Cloud Computing:

Agencies Have Increased Usage and Realized Benefits, but Cost and Savings Data Need to Be Better Tracked

GAO-19-58: Published: Apr 4, 2019. Publicly Released: May 6, 2019.

Additional Materials:

Contact:

Carol Harris
(202) 512-4456
harriscc@gao.gov

 

Office of Public Affairs
(202) 512-4800
youngc1@gao.gov

Each year, federal agencies spend $90 billion on IT. Cloud computing services—on-demand access to shared resources such as networks, servers, and data storage—can help agencies deliver better IT services for less money.

For example, the Department of Homeland Security migrated its network for information sharing and collaboration to the cloud, ensuring it remains continuously available for law enforcement and emergency response.

However, agencies don't consistently track cloud-related savings, making it hard for them to make informed decisions on whether to use cloud services. We recommended that agencies improve their savings tracking.

The Homeland Security Information Network is one example of a federal system using cloud services.

Photo of a man working on a laptop that displays information from the Department of Homeland Security's network for information sharing and collaboration.

Photo of a man working on a laptop that displays information from the Department of Homeland Security's network for information sharing and collaboration.

Additional Materials:

Contact:

Carol Harris
(202) 512-4456
harriscc@gao.gov

 

Office of Public Affairs
(202) 512-4800
youngc1@gao.gov

What GAO Found

The 16 agencies GAO reviewed made progress in implementing cloud computing services (cloud services)—namely, they established assessment guidance, performed assessments, and implemented these services—but the extent of their progress varied. To encourage cloud service acquisition, the Office of Management and Budget (OMB) began requiring agencies to assess all information technology (IT) investments for cloud services. However, only 10 of the 16 agencies reviewed had established assessment guidance. In addition, while the agencies assessed the majority of their planned fiscal year 2019 IT investments for cloud services, 12 agencies had not completed an assessment of 10 or more investments. Nevertheless, 10 of the agencies reported increasing their use of cloud services between fiscal years 2016 through 2019 (see figure). Six agencies noted that inconsistent reporting of cloud investments and investment consolidation impacted their reported percentage.

Agency Information Technology (IT) Investments That Used Cloud Services, as Reported on the IT Dashboard for Fiscal Years 2016-2019 (projected)

Agency Information Technology (IT) Investments That Used Cloud Services, as Reported on the IT Dashboard for Fiscal Years 2016-2019 (projected)

Further, the 16 agencies reported that they had increased their cloud service spending since 2015 and 13 of the 16 agencies had saved $291 million to date from these services. However, these agencies identified issues in tracking and reporting cloud spending and savings data, including not having consistent processes in place to do so. Agencies also noted that OMB guidance did not require them to explicitly report savings from cloud implementations and, therefore, they had to specifically collect this data to meet GAO's request. As a result of these identified issues, it is likely that agency-reported cloud spending and savings figures were underreported.

Officials from 15 of the 16 agencies reported that they had identified significant benefits from acquiring cloud services, including improved customer service and the acquisition of more cost-effective options for managing IT services. In addition, these agencies identified nine cloud investments that, among other things, enhanced the availability of weather-related information, facilitated collaboration and information sharing among federal, state, and local agencies related to homeland security, and provided benefits information to veterans, as examples of systems that realized these benefits. One agency reported that it had not realized benefits because it did not have any completed migration efforts.

Why GAO Did This Study

Cloud computing enables on-demand access to shared computing resources providing services more quickly and at a lower cost than having agencies maintain these resources themselves. In 2012, OMB began requiring agencies to assess all IT investments for cloud services.

GAO was asked to review agencies' reported use of cloud services. This report discusses selected agencies' progress in implementing cloud services, the extent to which those agencies increased cloud service spending and achieved savings or cost avoidances, and examples of agency-reported cloud investments with notable benefits. GAO selected 16 agencies to review based on their fiscal year 2017 IT budgets and analyzed their use of cloud services, associated spending and savings data, and guidance for assessing investments for these services. GAO interviewed agency officials in charge of cloud services and reviewed pertinent documents to identify acquisitions with notable benefits. GAO also interviewed OMB staff about their agency's role in federal cloud computing and related OMB guidance.

