What Roat's move to DOT means for FedRAMP

One of the driving managers behind the General Services Administration's cloud services security program is about to depart the agency, but industry insiders said the effort will likely rumble on effectively.

The director of GSA's Federal Risk Management and Authorization Program (FedRAMP), Maria Roat, is leaving the agency for the U.S. Department of Transportation. DOT CIO Richard McKinney confirmed in an Aug. 13 speech that Roat would become his agency's chief technology officer.

"Maria Roat will join the Department of Transportation next month [and] serve as the architect of the department’s technical transformation focused on shared services, cloud computing and data management," a DOT spokesman told FCW on Aug. 13. "As a data-driven agency, the addition of a CTO will help DOT leverage enterprise technology services to improve the operations, productivity, efficiency, effectiveness and service delivery of the department."

Roat's most likely successor as GSA is Matthew Goodrich, currently the FedRAMP program manager.

Roat was instrumental in setting up FedRAMP, which is aimed at providing a single federal accreditation for cloud service providers' offerings. She explained and clarified the multi-stage and multi-path certification process for sometimes-anxious providers as the program's June 5 deadline approached this year.

Her departure won't severely impact FedRAMP's ongoing operations, according to industry and agency sources. Most of those sources attributed her move not to any difficulties at FedRAMP, but to the relative success of the program.

"The FedRAMP program has a lot of moving parts," said federal procurement expert Larry Allen. "Maria has handled it well."

Goodrich has also done a good job for the program, Allen added, noting that he expects the competent work will continue in the interim position. (Goodrich won a 2013 Federal 100 award for his FedRAMP work.)

Allen did voice a minor concern that was echoed by other observers unwilling to speak for attribution. "There's always some potential for drop off when a program's strong advocate and leader leaves," he said. "There is also a long list of companies waiting in line" for certification. "People are being told that short of an agency-backed authorization, the process could take a year."