CLOUD COMPUTING

Agencies Have 

Increased Usage and 

Realized Benefits, but 

Cost and Savings 

Data Need to Be 

Better Tracked

Report to Congressional Requesters

April 2019

GAO-19-58

United States Government Accountability Office
United States Government Accountability Office

April 2019 

CLOUD COMPUTING

Agencies Have Increased Usage and Realized 

Benefits, but Cost and Savings Data Need to Be 

Better Tracked 

What GAO Found

The 16 agencies GAO reviewed made progress in implementing cloud 

computing services (cloud services)—namely, they established assessment 

guidance, performed assessments, and implemented these services—but the 

extent of their progress varied. To encourage cloud service acquisition, the 

Office of Management and Budget (OMB) began requiring agencies to assess all 

information technology (IT) investments for cloud services. However, only 10 of 

the 16 agencies reviewed had established assessment guidance. In addition, 

while the agencies assessed the majority of their planned fiscal year 2019 IT 

investments for cloud services, 12 agencies had not completed an assessment 

of 10 or more investments. Nevertheless, 10 of the agencies reported increasing 

their use of cloud services between fiscal years 2016 through 2019 (see figure). 

Six agencies noted that inconsistent reporting of cloud investments and 

investment consolidation impacted their reported percentage.

Agency Information Technology (IT) Investments That Used Cloud Services, as Reported on 

the IT Dashboard for Fiscal Years 2016-2019 (projected) 

Further, the 16 agencies reported that they had increased their cloud service 

spending since 2015 and 13 of the 16 agencies had saved $291 million to date 

from these services. However, these agencies identified issues in tracking and 

reporting cloud spending and savings data, including not having consistent 

processes in place to do so. Agencies also noted that OMB guidance did not 

require them to explicitly report savings from cloud implementations and, 

therefore, they had to specifically collect this data to meet GAO’s request. As a 

result of these identified issues, it is likely that agency-reported cloud spending 

and savings figures were underreported. 

Officials from 15 of the 16 agencies reported that they had identified significant 

benefits from acquiring cloud services, including improved customer service and 

the acquisition of more cost-effective options for managing IT services. In 

addition, these agencies identified nine cloud investments that, among other 

things, enhanced the availability of weather-related information, facilitated 

collaboration and information sharing among federal, state, and local agencies 

related to homeland security, and provided benefits information to veterans, as 

examples of systems that realized these benefits. One agency reported that it 

had not realized benefits because it did not have any completed migration efforts.

Highlights of GAO-19-58, a report to 

congressional requesters 

Why GAO Did This Study

Cloud computing enables on-demand 

access to shared computing resources

providing services more quickly and at

a lower cost than having agencies

maintain these resources themselves.

In 2012, OMB began requiring

agencies to assess all IT investments

for cloud services. 

GAO was asked to review agencies’

reported use of cloud services. This

report discusses selected agencies’

progress in implementing cloud 

services, the extent to which those 

agencies increased cloud service 

spending and achieved savings or cost

avoidances, and examples of agencyreported cloud investments with 

notable benefits. GAO selected 16 

agencies to review based on their

fiscal year 2017 IT budgets and 

analyzed their use of cloud services, 

associated spending and savings data,

and guidance for assessing 

investments for these services. GAO

interviewed agency officials in charge 

of cloud services and reviewed 

pertinent documents to identify

acquisitions with notable benefits. GAO

also interviewed OMB staff about their

agency’s role in federal cloud 

computing and related OMB guidance.

What GAO Recommends

GAO is making one recommendation 

to OMB on cloud savings reporting,

and 34 recommendations to the 16 

agencies on cloud assessments and 

savings. Fourteen agencies agreed 

with all recommendations, OMB and 

one agency neither agreed nor

disagreed, and one (Defense) agreed 

with one recommendation but not the 

other. GAO continues to believe its

recommendation to the department is

appropriate.

View GAO-19-58. For more information, 

contact Carol Harris at (202) 512-4456 or 

harriscc@gao.gov. 
Page i GAO-19-58 IT Cloud Computing

Letter 1

Background 5

Most of the Selected Agencies Reported Making Progress in 

Implementing Cloud Services 14

Agencies Have Increased Spending and Realized Savings from 

Using Cloud Services, but Spending and Savings Figures Are 

Underreported 23

Selected Agencies Have Realized Benefits from Cloud Services 36

Conclusions 47

Recommendations for Executive Action 48

Agency Comments and Our Evaluation 52

Appendix I Objectives, Scope, and Methodology 57

Appendix II Status of Cloud-related Recommendations in the 2017 American

Technology Council Report 64

Appendix III Selected Agency Cloud Investments for Fiscal Years 2016 

through 2019 66

Appendix IV Selected Agency Cloud Spending for Fiscal Years 2015 

through 2018 67

Appendix V Description of Cloud Computing Investments Provided by Selected 

Agencies for Fiscal Year 2018 69

Appendix VI Profiles of Selected Cloud Computing Acquisitions 87

Appendix VII Comments from the Department of Commerce 110

Contents
Page ii GAO-19-58 IT Cloud Computing

Appendix VIII Comments from the Department of Education 112

Appendix IX Comments from the Department of Energy 114

Appendix X Comments from the Health and Human Services 116

Appendix XI Comments from the Department of Homeland Security 118

Appendix XII Comments from the Department of State 121

Appendix XIII Comments from the Department of Transportation 123

Appendix XIV Comments from the Department of Veterans Affairs 124

Appendix XV Comments from the General Services Administration 126

Appendix XVI Comments from the Department of Labor 127

Appendix XVII Comments from the Small Business Administration 129

Appendix XVIII Comments from the Social Security Administration 130

Appendix XIX Comments from the Department of Defense 132
Page iii GAO-19-58 IT Cloud Computing

Appendix XX GAO Contact and Staff Acknowledgments 134

Tables

Table 1: Status of Information Technology (IT) Investment 

Assessments for Cloud Computing Services, as Reported 

on the IT Dashboard by 16 Selected Agencies for Fiscal 

Year 2019 18

Table 2: Percentage of Information Technology (IT) Investments 

That Use Cloud Computing Services, as Reported on the 

IT Dashboard by 16 Selected Agencies, for Fiscal Years 

2016-2019 (projected) 20

Table 3: Percentage of Total Information Technology (IT) Cloud 

Spending, as Reported on the IT Dashboard by the 16 

Selected Agencies for Fiscal Years 2015-2018 25

Table 4: Information on Total Spending For Investments with $1 

Million or More in Life-Cycle Costs For Cloud Services, 

Provided by the 16 Selected Agencies for Fiscal Years 

2015 through 2018 and Beyond (in millions of dollars) 26

Table 5: Information on Total Savings and Cost Avoidances For 

Investments with $1 Million or More in Life-Cycle Costs 

For Cloud Services, Provided by the 16 Selected 

Agencies for Fiscal Years 2014 through 2018 and Beyond 

(in millions of dollars) 30

Table 6: Significant or Notable Benefits Reported by 15 Selected 

Federal Agencies from the Acquisition of Cloud 

Computing Services 37

Table 7: Investments That Benefited from Cloud Acquisition, as 

Reported by Selected Federal Agencies Since 2012 42

Table 8: Key Practices Reported by 15 Selected Federal Agencies 

for Helping to Ensure the Successful Implementation of 

Cloud Computing Services 43

Table 9: Status of Recommendations Related to Advancing Cloud 

Computing Within the Federal Government in the Report 

to the President on Information Technology (IT) 

Modernization, According to Office of Management and 

Budget (OMB), as of July 2018 64

Table 10: Cloud Computing Investments and Information 

Technology (IT) Investments, as Reported on the IT 

Dashboard by 16 Selected Agencies, for Fiscal Years 

2016-2019 (projected) 66
Page iv GAO-19-58 IT Cloud Computing

Table 11: Cloud and IT Spending, as Reported on the IT 

Dashboard by 16 Selected Agencies for Fiscal Years (FY) 

2015-2018 (in millions of dollars) 67

Table 12: Information on Investments Using Cloud Services and 

Associated Service and Deployment Model Provided by 

16 Selected Agencies for Fiscal Year 2018, as of October 

2018 69

Figures

Figure 1: Analysis of Selected Agencies’ Cloud Guidance for 

Assessing Information Technology Investments for Cloud 

Computing Services, as of August 2018 16

Figure 2: Information Technology (IT) Investments That Used 

Cloud Services, as Reported on the IT Dashboard by 16 

Selected Agencies for Fiscal Years 2016-2019 

(projected) 21

Figure 3: Treasury’s Cloud Acquisition Supports Enterprise 

Resource Planning 88

Figure 4: Transportation’s Cloud Acquisition Stores Public Transit 

Data 90

Figure 5: GSA’s Cloud Acquisition Enhances Federal Data 

Analytics 92

Figure 6: VA’s Cloud Acquisition Improves Veteran Benefits and 

Services 94

Figure 7: Justice’s Cloud Acquisition Hosts Data Center 97

Figure 8: DHS’s Cloud Acquisition Supports Information Sharing 

and Collaboration 99

Figure 9: Agriculture’s Cloud Acquisition Improves Enterprise 

Content and Electronic Records Management 102

Figure 10: Commerce’s Cloud Acquisition Enhances Access to 

Weather Data 104

Figure 11: Defense’s Cloud Acquisition Enhances Transportation 

Command Systems 107
Page v GAO-19-58 IT Cloud Computing

Abbreviations

Agriculture Department of Agriculture

CIO chief information officer 

Commerce Department of Commerce 

Defense Department of Defense 

DHS Department of Homeland Security 

Education Department of Education 

Energy Department of Energy

FedRAMP Federal Risk and Authorization Management 

 Program 

FITARA Federal Information Technology Acquisition Reform 

 Act 

GSA General Services Administration

HHS Department of Health and Human Services 

IT information technology 

Justice Department of Justice

Labor Department of Labor

NIST National Institute of Standards and Technology

OMB Office of Management and Budget

SBA Small Business Administration

SSA Social Security Administration 

State Department of State

Transportation Department of Transportation 

Treasury Department of the Treasury 

VA Department of Veterans Affairs

This is a work of the U.S. government and is not subject to copyright protection in the 

United States. The published product may be reproduced and distributed in its entirety 

without further permission from GAO. However, because this work may contain 

copyrighted images or other material, permission from the copyright holder may be 

necessary if you wish to reproduce this material separately.
Page 1 GAO-19-58 IT Cloud Computing

441 G St. N.W.

Washington, DC 20548

April 4, 2019

Congressional Requesters

Over the past 2 decades, the federal government’s increasing demand for 

information technology (IT) has led to a dramatic rise in operational costs 

to develop, implement, and maintain its computer systems and services. 

Furthermore, while federal agencies’ IT use provides essential services 

affecting the health, economy, and defense of the nation, this use has 

also led to a reliance on custom IT systems that can be costly to maintain. 

Accordingly, as a result of these costs, the federal government invests 

approximately $90 billion annually in IT. 

As part of a comprehensive effort to transform IT within the federal 

government, in 2010, the Office of Management and Budget (OMB) 

began requiring agencies to shift their IT services to a cloud computing 

option when feasible.1 As defined by the National Institute of Standards 

and Technology (NIST), cloud computing is a means for enabling ondemand access to shared pools of configurable computing resources 

(e.g., networks, servers, storage applications, and services) that can be 

rapidly provisioned and released. This approach offers federal agencies a 

means to buy services more quickly and possibly at a lower cost than 

building, operating, and maintaining these computing resources 

themselves.

To encourage federal agencies to begin taking advantage of cloud 

computing services (cloud services), in February 2011, OMB issued a 

Cloud First policy that required each agency’s chief information officer 

(CIO) to implement a cloud service whenever there was a secure, 

reliable, cost-effective option.2 Since 2012, we have issued several 

reports on agencies’ use of cloud services, as detailed later in this report.

You asked us to conduct a further review of agencies’ reported use of 

cloud services. Specifically, our objectives were to: (1) evaluate selected 

agencies’ progress in implementing cloud services, (2) review the extent 

to which selected agencies have increased spending on cloud services 

 

1

OMB, 25 Point Implementation Plan to Reform Federal Information Technology 

Management (Washington, D.C.: Dec. 9, 2010).

2

OMB, Federal Cloud Computing Strategy (Washington, D.C.: Feb. 8, 2011). 

Letter
Page 2 GAO-19-58 IT Cloud Computing

and achieved cost savings or avoidances, and (3) describe examples of 

cloud investments with significant or notable benefits that have been 

identified by selected agencies.

To address these objectives, we selected a sample of agencies based on 

the size of their total IT budget for fiscal year 2017. Specifically, we 

categorized each of the 24 Chief Financial Officers Act agencies3 by the 

size of its IT budget: large (more than $3 billion), medium ($1 billion to $3 

billion), and small (less than $1 billion), as reported on OMB’s IT 

Dashboard4 for 2017. We then selected up to six agencies with the 

largest budgets from each budget category.

Using these criteria, we selected 16 agencies, including 7 agencies from 

our prior work on cloud services conducted in 2012 and 2014.5 These 

agencies were the Department of Agriculture (Agriculture), Department of 

Commerce (Commerce), Department of Defense (Defense), Department 

of Education (Education), Department of Energy (Energy), Department of 

Health and Human Services (HHS), Department of Homeland Security 

(DHS), Department of Justice (Justice), Department of Labor (Labor), 

Department of State (State), Department of Transportation 

(Transportation), Department of the Treasury (Treasury), Department of 

Veterans Affairs (VA), General Services Administration (GSA), Small 

Business Administration (SBA), and Social Security Administration (SSA).

