Microsoft's GCC High Got Fed Blessing Despite Security Red Flags
ProPublica investigation reveals FedRAMP authorized Microsoft's GCC High for sensitive gov data amid ongoing cybersecurity concerns.
A ProPublica investigation has exposed a troubling disconnect in federal cybersecurity. The US FedRAMP program authorized Microsoft's GCC High cloud service to handle sensitive government data in 2024 — even after years of documented security concerns about the platform.
GCC High is Microsoft's specialized cloud environment designed specifically for government agencies dealing with controlled and sensitive information. The authorization came as part of the broader federal "Cloud First" push to migrate agencies onto cloud infrastructure.
The investigation, titled "Zero Trust: Inside Microsoft's Cybersecurity Failures," raises serious questions about how the government evaluates cloud security when its biggest vendor has a checkered track record. The irony of a "zero trust" framework apparently not applying to its largest provider is hard to miss.
The findings spotlight the tension between rapid cloud adoption goals and rigorous security vetting in federal IT procurement.