Please note..
"Secure for US government" does not magically imply in any way, shape or form "secure for anyone else" of any of their other services. I know that most PHBs believe in the homeopathy shown by marketing people, but this is most likely a fully isolated service container.
It's not even sure if lessons learned securing this will make it to the main platform - you'd hope so, but you have no certainty.
Biting the hand that feeds IT
