Research if FIPS-140 adoption would impose a cost that is detrimental to our security efforts

[pburkholder]

In order to address FIPS-140 concerns with FedRAMP, we should be clear the extent to which FIPS-140 may impose costs to our team and operations that are detrimental to our other security efforts,
so that we can provide a solid response to their Corrective Action Plan letter.

---

Security considerations

Yes. This issue is all about security considerations.

Implementation sketch

Partial sketch:

• How much money and resources does it take to run FIPS-140 in every element of our stack?
• How does that compare to our other efforts?
• What is the point when the cost-benefit analysis leads us to say make the case that FIPS-140 adoption increases platform/customer risk?

[pburkholder]

Closing in favor of #2529