For our first objective, we obtained and analyzed IT Dashboard data 

related to the 16 selected agencies’ use of cloud services for fiscal years 

2016 through 2018 and projected use in 2019. We chose to begin with 

fiscal year 2016 because we had previously reported on federal agencies’ 

 

3

The 24 major agencies listed in the Chief Financial Officers Act of 1990 are the 

Departments of Agriculture, Commerce, Defense, Education, Energy, Health and Human 

Services, Homeland Security, Housing and Urban Development, the Interior, Justice, 

Labor, State, Transportation, the Treasury, and Veterans Affairs; the Environmental 

Protection Agency, General Services Administration, National Aeronautics and Space 

Administration, National Science Foundation, U.S. Nuclear Regulatory Commission, Office 

of Personnel Management, Small Business Administration, Social Security Administration, 

and U.S. Agency for International Development. 31 U.S.C. § 901(b). 

4

OMB’s IT Dashboard is a public website that provides detailed information on IT 

investments at 26 federal agencies. See https://itdashboard.gov/.

5

GAO, Cloud Computing: Additional Opportunities and Savings Need to Be Pursued, 

GAO-14-753 (Washington, D.C.: Sept. 25, 2014); and Information Technology Reform: 

Progress Made but Future Cloud Computing Efforts Should be Better Planned, GAO-12-

756 (Washington, D.C.: July 11, 2012). 
Page 3 GAO-19-58 IT Cloud Computing

use of cloud services through fiscal year 2014 and fiscal year 2015 data 

was not available. We reviewed agency responses that were submitted 

for fiscal years 2016 through 2019 as part of the annual budget 

submission process in order to determine whether a specific investment 

was using cloud services.

To ensure the accuracy and completeness of the selected agencies’ data 

on the use of cloud services, we downloaded data from the IT Dashboard 

on October 3, 2017, March 7, 2018, and October 9, 2018. We took this 

step because agencies may update their data on a quarterly basis 

throughout the fiscal year. In addition, we presented the results of our 

analysis to officials in charge of cloud services within the Office of the CIO 

at each selected agency. We asked these officials to verify the 

completeness and accuracy of this data and provide any updates as 

appropriate. Officials at all 16 agencies confirmed the total number of 

investments using cloud services for fiscal years 2016 through 2018 and 

their projected use for fiscal year 2019. Based on these steps, we 

determined that these data were sufficiently reliable to report on agencies’ 

progress in using cloud services.

In addition, we compared each selected agency’s cloud guidance to 

OMB’s Cloud First guidance and interviewed officials in charge of cloud 

services within the Office of the CIO at each agency regarding their cloud 

data and guidance. We also interviewed OMB staff in the Office of EGovernment and Information Technology regarding its guidance.

For our second objective, we obtained and analyzed IT Dashboard data 

related to the 16 agencies’ spending on cloud services for fiscal years 

2015 through 2018. We chose to begin with fiscal year 2015 because we 

had previously reported on federal agencies’ spending on cloud services 

through fiscal year 2014. In order to determine actual cloud spending 

costs for each fiscal year, we used agency spending data reported each 

subsequent fiscal year (from fiscal years 2017 through 2018), as of 

October 5, 2018.

We also administered a data collection instrument to obtain and analyze 

spending and savings by the 16 selected agencies for fiscal years 2014 

through 2018, as well as future planned costs. We requested that these 

agencies provide spending and savings data broken down by investment, 

as OMB only requires federal agencies to report total spending by cloud 

deployment model on the IT Dashboard, and agencies were not required 

to identify whether any reported savings were cloud-related.
Page 4 GAO-19-58 IT Cloud Computing

We took steps to help ensure the reliability of the data we collected. First, 

to minimize errors that might occur from respondents interpreting our 

instrument differently from our intended purpose, we reviewed the data 

collection instrument with agency officials who would be completing the 

instrument during meetings in October and November 2017. Second, we 

reviewed the completed spreadsheets to identify missing data or other 

errors, and consulted with a GAO data quality expert about these issues 

as appropriate. We also reviewed the associated notes regarding 

agencies’ qualifications of the provided data and followed up with agency 

officials to clarify the responses as appropriate.

Lastly, we presented the results of our analysis of IT Dashboard data and 

the data obtained from the data collection instrument to each of the 

selected agencies between June and August 2018. We asked the 

agencies to verify the completeness and accuracy of these data and 

provide any updates as appropriate. Each of the selected agencies 

provided updated information related to our data collection instrument, 

which we incorporated as appropriate. Based on the measures we took to 

ensure the reliability of the data reported by the agencies to us and on the 

IT Dashboard, we determined that the data were sufficiently reliable for 

the purpose of this report.

For the third objective, we obtained and reviewed available 

documentation discussing examples of cloud computing investments 

identified by the selected agencies as having produced significant or 

notable benefits and key practices that helped ensure the effort was 

successful, and interviewed officials from the Office of CIO or other 

components in charge of cloud services regarding these benefits. As part 

of this work, we asked officials within the Office of the CIO at each 

selected agency to identify up to three examples of investments that 

benefited from the acquisition of cloud services.

Fifteen of the sixteen agencies in our review identified at least one 

example, while one agency—HHS—reported that it did not have any 

examples of cloud investments that had produced significant or notable 

benefits because it did not have any completed migration efforts. 

Because of the open-ended nature of the 15 agencies’ responses to our 

questions, we conducted a content analysis of the information we 

received in order to identify and summarize the benefits and key practices 

that were identified by the 15 agencies. In addition, to select systems or 

investments to profile, we reviewed the 34 examples provided by the 15 

agencies and narrowed the list to 11 examples. In doing so, we sought to 

have a mix of systems that provided mission critical services to the 
Page 5 GAO-19-58 IT Cloud Computing

agency or the public, illustrated a range of cloud computing benefits, and 

included detailed information on the benefits achieved from using cloud 

services. 

In technical comments received on a draft of this report, two agencies 

provided new information regarding the use of cloud services for their 

systems that were profiled in appendix VI of the draft report. Based on the 

additional information provided by the two agencies, we determined there 

was no longer sufficient detail regarding what benefits were realized for 

these systems. Therefore, we removed the two agencies’ profiled 

examples from the report in order to be consistent with our methodology 

for reporting examples of systems that had realized benefits from the 

acquisition of cloud services. We then notified both agencies of this 

decision. Further details on our objectives, scope, and methodology are 

included in appendix I.

We conducted this performance audit from September 2017 to April 2019 

in accordance with generally accepted government auditing standards. 

Those standards require that we plan and perform the audit to obtain 

sufficient, appropriate evidence to provide a reasonable basis for our 

findings and conclusions based on our audit objectives. We believe that 

the evidence obtained provides a reasonable basis for our findings and 

conclusions based on our audit objectives.

Investments in federal IT have the potential to make agencies more 

efficient in fulfilling their missions by reducing costs and improving 

operational efficiencies. Each year, the federal government invests 

approximately $90 billion in IT, with about 75 percent reportedly spent on 

operating and maintaining existing systems. However, as we have 

previously testified, federal IT investments have too frequently failed or 

incurred cost overruns and schedule slippages while contributing little to 

mission-related outcomes.6 As a result, the federal government has spent 

billions of dollars on failed and poorly performing IT investments. These 

investments have often suffered from ineffective management of project 

planning, requirements definition, and program oversight and governance 

tasks.

 

6

GAO, Information Technology: Further Implementation of Recommendations is Needed 

to Better Manage Acquisitions and Operations, GAO-18-460T (Washington, D.C.: Mar. 14, 

2018). 

Background
Page 6 GAO-19-58 IT Cloud Computing

Accordingly, in February 2015, we added improving the management of 

IT acquisitions and operations to our high-risk list—a list of agencies and 

program areas that have a higher potential for fraud, waste, abuse, and 

mismanagement, or are in need of transformation.7 In introducing this 

high risk area, we specifically noted that agencies spend a significant 

portion of their budgets on the operations and maintenance of IT systems 

and need to effectively manage these investments in order to ensure they 

continue to meet agencies’ needs and deliver value. We issued an update 

to our high-risk report in February 2017 and noted that, while progress 

has been made in addressing the IT acquisitions and operations high-risk 

area, significant work remains to be completed, including establishing 

action plans to modernize or replace obsolete investments.

In addition, over the last 3 decades, Congress has enacted several laws 

to assist agencies and the federal government in managing IT 

investments. For example, Congress enacted the Clinger-Cohen Act of 

19968 to assist agencies in managing their investments. This act requires 

OMB to establish processes to analyze, track, and evaluate the risks and 

results of major capital investments in information systems made by 

federal agencies and report to Congress on the net program performance 

benefits achieved as a result of these investments.

Further, in December 2014, Congress enacted Federal Information 

Technology Acquisition Reform provisions (commonly referred to as 

FITARA) as a part of the Carl Levin and Howard P. ‘Buck’ McKeon 

National Defense Authorization Act for Fiscal Year 2015.

9 The act 

requires OMB, among other things, to develop standardized performance 

metrics, including for cost savings and cost avoidances, and to submit 

quarterly reports to Congress on cost savings and reductions in 

duplicative information technology investments.

More recently, recognizing the challenges in modernizing government IT 

systems, in December 2017, Congress enacted the Modernizing 

Government Technology Act as part of the National Defense 

 

7

GAO, High Risk Series: An Update, GAO-15-290 (Washington, D.C.: Feb. 11, 2015).

8

40 U.S.C. § 11101, et. seq. 

9

Pub. L. No. 113-291, division A, title VIII, subtitle D, 128 Stat. 3292, 3438 (Dec. 19, 

2014). 
Page 7 GAO-19-58 IT Cloud Computing

Authorization Act for Fiscal Year 2018.

10 This law authorizes all covered 

agencies11 to establish an IT system modernization and working capital 

fund to, among other things, transition legacy systems to commercial 

cloud computing and other innovative commercial platforms and 

technologies using agency reprogrammed funds. The act also establishes 

a Technology Modernization Fund administered by the Administrator of 

General Services, in consultation with the CIO Council, which will provide 

funds to federal agencies for modernization efforts.

As of March 2019, the board that oversees the Technology Modernization 

Fund had awarded $60.87 million to four projects that plan to migrate or 

deploy systems to cloud services. Specifically,

• GSA’s project, which received an award of $20.65 million, is intended 

to expedite the completion of a new software as a service solution for 

the agency’s payroll and work schedule and leave management within 

2 years.

• The Department of Housing and Urban Development’s project, which 

received an award of $20 million, is expected to accelerate the 

migration of five of the agency’s most critical business systems from 

an on-premise mainframe database to the cloud within the next 2 

years.

• Energy’s project, which received an award of $15.2 million, is 

intended to help the agency move 45 separate on-premise email 

systems to the cloud within the next 3 years.

• Agriculture’s project, which received an award of $5 million, is 

intended to help the agency migrate 10 applications to a shared 

services cloud platform model.

One approach to improving the government’s management of IT services 

is through cloud computing. As mentioned previously, cloud computing is 

a means for enabling on-demand access to shared pools of configurable 

computing resources (e.g., networks, servers, storage applications, and 

services) that can be rapidly provisioned. More specifically, purchasing IT 

services through a cloud service provider enables agencies to avoid 

 

10Modernizing Government Technology provisions of the National Defense Authorization 

Act for Fiscal Year 2018, div. A, title X, subtitle G (2017).

11The term covered agency refers to the 24 major agencies listed in the Chief Financial 

Officers Act of 1990. 31 U.S.C. § 901(b). 

Overview of Cloud 

Services
Page 8 GAO-19-58 IT Cloud Computing

paying for all the computing resources that would typically be needed to 

provide such services. This approach offers federal agencies a means to 

buy services more quickly and possibly at a lower cost than building, 

operating, and maintaining these computing resources themselves.

According to NIST, cloud computing offers federal agencies a number of 

benefits:

• On-demand self-service. Agencies can, as needed, provision 

computing capabilities, such as server time and network storage, from 

the service provider automatically and without human interaction.

• Broad network access. Agencies can access needed capabilities 

over the network through workstations, laptops, or other mobile 

devices.

• Resource pooling. Agencies can use pooled resources from the 

cloud provider, including storage, processing, memory, and network 

bandwidth.

• Rapid elasticity. Agencies can provision the resources that are 

allocated to match what actual resources are needed according to 

demand. This is done by scaling resources up or down by adding or 

removing processing or memory capacity, or both, according to 

demand.

• Measured service. Agencies can pay for services based on usage. 

This allows agencies to monitor, control, and generate reports, 

providing greater transparency into the agency’s use of cloud 

services.

As noted in NIST guidance, cloud service providers have established 

three types of service models that are offered to consumers:

• Infrastructure as a service. The service provider delivers and 

manages the basic computing infrastructure of servers, software, 

storage, and network equipment. The consumer provides the 

operating system, programming tools and services, and applications.

• Platform as a service. The service provider delivers and manages 

the infrastructure, operating system and programming tools and 

services, which the consumer can use to create applications.

• Software as a service. The service provider delivers one or more 

applications and all the resources (operating system and 

programming tools) and underlying infrastructure to run them for use 

on demand.
Page 9 GAO-19-58 IT Cloud Computing

NIST has also defined four types of cloud deployment models, including:

• Private cloud. Service is set up specifically for one organization, 

although there may be multiple customers within that organization and 

the cloud may exist on or off the customer’s premises.

• Community cloud. Service is set up for organizations with similar 

requirements. The cloud may be managed by the organizations or a 

third party and may exist on or off the organization’s premises.

• Public cloud. Service is available to the general public and is owned 

and operated by the service provider.

• Hybrid cloud. Service is a composite of two or more of the three 

deployment models (private, community, or public) that are bound 

together by technology that enables data and application portability.