What GAO Recommends

GAO is making one recommendation to OMB on cloud savings reporting, and 34 recommendations to the 16 agencies on cloud assessments and savings. Fourteen agencies agreed with all recommendations, OMB and one agency neither agreed nor disagreed, and one (Defense) agreed with one recommendation but not the other. GAO continues to believe its recommendation to the department is appropriate.

For more information, contact Carol Harris at (202) 512-4456 or harriscc@gao.gov.

Recommendations for Executive Action

  1. Status: Open

    Comments: The Office of Management and Budget (OMB) has not yet taken any actions to implement our recommendation. We will continue to monitor OMB's progress in implementing this recommendation.

    Recommendation: The Director of the Office of Management and Budget should require agencies to explicitly report, at least on a quarterly basis, the savings and cost avoidance associated with cloud computing investments. (Recommendation 1)

    Agency Affected: Executive Office of the President: Office of Management and Budget

  2. Status: Open

    Comments: In comments on our report, the Department of Agriculture (Agriculture) concurred with our recommendation but has not yet taken any actions to implement our recommendation. We will continue to monitor Agriculture's progress in implementing this recommendation.

    Recommendation: The Secretary of Agriculture should ensure that the chief information officer (CIO) of Agriculture completes an assessment of all IT investments for suitability for migration to a cloud computing service, in accordance with OMB guidance. (Recommendation 2)

    Agency Affected: Department of Agriculture

  3. Status: Open

    Comments: In comments on our report, the Department of Agriculture (Agriculture) concurred with our recommendation but has not yet taken any actions to implement our recommendation. We will continue to monitor Agriculture's progress in implementing this recommendation.

    Recommendation: The Secretary of Agriculture should ensure that the CIO of Agriculture establishes a consistent and repeatable mechanism to track savings and cost avoidances from the migration and deployment of cloud services. (Recommendation 3)

    Agency Affected: Department of Agriculture

  4. Status: Open

    Comments: In comments on our report, the Department of Commerce (Commerce) concurred with our recommendation and stated that the department will develop and implement a consistent and repeatable process for all cloud computing investments in accordance with the recommendation. We will follow up with Commerce to ascertain whether a consistent and repeatable mechanism to track savings and cost avoidances from the migration and deployment of cloud services has been established during fiscal year 2019.

    Recommendation: The Secretary of Commerce should ensure that the CIO of Commerce establishes a consistent and repeatable mechanism to track savings and cost avoidances from the migration and deployment of cloud services. (Recommendation 4)

    Agency Affected: Department of Commerce

  5. Status: Open

    Comments: In comments on our report, the Department of Defense (Defense) concurred with our recommendation and stated that the department planned to complete an assessment of its Fourth Estate IT investments. In addition, the department stated that it would publish guidance requiring all components within Defense to align their applications with the department's cloud strategy. We will follow up with Defense to ascertain whether an assessment of all IT investments for suitability for migration to a cloud computing service has been completed in fiscal year 2019.

    Recommendation: The Secretary of Defense should ensure that the CIO of Defense completes an assessment of all IT investments for suitability for migration to a cloud computing service, in accordance with OMB guidance. (Recommendation 5)

    Agency Affected: Department of Defense

  6. Status: Open

    Comments: The Department of Defense (Defense) has not yet taken any actions to implement our recommendation. We will continue to monitor Defense's progress in implementing this recommendation.

    Recommendation: The Secretary of Defense should ensure that the CIO of Defense establishes a consistent and repeatable mechanism to track savings and cost avoidances from the migration and deployment of cloud services. (Recommendation 6)

    Agency Affected: Department of Defense

  7. Status: Open

    Comments: In comments on our report, the Department of Education (Education) concurred with our recommendation and stated that the department is currently developing guidance on assessing new and existing IT investments for suitability for migration to a cloud computing service, in accordance with OMB guidance. We will follow up with Education to ascertain whether guidance on assessing new and existing IT investments for suitability for cloud services has been established during fiscal year 2019.

