General discussion and Q&A for RFC-0031 Incident Communications Procedures

[rhoesing]

This thread is for any general questions or discussion that isn't related to formal public comment on RFC-0031, Incident Communications Procedures.

Folks from FedRAMP may participate in this thread and answer questions/etc. in a way that isn't possible in the formal public comment threads.

[pete-gov]

(note, I repurposed this thread for RFC-0031 since no one was using it for RFC-0025, pew pew)

[hitecherik]

What is the intention behind the proposed requirement that Moderate/High providers report service status and historical availability information publicly, rather than in an environment accessible only to the customer / FedRAMP?

[pete-gov]

Reason for public vs private: Managing API keys, identities, etc. for many different services gets very complicated, and it's basically impossible for FR or CISA to do this at scale. Requiring these services to make availability information available in a public status page means FR and CISA can directly ingest this automatically with minimum investment.

Commercial cloud services and most gov clouds already do this, so it also enables such services to leverage existing capabilities and processes without having to create gov-specific versions or reporting. An automated page like this also is a lot less effort than notifying every agency and FR and CISA every time there's an availability incident, so it should reduce burden on most cloud services.

In general, public status pages are also a high quality customer experience signal and are worth investing in for any service.