Information Technology Reform:

Progress Made but Future Cloud Computing Efforts Should be Better Planned

GAO-12-756: Published: Jul 11, 2012. Publicly Released: Jul 11, 2012.

Multimedia:

Additional Materials:

Contact:

David A. Powner
(202) 512-9286
pownerd@gao.gov

 

Office of Public Affairs
(202) 512-4800
youngc1@gao.gov

What GAO Found

The selected federal agencies have made progress implementing the Office of Management and Budget’s (OMB) “Cloud First” policy. Consistent with this policy, each of the seven agencies incorporated cloud computing requirements into their policies and processes. For example, one agency had incorporated a review of its information technology (IT) investment portfolio to identify candidates for a cloud solution into its IT plan. Further, each of the seven agencies met the OMB deadlines to identify three cloud implementations by February 2011 and to implement at least one service by December 2011. However, two agencies do not plan to meet OMB’s deadline to implement three services by June 2012, but plan to do so by calendar year end, ranging from August to December. Each of the seven agencies has also identified opportunities for future cloud implementations, such as moving storage and help desk services to a cloud environment. While each of the seven agencies submitted plans to OMB for implementing the cloud solutions, all but one plan were missing key required elements. For example, 7 of the 20 plans did not include estimated costs and none of the plans for services that were to migrate existing functionality to a cloud-based service included plans for retiring or repurposing the associated legacy systems. According to agency officials, this was largely because the information was not available at the time the plans were developed. Until agencies’ cloud implementations are sufficiently planned and relevant systems are retired, the benefits of federal efforts to implement cloud solutions—improved operational efficiencies and reduced costs—may be delayed or not fully realized.

GAO identified seven common challenges associated with the implementation of OMB’s “Cloud First” policy.

Common Challenges to Cloud Computing

1. Meeting Federal Security Requirements

2. Obtaining guidance

3. Acquiring knowledge and expertise

4. Certifying and accrediting vendors

5. Ensuring data portability and interoperability

6. Overcoming cultural barriers

7. Procuring services on a consumption (on-demand) basis

Recently issued federal guidance and initiatives recognize many of these challenges, such as the National Institute of Standards and Technology standards and guidance, and the General Services Administration’s program to assist federal agencies certify and accredit potential cloud service providers.

Why GAO Did This Study

As part of a comprehensive effort to increase the operational efficiency of federal technology assets, federal agencies are shifting how they deploy IT services. OMB issued a “Cloud First” policy in December 2010 that requires federal agencies to implement cloud-based solutions whenever a secure, reliable, and cost-effective cloud option exists; and to migrate three technology services to a cloud solution by June 2012. Cloud computing provides on-demand access to a shared pool of computing resources; can be provisioned on a scalable basis; and reportedly has the potential to deliver services faster, more efficiently, and at a lower cost than custom-developed systems.

GAO was asked to (1) assess the progress selected agencies have made in implementing this policy and (2) identify challenges they are facing in implementing the policy. To do so, GAO (1) selected seven agencies, analyzed agency documentation, and interviewed agency and OMB officials; and (2) identified, assessed, and categorized common challenges.

What GAO Recommends

GAO is making recommendations to seven agencies to develop key planning information, such as estimated costs and legacy IT systems’ retirement plans for existing and planned services. The agencies generally agreed with GAO’s recommendations. State disagreed with one recommendation, noting that legacy retirement plans were not applicable to its existing cloud services. GAO maintains that the recommendation is applicable for reasons discussed in this report.

For more information, contact David Powner at (202) 512-9286 or pownerd@gao.gov.

Recommendations for Executive Action

  1. Status: Closed - Implemented

    Comments: The Department of Agriculture has substantially implemented key elements of this recommendation. While the Department did not establish estimated costs for the email cloud service or major milestones for the collaboration service, it has established major milestones for its email cloud service. Moreover, it established (1) estimated costs, and (2) performance goals for its collaboration service. By addressing most of the elements that we reported as not being addressed, the department has helped ensure the success of its cloud-based solutions.

    Recommendation: To help ensure the success of agencies' implementation of cloud-based solutions, the Secretaries of Agriculture, Health and Human Services, Homeland Security, State, and the Treasury; and the Administrators of the General Services Administration and Small Business Administration should direct their respective chief information officer (CIOs) to establish estimated costs, performance goals, and plans to retire associated legacy systems for each cloud-based service discussed in this report, as applicable.

    Agency Affected: Department of Agriculture

  2. Status: Closed - Implemented

    Comments: In response to the recommendation, the Department of Health and Human Services established estimated costs, performance goals, and plans to retire associated legacy systems for each of the cloud-based services discussed in the report. For example, we reported that the agency had not established performance goals for its Grants Solutions cloud service; however, the agency has since established goals for the service, including for availability and customer satisfaction.

