Cloud Computing: DOD Needs to Improve Workforce Planning and Software Application Modernization

Fast Facts

Cloud computing allows on-demand access to shared pools of computing resources (e.g., servers). Federal agencies can use cloud computing to access IT resources faster and for less money than it would take to own and maintain them.

The Office of Management and Budget requires federal agencies, when feasible, to adopt cloud computing and has established 14 key requirements to help them do so.

We found that DOD has addressed 11 of these requirements. But, it hasn't addressed some workforce planning issues—such as identifying the skills its staff will need for cloud-based services.

We recommended (among other things) that DOD address these issues.

IT professionals walking past servers

Highlights

What GAO Found

In 2019, the Office of Management and Budget (OMB) updated its Federal Cloud Computing Strategy and established 14 key requirements for agencies to implement within three areas—security, procurement, and workforce. Cloud computing enables on-demand access to shared computing resources . The Department of Defense (DOD) has addressed 11 of the 14 OMB requirements, but gaps exist in its workforce planning (see table). These gaps include identifying the future skills needed for cloud-based services and conducting regular evaluations of customer experiences and user needs. In addition, DOD has not yet developed and executed communication plans to inform employees of changes related to using these services. Addressing these workforce areas is essential to realizing the benefits of cloud computing.

Extent to Which DOD Guidance Has Addressed 14 OMB Key IT Cloud Requirements as of April 2022

Requirement area	Fully addressed	Partially addressed	Not addressed
Security	Four	—	—
Procurement	Five	—	—
Workforce	Two	Two	One

Legend: — = not applicable.

Source: GAO analysis of Department of Defense (DOD) documentation. | GAO-22-104070

In order to meet OMB's application rationalization requirement, DOD has partially implemented the first step noted in leading implementation practices. The department has established a scope for its rationalization efforts and is working to formalize a governance group with the authority to set requirements and issue guidance. However, DOD's lack of established timeframes for completing the remaining activities has impacted its efforts to make progress on subsequent leading practice steps. In addition, DOD has not developed a long-term plan for rationalization implementation with measurable objectives, milestones, and timelines. This is due to significant changes to its approach over the past 2 years; long time frames for implementing enterprise-wide initiatives; and a lack of definition by DOD regarding who is responsible for ensuring rationalization activities are successful. Without measureable objectives, milestones, and time frames for rationalization efforts—and holding department components accountable for these efforts—DOD will be less likely to make consistent measurable progress on rationalization or effectively reduce IT duplication.

In its fiscal year 2019 guidance, OMB began requiring agencies to use Technology Business Management (TBM)—a framework for increasing the granularity in agency-reported IT spending data by grouping related costs together—as part of the annual budget submission. DOD has reported its budget data using TBM cost categories. However, GAO identified weaknesses in the completeness of DOD components' cloud spending data. As a result, DOD's cloud spending is likely underreported. This was due in part to nonspecific department guidance on reporting these data and the control processes needed to ensure reliable data. In addition, the Army and Air Force did not follow leading TBM implementation practices. Until the Army and Air Force address TBM practices, and the DOD Chief Information Officer updates the department's guidance on reporting TBM data and ensuring its reliability, DOD will lack complete information needed to make decisions on its IT investments.

Why GAO Did This Study

In fiscal year 2022, DOD plans to spend approximately $38.6 billion on unclassified IT investments. To help drive cloud adoption, OMB requires agencies to modernize, retire, or consolidate their portfolios of software applications—a process known as application rationalization. OMB also requires agencies to use TBM to categorize IT and cloud-related spending.

GAO was asked to assess DOD's reported use of cloud services. This report examines the extent to which (1) DOD's planned cloud strategy addresses key requirements in OMB's federal cloud strategy, (2) the department has plans for developing and implementing an enterprise-wide application rationalization process, and (3) DOD is using TBM to track and report spending data for cloud services. To do so, GAO analyzed relevant DOD policies, guidance, and other documentation on cloud services and application rationalization. It also assessed the department's cloud investment data for fiscal years 2021 and 2022 and department-wide guidance and training on implementing TBM. GAO also interviewed DOD officials.

Recommendations

GAO is making nine recommendations to DOD related to addressing gaps in cloud workforce activities, improving application rationalization planning, and updating guidance on TBM implementation. DOD agreed with one recommendation, partially agreed with seven, and did not agree with one. As discussed in the report, GAO continues to believe its recommendations are appropriate.

