John Z Black

John Z Black Mar 18, 2026 Policy, Law & Governance #fedramp #cloud-security #governance #procurement #assurance #public-sector #risk-management

Most buyers treat a federal cloud authorization as a trust shortcut. The badge means the hard technical work got done, dissent was resolved, risk got documented.

New investigative reporting on Microsoft’s cloud approvals suggests that assumption deserves a harder look.

When internal objections can be overridden without any transparent resolution process, certification starts functioning as a procurement artifact rather than a real risk signal. That creates two failures at once: technical teams inside government stop trusting that escalation paths mean anything, and buyers outside government overestimate what “approved” actually proves.

The story isn’t unique to Microsoft. Schedule pressure, vendor dependency, and political timelines can all crowd out adversarial review. Governance can still look intact on paper while assurance quality quietly slips.

For enterprise buyers copying federal procurement language, the fix is simple but uncomfortable: ask what objections were raised, how they were resolved, and what would trigger reassessment. A certification is a starting point, not an endpoint.

Get the full analysis on what better assurance governance actually looks like – and the questions every buyer should be asking