Each year the federal government spends billions of dollars on information technology (IT) investments; federal agencies reported to the Office of Management and Budget (OMB) that approximately $74 billion was budgeted for IT for fiscal year 2013. Over the past several years, GAO has reported that federal IT projects too frequently incur cost overruns and schedule slippages while contributing little to mission outcomes. Cloud computing, an emerging approach to delivering IT services, provides on-demand access to a shared pool of scalable computing resources. According to OMB, cloud computing has the potential to address IT inefficiencies by providing services both more quickly and at a lower cost. OMB further noted that IT services costing billions of dollars annually could potentially be migrated to cloud computing. Accordingly, agencies reported saving millions of dollars from implementing cloud-based solutions. In particular, the Department of Homeland Security reported that its implementation of enterprise content delivery services avoids an estimated $5 million in costs annually.
In December 2010, OMB issued a Cloud First policy that requires federal agencies, when evaluating options for IT deployments, to implement cloud-based solutions whenever a secure, reliable, and cost-effective cloud option exists. Each agency was also required to migrate three IT services to a cloud solution by June 2012 and retire the associated legacy systems.
In July 2012, GAO reported that seven federal agencies GAO reviewed had made progress implementing OMBs Cloud First policy. Consistent with this policy, each of these seven agencies incorporated cloud computing requirements into their policies and processes. For example, one agency planned to review its IT investment portfolio to identify candidates for cloud solutions. Another agency identified cloud computing as a high priority and complied with the OMB deadlines by migrating existing IT services to or offering new services in a cloud-based environment. Further, five of the seven agencies reported that they had met the OMB deadlines to identify and implement three cloud services by June 2012. The other two agencies planned to implement three services from August through December 2012. Each of the agencies also identified opportunities for future cloud implementations. For example, one agency is considering moving its storage and help desk services to a cloud environment, while another agency is considering moving its development environment to a cloud solution.
In addition, each of the seven agencies submitted plans to OMB for implementing their respective cloud solutions. According to OMB, each plan is to contain, among other things, estimated costs of implementing the new cloud service, major milestones for implementing the service, performance goals, and plans for retiring the associated legacy systems. However, all but one plan were missing one or more key required elements. For example, of the plans we reviewed, 7 did not include estimated costs for implementing the new cloud service, 5 did not include major milestones, 11 did not include performance goals, and 14 did not include plans to retire the associated legacy systems. According to agency officials, these elements were missing largely because the agencies did not have the information available at the time the plans were developed, despite OMBs requirement. GAO reported that identifying key elementscost estimates, milestones, performance goals, and legacy system retirement planswill be essential in determining whether agencies activities constitute a positive return on investment, and therefore whether the benefits of their activitiesimproved operational efficiencies and reduced costs associated with retiring legacy systems will be fully realized.
The selected agencies were the Departments of Agriculture, Health and Human Services, Homeland Security, State, and the Treasury; the General Services Administration; and the Small Business Administration. We selected these agencies using a combination of the size of the agencies IT budgets and their prior experience in using cloud services.
As of Jan. 2013, the Department of Agriculture and Small Business Administration provided evidence that they had completed the three required implementations.
One of the seven agencies, the Small Business Administration, changed one of its services and did not submit a plan to OMB for the new service.
GAO recommended in July 2012 that the Secretaries of Agriculture, Health and Human Services, Homeland Security, State, and the Treasury and the Administrators of the General Services Administration and the Small Business Administration direct their respective Chief Information Officers to take the following two actions:
These actions could help to ensure the success of agencies implementation of cloud-based solutions. Determining precise costs and potential cost savings in this area is challenging because the costs of cloud-based solutionsand thus agencies expendituresvary based on consumption, and because the migrated cloud-based services may offer additional functionality not provided by the legacy system. Further, because agencies do not capture costs in a uniform manner, GAO was unable to quantify the cost savings associated with the migration. Nevertheless, agencies reported saving millions of dollars from implementing cloud-based solutions.
On the basis of the level of investments that agencies are making and OMBs Cloud First policy, agencies have opportunities to achieve significant cost savings if they implement the actions outlined earlier. As agencies implement these and other cloud-based solutions, identifying key informationcost estimates, milestones, performance goals, and legacy system retirement planswill also be essential in determining whether their activities will result in improved operational efficiencies and cost savings, and therefore whether the benefits of their activities will be fully realized.