    Recommendation: To help ensure the success of agencies' implementation of cloud-based solutions, the Secretaries of Agriculture, Health and Human Services, Homeland Security, State, and the Treasury; and the Administrators of the General Services Administration and Small Business Administration should direct their respective CIOs to establish estimated costs, performance goals, and plans to retire associated legacy systems for each cloud-based service discussed in this report, as applicable.

    Agency Affected: Department of Health and Human Services

  3. Status: Closed - Implemented

    Comments: The Department of Homeland Security has substantially implemented key elements of this recommendation. While the Department has not yet provided documented support for establishing estimated costs for the Data Center cloud service, DHS has estimated costs for the other service. Furthermore, it established (1) performance goals and (2) plans to retire associated legacy systems for both of the two cloud-based services discussed in our report. By addressing five of the six elements that we reported as not being addressed, the department has helped ensure the success of its cloud-based solutions.

    Recommendation: To help ensure the success of agencies' implementation of cloud-based solutions, the Secretaries of Agriculture, Health and Human Services, Homeland Security, State, and the Treasury; and the Administrators of the General Services Administration and Small Business Administration should direct their respective CIOs to establish estimated costs, performance goals, and plans to retire associated legacy systems for each cloud-based service discussed in this report, as applicable.

    Agency Affected: Department of Homeland Security

  4. Status: Closed - Implemented

    Comments: In response to the recommendation, the Department of State established costs, performance goals, and plans to retire the associated legacy systems for each cloud-based service discussed in the report, as applicable. For example, we reported that the agency had not established performance goals for its Electronic Library cloud service; however, as of October 2014, the agency had established goals for the service, including for availability and security.

    Recommendation: To help ensure the success of agencies' implementation of cloud-based solutions, the Secretaries of Agriculture, Health and Human Services, Homeland Security, State, and the Treasury; and the Administrators of the General Services Administration and Small Business Administration should direct their respective CIOs to establish estimated costs, performance goals, and plans to retire associated legacy systems for each cloud-based service discussed in this report, as applicable.

    Agency Affected: Department of State

  5. Status: Closed - Not Implemented

    Comments: The Department of Treasury did not establish major milestones or retirement plans for legacy systems for two cloud-based services. According to agency officials, the agency did not establish these, because they implemented the cloud based services prior to the issuance of OMB's guidance.

    Recommendation: To help ensure the success of agencies' implementation of cloud-based solutions, the Secretaries of Agriculture, Health and Human Services, Homeland Security, State, and the Treasury; and the Administrators of the General Services Administration and Small Business Administration should direct their respective CIOs to establish estimated costs, performance goals, and plans to retire associated legacy systems for each cloud-based service discussed in this report, as applicable.

    Agency Affected: Department of the Treasury

  6. Status: Closed - Implemented

    Comments: In response to our recommendation, the General Services Administration established performance goals, and retirement plans for legacy systems for its Email and Collaboration Solution cloud service. In addition, the agency documented performance goals for its IT power management services.

    Recommendation: To help ensure the success of agencies' implementation of cloud-based solutions, the Secretaries of Agriculture, Health and Human Services, Homeland Security, State, and the Treasury; and the Administrators of the General Services Administration and Small Business Administration should direct their respective CIOs to establish estimated costs, performance goals, and plans to retire associated legacy systems for each cloud-based service discussed in this report, as applicable.

    Agency Affected: General Services Administration

  7. Status: Open

    Comments: The Small Business Administration cancelled the implementation of the two cloud services that were documented in our report as missing estimated costs and performance goals. Accordingly, the risk associated with proceeding with cloud services without knowing expected costs or performance goals was removed.

    Recommendation: To help ensure the success of agencies' implementation of cloud-based solutions, the Secretaries of Agriculture, Health and Human Services, Homeland Security, State, and the Treasury; and the Administrators of the General Services Administration and Small Business Administration should direct their respective CIOs to establish estimated costs, performance goals, and plans to retire associated legacy systems for each cloud-based service discussed in this report, as applicable.

    Agency Affected: Small Business Administration

  8. Status: Closed - Implemented

    Comments: In response to the recommendation, in May 2013, the Department of Agriculture updated its IT investment guidance. The updated guidance includes requirements for IT investments, including cloud services, to establish estimated costs, milestones, and performance goals. Further, the guidance calls for investments to be reviewed as to whether it should be retired.

    Recommendation: To help ensure the success of agencies' implementation of cloud-based solutions, the Secretaries of Agriculture, Health and Human Services, Homeland Security, State, and the Treasury; and the Administrators of the General Services Administration and Small Business Administration should direct their respective CIOs to develop, at a minimum, estimated costs, milestones, performance goals, and plans for retiring legacy systems, as applicable, for planned additional cloud-based services.

    Agency Affected: Department of Agriculture

  9. Status: Closed - Implemented

    Comments: In response to the recommendation, the Department of Health and Human Services has established an enterprise performance lifecycle framework that requires investments, including cloud services, to establish estimated costs, milestones, and performance goals. Further, in May 2015, the agency finalized its operational analysis guidance, which calls for investments to be assessed for retirement on an annual basis.