    Recommendation: The Secretary of Education should ensure that the CIO of Education establishes guidance on assessing new and existing IT investments for suitability for cloud computing services, in accordance with OMB guidance. (Recommendation 7)

    Agency Affected: Department of Education

  8. Status: Open

    Comments: In comments on our report, the Department of Education (Education) concurred with our recommendation and stated that the department will develop guidance and ensure that the CIO of Education completes an assessment of all IT investments for suitability for migration to a cloud computing service. We will follow up with Education to ascertain whether an assessment of all IT investments for suitability for migration to a cloud computing service has been completed in fiscal year 2019.

    Recommendation: The Secretary of Education should ensure that the CIO of Education completes an assessment of all IT investments for suitability for migration to a cloud computing service, in accordance with OMB guidance. (Recommendation 8)

    Agency Affected: Department of Education

  9. Status: Open

    Comments: n comments on our report, the Department of Education (Education) concurred with our recommendation and stated that the department is currently developing guidance that will establish a consistent and repeatable mechanism to track savings and cost avoidances from the migration and deployment of cloud services. We will follow up with Education to ascertain whether a consistent and repeatable mechanism to track savings and cost avoidances from the migration and deployment of cloud services has been established during fiscal year 2019.

    Recommendation: The Secretary of Education should ensure that the CIO of Education establishes a consistent and repeatable mechanism to track savings and cost avoidances from the migration and deployment of cloud services. (Recommendation 9)

    Agency Affected: Department of Education

  10. Status: Open

    Comments: In comments on our report, the Department of Energy (Energy) concurred with our recommendation and stated that the department will update Energy's IT budget guidance to address assessing IT investments for suitability for cloud computing services. We will follow up with Energy to ascertain whether guidance on assessing new IT investments for suitability for cloud services has been established during fiscal year 2019.

    Recommendation: The Secretary of Energy should ensure that the CIO of Energy updates the agency's guidance on assessing IT investments for suitability for cloud computing services to include a requirement to assess new acquisitions for these services. (Recommendation 10)

    Agency Affected: Department of Energy

  11. Status: Open

    Comments: In comments on our report, the Department of Energy (Energy) concurred with our recommendation and stated that the department will update Energy's IT budget guidance to address assessing IT investments for suitability for cloud computing services. We will follow up with Energy to ascertain whether an assessment of all IT investments for suitability for migration to a cloud computing service has been completed in fiscal year 2019.

    Recommendation: The Secretary of Energy should ensure that the CIO of Energy completes an assessment of all IT investments for suitability for migration to a cloud computing service, in accordance with OMB guidance. (Recommendation 11)

    Agency Affected: Department of Energy

  12. Status: Open

    Comments: In comments on our report, the Department of Energy (Energy) concurred with our recommendation and stated that the CIO has established a consistent and repeatable mechanism to track savings and cost avoidances that will be refined to improve the tracking of savings and cost avoidances from the migration and deployment of cloud services. We will follow up with Energy to ascertain whether a consistent and repeatable mechanism to track savings and cost avoidances from the migration and deployment of cloud services has been established during fiscal year 2019.

    Recommendation: The Secretary of Energy should ensure that the CIO of Energy establishes a consistent and repeatable mechanism to track savings and cost avoidances from the migration and deployment of cloud services. (Recommendation 12)

    Agency Affected: Department of Energy

  13. Status: Open

    Comments: In comments on our report, the Department of Health and Human Services (HHS) concurred with our recommendation and stated that the Office of the CIO will revise its cloud computing strategy to reflect current OMB guidance and the current technology environment by September 30, 2019. We will follow up with HHS to ascertain whether guidance on assessing new and existing IT investments for suitability for cloud services has been established in fiscal year 2019.

    Recommendation: The Secretary of the Department of Health and Human Services (HHS) should ensure that the CIO of HHS establishes guidance on assessing new and existing IT investments for suitability for cloud computing services, in accordance with OMB guidance. (Recommendation 13)

    Agency Affected: Department of Health and Human Services

  14. Status: Open

    Comments: In comments on our report, the Department of Health and Human Services (HHS) concurred with our recommendation and stated that the CIO will ensure all IT investments complete a review of suitability for migration to cloud computing services as part of the annual Operating Division IT portfolio reviews for fiscal year 2021. We will continue to monitor HHS's progress in implementing this recommendation.