According to NIST guidance, these deployment models impact the 

number of consumers and the nature of other consumers’ data that may 

be present in the cloud environment. A public cloud should not allow a 

consumer to know or control other consumers of a cloud service 

provider’s environment. However, a private cloud can allow for ultimate 

control in selecting who has access to a cloud environment. Community 

clouds and hybrid clouds allow for a mixed degree of control and 

knowledge of other consumers. Additionally, the cost for cloud services 

typically increases as control over other consumers and knowledge of 

these consumers increase.

In December 2010, OMB made cloud computing an integral part of its 25 

Point Implementation Plan to Reform Federal Information Technology 

Management.

12 The plan called for the development of a governmentwide strategy to hasten the adoption of cloud services. To accelerate the 

shift, OMB required agencies to identify three systems to migrate to cloud 

services, create a project plan for migration, and migrate all three 

systems by June 2012.

In February 2011, OMB issued the Federal Cloud Computing Strategy,

13

as called for in its 25-point plan. The strategy provided definitions of cloud 

services; benefits of cloud services, such as accelerating data center 

 

12OMB, 25 Point Implementation Plan to Reform Federal Information Technology 

Management. 

13OMB, Federal Cloud Computing Strategy. 

OMB and Past and 

Current Administrations 

Have Undertaken Efforts 

to Increase Use of Cloud 

Services
Page 10 GAO-19-58 IT Cloud Computing

consolidations; a decision framework for migrating services to a cloud 

environment;14 case studies to support agencies’ migration to cloud 

services; and roles and responsibilities for federal agencies. For example, 

the strategy states that NIST’s role is to lead and collaborate with federal, 

state, and local government agency CIOs, private sector experts, and 

international bodies to identify standards and guidance and prioritize the 

adoption of cloud services.

Subsequently, in December 2011, OMB established the Federal Risk and 

Authorization Management Program (FedRAMP), a government-wide 

program to provide joint authorizations and continuous security 

monitoring services for cloud services for all federal agencies.15 GSA 

initiated FedRAMP operations, which the agency referred to as initial 

operational capabilities, in June 2012.

In 2012, OMB began requiring agencies to evaluate each investment, or 

components or systems within the investment, for cloud services,

regardless of the overall life-cycle stage of the investment.16 Agencies 

were required to report the status of each investment’s evaluation as part 

of the annual budget submission, as noted in OMB’s annual capital 

planning guidance. Specifically, OMB required agencies to select an 

option regarding whether they had evaluated a cloud alternative and 

chosen a cloud alternative with a particular cloud deployment model or 

indicate that they had not yet evaluated the investment for cloud services. 

Starting in fiscal year 2018, OMB revised the options that agencies were 

to select from and required agencies to select an option regarding 

whether the investment, or a portion of the investment, was leveraging 

cloud computing, or indicate that cloud computing had not been 

considered for the investment.17

 

14The decision framework, among other things, identifies several key areas for 

determining the readiness for moving to a cloud environment, including the ability of the 

cloud service provider to address government security requirements.

15OMB, Security Authorization of Information Systems in Cloud Computing Environments

(Washington, D.C.: Dec. 8, 2011). FedRAMP is governed by the Joint Authorization Board 

(composed of the CIOs from Defense, DHS, and GSA), the FedRAMP program 

management office, NIST, the Federal CIO Council, OMB, and DHS.

16OMB, FY 2014 Guidance on Exhibits 53 and 300 (Washington, D.C.: Aug. 3, 2012).

17OMB, FY 2018 IT Budget–Capital Planning Guidance (Washington, D.C.: June 30, 

2016). 
Page 11 GAO-19-58 IT Cloud Computing

In 2012, OMB began requiring agencies to report associated cloud 

spending, as called for in its annual capital planning guidance.18 For fiscal 

years 2015 through 2018, OMB’s capital planning guidance required 

agencies to report their total cloud spending at the agency level based on 

the cloud deployment model, rather than by individual investment.19

Starting in fiscal year 2019, OMB will require agencies to report total 

cloud spending by investment and use the Technology Business 

Management Framework.20 The Framework provides a cost taxonomy for 

agencies to use to manage the cost, quality, and value of their IT 

services. Specifically, agencies will be required to use a standard set of 

cost categories to group IT spending, including cloud-related spending. 

This new model is intended to increase the granularity in reporting of 

agency IT budget and spending data.

In addition, in May 2017, the administration established the American 

Technology Council to help transform and modernize federal IT and how 

the government uses and delivers digital services.21 The President is the 

chairman of this council, and the Federal CIO and the United States 

Digital Service Administrator22 are among its members.

Subsequently, in December 2017, the American Technology Council 

issued a Report to the President on Federal IT Modernization and made 

eight cloud computing-related recommendations that are relevant to the 

focus of our review.23 For example, the report recommended that OMB 

issue two data calls to agencies in order to: (1) obtain a list of agency inprogress and pending projects for cloud migration; and (2) have agencies 

 

18OMB, FY 2014 Guidance on Exhibits 53 and 300. 

19OMB, FY 2015 Guidance on Exhibits 53 and 300; FY 2016 IT Budget–Capital Planning 

Guidance (Washington, D.C.: June 27, 2014); FY 2017 IT Budget–Capital Planning 

Guidance (Washington, D.C.: June 16, 2015); and FY 2018 IT Budget–Capital Planning 

Guidance.

20OMB, FY 2019 IT Budget–Capital Planning Guidance (Washington, D.C.: Aug. 1, 2017).

21The American Technology Council was established under Executive Order on May 1, 

2017 in order to promote the secure, efficient, and economical use of information 

technology within the federal government. 

22The United States Digital Service is an office within OMB that aims to improve the most 

important public-facing federal digital services. 

23White House American Technology Council, Report to the President on Federal IT 

Modernization (Washington, D.C.: Dec. 13, 2017).
Page 12 GAO-19-58 IT Cloud Computing

identify systems that have not yet migrated due to perceived or 

encountered difficulties. Based on the information provided, OMB would 

then assist agencies in making transition plans and work to remove 

obstacles in order to accelerate cloud adoption. In addition, the report 

recommended that OMB take action to update its guidance related to 

cloud computing and revise the Federal Cloud Computing Strategy that 

was previously issued in 2011.

According to staff in OMB’s Office of E-Government and Information 

Technology, OMB has taken action to address these recommendations. 

For example, the staff reported that the two data calls were issued in 

December 2017 and staff are currently reviewing the information provided 

by agencies in response. In addition, OMB issued its draft strategy 

revision, the 2018 Federal Cloud Computing Strategy, for comment on 

September 24, 2018.24 This proposed Cloud Smart policy outlines a 

strategy for agencies to adopt cloud solutions that streamline 

transformation and embrace modern capabilities.

According to the draft strategy, Cloud Smart focuses on equipping 

agencies with the tools needed to make informative technology decisions 

in accordance with their mission needs. In addition, the draft strategy 

indicates that OMB intends to leverage private-sector solutions to provide 

the best services to the American people. The strategy also notes that the 

CIO Council and Chief Financial Officer Council are to work with OMB, 

GSA, DHS, and other federal entities to develop a work plan of actions 

and targeted policy updates that are to be delivered over the next 18 

months. For more information about the current status of each of these 

eight cloud recommendations, as reported by OMB, please see appendix 

II.

During the past several years, we reported on federal agencies’ efforts to 

implement cloud services, and on the progress that oversight agencies 

have made to help federal agencies in those efforts. For example, in July 

2012, we reported that the seven federal agencies we reviewed had 

made progress in meeting OMB’s requirement to implement three cloud 

services by June 2012.25 Specifically, the seven agencies had 

 

24OMB, 2018 Federal Cloud Computing Strategy (draft), (Washington, D.C.: Sept. 24, 

2018). 

25GAO, Information Technology Reform: Progress Made but Future Cloud Computing 

Efforts Should be Better Planned, GAO-12-756 (Washington, D.C.: July 11, 2012).

Prior GAO Reports on 

Efforts to Implement Cloud 

Services
Page 13 GAO-19-58 IT Cloud Computing

implemented 21 cloud services and spent a total of $307 million for cloud 

computing in fiscal year 2012—about 1 percent of their total IT budgets. 

In addition, while all seven agencies had submitted plans to OMB for 

implementing cloud solutions, all but one plan were missing key required 

elements. We made 14 recommendations to the seven agencies to 

develop planning information, such as estimated costs and legacy IT 

systems’ retirement plans for existing and planned services. The 

agencies generally agreed with, and implemented, 13 out of 14 of our 

recommendations.

In September 2014, we reviewed the efforts of the same seven federal 

agencies again and found that each of them had implemented additional 

cloud services subsequent to our July 2012 report.26 In particular, the total 

number of cloud services implemented by the seven agencies had 

increased by 80 services, from 21 to 101. The seven agencies’ reported 

spending on cloud services had also increased by $222 million, from 

$307 million in 2012 to $529 million in 2014. However, this relatively small 

increase in cloud spending was attributed, in part, to the fact that these 

agencies had not considered cloud services for 67 percent of their 

investments. Accordingly, we recommended that the seven agencies 

assess their IT investments for suitability for cloud services. The agencies 

generally agreed with our recommendations and 6 of the agencies 

(Agriculture, DHS, GSA, HHS, SBA, and State) implemented all of our 

recommendations.

Further, in April 2016, we identified 10 key practices that federal and 

private-sector guidance noted should be included in service-level 

agreements in a contract when acquiring IT services though a cloud 

services provider.27 However, our review of five agencies’ (Defense, DHS, 

HHS, Treasury, and VA) cloud service contracts found that not all 10 key 

practices were included in these contracts. We therefore made 

recommendations to OMB to include all 10 key practices in future 

guidance to agencies. We also recommended that the five agencies 

incorporate these key practices as their contract and service level 

agreements expire. The agencies generally agreed with our 

 

26GAO, Cloud Computing: Additional Opportunities and Savings Need to Be Pursued, 

GAO-14-753 (Washington, D.C.: Sept. 25, 2014).

27GAO, Cloud Computing: Agencies Need to Incorporate Key Practices to Ensure 

Effective Performance, GAO-16-325 (Washington, D.C.: Apr. 7, 2016). 
Page 14 GAO-19-58 IT Cloud Computing

recommendations and, to date, Defense and DHS have taken action to 

implement the recommendations.

More recently, in April 2017, we highlighted the results of a forum, 

convened by the Comptroller General on September 14, 2016, to explore 

challenges and opportunities for CIOs to improve federal IT acquisitions 

and operations—with the goal of better informing policymakers and 

government leadership.28 Thirteen current and former federal agency 

CIOs, members of Congress, and private-sector IT executives who 

participated in the forum noted challenges with agency operations that 

could be addressed by migrating more services to the cloud. In their view, 

this approach would offer agencies a means to buy the services faster 

and possibly at a lower cost than through the traditional methods of 

building and maintaining systems.

In addition, forum participants noted the importance of federal agencies’ 

IT procurement offices and processes evolving to align with new 

technologies, as agencies are not always set up to take advantage of 

cloud services. Lastly, forum participants said that, as the federal 

government is expected to increase its purchase of IT as a service with 

the move toward cloud computing, more oversight is needed to ensure 

that appropriate contracts are in place and appropriate oversight of 

performance occurs.

The16 selected agencies reported making progress in implementing 

cloud services—namely, they established guidance for assessing 

investments for cloud services, performed those assessments, and 

implemented cloud services for their investments. However, the extent of 

these agencies’ progress varied. Specifically, 10 of the 16 agencies 

established guidance for assessing all new and existing investments for 

cloud services, while six agencies did not. In addition, while these 

agencies had assessed the majority of their investments for cloud 

services planned for fiscal year 2019, 12 agencies had not completed an 

assessment of 10 or more IT investments for cloud services. Lastly, 10 of 

the agencies reported a percentage increase in the use of cloud services 

from fiscal year 2016 through fiscal year 2019, while two agencies 

 

28GAO, Information Technology: Opportunities for Improving Acquisitions and Operations, 

GAO-17-251SP (Washington, D.C.: Apr. 11, 2017). 

Most of the Selected 

Agencies Reported 

Making Progress in 

Implementing Cloud 

Services
Page 15 GAO-19-58 IT Cloud Computing

reported no percentage change and four agencies reported a decrease 

during this 4-year period.

OMB’s Cloud First policy, issued in February 2011, requires each 

agency’s CIO to implement a cloud service whenever there is a secure, 

reliable, cost-effective option to do so.29 Further, subsequent OMB capital 

planning guidance, issued in 2014, requires agencies to evaluate each 

investment, or components or systems within the investment, for cloud 

services, regardless of the overall life-cycle stage of the investment.30

While OMB’s guidance is not specific on how agencies should conduct 

these evaluations, GAO’s Information Technology Investment 

Management framework31 notes that organizations should have 

documented policies and procedures for the management oversight of IT 

investments, including the selection of investments and the evaluation of 

information technologies that have the potential to improve the 

organization’s business.

Ten of the 16 agencies we reviewed had established guidance in 

accordance with OMB’s requirement to assess new and existing IT 

investments for suitability for cloud services, as of August 2018. In 

particular, all 10 agencies’ guidance required assessments of cloud 

service suitability for both new and existing IT investments.

However, the remaining six agencies did not have such comprehensive 

guidance in place. Rather, the guidance either required assessments of 

new or existing systems for cloud services but not both, or the guidance 

had not yet been established. Specifically, Labor’s and SSA’s guidance 

required assessments of new investments for cloud services but did not 

address assessments of existing investments. In addition, Energy’s 

guidance required assessments of existing systems but not new 

acquisitions. Further, three agencies (Education, HHS, and 

Transportation) had not established guidance for assessing investments 

for cloud services.

