(Disclaimer: I am not a lawyer; don't try this at home.)
The U.S. government does have very specific guidelines for government agencies wanting to consume cloud services. Those cloud services must be FedRAMP certified. This is an arduous, lengthy, expensive process... and it's specifically geared toward cloud services, not managed or shared hosting.
Per the OMB memo published on December 8, 2011, all low and moderate impact cloud services leveraged by more than one office or agency must comply with FedRAMP requirements by 2014.
FedRAMP prescribes a bunch of security controls and configuration baselines here.
FIPS (140 and otherwise) and FedRAMP are not the same thing. FIPS 140 is much more specific, and details requirements for the use of cryptographic modules, which symmetric algorithms are allowed, which hashing algorithms are allowed, etc. Using another vendor's cryptographic modules in a FIPS-compliant manner is not the same as having a FIPS certified solution. FIPS certification (The Cryptographic Module Validation Program) is also a lengthy and very expensive process whereby you must submit your cryptographic module (be it a physical hardware security module, or a software module such as a DLL file) to the government for them to review it and approve it. A cryptographic module can not be FIPS certified, even if it generates identical data as a FIPS certified module, unless it has passed the CMVP. However, you can use and incorporate other vendor's modules (such as OpenSSL, bcrypt.dll from Microsoft, etc.,) in your solution and still call it a FIPS compliant solution, or that it is operating in a FIPS compliant mode.
FedRAMP is about certifying your entire cloud solution, which is much grander in scope than just one application. FedRAMP encompasses everything from the physical security in your datacenters, to your disaster recovery plan, to how well documented your solution is, to how you conduct regular vulnerability scanning, as well as inspecting every operating system, application and server in your environment.
If you look into the security controls set forth in the FedRAMP certification program, it does mention FIPS several times. Cryptography must be employed in a FIPS-compliant manner throughout a FedRAMP-certifiable solution.
- Is it okay to host your FIPS level 1 compliant application in the cloud? How about level 2?
Yes it's OK. FIPS is always OK (and furthermore typically required) for U.S. government agencies. In my experience, FedRAMP is not very picky about FIPS Level 1 versus Level 2, etc., only that FIPS Level-something is being used wherever cryptography is used.
If your solution is all software, I think the best you are going to do is FIPS 140 Level 1, since the requirements for Level 2 and above call for physical tamper proofing, tamper evidence and other physical security measures (like that PCB coating you mentioned,) and a purely software solution can never meet those requirements. A module that is validated to level 2 or above would be something like a smart card or hardware security module that has physical attributes.
- If #1 is yes, are there specific requirements/certifications needed by the cloud host?
FedRAMP, and possibly others such as FISMA depending on which government agencies are looking to buy service from you.
- Just want to validate my assumption: it is okay to collocate at a normal facility for level 1, correct? If not, what are the requirements/certifications needed by the host? What about level 2?
There is no clause in any of the baselines that expressly forbids colocation and shared hosting, however, it's been my experience that you will need to show strong evidence of role-based access controls and sensitive accounts management, specifically when it comes to being able to disallow non-U.S. citizens from accessing the system, or even preventing U.S. citizens who are travelling abroad from accessing the system. This will probably implicitly disqualify most instances of colocation because I couldn't guarantee that the datacenter cage next to yours couldn't be rented out by Russian spies, etc.
