Microsoft and Google: Who's the most FISMA-compliant of them all?

There's one thing that seems to be lost in the latest debate between Microsoft and Google, which erupted on April 11 over FISMA-certification of their cloud-hosted app offerings. Neither company has yet achieved FISMA certification status for the federal versions of their wares.

Google officials said last year that its Google Apps offering was FISMA-certified and highlighted that as a distinction separating it from Microsoft's Business Productivity Online Suite (BPOS). It turns out that Google Apps for Government is not FISMA-certified, even though Google Apps Premier is, as just-unsealed documents made public by the Department of Justice have revealed.

Microsoft also still has not achieved FISMA certification for BPOS. Last summer when I asked, I was told BPOS-Federal would get the FISMA nod "very soon." When I asked again today when it would achieve that state, I was told "imminently."

Is this more than yet another war of words between the two adversaries?

FISMA, the Federal Information Security Management Act (FISMA) specifies a “comprehensive framework to protect government information, operations and assets against natural or manmade threats.” Many federal agenciesstipulate FISMA certification as a requirement for their IT solutions. FISMA certification and accreditation is confirmed by the General Services Administration — which just so happened to be deciding upon a new e-mail system last summer.

Google called out Google Apps for Government at that time as "the first suite of cloud computing applications to receive Federal Information Security Management Act (FISMA) certification and accreditation from the U.S. government."

It turns out that Google Apps Premier -- not the federally-focused Apps for Government -- got the FISMA nod. Google is not seeking separate FISMA authorization for Google Apps for Government, however, because the Government and Premier products are almost identical, officials said. Google is simply "updating the existing authorization," a Google spokesperson said. When will that happen? "Imminently."

Hmm. Haven't I heard that somewhere before?

Bottom line: Neither Google nor Microsoft can yet claim the FISMA crown for their federal cloud solutions -- in spite of Google's claims to the contrary last year.