterprise scale since Drupal 5.x, so we are always happy to have an architecture discussion, even if we aren't ultimately the solution provider you choose.
--Dan
As a non government user of
As a non government user of Blackmesh services I will vouch for their awesome support. It has been great working with them. Having a host that truly knows Drupal is wonderful.
Blackmesh
I can vouch for Blackmesh as well. We have been using them for almost 3 years and their support is really good.
There's always Acquia
Some Gov't agencies require a specific level of support - I know you said other than, but Acquia has done us well for over 2 years now.
PaaS for Federal
Hello Patty,
My company, Quotient, Inc., provides this type of service. Our service involves offering the entire platform (PaaS) in a FISMA Moderate compliant environment. After reading the excerpt from our recent proposal to another agency below you can contact me to explore options:
The Quotient Team understands the security requirements necessary for the Drupal Platform as a Service implementation. Quotient partner Autonomics Resources was one of the first vendors to receive FedRAMP compliance for the ARC-P platform. Quotient has been performing security services to the Department of Defense for over 11 years under contract with the Defense Information Systems Agency (DISA). Quotient also recently built a Drupal Platform as a Service for the Department of Education and received an Authority to Operate in January of 2013. The Quotient Team will utilize our platform and expertise in security to confirm the Drupal PaaS is secure and follows best practices.
The Quotient Team solutions are at the FISMA Moderate impact level, with current GSA authority to operate ATO in place for the ARC-P solution. ARC-P received a FedRAMP provisional ATO from the FedRAMP JAB in December of 2012. The Quotient Team will work with with the agency to confirm that any additional security controls, required by an agency above and beyond the FedRAMP baseline of controls from NIST 800-53 Rev3, are met, assessed and reviewed by the agency. [Agency removed] can then provide an ATO, based on the FedRAMP provisional ATO and the assessment of the additional agency required controls. The Quotient Team will advise the FedRAMP PMO as we receive agency ATOs, per FedRAMP requirements, so that FedRAMP may list these with our provisional ATO on the FedRAMP Website. This approach allows a more streamlined FedRAMP authorization process for IaaS,PaaS, and Saas solutions deployed on ARC-P. It also allows The Quotient Team to confirm that security controls, processes, procedures, and standards are integrated into each layer of the total offering so that all our offerings receive a full ATO and that they provide continuous monitoring under those ATOs to effectively manage
information system security.
Thank you,
Edward Monk
Quotient, Inc.
Director Enterprise Solutions
443-283-2143 (w)
443-283-2193 (f)
804-405-4579 (c)
www.quotient-inc.com
Fisma Moderate and DISA Compliant
Hi Pattyz,
I can attest to Amazon Web Services being a viable solution for federal government hosting. The company that I currently work for (MetroStar Systems out of Reston, Virginia) is a federal government and DoD contractor who has been faced with deploying infrastructure and applications ranging from Drupal 7, to WordPress, and even SharePoint. For all of these products/solutions, AWS has been a mainstay, being rated at FISMA moderate, and having the capability to be STIG'ed out to and approved as DISA compliant for DoD applications. Recently, we have launched applications for the Internal Revenue Service, U.S. Marine Corps, Department of Justice, and other mission critical agencies all using AWS in some form to provide robust solutions, and it is now acknowledged as an adopted vendor. While AWS can be daunting for first time users (forgive me if you are not one), it truly has the capacity to provide a higher set of features at an extremely lower cost when configured correctly, especially for Drupal projects (Varnish, SOLR, automated backups, you name it).
If you ever need anyone to chat with about any specific questions you have on Drupal, AWS, and the federal government, feel free to drop me a line, and best of luck with your Drupal adventures!
Cheers - Mark
Another vote
I'm not in Government but as a commercial user of Blackmesh I can vouch for how awesome they are as well. I consider them an extension of my team and they are my Drupal subject matter experts (among other things).
FedRamp Drupal Platform in the Cloud
I know this thread is a few weeks old, but I wanted to chime in. I work for Aquilent in Laurel, MD. We’re strictly federal and use a variety of CMS products, including Drupal (not to mention the whole digital and mobile strategy and app dev side of things). As it happens, we’re also a cloud service provider and host everything from content managed sites to web applications through Amazon, Terramark, etc. Just last week we launched a secure Drupal Platform in the Cloud specifically for the federal government to address issues we were running into with our own clients. Some agencies have been given directives to ensure their sites are FedRAMP compliant before they can renew their ATOs (or before a specific date), and for the ones that don’t host it internally, it seems to be something they’ve had trouble finding a good solution for.
Here’s the company 411 on the whole thing:
I know that’s a lot of press release-type stuff, but just wanted to provide a brief summary. If you need more info, you can see the full press release or contact Aquilent at: DigitalCommunications@aquilent.com or 301.939.1000.
Thanks,
Eric