    Recommendation: The Secretary of Health and Human Services should ensure that the CIO of HHS completes an assessment of all IT investments for suitability for migration to a cloud computing service, in accordance with OMB guidance. (Recommendation 14)

    Agency Affected: Department of Health and Human Services

  15. Status: Open

    Comments: In comments on our report, the Department of Health and Human Services (HHS) concurred with our recommendation and stated that the CIO will ensure that all IT investments with cloud components are tracking any attributable costs savings or avoidance as part of the annual Operating Division IT portfolio reviews. We will follow up with HHS to ascertain whether a consistent and repeatable mechanism to track savings and cost avoidances from the migration and deployment of cloud services has been established during fiscal year 2019.

    Recommendation: The Secretary of Health and Human Services should ensure that the CIO of HHS establishes a consistent and repeatable mechanism to track savings and cost avoidances from the migration and deployment of cloud services. (Recommendation 15)

    Agency Affected: Department of Health and Human Services

  16. Status: Open

    Comments: In comments on our report, the Department of Homeland Security (DHS) concurred with our recommendation and stated that the Office of the CIO is working to complete an analysis of department-hosted systems and produce a baseline report which will include suitability for migration to a cloud service provider by July 31, 2019. We will follow up with DHS to ascertain whether an assessment of all IT investments for suitability for migration to a cloud computing service has been completed in fiscal year 2019.

    Recommendation: The Secretary of Homeland Security should ensure that the CIO of the Department of Homeland Security (DHS) completes an assessment of all IT investments for suitability for migration to a cloud computing service, in accordance with OMB guidance. (Recommendation 16)

    Agency Affected: Department of Homeland Security

  17. Status: Open

    Comments: In comments on our report, the Department of Homeland Security (DHS) concurred with our recommendation and stated that the department will evaluate its current formula and processes for collecting and assessing actual cloud spending by the end of fiscal year 2019 in order to support decisions for the calculation and reporting of cloud savings at the program or system level in fiscal year 2020. We will continue to monitor DHS's progress in implementing this recommendation.

    Recommendation: The Secretary of Homeland Security should ensure that the CIO of DHS establishes a consistent and repeatable mechanism to track savings and cost avoidances from the migration and deployment of cloud services. (Recommendation 17)

    Agency Affected: Department of Homeland Security

  18. Status: Open

    Comments: In comments on our report, the Department of Justice (Justice) concurred with our recommendation but has not yet taken any actions to implement our recommendation. We will continue to monitor Justice's progress in implementing this recommendation.

    Recommendation: The Attorney General of the United States should ensure that the CIO of Justice completes an assessment of all IT investments for suitability for migration to a cloud computing service, in accordance with OMB guidance. (Recommendation 18)

    Agency Affected: Department of Justice

  19. Status: Open

    Comments: In comments on our report, the Department of Justice (Justice) concurred with our recommendation but has not yet taken any actions to implement our recommendation. We will continue to monitor Justice's progress in implementing this recommendation.

    Recommendation: The Attorney General of the United States should ensure that the CIO of Justice establishes a consistent and repeatable mechanism to track savings and cost avoidances from the migration and deployment of cloud services. (Recommendation 19)

    Agency Affected: Department of Justice

  20. Status: Open

    Comments: In comments on our report, the Department of Labor (Labor) concurred with our recommendation and stated that the department had taken steps to integrate a process for assessing investments for cloud computing suitability into its budgeting process. We will follow up with Labor to ascertain whether the department has updated its guidance on assessing IT investments for suitability for cloud computing services to include a requirement to assess existing investments for these services in fiscal year 2019.