 

29OMB, Federal Cloud Computing Strategy. 

30OMB, FY 2016 IT Budget–Capital Planning Guidance. 

31GAO, Information Technology Investment Management: A Framework for Assessing 

and Improving Process Maturity (Supersedes AIMD-10.1.23), GAO-04-394G (Washington, 

D.C.: March 2004). 

About Two-thirds of the 

Selected Agencies Had 

Established Guidance for 

Assessing Investments for 

Cloud Services Suitability
Page 16 GAO-19-58 IT Cloud Computing

The results of our analysis of agencies’ guidance on assessing IT 

investments for cloud services are shown in figure 1.

Figure 1: Analysis of Selected Agencies’ Cloud Guidance for Assessing Information Technology Investments for Cloud 

Computing Services, as of August 2018

Agency officials in the Office of the CIO at the six agencies provided a 

variety of reasons for why they did not have guidance for assessing all 

investments for cloud services. Specifically, Labor officials reported that 

they had not included legacy applications in their guidance because not 

all applications should or could be migrated to the cloud. In addition, SSA 

officials reported that they were planning to assess all existing systems 

for cloud services, but had not determined a time frame for this review. 

Further, Energy officials reported that, while the agency was following 

OMB’s Cloud First policy, it would need to establish guidance for 

assessing new investments for cloud services; however, a date for doing 

so had not been determined.
Page 17 GAO-19-58 IT Cloud Computing

Transportation officials reported that they believed their guidance on 

managing cloud computing efforts was consistent with OMB’s Cloud First 

policy and stated that they had no plans to develop additional guidance. 

However, our review of the agency’s guidance found that it did not include 

any information regarding the assessment of investments for cloud 

services. Instead, the guidance only required that investments intending 

to use cloud services provide procurement and other cost information as 

part of the business case and use specified language in contracts with 

cloud service providers. Therefore, we believe that the guidance is not 

consistent with OMB’s guidance requiring agencies to assess 

investments for cloud services.

Education officials reported that they were in the process of finalizing a 

policy and hoped to have it completed by the end of the year. In addition, 

HHS officials reported that they had explored developing some guidance 

regarding cloud services, but had not established any plans to do so.

As previously discussed, assessing all new and existing IT investments to 

determine whether they are suitable for cloud services is an important 

component of OMB’s Cloud First policy. Until the six identified agencies 

update or establish guidance for assessing both new and existing 

investments for cloud services, they will not be positioned to ensure 

adequate implementation of OMB’s Cloud First policy. Further, these 

agencies increase the risk that they will not be able to take advantage of 

cloud services to improve operational efficiencies and minimize costs.

As noted previously, OMB’s fiscal year 2016 IT capital planning guidance 

requires agencies to evaluate each investment for cloud services and 

report the status of this evaluation as part of the annual budget 

submission. Specifically, agencies were to respond to a question 

regarding whether they had selected cloud services for the investment, or 

components or systems within the investment, or, for example, report that 

the investment had not yet been assessed for cloud services. OMB 

publicly reports agencies’ responses to this question on the IT 

Dashboard.

As of October 9, 2018, the 16 agencies in our review reported on the IT 

Dashboard that they had completed cloud assessments for 84 percent of 

their IT investments (5,180 out of a total of 6,157) planned for fiscal year 

2019. Of these, two agencies (GSA and State) had completed an 

assessment of all investments. However, 12 agencies had not completed 

an assessment of 10 or more IT investments for cloud services.

Selected Agencies 

Assessed the Majority of 

Their IT Investments for 

Cloud Services
Page 18 GAO-19-58 IT Cloud Computing

Table 1 lists the number of IT investments at the 16 selected agencies for 

fiscal year 2019 that had been assessed for cloud services. The table 

also shows the number and percentage of investments that remained to 

be assessed.

Table 1: Status of Information Technology (IT) Investment Assessments for Cloud Computing Services, as Reported on the IT 

Dashboard by 16 Selected Agencies for Fiscal Year 2019

Number Percentage

Agency

Total IT 

investments

Investments 

assessed for 

cloud services

Investments not 

assessed for

cloud services

Investments not 

assessed for 

cloud services

Department of Agriculture 225 172 53 24

Department of Commerce 167 164 3 2

Department of Defense 2,735 2,498 237 9

Department of Education 146 96 50 34

Department of Energy 365 246 120 33

Department of Health and Human Services 727 614 113 16

Department of Homeland Security 391 339 52 13

Department of Justice 250 193 57 23

Department of Labor 158 146 12 8

Department of State 94 94 0 0

Department of the Treasury 273 126 147 54

Department of Transportation 357 288 69 19

Department of Veterans Affairs 62 36 26 42

General Services Administration 114 114 0 0

Small Business Administration 26 24 2 8

Social Security Administration 66 30 36 55

Total 6,157 5,180 977 16

Source: GAO analysis of IT Dashboard data as of October 9, 2018. | GAO-19-58

Officials in the Office of the CIO at the 12 agencies provided a variety of 

reasons for why they had not assessed all investments for cloud services. 

For example, Agriculture officials reported that 21 of their 53 investments 

did not need assessments because the investments were not suitable for 

cloud services. The officials said they intended to update the IT 

Dashboard to reflect this change. Further, these officials stated that they 

planned to assess the remaining 32 investments by April 30, 2019. 

Defense officials reported that the agency was in the process of adjusting 

its cloud strategy that was issued in January 2018 and intends to address 
Page 19 GAO-19-58 IT Cloud Computing

investments that have not yet been evaluated. However, the officials 

stated that they had not established time frames for the evaluations. In 

addition, DHS officials reported that they were in the process of 

implementing their guidance and putting in place a new process for 

identifying planned acquisitions based on the phase in the acquisition life 

cycle. However, the officials had not identified a time frame for when the 

new process would be finalized or when all assessments of the 

investments would be completed. 

Justice officials reported that, as they began the budget process, the 

agency planned to look at performing additional assessments of 

investments for cloud services. However, the officials provided no time 

frames for when these assessments would be completed. In addition, 

SSA officials stated that the agency planned to perform an assessment of 

current investments for cloud services. However, the officials reported 

that they had not established a time frame for completing these 

assessments.

Further, Treasury officials reported that, while the agency had established 

a process for assessing investments for cloud services, it did not set 

specific dates for when the assessments were to be conducted. These 

officials reported that they only conducted a cloud assessment if the 

agency determined that it would replace, redevelop, or retire an 

investment. However, Treasury’s guidance is not consistent with OMB’s 

requirement that agencies conduct an annual assessment of all 

investments, regardless of the overall life-cycle stage of the investment.

Many of the 16 agencies in our review have made progress in 

implementing cloud services by establishing guidance for assessing 

investments for cloud services and performing assessments. Even 

agencies that lacked formal guidance for performing an assessment have 

made progress in increasing the use of cloud services when the 

assessment was completed. Nevertheless, 12 agencies still need to 

assess a large number of their investments. Until these agencies assess 

their investments that have yet to be evaluated for cloud services, they 

may not know which investments are likely candidates for migration to 

cloud services. Moreover, these agencies will not be positioned to take 

advantage of operational efficiencies, cost savings, and other benefits 

from the use of cloud services.
Page 20 GAO-19-58 IT Cloud Computing

As of October 9, 2018, the 16 agencies in our review reported on the IT 

Dashboard that 11 percent of their IT investments were projected to use 

cloud services for fiscal year 2019—an increase of 3 percentage points 

from fiscal year 2016 to fiscal year 2019. In addition, 13 out of the 16 

agencies reported that they planned to increase their use of cloud 

services, in some cases, by as much as 20 percentage points or more, 

between fiscal years 2018 and 2019.

Table 2 lists the percentage of the selected agency IT investments that 

used cloud services for fiscal years 2016 through 2018 and are projected 

for 2019. (For additional details on the number of cloud investments and 

the total investments reported by each of the selected agencies for fiscal 

years 2016 through 2019, see appendix III.)

Table 2: Percentage of Information Technology (IT) Investments That Use Cloud Computing Services, as Reported on the IT 

Dashboard by 16 Selected Agencies, for Fiscal Years 2016-2019 (projected) 

Percent

Agency Fiscal year 2016 Fiscal year 2017 Fiscal year 2018 Fiscal year 2019

Department of Agriculture 10 11 20 24

Department of Commerce 15 15 23 27

Department of Defense 4 3 3 3

Department of Education 10 11 5 8

Department of Energy 9 11 7 9

Department of Health and Human Services 13 17 17 19

Department of Homeland Security 21 27 17 18

Department of Justice 9 10 9 14

Department of Labor 17 19 19 17

Department of State 12 16 8 18

Department of the Treasury 4 6 6 10

Department of Transportation 8 10 8 12

Department of Veterans Affairs 15 16 7 10

General Services Administration 17 23 35 38

Small Business Administration 14 15 19 15

Social Security Administration 14 15 13 35

Government percentagea 8 9 9 11

Source: GAO analysis of IT Dashboard data as of October 9, 2018. | GAO-19-58

a

The government percentage was calculated by dividing the total number of investments using cloud 

services from the total number of IT investments, as reported by the 16 agencies for each fiscal year. 

Based on the total number of investments that we reviewed, at least 44 percent of these investments 

were from Defense, but that agency’s reported percentage of cloud investments (3 to 4 percent each 

Selected Agencies Have 

Increased Their Use of 

Cloud Services
Page 21 GAO-19-58 IT Cloud Computing

fiscal year) was one of the lowest among the agencies in our review. As a result, Defense’s reported 

percentage lowered the government percentage reported for each fiscal year. 

In addition, while the majority of agencies made progress in implementing 

cloud services between fiscal years 2016 and 2019, the extent of 

agencies’ progress varied. Specifically, 10 of the 16 agencies reported an 

increase in the use of cloud services, with the percentage of increase 

varying from up to 10 percentage points to 20 or more percentage points.

For the remaining six agencies, two reported no change in the percentage 

of investments using cloud services and four reported a decrease in the 

overall percentage of cloud usage. Figure 2 shows the breakdown in the 

range of percentage point changes in the use of cloud services for 

agency investments for fiscal years 2016 through 2019, as reported on 

the IT Dashboard.

Figure 2: Information Technology (IT) Investments That Used Cloud Services, as Reported on the IT Dashboard by 16 

Selected Agencies for Fiscal Years 2016-2019 (projected)
Page 22 GAO-19-58 IT Cloud Computing

Officials in the Offices of the CIO, and Office of Information Technology, 

at the six agencies that reported no change or a decrease in their cloud 

investment percentages during this 4-year period provided a variety of 

reasons for why this was the case, or had no comments regarding the 

lack of change in their cloud investment percentages. Specifically, Energy 

officials reported that the agency had not shown an increase in the 

percentage of its cloud investments due to an IT portfolio optimization 

effort designed to consolidate the agency’s cloud investments. According 

to the officials, this optimization effort was designed to reduce the total 

number of these investments during the 4-year period. As a result, this 

optimization effort affected the overall percentage of cloud investments. 

As for Labor, its officials did not offer any comments regarding the lack of 

an increase in cloud use during this period.

In addition, Defense, DHS, and Education officials reported that staff in 

their agencies had inconsistently applied the definition of cloud 

computing, which had led to differences in identifying and reporting the 

number of cloud investments within their agencies during this period. 

Further, DHS officials noted that the ongoing addition, combination, 

completion, and cancellation of investments had contributed to the 

fluctuation in the number of cloud investments within their agency. Finally, 

VA officials reported that their cloud identification processes were 

maturing during this period and, as such, had resulted in different cloud 

investment counts.

Some of the inconsistencies reported by agencies regarding the types of 

investments that they identified as being cloud investments may also be a 

result of OMB’s changes to its guidance during this 4-year period. 

Specifically, OMB changed how agencies were required to report their 

use of cloud services in fiscal year 2018, and revised the options that 

agencies were to select from in order to identify and report the use of 

cloud services for each investment.

Going forward, several agencies reported that they intended to continue 

making progress in their implementation of cloud services beyond fiscal 

year 2019. For example:

• Education officials reported that the agency expected to increase 

cloud use significantly in 2019 and beyond due to an IT services 

contract award that is to support the migration of the agency’s primary 

hosting infrastructure to the cloud.
Page 23 GAO-19-58 IT Cloud Computing

• DHS officials reported that the agency had set aggressive goals for 

acquiring cloud services. Toward this end, the agency had initiated a 

cloud steering group and created a team with staff from all 

components. In addition, the officials reported that they planned to 

consolidate space in one data center and eliminate another data 

center, which would allow the agency to accelerate its migration to the 

cloud.

• Justice officials reported that they expected to increase spending on 

cloud services as the agency completed ongoing initiatives in 2019. In 

addition, the officials reported that they anticipated migrating the 

majority of the agency’s unclassified data to the cloud in the next few 

years.

• VA officials reported that the agency planned to migrate at least 350 

applications to the cloud by 2024.

Agencies’ efforts to acquire additional cloud services and take advantage 

of improved efficiencies and cost savings should help to further improve 

their management of IT acquisitions and operations.

The 16 agencies in our review made progress in implementing cloud 

services. Specifically, the 16 agencies reported that their spending on 

cloud investments had increased by over $1 billion between fiscal years 

2015 and 2018 for investments with total life-cycle costs of $1 million or 

more. Nevertheless, the agencies reported that factors such as 

inconsistent tracking of spending data, along with confusion in interpreting 

OMB guidance, impacted the accuracy of their reported cloud spending 

data. In addition, 13 of the 16 agencies provided savings data indicating 

that they had saved hundreds of millions of dollars on cloud services, but 

agencies reported that they had problems with tracking this data. Further, 

six agencies reported that they had reinvested cloud savings into other IT 

modernization efforts or other improvements to IT services.

