By Brandon Hancock, J.D., CMMC-RP
CIGIE's March 2026 cloud-security best-practices report is written for federal agencies, but contractors should read it as a preview of oversight questions. Cloud security is no longer satisfied by saying a system is hosted by a major provider. Agencies and their inspectors general are looking for governance, monitoring, provider oversight, identity controls, configuration management, and authorization discipline.
Cloud risk does not disappear when the government buys a service
Federal agencies use cloud services to improve capability, scalability, and resilience. But moving to the cloud changes the risk model; it does not eliminate agency responsibility. The same is true for contractors. A contractor that hosts federal information in a cloud service must understand what the provider controls, what the contractor configures, and what the agency expects.
CIGIE's report identifies recurring best-practice themes from prior oversight work. Those themes map closely to the questions contractors receive in security questionnaires, FedRAMP discussions, agency authorization reviews, and CUI handling plans.
The major themes contractors should expect
The report's themes include oversight of cloud service providers, data protection and monitoring, identity and access management, configuration management, continuous monitoring, and assessment and authorization. Each theme has a contractor equivalent.
Oversight of cloud service providers means the contractor should know which cloud services are in use, what authorization status they have, what shared-responsibility model applies, and what contractual commitments exist. Data protection means the contractor should know what federal information is stored, how it is encrypted, where it is backed up, and who can access it. Identity and access management means roles, privileges, multifactor authentication, and periodic reviews must be more than policy statements. Configuration management means baseline settings, change control, and misconfiguration detection. Continuous monitoring means collecting and reviewing evidence over time, not only before award.
What this means for government contractors
Contractors should expect federal customers to ask more specific questions about cloud operations. A SaaS vendor may need to explain how it monitors privileged access. A managed service provider may need to document configuration baselines. A professional services contractor using a commercial collaboration platform may need to show whether CUI is allowed in that platform. A cloud integrator may need to show how customer responsibilities are allocated.
The biggest risk is assuming that FedRAMP, by itself, answers every question. FedRAMP authorization is important when applicable, but it does not configure the customer's tenant, train users, manage data markings, review privileges, or decide whether CUI belongs in a specific workflow.
Subcontractors and shadow cloud matter
Cloud services often enter through subcontractors, business units, and project teams. A prime contractor may not realize that a subcontractor is storing federal data in a separate ticketing tool or document repository. A project manager may create a workspace outside the approved environment. A developer may export logs containing sensitive information.
For protected information in practice, those are not minor administrative details. They define the real system boundary.
Next step: create a cloud responsibility matrix
For each cloud service used in federal work, document:
- the service name and provider;
- the federal contracts supported;
- the type of information stored or processed;
- authorization or security status;
- shared-responsibility boundaries;
- identity and privilege owners;
- logging and monitoring responsibilities;
- configuration baseline owner;
- incident-response path; and
- subcontractor involvement.
Use the matrix to support proposals, customer reviews, CUI decisions, and incident response.
Sources
- Best Practices for Federal Agencies to Strengthen Cloud Security, Council of the Inspectors General on Integrity and Efficiency, March 12, 2026.
- Best Practices for Federal Agencies to Strengthen Cloud Security PDF, Council of the Inspectors General on Integrity and Efficiency, March 2026.
- CIGIE Outlines Best Practices for Agencies to Strengthen Cloud Security, MeriTalk, March 17, 2026.