"This is the end
You made your choice
And now my chance is over
I thought I was in
You put me down and say I'm goin nowhere"
-- Frank Stallone
Sure enough, despite the fairly wide Apache base installed where I work, the latest modernization effort for web services was more or less rejected because Apache isn't NIAP certified.
Of course, neither is IIS, which they approved, but the security accreditors think Microsoft is more likely to pay for certification than an Apache developer. I'm not exactly sure what they would certify IIS against, as the Protection Profile is still in development.
I did point out that both WebLogic and WebSphere are being tested. The last I checked, WebSphere shipped with Apache. I wonder if the evaluation configuration requires it?