Agencies Have 

Increased Spending 

and Realized Savings 

from Using Cloud 

Services, but 

Spending and 

Savings Figures Are 

Underreported
Page 24 GAO-19-58 IT Cloud Computing

OMB requires agencies to report spending on cloud services. Specifically, 

OMB’s annual capital planning guidance for fiscal years 2015 through 

201832 required agencies to report their total cloud spending on the IT 

Dashboard, although it did not require the information to be reported by 

investment.33

While the selected agencies’ reporting on the IT Dashboard indicated that 

their percentage of total spending on cloud services generally remained 

constant during fiscal years 2015 through 2017. Specifically, the 16 

agencies reported on the IT Dashboard that approximately 3 percent of 

their total IT spending each fiscal year during this period was spent on 

cloud services. For fiscal year 2018, agency-reported cloud spending 

through March 2018 was at 2 percent. Table 3 identifies the percentage 

of the selected agency spending on cloud services for fiscal years 2015 

through 2018, as reported on the IT Dashboard. (For additional details on 

total agency cloud spending and total IT spending reported by each of the 

selected agencies for fiscal years 2015 through 2018, see appendix IV.)

 

32OMB, FY 2015 Guidance on Exhibits 53 and 300; FY 2016 IT Budget–Capital Planning 

Guidance; FY 2017 IT Budget–Capital Planning Guidance; and FY 2018 IT Budget–

Capital Planning Guidance.

33As part of our review, we requested that agencies provide cloud spending data broken 

down by investment. 

Selected Agencies Are 

Spending More on Cloud 

Services, but Do Not Have 

Complete Spending Data
Page 25 GAO-19-58 IT Cloud Computing

Table 3: Percentage of Total Information Technology (IT) Cloud Spending, as Reported on the IT Dashboard by the 16 

Selected Agencies for Fiscal Years 2015-2018

Percent

Agency Fiscal year 2015 Fiscal year 2016 Fiscal year 2017 Fiscal year 2018a

Department of Agriculture 3 2 5 3

Department of Commerce 11 12 9 9

Department of Defense 4 4 1 1

Department of Education 9 9 10 1

Department of Energy 2 3 2 1

Department of Health and Human Services 0 1 4 3

Department of Homeland Security 4 4 2 2

Department of Justice 1 1 1 1

Department of Labor 8 9 6 4

Department of State 1 1 4 4

Department of the Treasury 4 4 3 1

Department of Transportation 1 1 1 1

Department of Veterans Affairs 1 1 7 6

General Services Administration 3 8 12 12

Small Business Administration 4 5 7 9

Social Security Administration 3 3 2 3

Government percentageb 3 3 3 2

Source: GAO analysis of IT Dashboard data as of October 5, 2018. | GAO-19-58

a

Although agency-reported cloud spending for fiscal year 2018 was obtained from the IT Dashboard 

on October 5, 2018, the agencies last updated their data between January through March 2018. 

b

The government percentage was calculated by dividing the total cloud spending from the total IT 

spending, as reported by the 16 agencies for each fiscal year. 

However, the breakdown in spending by investment for cloud services 

with $1 million or more in life-cycle costs that the 16 agencies provided to 

us, showed that their spending on cloud investments had increased 

during fiscal years 2015 through 2018, and beyond (agencies generally 

submitted data on planned spending for one or more fiscal years beyond 

2018). Specifically, the agencies’ provided data showed that total cloud 

spending for these investments was approximately $1.38 billion in fiscal 

year 2017—an increase of over $1 billion since fiscal year 2015. In 

addition, the 16 agencies’ data indicated that they plan to spend over $3.2 

billion on cloud services in fiscal year 2018 and beyond for these 

investments.
Page 26 GAO-19-58 IT Cloud Computing

Table 4 summarizes the information provided to us on a breakdown of the 

16 selected agencies’ total spending for investments with $1 million or 

more in life-cycle costs for cloud services, from fiscal years 2015 through 

2018 and beyond through fiscal year 2024, that was submitted to us. (For 

a list of the investments that have spent $1 million or more in life-cycle 

costs for cloud services, provided by each of the 16 selected agencies for 

fiscal year 2018, see appendix V.)

Table 4: Information on Total Spending For Investments with $1 Million or More in Life-Cycle Costs For Cloud Services, 

Provided by the 16 Selected Agencies for Fiscal Years 2015 through 2018 and Beyond (in millions of dollars) 

Agency Fiscal year 2015 Fiscal year 2016 Fiscal year 2017

Fiscal year

2018 and beyonda

Department of Agriculture 84.91 102.96 242.23 272.70

Department of Commerce 2.53 21.75 33.74 92.65

Department of Defense Not available 178.69 173.11 962.02

Department of Education 2.0 3.97 41.47 10.80

Department of Energy 10.80 13.42 17.06 28.37

Department of Health and Human Services 48.05 335.89 516.35 140.52

Department of Homeland Security 47.76 70.67 94.57 645.06

Department of Justice 25.99 40.38 36.08 39.61

Department of Labor 1.39 .37 1.90 5.81

Department of State 6.83 56.91 80.84 53.62

Department of the Treasury 20.27 24.62 32.24 93.82

Department of Transportation 15.31 25.02 26.98 30.46

Department of Veterans Affairs 3.74 3.47 15.57 782.49

General Services Administration 26.48 75.80 62.78 114.50

Small Business Administration 0.00 .07 3.85 9.31

Social Security Administration 0.00 0.00 3.01 17.73

Total 296.06 954.00 1,381.76 3,299.47

Source: GAO analysis of agency-provided cloud computing data. | GAO-19-58

a

In addition to providing planned spending on cloud services for fiscal year 2018, agencies generally 

submitted data on planned spending for one or more fiscal years beyond 2018 up through fiscal year 

2024. 

Officials in the Office of the CIO at all of the agencies in our review 

identified three factors that could affect the completeness of the cloud 

spending data provided to us and on the IT Dashboard: (1) spending data 

were not consistently tracked; (2) different methods were used to 

calculate cloud spending costs; and (3) interpreting changes in OMB and 

related guidance created confusion regarding what spending data should 

be tracked.
Page 27 GAO-19-58 IT Cloud Computing

• Spending data were not consistently tracked. Defense officials 

reported, for example, that the agency had only begun tracking cloud 

spending in fiscal year 2016 and, therefore, spending data were not 

available for fiscal year 2015. In addition, VA officials reported that 

they were in the process of maturing their tracking of cloud spending 

data and, therefore, the agency did not have spending data available 

for the majority of their investments prior to fiscal year 2019. Further, 

Justice officials reported that the agency had been challenged to track 

cloud costs because the costs are based on fluctuating usage, rather 

than a flat rate.

• Different methods were used to calculate cloud spending costs. 

Some agencies reported that the data they provided to us included 

costs for items such as power usage and staff full-time equivalents, 

while other agencies told us that they only provided contract costs. In 

addition, some agency officials noted that they included in the 

provided spending figure, the additional costs for migrating the 

application to cloud services, while other officials said that these costs 

had not been included in their spending totals.

• Interpreting changes in OMB and related guidance created 

confusion regarding what spending data should be tracked. 

Agencies noted that OMB made changes to its guidance since 2015, 

including clarifications to the definition of cloud computing, changes to 

the definition and scope of cloud services and cloud spending, and 

changes to the guidance regarding what applicable costs should be 

included in spending totals—all of which created confusion regarding 

what investments and what costs should be tracked for cloud 

services. Defense officials also reported that the agency 

misinterpreted the NIST definition of cloud computing, and, as a 

result, Defense misreported that certain IT investments were using 

cloud services, when these investments were not using these 

services. Defense officials reported that the agency had corrected this 

issue but it affected the total cloud spending reported during this 

period and led to the decrease in spending noted.

Based on our review of these factors reported by the 16 selected 

agencies, we identified issues with the completeness of the reported 

cloud spending data. Specifically, these factors increase the likelihood 

that all costs associated with spending on cloud services may have been 

incompletely captured by the 16 selected agencies in our review. As a 

result, agencies’ reported total cloud spending on the IT Dashboard and 

the data provided to us is likely underreported.
Page 28 GAO-19-58 IT Cloud Computing

Staff in OMB’s Office of E-Government and Information Technology 

stated that agencies have previously reported challenges in breaking out 

cloud costs, particularly when the cloud acquisition is part of a larger 

contract. Given these challenges, the staff acknowledged that agencyreported cloud spending data are underreported and stated that the IT 

Dashboard reflects only a fraction of actual federal spending on cloud 

services. However, the staff stated that OMB’s changes to its guidance, 

beginning in fiscal year 2019, should help to improve the reporting of 

cloud spending data. Specifically, beginning in fiscal year 2019, agencies 

will be required to report total cloud costs by investment, per OMB’s IT 

capital planning guidance,34 and use the Technology Business 

Management framework.35

Having complete data on spending for cloud services is critical in order to 

ensure that agencies can provide effective management and oversight of 

their cloud use, and that OMB and lawmakers can hold CIOs accountable 

for the performance of these cloud investments. The changes to OMB’s 

guidance for fiscal year 2019 provide a key improvement for ensuring that 

agencies establish more consistent processes for reporting on cloudspending and should help agencies improve the completeness of the 

cloud-spending data that they report to OMB.

 

34OMB, FY 2019 IT Budget–Capital Planning Guidance. 

35Under the Technology Business Management framework, agencies will be required to 

use a standard set of cost categories to group IT spending, including cloud-related 

spending. This new model is intended to increase the granularity in reporting of agency IT 

budget and spending data. 
Page 29 GAO-19-58 IT Cloud Computing

Since 2013, OMB has required agencies to report quarterly on their total 

savings and cost avoidances36 from implementing OMB’s IT reform 

initiatives, including savings realized from the migration to cloud 

services.37 Specifically, agencies are required to report actual and 

planned savings from implementing these initiatives in a quarterly 

submission and identify which implementation of an OMB initiative 

resulted in the reported savings. Despite this, in the reporting mechanism, 

agencies can only associate specific savings with certain OMB initiatives, 

a list that does not include the migration to cloud services.38 Standards for 

Internal Control in the Federal Government emphasizes that management 

should track the actual performance of key initiatives in order to ensure 

that these activities are meeting plans, goals, and objectives, and in doing 

so, management should use quality information.39

Thirteen of the 16 agencies in our review provided savings data to us for 

at least one cloud investment with life-cycle costs of $1 million or more for 

cloud services during fiscal years 2014 through 2018.40 In total, the 13 

agencies’ provided data showed that they had accrued approximately 

$291 million in savings or cost avoidances using cloud services since 

2014. In addition, the agencies’ data indicated that they planned to save 

at least $150 million in fiscal year 2018 and beyond (agencies generally 

submitted data on planned savings for one or more fiscal years beyond 

2018).

 

36As defined in Circular A-131, OMB defines cost savings as a reduction in actual 

expenditures below the projected level of costs to achieve a specific objective. Cost 

avoidances are defined as results from an action taken in the immediate time frame that 

will decrease costs in the future. See OMB, Value Engineering, Circular A-131 (Revised)

(Washington, D.C.: Dec. 26, 2013). 

37OMB, Fiscal Year 2013 PortfolioStat Guidance: Strengthening Federal IT Portfolio 

Management, Memorandum M-13-09 (Washington, D.C.: Mar. 27, 2013). 

38OMB requires agencies to report quarterly integrated data collection submissions using 

a standardized text format that allows agencies to submit data electronically. OMB 

provides guidance on submitting reported savings data through the CIO Council’s website 

at https://management.cio.gov/schema/#savings. The available options for agencies to 

select in reporting savings include data center, digital services, commodity IT, 

PortfolioStat, software license management, or other.

39GAO, Standards for Internal Control in the Federal Government, GAO-14-704G 

(Washington, D.C.: September 2014). 

40As part of our work, we requested agencies provide cloud savings data broken down by 

investment. 

Selected Agencies Report 

Saving Approximately 

$291 Million from the Use 

of Cloud Services but 

Acknowledge Data Are 

Incomplete
Page 30 GAO-19-58 IT Cloud Computing

However, agency officials from the 13 agencies stated that, while they 

were able to provide some savings data, these data are only tracked on 

an ad hoc basis for certain cloud investments. In addition, officials from 

three agencies (Defense, State, and SSA) stated that they could not 

provide savings data for any of their cloud investments. As a result, the 

16 agencies were unable to provide savings or avoidance data for 411 

out of 488 investments (84 percent) that we reviewed.

Table 5 shows, for the selected agencies in our review, the breakdown in 

total agency savings and cost avoidances for fiscal years 2014 through 

2018 and beyond for investments with $1 million or more in life-cycle 

costs for cloud services.