    Recommendation: To help ensure the success of agencies' implementation of cloud-based solutions, the Secretaries of Agriculture, Health and Human Services, Homeland Security, State, and the Treasury; and the Administrators of the General Services Administration and Small Business Administration should direct their respective CIOs to develop, at a minimum, estimated costs, milestones, performance goals, and plans for retiring legacy systems, as applicable, for planned additional cloud-based services.

    Agency Affected: Department of Health and Human Services

  10. Status: Closed - Implemented

    Comments: In response to the recommendation, the Department of Homeland Security issued guidance for developing cloud alternatives analyses, which included established costs, milestones, performance goals, and plans to retire the associated legacy systems for future cloud-based service. For example, in September 2015, DHS issued its IT Service Justification Template which includes plans for establishing costs and performance goals when developing a cloud-based service.

    Recommendation: To help ensure the success of agencies' implementation of cloud-based solutions, the Secretaries of Agriculture, Health and Human Services, Homeland Security, State, and the Treasury; and the Administrators of the General Services Administration and Small Business Administration should direct their respective CIOs to develop, at a minimum, estimated costs, milestones, performance goals, and plans for retiring legacy systems, as applicable, for planned additional cloud-based services.

    Agency Affected: Department of Homeland Security

  11. Status: Closed - Implemented

    Comments: In response to the recommendation, the Department of State issued guidance for developing cloud alternatives analyses. The guidance required the department to consider, as a part of assessing cloud alternatives, estimated costs, major milestones, performance goals, and retirement plans for associated legacy systems.

    Recommendation: To help ensure the success of agencies' implementation of cloud-based solutions, the Secretaries of Agriculture, Health and Human Services, Homeland Security, State, and the Treasury; and the Administrators of the General Services Administration and Small Business Administration should direct their respective CIOs to develop, at a minimum, estimated costs, milestones, performance goals, and plans for retiring legacy systems, as applicable, for planned additional cloud-based services.

    Agency Affected: Department of State

  12. Status: Closed - Implemented

    Comments: In response to the recommendation, the Department of Treasury updated its IT investment guide to include requirements for establishing estimated costs, milestones, performance goals, and plans for retiring legacy systems for cloud-based services.

    Recommendation: To help ensure the success of agencies' implementation of cloud-based solutions, the Secretaries of Agriculture, Health and Human Services, Homeland Security, State, and the Treasury; and the Administrators of the General Services Administration and Small Business Administration should direct their respective CIOs to develop, at a minimum, estimated costs, milestones, performance goals, and plans for retiring legacy systems, as applicable, for planned additional cloud-based services.

    Agency Affected: Department of the Treasury

  13. Status: Closed - Implemented

    Comments: In response to the recommendation, in October 2014, the General Services Administration updated its IT investment guidance. The updated guidance includes requirements for IT investments, including cloud services, to establish estimated costs, milestones, and performance goals. The guidance also calls for investments to be assessed for suitability to be migrated to the cloud. Further, the agency's operational analysis guidance calls for investments to be assessed for retirement on an annual basis.

    Recommendation: To help ensure the success of agencies' implementation of cloud-based solutions, the Secretaries of Agriculture, Health and Human Services, Homeland Security, State, and the Treasury; and the Administrators of the General Services Administration and Small Business Administration should direct their respective CIOs to develop, at a minimum, estimated costs, milestones, performance goals, and plans for retiring legacy systems, as applicable, for planned additional cloud-based services.

    Agency Affected: General Services Administration

  14. Status: Closed - Implemented

    Comments: In response to the recommendation, the Small Business Administration updated its IT investment guidance and issued a cloud computing strategy. The updated guidance includes requirements for IT investments, including cloud services, to establish estimated costs, milestones, and performance goals. The guidance also calls for investments to be assessed for retirement on an annual basis. Further, the agency's cloud computing strategy calls for cloud service contracts to have measureable goals in service level agreements and to assess legacy IT systems for cloud alternatives.

    Recommendation: To help ensure the success of agencies' implementation of cloud-based solutions, the Secretaries of Agriculture, Health and Human Services, Homeland Security, State, and the Treasury; and the Administrators of the General Services Administration and Small Business Administration should direct their respective CIOs to develop, at a minimum, estimated costs, milestones, performance goals, and plans for retiring legacy systems, as applicable, for planned additional cloud-based services.

    Agency Affected: Small Business Administration

 

Explore the full database of GAO's Open Recommendations »

Sep 15, 2016

Sep 14, 2016

Sep 8, 2016

Jun 29, 2016

Jun 22, 2016

Jun 10, 2016

Jun 9, 2016

Jun 2, 2016

May 25, 2016

Looking for more? Browse all our products here