    Recommendation: The Secretary of Labor should ensure that the CIO of Labor updates the agency's guidance on assessing IT investments for suitability for cloud computing services to include a requirement to assess existing investments for these services. (Recommendation 20)

    Agency Affected: Department of Labor

  21. Status: Open

    Comments: In comments on our report, the Department of Labor (Labor) concurred with our recommendation and stated that the department planned to undertake a full review of data center-based applications for cloud suitability. We will follow up with Labor to ascertain whether an assessment of all IT investments for suitability for migration to a cloud computing service has been completed in fiscal year 2019.

    Recommendation: The Secretary of Labor should ensure that the CIO of Labor completes an assessment of all IT investments for suitability for migration to a cloud computing service, in accordance with OMB guidance. (Recommendation 21)

    Agency Affected: Department of Labor

  22. Status: Open

    Comments: In comments on our report, the Department of Labor (Labor) concurred with our recommendation and stated that the department has developed a baseline to determine the cost of on premise systems. Labor will use this baseline to assess cost savings for systems and services that have been transitioned to the cloud. We will follow up with Labor to ascertain whether a consistent and repeatable mechanism to track savings and cost avoidances from the migration and deployment of cloud services has been established in fiscal year 2019.

    Recommendation: The Secretary of Labor should ensure that the CIO of Labor establishes a consistent and repeatable mechanism to track savings and cost avoidances from the migration and deployment of cloud services. (Recommendation 22)

    Agency Affected: Department of Labor

  23. Status: Open

    Comments: In comments on our report, the Department of State (State) concurred with our recommendation and stated that the department will develop a tracking system and plans to have a prototype system ready for testing by the beginning of fiscal year 2020. We will continue to monitor State's progress in implementing this recommendation.

    Recommendation: The Secretary of State should ensure that the CIO of State establishes a consistent and repeatable mechanism to track savings and cost avoidances from the migration and deployment of cloud services. (Recommendation 23)

    Agency Affected: Department of State

  24. Status: Open

    Comments: The Department of the Treasury (Treasury) has not yet taken any actions to implement our recommendation. We will continue to monitor Treasury's progress in implementing this recommendation.

    Recommendation: The Secretary of the Treasury should ensure that the CIO of Treasury completes an assessment of all IT investments for suitability for migration to a cloud computing service, in accordance with OMB guidance. (Recommendation 24)

    Agency Affected: Department of the Treasury

  25. Status: Open

    Comments: The Department of the Treasury (Treasury) has not yet taken any actions to implement our recommendation. We will continue to monitor Treasury's progress in implementing this recommendation.

    Recommendation: The Secretary of the Treasury should ensure that the CIO of Treasury establishes a consistent and repeatable mechanism to track savings and cost avoidances from the migration and deployment of cloud services. (Recommendation 25)

    Agency Affected: Department of the Treasury

  26. Status: Open

    Comments: In comments on our report, the Department of Transportation (Transportation) concurred with our recommendation but has not yet taken any actions to implement our recommendation. We will continue to monitor Transportation's progress in implementing this recommendation.

    Recommendation: The Secretary of Transportation should ensure that the CIO of Transportation establishes guidance on assessing new and existing IT investments for suitability for cloud computing services. (Recommendation 26)

    Agency Affected: Department of Transportation

  27. Status: Open

    Comments: In comments on our report, the Department of Transportation (Transportation) concurred with our recommendation but has not yet taken any actions to implement our recommendation. We will continue to monitor Transportation's progress in implementing this recommendation.

    Recommendation: The Secretary of Transportation should ensure that the CIO of Transportation completes an assessment of all IT investments for suitability for migration to a cloud computing service, in accordance with OMB guidance. (Recommendation 27)

    Agency Affected: Department of Transportation

  28. Status: Open

    Comments: In comments on our report, the Department of Transportation (Transportation) concurred with our recommendation, but has not yet taken any actions to implement our recommendation. We will continue to monitor Transportation's progress in implementing this recommendation.

    Recommendation: The Secretary of Transportation should ensure that the CIO of Transportation establishes a consistent and repeatable mechanism to track savings and cost avoidances from the migration and deployment of cloud services. (Recommendation 28)

    Agency Affected: Department of Transportation

  29. Status: Open

    Comments: In comments on our report, the Department of Veterans Affairs (VA) concurred with our recommendation and stated that it has begun an assessment process and expects to complete this effort by June 30, 2024. We will continue to monitor VA's progress in implementing this recommendation.

