Cloud Implementation in the Agencies: Challenges and Opportunities Ahead (Part 2)

In a post yesterday, I shared the first three themes that emerged from the discussion. Today's post addresses the next three themes: Budgeting and buying cloud services Building security in the cloud Developing skilled personnel Budgeting and buying cloud services. Government is still in the early stages of understanding how to budget for the cloud, and purchase cloud services under existing procurement rules and norms. Concerns continue about how implementation under the FAR drives current government contracting and billing models that do not match commercial cloud provisioning and budget/spend models, which are often done through flexible and scalable funding arrangements that do not reflect current spending paths that call for advanced expectation of funds into accounts based on a fiscal year calendar. Similarly, the difference in how fixed and variable costs are best optimized does not match conventional cost estimation and pricing models Strategies to address this concern include: Greater granularity in cost identification and billing to help drive budget estimating; government would benefit from how businesses have approached Greater use of franchise fund flexibility, allowing for multi-year funding. Communication to program offices that a new cloud acquisition paradigm will be more cost effective - education users and mission leaders about cost drivers, and promoting transparency on how flexible spending models can address there dirvers more effectively in a cloud environment. Building security in the cloud. Cloud systems provide robust security, if well implemented. The government has benefited in recent years through advancing programs that include the Trusted Internet Connections (TIC) and DHS Einstein programs for network visibility; DHS and the Department of the Interior are co-chairs on a TIC working group looking at cloud implementation. In addition, Managed Trusted Internet Protocol Service (MTIPS) may have a growing impact to security in the Cloud. The ability to obtain TIC protection without having to come back to an organization's TIC infrastructure may make migrating to the Cloud much more feasible and practical, especially for for many small and midsized organizations. Finally, the use of FedRAMP for cloud systems security certification could be expanded to promote security "up the stack" for software (SaaS) applications, enabling agencies to leverage a broader array of approved cloud services without needing to repeat costly certification and accreditation in advance. An important facilitator to allow agencies flexibility to implement strong security in the cloud would be reducing variability in how oversight entities, including GAO and IGs, assess cloud security across agencies. One strategy for accomplishing this could be to have IGs consult with third party experts as they conduct reviews, and treat their opinions not as compliance exercises but rather as input into business decisions - similar to how auditor opinions are used in financial services sector security reviews. This would require some changes to the guidance for how IGs operate under OMB guidance that implements the Federal Information Security Management Act (FISMA), which was just updated in December to adopt CDM and other approaches as expectations for agencies. Finally, as with any IT environment, understanding of risk management in the cloud context is critical. Just as with commercial organizations, agencies can never get to 100% security if they are operating over any network that can be accessed from outside a firewall. An important element of demonstrating strong security in the cloud -- recognizing that this does not mean perfect security, but rather risk-based approach that provides for resiliency in the fact of inevitable vulnerabilities, threats, and incidents - is the continued evolution of metrics that are understood an advance and made transparent in review. In this way, users, oversight bodies, and program leaders and stakeholders will know in advance how security is being addressed within the cloud, and be able to assess performance against those well-understood metrics. Developing skilled personnel. Any implementation of cloud will rely on agency leaders and managers who understand how to manage effectively in the cloud, and technical experts who can work with industry to bring cloud innovation into agencies for strong performance and strong security. Hiring flexibilities should be leveraged to build cloud experts in agencies; OPM and GSA are working to help agencies attract such talent. In addition, strategies to retain key staff must be addressed given competition with industry for skilled cloud leaders; similarly, CIO and agency cloud leaders can recognize the importance of succession planning, given the risk of a loss in institutional knowledge as Federal leaders retire or move to another job. Closing Perspectives The Center is grateful to the CIOs and IT leaders who joined the Cloud Roundtable. As demonstrated through the discussion above, agencies want to leverage the benefits that the cloud offers while mitigating its risks, and be open about challenges as well as opportunities to overcome them. We look forward to continued dialogue on how best to help government innovate for success and improved per Image courtesy of tungphoto at FreeDigitalPhotos.net.