Table 5: Information on Total Savings and Cost Avoidances For Investments with $1 Million or More in Life-Cycle Costs For 

Cloud Services, Provided by the 16 Selected Agencies for Fiscal Years 2014 through 2018 and Beyond (in millions of dollars)

Number Dollars (millions)

Agency

Current cloud 

investments

Current cloud 

investments with 

reported savings 

Fiscal years

2014-2016

Fiscal year 

2017

Fiscal years

2018 and beyonda

Department of Agriculture 57 11 4.21 $7.11 18.74

Department of Commerce 16 2 22.98 15.20 4.83

Department of Defense 115 0 0.00 0.00 0.00

Department of Education 5 2 2.23 1.61 1.12

Department of Energy 40 16 33.82 6.52 9.04

Department of Health and Human 

Services 

61 17 36.84 17.89 57.80

Department of Homeland Security 51 3 8.98 8.06 1.66

Department of Justice 29 1 3.47 4.70 4.88

Department of Labor 3 3 3.78 1.92 6.28

Department of State 16 0 0.00 0.00 0.00

Department of the Treasury 17 7 2.04 2.46 16.40

Department of Transportation 13 2 4.86 2.20 0.02

Department of Veterans Affairs 42 2 0.10 0.00 2.10

General Services Administration 16 9 79.53 20.89 26.12

Small Business Administration 4 2 0.00 0.00 1.35

Social Security Administration 3 0 0.00 0.00 0.00

Total 488 77 202.83 88.58 150.30

Source: GAO analysis of agency-provided cloud computing data. | GAO-19-58

a

In addition to providing information on planned savings or cost avoidances on cloud services for 

fiscal year 2018, agencies generally submitted data on planned savings for one or more fiscal years 

beyond 2018.
Page 31 GAO-19-58 IT Cloud Computing

Officials in the Office of the CIO at the 16 agencies identified three factors 

that impacted their efforts to provide data on savings or cost avoidances 

for cloud computing investments: (1) savings data were not systematically 

tracked or were hard to track; (2) deploying or migrating systems to the 

cloud had resulted in no cost savings; and (3) OMB does not require 

agencies to identify savings associated with cloud services as part of 

reported savings.

• Savings data were not systematically tracked or were hard to 

track. Defense, Treasury, and VA officials reported that their 

investment management systems did not have the capability to track 

cloud savings or avoidance data. In addition, GSA officials reported 

that, while their system had the capability to track cost savings data, 

the agency did not capture and track realized cloud savings in a 

consistent format. GSA officials stated that they were in the process of 

implementing the Technology Business Management Framework, 

which they expected would improve the collection of these data. 

However, the officials did not identify a time frame for when this 

framework was to be implemented.

Education officials reported that the agency did not provide cost 

savings data for those investments where cost savings targets had 

not been established or anticipated. SBA officials reported that 

investments with two cloud providers had only been recently made so 

the agency could not yet make a reasonable assessment of savings. 

Further, Agriculture officials reported that the agency had a hard time 

tracking the savings from certain investments because the process for 

formulating the overall agency budget was different than the process 

for determining savings from cloud implementation.

State officials reported that they were in the process of developing the 

capability to collect and track savings data from using cloud services 

but did not have any reliable data to provide during our review. In 

addition, Energy officials reported that their agency intended to 

establish review processes in the coming year to ensure that costs, 

cost savings, and cost avoidances were tracked for all cloud 

investments. As part of this process, the agency intended to work 

closely with its components to ensure that there was a consistent 

application of definitions for cloud spending and savings. However, 

the officials did not identify a specific time frame for when the agency 

expected the new process to be completed.
Page 32 GAO-19-58 IT Cloud Computing

Lastly, HHS officials reported that the agency did not expect to track 

cost savings beyond the FITARA requirements. FITARA requires the 

reporting of savings associated with two OMB initiatives—data center 

consolidation and PortfolioStat. However, per M-13-09, OMB requires 

agencies to report savings associated with all of its initiatives.41 As 

such, HHS’s tracking of savings is not consistent with OMB’s 

guidance.

• Deploying or migrating systems to the cloud resulted in no cost 

savings. Treasury officials reported that their agency had not realized 

any cost savings from the migration of certain investments because 

the acquisition of cloud services either had allowed the agency to 

purchase additional capabilities that the previous system did not have, 

or the agency had continued to operate the previous system at the 

same time as the new cloud system for a period of time. In addition, 

Commerce officials reported that their agency had not realized any 

cost savings for some investments because acquiring cloud services 

required that new business and performance requirements be put in 

place, which resulted in no overall savings for these investments. 

Further, DHS and SSA officials reported that a number of their 

investments were new applications that were developed and deployed 

in the cloud. As such, there were no costs from a prior system that 

could be compared with the costs to maintain the new system using 

cloud services; thus, there were no associated cost savings or 

avoidances.

• OMB does not require agencies to identify savings associated 

with cloud services as part of reported savings. Officials from 

Agriculture, Justice and Transportation noted that, while OMB 

requires agencies to report savings, current reporting instructions do 

not specifically require the identification and reporting of cloud savings 

as a separate category of cost savings and avoidance. In this regard, 

OMB’s guidance requires agencies to identify which OMB initiative 

resulted in the reported savings, but the available options for agencies 

to choose from do not include cloud services.42 Accordingly, officials 

 

41OMB, Memorandum M-13-09.

42OMB requires agencies to report quarterly integrated data collection submissions using 

a standardized text format that allows agencies to submit data electronically. OMB 

provides guidance on submitting reported savings data through the CIO Council’s website 

at https://management.cio.gov/schema/#savings. The available options for agencies to 

select in reporting savings include data center, digital services, commodity IT, 

PortfolioStat, software license management, or other.
Page 33 GAO-19-58 IT Cloud Computing

from these agencies stated that they either reached out to their 

components to try and collect this information or had to review their 

investments to determine whether there were any cloud savings, to be 

able to provide this information to us.

Based on our review of the factors that impacted the selected agencies’ 

efforts to provide savings data, we identified issues with the 

completeness of the savings data. Specifically, challenges identified by 

the selected agencies in systematically tracking savings data, and the 

lack of a specific OMB requirement to report savings associated with 

cloud services, increase the likelihood that all savings associated with 

cloud services may have been incompletely captured by the agencies that 

provided these data. As a result, agencies’ reported cloud savings data 

on the IT Dashboard and the data provided to us is likely underreported.

Staff in the Office of E-Government and Information Technology stated 

that, while agencies are required to report total savings related to OMB 

initiatives, the format is left to agency discretion. In addition, OMB staff 

confirmed that agencies do not have to specifically identify savings 

related to cloud computing unless they choose to do so. OMB staff further 

said that they do not require a specific format for reporting savings in 

order to minimize the burden on agencies in reporting this information.

While OMB’s effort to minimize the reporting burden on agencies is 

appropriate, the lack of an explicit requirement to identify reported 

savings associated with cloud services has contributed to agencies not 

consistently tracking these savings. In addition, while OMB has taken 

steps to ensure more accuracy and granularity in agency reporting of 

cloud investment spending data in fiscal year 2019, there has not been a 

corresponding effort to ensure better reporting of cloud savings data. As a 

result, OMB and Congress may not have sufficient data to see the results 

of key initiatives, like Cloud Smart, and understand whether agencies are 

achieving savings using cloud services.

Since 2013, OMB has required agencies to report on the savings 

resulting from implementation of its key IT reform initiatives. Although 

OMB does not provide the means for agencies to explicitly identify cloudrelated savings, it is nevertheless important for agencies to take steps to 

fully track savings and cost avoidances from cloud computing acquisitions 

in order to ensure effective oversight and management of these 

initiatives. However, until OMB establishes a specific cloud savings 

reporting requirement, and until these agencies establish a consistent and 

repeatable mechanism to track these savings and cost avoidances, the 
Page 34 GAO-19-58 IT Cloud Computing

agencies may lack sufficient information on the results of cloud 

acquisitions to date and the data necessary to make decisions regarding 

future cloud acquisitions.

In 2017, Congress enacted what is known as the Modernizing 

Government Technology Act,

43 which authorized covered agencies44 to 

establish an IT system modernization and working capital fund. This fund 

was to be used to, among other things, transition legacy IT systems to 

commercial cloud computing and other innovative commercial platforms 

and technologies using agency reprogrammed funds45 or amounts made 

available to the IT working capital fund through discretionary 

appropriations.

Regardless of the extent of agencies’ processes for tracking savings 

obtained from using cloud services, officials in the Office of the CIO at six 

agencies in our review (Education, GSA, Labor, SBA, SSA, and Treasury) 

reported that they have reinvested these savings into other IT 

modernization efforts or other improvements to IT services. For example:

• Education officials reported that $498,000 in fiscal year 2018 cloud 

savings was used to modernize the agency’s network infrastructure in 

order to provide increased multipath bandwidth and software that 

automatically routes traffic if network issues occur.

• GSA officials reported that the agency used the savings from 

replacing the agency’s legacy on-premises email program with a 

cloud-based email system to implement a modern enterprise 

collaboration platform, email, and document storage system. 

According to the officials, the move to the cloud helped improve the 

agency’s flexibility (the new system is accessible from any device, at 

any time, and from any location), productivity, and cost-effectiveness. 

As part of this effort, the officials reported that the savings were 

managed using the agency’s working capital fund.

 

43Modernizing Government Technology provisions of the National Defense Authorization 

Act for Fiscal Year 2018, Pub. L. No. 115-91, div. A., title X, subtitle G, § 1076, 131 Stat. 

1283, 1586 (2017).

44The term ‘‘covered agency’’ refers to each agency listed in 31 U.S.C. § 901(b).

45Reprogramming is defined as shifting funds within an appropriation or fund account to 

use them for purposes other than those contemplated at the time of appropriation. 

Agencies Reported 

Reinvesting Cloud 

Implementation Savings 

into IT Modernization or 

Other Improvement Efforts
Page 35 GAO-19-58 IT Cloud Computing

• Labor officials reported that their agency is using savings and cost 

avoidances to partially fund an initiative to consolidate cloud services 

within the agency in order to provide future secure cloud services and 

establish an enterprise contract vehicle to obtain cloud services. The 

officials noted that this investment is intended to allow the agency’s 

components to leverage a cloud authority to operate, obtain 

competitive pricing for, and establish communications to cloud service 

providers. In addition, Labor officials reported that the agency has 

established a working capital fund that is to be used to manage the 

savings from cloud and shared services.

• SBA’s CIO reported that the agency reinvested $7.8 million in savings 

from efforts to consolidate data centers to the cloud toward the 

implementation of other enterprise-wide modernization efforts. In 

addition, the agency had used the savings for the deployment and 

migration of additional applications to cloud services. Specifically, the 

CIO reported that the savings were used to design and architect cloud 

services, roll out the agency’s update of key operating system and 

office applications, decommission obsolete data center assets, reduce 

overlapping technologies, and enhance security and compliance 

capabilities with new enterprise tools and network monitoring. In 

addition, the CIO stated that, by using the savings from the data 

center consolidation, SBA has been able to undertake all of the 

agency’s cloud modernization efforts with no additional budgeted 

funding. 

We have previously reported46 that significant work remains to ensure 

that agencies improve their management of IT acquisitions and 

operations, including modernizing or replacing obsolete IT investments. It 

is encouraging that several agencies have reinvested savings from cloud 

initiatives into other IT modernization efforts and, in some cases, have 

taken advantage of working capital funds authorized by Congress to do 

so. Having complete information on the savings or avoidances that result 

from cloud initiatives and using those savings to further IT modernization 

efforts is critical to ensuring the transformation of IT services across the 

federal government in the future.

 

46GAO-17-317 and GAO-15-290. 
Page 36 GAO-19-58 IT Cloud Computing

Officials from 15 of the 16 agencies in our review reported that they had 

realized several significant benefits from the adoption of cloud services, 

ranging from improvements in the delivery of IT services to increasing the 

efficiency of operations and systems.47 In addition, the 15 agencies noted 

that certain key practices enabled them to realize these benefits through 

the successful implementation of cloud services. These practices 

included establishing new governance planning activities and policies, 

reorganizing the management of agency IT resources, and having 

executive leadership involved to help drive acquisition efforts.

Officials in charge of cloud services at 15 of the 16 agencies in our review 

reported that they had identified five significant or notable benefits as a 

result of acquiring cloud services.48 Specifically, the 13 agencies reported 

that they had improved customer experiences through better design and 

performance of business systems and customer websites. In addition, all 

15 agencies reported that they were able to procure more flexible and 

scalable IT resources,49 and reduce the cost of provisioning infrastructure 

and managing services. Table 6 lists the five significant or notable 

benefits reported by the 15 agencies and the number of agencies that 

reported each benefit. The discussion that follows the table provides 

examples of each of the five agency-reported benefits from the 

acquisition of cloud services.

 

47One agency in our review reported that it had not realized any significant benefits from 

acquiring cloud services. 

48The 15 agencies were Agriculture, Commerce, Defense, DHS, Energy, Education, GSA, 

Justice, Labor, SBA, SSA, State, Transportation, Treasury, and VA. HHS officials reported 

that they had no examples of cloud migrations or deployments that produced benefits 

because it did not have any completed migration efforts. 

49Cloud computing allows an organization the ability to scale resources up or down by 

adding or removing processing or memory capacity, or both, according to demand. This 

enables the organization to provision the resources that are allocated to match what 

actual resources are needed.

Selected Agencies 

Have Realized 

Benefits from Cloud 

Services

Cloud Services Aid with IT 

Efficiency, Cost Savings, 

and System Modernization
Page 37 GAO-19-58 IT Cloud Computing

Table 6: Significant or Notable Benefits Reported by 15 Selected Federal Agencies 

from the Acquisition of Cloud Computing Services 

Benefit identified 

Number of agencies 

identifying benefit

Improved the delivery of IT services through more flexible and 

scalable IT resources

15

Helped reduce the cost of provisioning IT infrastructure and 

managing IT services

15

Increased the efficiency of operations and systems through 

system performance improvements and automated functions 

15

Enhanced the customer’s experience by improving system 

design and usability 

13

Strengthened mission assurance through streamlined security 

resources and improved backup capabilities 

13

Source: GAO analysis of agency data. | GAO-19-58

Note: Some agencies reported multiple benefits from the acquisition of cloud computing services. The 

15 agencies include the Departments of Agriculture, Commerce, Defense, Energy, Education, 

Homeland Security, Justice, Labor, State, Transportation, the Treasury, and Veterans Affairs; and the 

General Services Administration, Small Business Administration, and Social Security Administration. 

