Installing software on your government Mac isn’t as simple as downloading from the App Store. Federal security requirements mandate that software be reviewed and approved through processes like FedRAMP. Understanding this process helps you request and obtain the tools you need for your work.
Why Software Approval Matters
Federal agencies restrict software for critical reasons:
- Security risk: Unvetted software could contain vulnerabilities or malware
- Data protection: Software may transmit data to unauthorized locations
- Compliance: Federal systems must use authorized solutions
- Supply chain: Software provenance must be verified
- Support: Approved software has vendor support relationships
Understanding FedRAMP
The Federal Risk and Authorization Management Program (FedRAMP) standardizes security assessment for cloud services.
FedRAMP Basics
- Provides standardized approach to security assessment
- Authorizes cloud products for government use
- Three impact levels: Low, Moderate, High
- Ongoing monitoring ensures continued compliance
FedRAMP Authorization Levels
- Low: Limited impact if compromised (e.g., public websites)
- Moderate: Serious impact (most agency systems)
- High: Severe or catastrophic impact (sensitive systems)
Finding FedRAMP Authorized Products
The FedRAMP Marketplace lists authorized cloud services:
- Visit marketplace.fedramp.gov
- Search by product name or category
- Verify authorization status and level
- Check if your agency has existing ATO
The Software Request Process
Step 1: Identify Your Need
Before requesting software, document:
- What task you need to accomplish
- Why existing approved tools are insufficient
- How many users need the software
- What data the software will access
Step 2: Check Approved Software Lists
Your agency likely maintains approved software catalogs:
- Check Self Service app for available software
- Review agency intranet software catalogs
- Ask IT about approved alternatives
- Search your agency’s IT service portal
Step 3: Submit a Request
If the software isn’t approved, submit a formal request:
- Complete software request form (IT service portal)
- Provide business justification
- Include software vendor information
- Note FedRAMP status if applicable
- Identify funding source if required
Step 4: Security Review
Your request triggers security assessment:
- IT security reviews the software
- Risk assessment is conducted
- Compliance requirements are verified
- Testing may be performed
Step 5: Approval and Deployment
If approved:
- Software is added to approved catalog
- Installation package is created
- Deployment through Self Service or MDM
- License management is established
Timeline Expectations
Software approval takes time:
- Already approved software: Days to weeks
- FedRAMP authorized cloud service: Weeks to months
- Non-FedRAMP cloud service: Months (requires agency ATO)
- Desktop software: Weeks to months depending on complexity
Plan ahead for software needs rather than waiting until urgent.
Common Approved Software Categories
Productivity
- Microsoft 365 (GCC/GCC High)
- Adobe Acrobat (approved versions)
- Zoom for Government
- Box for Government
Development
- Xcode (Apple)
- Visual Studio Code (with restrictions)
- Git (command line)
- Homebrew (some agencies)
Browsers
- Safari (built-in)
- Microsoft Edge
- Google Chrome (approved versions)
- Firefox (approved versions)
What To Do While Waiting
If your software request is pending:
- Use approved alternatives where possible
- Work with IT on temporary solutions
- Document workarounds you’re using
- Check request status periodically
- Escalate through your management if mission-critical
Prohibited Software
Some software is explicitly prohibited:
- Software from adversary nations (specified by CISA)
- Peer-to-peer file sharing applications
- Unauthorized remote access tools
- Gaming or entertainment software (usually)
- Cryptocurrency mining applications
- Software with known security vulnerabilities
Personal Software on Government Macs
Generally, you cannot install personal software on government Macs:
- MDM policies block unauthorized installations
- App Store access may be restricted
- Admin rights are typically not granted
- Personal use of government equipment is limited
Shadow IT Risks
Using unauthorized software (shadow IT) creates risks:
- Security vulnerabilities unknown to IT
- Data may be stored in unauthorized locations
- Compliance violations may occur
- No IT support if problems arise
- Potential disciplinary action
Always work through proper channels for software needs.
Advocating for Better Tools
If the approval process is too slow or burdensome:
- Provide feedback through proper channels
- Document mission impact of delays
- Suggest process improvements
- Work with your CIO office on systemic issues
- Participate in technology working groups
The software approval process protects federal systems, but it should also enable mission accomplishment. Understanding the process helps you navigate it effectively while maintaining security compliance.