The information contained in this analysis is based on our July 2012 report in the related GAO products section. GAO selected seven agencies using a combination of the size of the agencies IT budgets and their prior experience in using cloud services. GAO analyzed documentation from the selected agencies, including 20 plans across seven agencies and progress reports submitted to OMB that described the actions agencies had taken to migrate selected services to a cloud solution, and interviewed officials responsible for implementing the cloud solutions to determine how the services were selected and migrated. GAO also compared agencies documentation with OMBs associated guidance to determine any variances.
In commenting on the July 2012 report on which this analysis was based, the Departments of Agriculture, Homeland Security, and the Treasury, and the General Services Administration, agreed with the recommendations; the Department of State (State) agreed with the second recommendation and disagreed with the first recommendation; and the Department of Health and Human Services and the Small Business Administration did not agree or disagree with the recommendations. In particular, the Department of State disagreed because the services in question did not have associated legacy systems to be retired. However, GAO noted that State had not established performance goals for its electronic library service, as called for in the recommendation; thus the recommendation remained applicable and relevant to the department. OMB and the National Institute of Standards and Technology provided technical comments, which were incorporated as appropriate.
GAO provided a draft of this report section to the Departments of Agriculture, Health and Human Services, Homeland Security, State, and the Treasury, as well as the General Services Administration, the Small Business Administration, and the Office of Management and Budget for review and comment. The Department of Health and Human Services acknowledged its support for and the importance of establishing estimated costs and performance goals, and developing milestones, but noted that GAOs recommendation to develop plans for retiring legacy systems requires clarification. In particular, the department stated that retirement plans may not be necessary for all cloud implementations because legacy systems may not be retired, either because the cloud deployment is new development, the deployment augments, but does not replace, existing capacity, or the deployment replaces one service of a multi-tier application, resulting in the partial retirement of a legacy system. GAO acknowledges in its recommendation that a retirement plan may not be applicable for all cloud deployments, recognizing that some cloud implementations may be new or enhanced functionality.
The department further stated that GAOs recommendations would benefit from some recognition that the depth of documentation and evaluation should bear some relationship to the cost or size of the cloud deployment, so that small innovative projects are not inhibited by requirements more suitable to large expensive ones. GAO does not disagree that the documentation and evaluation may be relative to the cost and size of the deployment. Nevertheless, GAO continues to believe that developing cost estimates, milestones, and performance goals for cloud deployments, as well as developing plans for retiring legacy systems, as appropriate, are important planning elements of each cloud implementation because such information enables agencies to determine whether cloud deployments are cost effective and ensures that savings generated from retiring legacy systems are realized.
The Office of Management and Budget stated that it continues to emphasize its Cloud First policy with agencies as one of the primary ways that the cost of delivering IT services can be reduced in the future. The Department of Homeland Security provided a technical comment, which GAO incorporated. The Departments of Agriculture, State, and the Treasury, as well as the General Services Administration and the Small Business Administration did not provide any comments on this report section.
For additional information about this area, contact David A. Powner at (202) 512-9286, or firstname.lastname@example.org.
The selected federal agencies have made progress implementing the Office of Management and Budgets (OMB) Cloud First policy. Consistent with this policy, each of the seven agencies incorporated cloud computing requirements into their policies and processes. For example, one agency had incorporated a review of its information technology (IT) investment portfolio to identify candid...
The Office of Management and Budget (OMB) and key federal agencies have made progress on action items in the Information Technology (IT) Reform Plan, but there are several areas where more remains to be done. Of the 10 key action items GAO reviewed, 3 were completed and 7 were partially completed by December 2011, in part because the initiatives are complex. OMB reported greater progress than GAO...
Cloud computing, an emerging form of computing where users have access to scalable, on-demand capabilities that are provided through Internet-based technologies, has the potential to provide information technology services more quickly and at a lower cost, but also to introduce information security risks. Accordingly, GAO was asked to testify on the security implications of cloud computing. This t...
Cloud computing, an emerging form of computing where users have access to scalable, on-demand capabilities that are provided through Internet-based technologies, reportedly has the potential to provide information technology services more quickly and at a lower cost, but also to introduce information security risks. Accordingly, GAO was asked to testify on the benefits and risks of moving federal...
Cloud computing, an emerging form of computing where users have access to scalable, on-demand capabilities that are provided through Internet-based technologies, has the potential to provide information technology services more quickly and at a lower cost, but also to introduce information security risks. Accordingly, GAO was asked to (1) identify the models of cloud computing, (2) identify the in...