Officials in the Office of the CIO at the 15 agencies reported that 

acquiring cloud services had allowed them to procure IT resources that 

were more flexible and scalable than the prior legacy infrastructure. For 

example, officials in Labor’s Office of the CIO reported that they had 

acquired cloud services to address seasonal demands for system 

processing. By eliminating the need to purchase additional servers and 

other equipment that would go unused during the rest of the year, Labor 

officials reported that cloud services allow the agency to scale resources 

up during these periods of increased processing and then scale the 

resources back down when the excess capacity is no longer needed.

In addition, officials in DHS’s Office of the CIO reported that, in 2012, they 

had acquired software as a service for the agency’s virtual desktop 

solution. This new service provided six agency components access to 

virtual secure desktop operating systems and applications. By eliminating 

the need for users to be physically present in a specified location in order 

to perform work activities, DHS officials reported that cloud services had 

improved the ability to quickly respond to the agency’s mission needs and 

provided teleworking capabilities. In addition, the officials reported that 

the solution streamlined the process of provisioning network access 

between agency components and other external agencies.

Procuring Cloud Services 

Improved the Delivery of IT 

Services
Page 38 GAO-19-58 IT Cloud Computing

Officials in the Office of the CIO at the 15 agencies reported that 

acquiring cloud services had allowed them to procure more cost-effective 

options for provisioning IT infrastructure and managing IT services. For 

example, officials in Education’s Office of the CIO reported that, by 

migrating the Institute of Education Sciences’50 data center to the cloud in 

2014, the agency had saved approximately $3.3 million in cost 

avoidances annually for the last 3 years from not having to pay prior data 

center hosting charges. In addition, Education officials reported that the 

agency had saved $11.6 million between fiscal years 2013 and 2018 by 

eliminating contractor website hosting.

In addition, officials in Energy’s Office of the CIO reported that the agency 

saved $900,000 in fiscal years 2013 to 2014 by transitioning to a cloudbased platform for managing IT services, such as asset management. 

Acquiring the software and platform as a service reduced or eliminated 

the costs of administering the agency’s on-premise legacy infrastructure 

and associated software licensing fees.

Officials in the 15 agencies’ Offices of the CIO reported that acquiring 

cloud services had allowed them to streamline or improve systems and 

automate business processes and other functions. For example, officials 

in State’s Office of the CIO reported that the agency had previously relied 

on paper-based and manual processes for completing employee requests 

for, among other things, leave, training, personal identification cards, and 

other general services. By acquiring software and platform as a service, 

State implemented an electronic application that replaced over 800 paper 

forms used to make these requests, without the time and cost of 

developing an application themselves. As a result, the officials reported 

that they estimate the application has saved more than 50,000 hours of 

staff time since its deployment by streamlining the request process, 

automatically populating common data fields, and improving support 

options.

 

50The Institute of Education Sciences provides education data and research that 

addresses school readiness and education from infancy through adulthood. The Institute’s 

work includes, among other things, conducting surveys, sponsoring research projects, 

funding development and testing of approaches for improving education outcomes, and 

providing data on how well the United States is educating its students. 

Acquiring Cloud Services 

Helped Agencies Reduce the 

Cost of IT Services

Using Cloud Services 

Increased the Efficiency of 

Agency Operations and 

Systems
Page 39 GAO-19-58 IT Cloud Computing

In addition, officials in Treasury’s Community Development Financial 

Institutions Fund51 reported that their office acquired software as a 

service, which will enable them to reduce the number of legacy systems 

related to awards management from 17 to 2. These legacy systems had 

required staff to enter the same data in different systems and manually 

complete certification work tasks. By automating many of the manual 

review and compliance processes, the officials reported that the office 

saved approximately 650 staff hours in 2017.

Officials in the Office of the CIO at 13 agencies reported that acquiring 

cloud services had allowed their agencies to improve system design and 

usability, which helped to enhance their customer service. For example, 

VA officials reported that they had deployed a website in the cloud, 

Access to Care,52 which included detailed data on the wait times and 

quality-care metrics at local hospitals. Doing so enabled veterans to be 

able to make better decisions about their health care options. By 

acquiring cloud services, VA officials reported that they had developed 

and deployed the new Access to Care website in approximately 30 days, 

incorporating information from 130 components of VA’s electronic health 

records system that were previously available on disparate legacy 

websites into one website. Further, the officials reported that the new 

website increased the transparency of health care information for the 

veteran community, empowered veterans, and promoted competition for 

health care services.53

 

51The Community Development Financial Institutions Fund provides awards, for example, 

to institutions such as community development banks, credit unions, and other loan and 

venture capital funds, in order to finance activities including mortgage lending for first-time 

homebuyers, flexible underwriting for community facilities, and commercial loans for 

businesses in low-income areas. In fiscal year 2018, the fund awarded $495 million in 

financial assistance, loans, and bond guarantees. 

52Access to Care is a website enabling veterans and their families to view wait times at VA 

facilities, compare care ratings, and review national data.

53In September 2017, we reported that VA provided the status of health care quality 

measures on its Access to Care website in a way that is accessible and easy to 

understand. However, we found that the agency’s website only included a subset (15 out 

of 110) of the quality measures on VA medical centers. We therefore recommended that 

the agency report a broader range of health care quality measures on its website. VA

concurred with our recommendation and stated that they planned to expand the quality 

measures reported on the website.

Cloud Services Helped 

Agencies Enhance Their 

Customer Service
Page 40 GAO-19-58 IT Cloud Computing

In addition, a Defense official from the Army’s Total Ammunition 

Management Information System54 reported that the office had acquired 

infrastructure as a service in order to improve the processing and 

reporting of ammunition requests that the Army receives from users 

worldwide. Defense staff reported that, previously, they had received 

complaints from customers regarding system pauses and delays when 

entering requests for ammunition and generating reports due to legacy 

infrastructure. Defense officials stated that using infrastructure as a 

service improved system processing and reporting times—from minutes 

to seconds—by providing scalable technology resources that can meet 

worldwide performance demands. As a result, customers can more 

quickly enter their orders into the system.

Officials in the Office of the CIO at nine agencies reported that acquiring 

cloud services had allowed them to achieve greater levels of mission 

assurance by streamlining security resources and improving backup 

capabilities that were not available previously. For example, officials at 

Defense’s North American Aerospace Defense Command and U.S. 

Northern Command reported that they had acquired cloud services for the 

Situational Awareness Geospatial Enterprise system55 in order to improve 

mission assurance and address Defense cybersecurity requirements.

According to the officials, cloud services improved mission assurance by 

allowing them to more quickly correct problems such as malware and the 

loss of network connectivity in order to ensure the near continuous 

availability of data from different access points. In addition, the system 

required extensive storage and backup capabilities due to the need to 

ensure the system’s data were available continuously from different 

access points. The officials reported that the acquisition of cloud services 

has reduced the costs required to maintain continuous backup and 

storage capabilities. They added that the system also complies with 

Defense requirements that investments use an approved cloud service 

 

54The Total Ammunition Management Information System is a web-based system used to, 

among other things, validate, track, manage, and authorize ammunition requests for 

training and combat purposes. 

55The Situational Awareness Geospatial Enterprise system is a global unclassified, spacebased tracking system that provides situational awareness data to a variety of 

organizations, including local law enforcement, and federal agencies. Officials use the 

system during special events such as the State of the Union address and the World 

Series, which require additional security. In addition, the system combines air tracking 

data with geospatial data to track hostiles, unknowns, friendlies, and suspects with respect 

to the President’s location at all times.

Acquiring Cloud Services 

Strengthened Mission 

Assurance
Page 41 GAO-19-58 IT Cloud Computing

provider. In addition, the officials said acquiring cloud services has 

provided the capability to scale resources, as needed, to meet demands 

during special events, such as the State of the Union address and the 

World Series, which require additional security.

Further, Federal Transit Administration officials reported that migrating 

two systems to the cloud had allowed the agency to enhance system 

security by managing access to the systems through a single portal rather 

than managing access to each system individually. As a result, the 

officials reported that they were able to shift some responsibilities of 

systems security management to the cloud vendor, which reduced the 

number of security risks and consolidated the number of security tools 

used. Further, according to the officials, an additional benefit is that users 

are required to only remember a single password rather than different 

passwords required for the multiple systems.

Separately, from information provided by the 15 selected agencies, we 

identified nine cloud computing investments that illustrate the variety of 

examples of benefits that had been realized by these agencies from the 

acquisition of cloud services. Table 7 identifies these investments and 

additional details regarding the nature and sources of the benefits 

achieved from them are profiled in appendix VI.56

 

56Additional detail on how these agencies were selected can be found in appendix I.
Page 42 GAO-19-58 IT Cloud Computing

Table 7: Investments That Benefited from Cloud Acquisition, as Reported by Selected Federal Agencies Since 2012 

Cloud investment Agency Managing component

Cloud operations 

start date 

Manufacturing Support Suite Department of Treasury Bureau of Engraving and Printing October 2012

National Transit Database Department of Transportation Federal Transit Administration October 2014

Data to Decisions General Services Administration Not applicable October 2015

Vets.gov Web Portal Department of Veterans Affairs Not applicable March 2016

U.S. Trustee Program Cloud Initiative Department of Justice U.S. Trustee Program March 2017

Homeland Security Information 

Network

Department of Homeland Security Not applicable July 2017

Pinyon Department of Agriculture U.S. Forest Service August 2017

Weather Cloud Content Delivery 

Network

Department of Commerce National Oceanic and 

Atmospheric Administration

September 2017

U.S. Transportation Command Cloud 

Program

Department of Defense U.S. Transportation Command January 2018

Source: GAO analysis of agency data. | GAO-19-58

In addition to the examples of significant benefits reported from acquiring 

cloud services, officials at the 15 agencies reported that six key practices 

had enabled them to realize these benefits through the successful 

implementation of cloud services. For example, 12 agencies reported that 

they implemented new governance planning activities, policies, or 

processes in order to help ensure that cloud acquisition efforts were 

managed enterprisewide. In addition, 12 agencies reported that they had 

reorganized the management of agency IT resources to help increase 

operational efficiency. Further, six agencies reported that having 

executive leadership involved in driving the acquisition or sponsoring 

efforts to use cloud services was critical for the successful adoption of 

cloud services across the agency. Table 8 lists these key practices and 

the number of agencies that reported each key practice, ranked by the 

number of agencies reporting the practice.

Selected Agencies 

Identified Key Practices 

That Enabled Cloud 

Services
Page 43 GAO-19-58 IT Cloud Computing

Table 8: Key Practices Reported by 15 Selected Federal Agencies for Helping to 

Ensure the Successful Implementation of Cloud Computing Services 

Key practice activity Number of agencies 

Implemented new governance planning activities, policies, and 

processes 

12

Modified procurement and contract oversight practices 12

Addressed changes in IT workforce needs 12

Reorganized the management of IT resources 12

Streamlined and improved IT security management 8

Engaged executive leadership to help drive acquisition efforts 6

Source: GAO analysis of agency data. | GAO-19-58

Note: The 15 agencies were the Departments of Agriculture, Commerce, Defense, Energy, 

Education, Homeland Security, Justice, Labor, State, Transportation, the Treasury, and Veterans 

Affairs; and the General Services Administration, Small Business Administration, and Social Security 

Administration. 

In addition, many of these six key practice areas identified by agencies 

are consistent with requirements outlined in FITARA57 and 

recommendations from our prior work58 made to agencies to address 

longstanding issues with the management of IT acquisitions and 

operations. Specifically, we previously have noted the importance of 

strengthening the authority of CIOs, improving the portfolio review 

process and the transparency of major investment data, ensuring the use 

of incremental development methodologies, and updating human capital 

plans.

 

57Pub. L. No. 113-291, division A, title VIII, subtitle D, § 831, 128 Stat. 3292, 3438 (Dec. 

19, 2014). 

58GAO, Federal Chief Information Officers: Critical Actions Needed to Address 

Shortcomings and Challenges in Implementing Responsibilities, GAO-18-93 (Washington, 

D.C.: August 2, 2018); Information Technology Reform: Agencies Need to Improve 

Certification of Incremental Development, GAO-18-148 (Washington, D.C.: November 7, 

2017); IT Workforce: Key Practices Help Ensure Strong Integrated Program Teams; 

Selected Departments Need to Assess Gaps, GAO-17-8 (Washington, D.C.: November 

30, 2016); Information Technology: Additional OMB and Agency Actions Needed to 

Ensure Portfolio Savings Are Realized and Effectively Tracked, GAO-15-296

(Washington, D.C.: April 16, 2015) and IT Dashboard: Agencies Need to Fully Consider 

Risks When Rating Their Investments, GAO-16-494 (Washington, D.C.: June 2, 2016).
Page 44 GAO-19-58 IT Cloud Computing

Officials in the Office of the CIO at 12 agencies reported that they had 

implemented new governance activities or drafted new policies and 

processes to help ensure the successful implementation of cloud 

services. For example, SSA officials reported that they had drafted 

several new policies to simplify the management of cloud resources and 

provide better oversight for new cloud service acquisitions. Specifically, 

the officials reported that the new policies established a request-andapproval governance process to address which staff can initiate cloud 

solutions and what types of projects can receive funding.

In addition, Energy officials reported that they had formalized policies and 

governance processes on how to perform cloud migrations, including 

establishing a documented, repeatable process to help offices migrate to 

cloud services more efficiently. Further, Treasury officials reported that 

they had focused on strengthening cloud-governance activities, including 

planning and identifying requirements, because changes to enterprise 

cloud systems may impact multiple programs. As a result, these officials 

reported that they had implemented a cross-cutting steering committee to 

help better plan and assess the impact of changes to enterprise cloud 

systems that support multiple programs.