    Recommendation: The Secretary of Veterans Affairs should ensure that the CIO of the Department of Veterans Affairs (VA) completes an assessment of all IT investments for suitability for migration to a cloud computing service, in accordance with OMB guidance. (Recommendation 29)

    Agency Affected: Department of Veterans Affairs

  30. Status: Open

    Comments: In comments on our report, the Department of Veterans Affairs (VA) concurred with our recommendation and stated that it has begun populating a financial management application with data to track overall IT spending and cost savings. We will follow up with VA to ascertain whether a consistent and repeatable mechanism to track savings and cost avoidances from the migration and deployment of cloud services has been established in fiscal year 2019.

    Recommendation: The Secretary of Veterans Affairs should ensure that the CIO of VA establishes a consistent and repeatable mechanism to track savings and cost avoidances from the migration and deployment of cloud services. (Recommendation 30)

    Agency Affected: Department of Veterans Affairs

  31. Status: Open

    Comments: In comments on our report, the General Services Administration (GSA) concurred with our recommendation but has not yet taken any actions to implement our recommendation. We will continue to monitor GSA's progress in implementing this recommendation.

    Recommendation: The Administrator of General Services should ensure that the CIO of the General Services Administration establishes a consistent and repeatable mechanism to track savings and cost avoidances from the migration and deployment of cloud services. (Recommendation 31)

    Agency Affected: General Services Administration

  32. Status: Open

    Comments: In comments on our report, the Small Business Administration (SBA) concurred with our recommendation and reported that the Office of the CIO and appropriate program offices will establish a consistent and repeatable process to track savings and cost avoidances from the migration and deployment of cloud services by September 30, 2019. We will follow up with SBA to ascertain whether a consistent and repeatable mechanism to track savings and cost avoidances from the migration and deployment of cloud services has been established in fiscal year 2019.

    Recommendation: The Administrator of the Small Business Administration should ensure that the CIO of the Small Business Administration establishes a consistent and repeatable mechanism to track savings and cost avoidances from the migration and deployment of cloud services. (Recommendation 32)

    Agency Affected: Small Business Administration

  33. Status: Open

    Comments: In comments on our report, the Social Security Administration (SSA) concurred with our recommendation but has not yet taken any actions to implement our recommendation. We will continue to monitor SSA's progress in implementing this recommendation.

    Recommendation: The Commissioner of the Social Security Administration should ensure that the CIO of the Social Security Administration (SSA) updates the agency's guidance on assessing IT investments for suitability for cloud computing services to include a requirement to assess existing investments for these services. (Recommendation 33)

    Agency Affected: Social Security Administration

  34. Status: Open

    Comments: In comments on our report, the Social Security Administration (SSA) concurred with our recommendation but has not yet taken any actions to implement our recommendation. We will continue to monitor SSA's progress in implementing this recommendation.

    Recommendation: The Commissioner of the Social Security Administration should ensure that the CIO of SSA completes an assessment of all IT investments for suitability for migration to a cloud computing service, in accordance with OMB guidance. (Recommendation 34)

    Agency Affected: Social Security Administration

  35. Status: Open

    Comments: In comments on our report, the Social Security Administration (SSA) concurred with our recommendation but has not yet taken any actions to implement our recommendation. We will continue to monitor SSA's progress in implementing this recommendation.

    Recommendation: The Commissioner of the Social Security Administration should ensure that the CIO of SSA establishes a consistent and repeatable mechanism to track savings and cost avoidances from the migration and deployment of cloud services. (Recommendation 35)

    Agency Affected: Social Security Administration

 

Explore the full database of GAO's Open Recommendations »

Jun 26, 2019

Jun 11, 2019

Apr 29, 2019

Apr 11, 2019

Apr 9, 2019

Dec 13, 2018

Dec 12, 2018

Dec 11, 2018

Nov 13, 2018

Sep 27, 2018

Looking for more? Browse all our products here