What is meant by "Digital Government services?" (Previously called
"e-Government" services)
Digital government services, often known as e-government, are
services provided by the government to itself and to the public
through the use of information and communication technologies. Tax
returns, driver's license renewals, and pet license applications are all
frequently done online. Almost any form or service provided by the
government can be obtained online.
FedRAMP (what it is, how agencies use FedRAMP to deliver Digital
Services, and how FedRAMP contributes to improved security for
Digital Services)
The government-wide Federal Risk and Authorization
Management Program (FedRAMP) offers a standardized method
for security evaluation, authorization, and ongoing monitoring
for cloud goods and services. FedRAMP enables organizations to
use cutting-edge cloud technology with a focus on security and
the preservation of federal data, and it hastens the adoption of
safe cloud solutions.
Additional strategies for improving privacy and security (Play #11)
from the Federal CIO Council's Digital Services Playbook ("Manage
security and privacy through reusable processes") -- make sure that
you address the "Checklist" and "Key Questions"
Week 3: How does FedRAMP help agencies ensure that Digital Government services
are secure?
Our digital services must safeguard confidential data and maintain system
security. This is often a constant evaluation and improvement process that
needs to be implemented during the service's creation and upkeep.
Checklist
Contact the appropriate privacy or legal officer of the department or
agency to determine whether a System of Records Notice (SORN),
Privacy Impact Assessment, or other review should be conducted
Determine, in consultation with a records officer, what data is
collected and why, how it is used or shared, how it is stored and
secured, and how long it is kept
Determine, in consultation with a privacy specialist, whether and
how users are notified about how personal information is collected
and used, including whether a privacy policy is needed and where it
should appear, and how users will be notified in the event of a
security breach
Consider whether the user should be able to access, delete, or
remove their information from the service
“Pre-certify” the hosting infrastructure used for the project using
FedRAMP
Use deployment scripts to ensure configuration of production
environment remains consistent and controllable
Key Questions
Does the service collect personal information from the user? How is the
user notified of this collection?
Does it collect more information than necessary? Could the data be
used in ways an average user wouldn’t expect?
How does a user access, correct, delete, or remove personal
information?
Will any of the personal information stored in the system be shared
with other services, people, or partners?
How and how often is the service tested for security vulnerabilities?
How can someone from the public report a security issue?
References
Granicus (2022). Digital Government Service. (2023). Retrieved from
https://granicus.com/dictionary/digital-government-
services/#:~:text=Digital%20government%20services%20(also
%20called,applying%20for%20a%20pet%20license
.
About Us | FedRAMP.gov. (2019). Retrieved from
https://www.fedramp.gov/about
The Digital Services Playbook — from the U.S. Digital Service. (2019).
Retrieved from
https://playbook.cio.gov/
Powered by TCPDF (www.tcpdf.org)