Recommendations for Executive Action

Agency Affected Sort descending	Recommendation	Status
Department of Defense	The Secretary of Defense should direct the CIO and OUSD (A&S) to work with department components, to conduct skills gap analyses that maps current IT workforce resources to future skill and position requirements needed for an enterprise-wide cloud environment. (Recommendation 1)	Closed – Implemented The Department of Defense (DOD) concurred with, and has taken steps to address, our recommendation. Specifically, in September 2023, DOD provided us a copy of a skills gap analysis that was completed in June 2023 of the department's cyber security and cyber IT personnel, which also included skill and position requirements related to cloud services. By conducting a skills gap analysis to map current workforce resources to future skill and position requirements needed for an enterprise-wide cloud environment, the department will be in a better position to anticipate and respond to changing IT staffing needs and control human capital risks while developing, implementing, and operating its IT systems within the cloud environment.
Department of Defense	The Secretary of Defense should direct the CIO to ensure that the department's components and OUSD (A&S) conduct regular evaluations of customer experience and user needs to ensure that the solutions for the enterprise-wide cloud environment foster efficiency, accessibility, and privacy. (Recommendation 2)	Open The Department of Defense (DOD) partially concurred with our recommendation and stated that it would include responsibilities for ongoing evaluation of customer experience in future guidance by September 2024. We will continue to monitor DOD's progress in implementing this recommendation.
Department of Defense	The Secretary of Defense should direct the CIO and department components to develop and execute a communication plan that will help employees understand the planned changes that will occur for the implementation of the department's enterprise-wide cloud environment. (Recommendation 3)	Open The Department of Defense (DOD) partially concurred with our recommendation and stated that it would update existing guidance by October 2024 to address the requirements for communication planning to increase awareness of current and future capabilities available to authorized DOD users in the department's enterprise-wide cloud environment. We will continue to monitor DOD's progress in implementing this recommendation.
Department of Defense	The Secretary of Defense should direct the CIO to establish an enterprise-wide rationalization governance structure, identify and document all rationalization requirements in department policy, and determine the relevant information required on each application for rationalization and the means to collect it. (Recommendation 4)	Open The Department of Defense (DOD) partially concurred with our recommendation and stated that it would work to implement improvements to the current DOD IT portfolio management processes by October 2024 that will include governance, requirements, roles, and responsibilities, to enable enterprise-wide rationalization. We will continue to monitor DOD's progress in implementing this recommendation.
Department of Defense	The Secretary of Defense should direct the CIO to establish measurable objectives, milestones, and time frames for the development and implementation of the department's enterprise-wide application rationalization process. (Recommendation 5)	Open The Department of Defense (DOD) partially concurred with our recommendation and reported that it would provide additional guidance by October 2024 to include measurable objectives, milestones, and timeframes for implementation of the department's enterprise-wide application rationalizations priorities. We will continue to monitor DOD's progress in implementing this recommendation.
Department of Defense	The Secretary of Defense should direct the CIO to ensure that all department components are held accountable for meeting the objectives, milestones, and time frames included in for the department's enterprise-wide application rationalization process. (Recommendation 6)	Open The Department of Defense (DOD) partially concurred with our recommendation and reported that it would define responsibilities by October 2024 to ensure that application rationalization objectives, milestones, and timeframes are met. We will continue to monitor DOD's progress in implementing this recommendation.
Department of Defense	The Secretary of Defense should direct the CIO to update department-wide guidance to components regarding TBM implementation to include more specific information: how components should allocate spending for cloud services to specific cost pools and towers; identify what control process should be in place to ensure the TBM data is reliable; and provide clarification on the use of minimum reported spending of at least $1,000 for IT investments. (Recommendation 7)	Open The Department of Defense (DOD) did not concur with our recommendation and has not yet taken any actions to implement it. When we confirm what actions DOD has taken in response to this recommendation, we will provide updated information.
Department of the Air Force	The Secretary of the Air Force should direct the Air Force CIO to designate a unit within the component with responsibility for TBM implementation, provide additional guidance on TBM allocation of spending for cloud services to specific cost pools and towers, and to develop a process for assessing and improving the quality of TBM data. (Recommendation 8)	Open The Air Force partially concurred with our recommendation and reported that it has taken actions to upgrade ITIPS to provide IT investment data categorized in accordance with the TBM framework and planned to complete efforts by October 2026. We will continue to monitor the Air Force's progress in implementing this recommendation.
Department of the Army	The Secretary of the Army should direct the Army CIO to provide additional guidance on TBM allocation of spending for cloud services to specific cost pools and towers, and to develop a process for assessing and improving the quality of TBM data. (Recommendation 9)	Open The Army concurred with our recommendation and stated that it was developing the TBM-PSC-PWS Memo and Matrix providing the Army community with additional guidance and a cheat sheet to assist resource and acquisition personnel with the proper alignment of TBM to IT acquisitions. We will continue to monitor Army's progress in implementing this recommendation.