Officials in the Office of the CIO at 12 agencies reported that they had 

modified their procurement and contract oversight practices in order to 

accommodate the differences in how cloud services are acquired from 

traditional acquisitions. For example, Commerce officials emphasized the 

importance of developing standardized requirements to ensure that when 

bureaus award contracts, they use standardized language. The officials 

stated that these requirements help to ensure that contracts with cloud 

service providers are comprehensive, legally adequate, and include 

specific details regarding all of the activities the agency will need the 

contractor to perform.

In addition, officials of the U.S. Trustee Program at Justice reported that 

they had used existing project and financial management resources to 

monitor the use of cloud services and associated spending to help control 

costs and ensure the accuracy of cloud vendor charges. For example, the 

officials reported that the program used the cloud vendor’s administrative 

and business intelligence tools to create reports to verify cloud charges. 

Also, Labor officials reported that they had worked with the agency’s 

acquisition team to ensure the agency is only billed for its actual cloud 

usage. This required the agency to transition from a fixed-price contract 

model to a time and materials-based contract model, which included a 

Selected Agencies 

Implemented New Policies and 

Processes to Guide 

Governance of Cloud 

Acquisition

Selected Agencies Modified 

Procurement and Contract 

Oversight Practices to 

Strengthen Cloud Acquisition 

Processes
Page 45 GAO-19-58 IT Cloud Computing

clause that limited the maximum costs the agency would have to pay for 

cloud services.

Officials in the Office of the CIO at 12 agencies reported that they had 

taken several steps to address changes in workforce needs for managing 

cloud services. Specifically, these officials reported that they had 

conducted inventories of staff skills, transitioned staff into new roles, and 

ensured that staff acquired training. For example, VA officials reported 

that they had conducted a staff skills inventory to identify future IT 

workforce training needs and transition staff from managing legacy 

technologies to managing cloud services. In addition, Energy officials 

reported that they were preparing staff to transition from managing data 

center resources to managing the agency’s service level agreements with 

cloud providers. The officials reported that moving to cloud services 

allowed staff to spend more time improving existing applications and 

identifying other efforts to innovate IT services rather than managing onpremise infrastructure. Further, a Defense official lead for cloud 

computing in the Navy’s Office of the CIO reported that the Navy had 

developed an enterprise cloud working group consisting of key members 

from major offices and security groups to help determine the appropriate 

training and certification needs for staff and to conduct training seminars. 

In addition, SBA officials said that the agency took advantage of a 

contract option offered by the cloud vendor to acquire free cloud classes 

and training, thereby avoiding the need to spend approximately $380,000 

on training.

Office of the CIO officials at 12 agencies reported that acquiring cloud 

services had led them to change how they organized and managed the 

agency’s IT resources. For example, GSA officials reported that they had 

transitioned from letting individual components within the agency acquire 

their own application to using an enterprise approach in which software 

as a service applications are acquired and made available to the entire 

agency. As a result, the officials reported that this approach allows the 

agency to further optimize their software purchases and improve their 

monitoring and tracking of software application usage enterprise-wide.

In addition, officials at the Agricultural Research Service reported that 

acquiring software as a service had promoted opportunities to share 

customizations of the acquired software between Agriculture’s 

components rather than having each component develop a separate 

customization. Specifically, these officials reported that they were able to 

take a software feature developed by another Agriculture component and 

Selected Agencies Addressed 

Changes in Workforce Needs 

for Managing Cloud Services

Selected Agencies 

Reorganized the Management 

of IT Resources to Increase 

Operational Efficiency
Page 46 GAO-19-58 IT Cloud Computing

implement it for their customer service portal, rather than having to 

develop it themselves.

Lastly, Education officials reported that they were in the process of 

beginning an assessment to consolidate the agency’s existing cloud 

services across federal and commercial environments. The officials said 

that they hoped to reduce the number of commercial cloud providers used 

from twenty-five to eight, and to consolidate two of the agency’s cloud 

environments into a single environment within the next 3 years.

Office of the CIO officials at eight agencies reported that they were able 

to streamline the management of IT security by leveraging cloud services. 

For example, SBA officials reported that they used security tools from 

their cloud vendor in order to meet DHS’s requirements for continuous 

diagnostics and mitigation and improve the agency’s security posture. 

The officials reported that they had performed a requirements analysis 

and found that, compared to acquiring costly hardware solutions to 

manage this capability internally, their existing cloud vendor provided 

security capabilities that actually exceeded DHS’s recommended 

continuous diagnostics and mitigation requirements. As a result, SBA 

adopted the cloud vendor’s security tools and avoided $300,000 in initial 

hardware purchases, as well as subsequent hardware technology 

refreshes every 3 years.

In addition, GSA officials reported that choosing a FedRAMP-approved 

cloud service provider had expedited the agency’s adoption of cloud 

services. Specifically, the agency did not have to visit and review each 

vendor’s facility as part of the vendor approval process, which shortened 

the time frame needed to approve a system for use. The officials also 

reported that using cloud services streamlined the deployment process 

for new systems because using a cloud platform that had previously been 

granted the authority to operate59 allowed the agency to avoid 

undertaking a separate authorization process, which saved time and 

resources.

 

59National Institute of Standards and Technology, Guide for Applying the Risk 

Management Framework to Federal Information Systems: A Security Life Cycle Approach, 

Special Publication 800-37 (Revision 1, updated June 5, 2014), defines the authority to 

operate as the official management decision given by a senior organizational official to 

authorize operation of an information system and to explicitly accept the risk to 

organizational operations (including mission, functions, image, or reputation), 

organizational assets, individuals, other organizations, and the nation based on the 

implementation of an agreed-upon set of security controls. 

Selected Agencies Streamlined 

Cloud Services to Address 

Security Needs in a More 

Efficient Manner
Page 47 GAO-19-58 IT Cloud Computing

Officials in the Office of the CIO at six agencies reported that having 

executive leadership involved in driving acquisitions or sponsoring efforts 

to use cloud services was critical to the successful adoption of cloud 

services across the agency. For example, SBA officials reported that their 

agency CIO’s commitment to acquiring cloud services and the deputy 

CIO’s attendance at daily cloud meetings were critical for the successful 

adoption of cloud services at the agency. Similarly, Energy officials 

reported that the agency had established a team with representatives 

from offices of the CIO, chief financial officer, and chief acquisition officer, 

to coordinate IT expenditures, including cloud investments, across the 

agency.

Further, Defense officials from the U.S. Transportation Command 

reported that establishing a cloud center of excellence team that reported 

directly to the Commander of U.S. Transportation Command had 

empowered the team to engage directly with users to help break down 

barriers that might impact the migration to cloud services. In addition, the 

officials said that the team helped streamline the processes—specifically, 

the design, contracting, funding, transition planning, and implementation 

processes—necessary for the successful migration of all of the 

command’s systems to the cloud.

Since 2011, when OMB began requiring agencies to adopt a Cloud First 

strategy, agencies have made progress in implementing cloud services 

and, in doing so, have saved hundreds of millions of dollars and realized 

notable benefits. However, six agencies still lack guidance for assessing 

IT investments for cloud services and 12 agencies still have not 

performed assessments for a number of their IT investments. In addition, 

all of the agencies in our review do not have sufficient mechanisms or 

approaches to track and report the savings data associated with these 

cloud initiatives.

Although agencies have reported spending $1 billion or more on cloud 

services in just the past 2 years, and identified hundreds of millions of 

dollars in related savings, these figures are not consistently reported. To 

its credit, beginning in fiscal year 2019, OMB will require more accuracy 

and granularity in how agencies report cloud investment spending data. 

However, there has not been a corresponding effort to improve the 

reporting of cloud savings data. An important aspect to the success of key 

OMB cloud initiatives, like Cloud Smart and the associated drive for 

greater agency adoption of cloud services, will be the ability for key 

Selected Agencies Engaged 

Executive Leadership Support 

during Cloud Acquisition to 

Help Ensure Successful 

Implementation

Conclusions
Page 48 GAO-19-58 IT Cloud Computing

stakeholders to access complete information on the savings that agencies 

are achieving under these efforts.

We are making a total of 35 recommendations—1 recommendation to 

OMB and 34 recommendations to the 16 agencies in our review.

The Director of the Office of Management and Budget should require 

agencies to explicitly report, at least on a quarterly basis, the savings and 

cost avoidance associated with cloud computing investments. 

(Recommendation 1)

The Secretary of Agriculture should ensure that the CIO of Agriculture 

completes an assessment of all IT investments for suitability for migration 

to a cloud computing service, in accordance with OMB guidance. 

(Recommendation 2)

The Secretary of Agriculture should ensure that the CIO of Agriculture 

establishes a consistent and repeatable mechanism to track savings and 

cost avoidances from the migration and deployment of cloud services. 

(Recommendation 3)

The Secretary of Commerce should ensure that the CIO of Commerce 

establishes a consistent and repeatable mechanism to track savings and 

cost avoidances from the migration and deployment of cloud services. 

(Recommendation 4)

The Secretary of Defense should ensure that the CIO of Defense 

completes an assessment of all IT investments for suitability for migration 

to a cloud computing service, in accordance with OMB guidance. 

(Recommendation 5)

The Secretary of Defense should ensure that the CIO of Defense 

establishes a consistent and repeatable mechanism to track savings and 

cost avoidances from the migration and deployment of cloud services. 

(Recommendation 6)

The Secretary of Education should ensure that the CIO of Education 

establishes guidance on assessing new and existing IT investments for 

suitability for cloud computing services, in accordance with OMB 

guidance. (Recommendation 7) 

Recommendations for 

Executive Action
Page 49 GAO-19-58 IT Cloud Computing

The Secretary of Education should ensure that the CIO of Education 

completes an assessment of all IT investments for suitability for migration 

to a cloud computing service, in accordance with OMB guidance. 

(Recommendation 8)

The Secretary of Education should ensure that the CIO of Education 

establishes a consistent and repeatable mechanism to track savings and 

cost avoidances from the migration and deployment of cloud services. 

(Recommendation 9)

The Secretary of Energy should ensure that the CIO of Energy updates 

the agency’s guidance on assessing IT investments for suitability for 

cloud computing services to include a requirement to assess new 

acquisitions for these services. (Recommendation 10)

The Secretary of Energy should ensure that the CIO of Energy completes 

an assessment of all IT investments for suitability for migration to a cloud 

computing service, in accordance with OMB guidance. (Recommendation 

11)

The Secretary of Energy should ensure that the CIO of Energy 

establishes a consistent and repeatable mechanism to track savings and 

cost avoidances from the migration and deployment of cloud services. 

(Recommendation 12)

The Secretary of Health and Human Services should ensure that the CIO 

of HHS establishes guidance on assessing new and existing IT 

investments for suitability for cloud computing services, in accordance 

with OMB guidance. (Recommendation 13)

The Secretary of Health and Human Services should ensure that the CIO 

of HHS completes an assessment of all IT investments for suitability for 

migration to a cloud computing service, in accordance with OMB 

guidance. (Recommendation 14)

The Secretary of Health and Human Services should ensure that the CIO 

of HHS establishes a consistent and repeatable mechanism to track 

savings and cost avoidances from the migration and deployment of cloud 

services. (Recommendation 15)

The Secretary of Homeland Security should ensure that the CIO of DHS 

completes an assessment of all IT investments for suitability for migration 
Page 50 GAO-19-58 IT Cloud Computing

to a cloud computing service, in accordance with OMB guidance. 

(Recommendation 16)

The Secretary of Homeland Security should ensure that the CIO of DHS 

establishes a consistent and repeatable mechanism to track savings and 

cost avoidances from the migration and deployment of cloud services. 

(Recommendation 17)

The Attorney General of the United States should ensure that the CIO of 

Justice completes an assessment of all IT investments for suitability for 

migration to a cloud computing service, in accordance with OMB 

guidance. (Recommendation 18)

The Attorney General of the United States should ensure that the CIO of 

Justice establishes a consistent and repeatable mechanism to track 

savings and cost avoidances from the migration and deployment of cloud 

services. (Recommendation 19)

The Secretary of Labor should ensure that the CIO of Labor updates the 

agency’s guidance on assessing IT investments for suitability for cloud 

computing services to include a requirement to assess existing 

investments for these services. (Recommendation 20)

The Secretary of Labor should ensure that the CIO of Labor completes an 

assessment of all IT investments for suitability for migration to a cloud 

computing service, in accordance with OMB guidance. (Recommendation 

21)

The Secretary of Labor should ensure that the CIO of Labor establishes a 

consistent and repeatable mechanism to track savings and cost 

avoidances from the migration and deployment of cloud services. 

(Recommendation 22)

The Secretary of State should ensure that the CIO of State establishes a 

consistent and repeatable mechanism to track savings and cost 

avoidances from the migration and deployment of cloud services. 

(Recommendation 23)

The Secretary of the Treasury should ensure that the CIO of Treasury 

completes an assessment of all IT investments for suitability for migration 

to a cloud computing service, in accordance with OMB guidance. 

(Recommendation 24)
Page 51 GAO-19-58 IT Cloud Computing

The Secretary of the Treasury should ensure that the CIO of Treasury 

establishes a consistent and repeatable mechanism to track savings and 

cost avoidances from the migration and deployment of cloud services. 

(Recommendation 25)

The Secretary of Transportation should ensure that the CIO of 

Transportation establishes guidance on assessing new and existing IT 

investments for suitability for cloud computing services. 

(Recommendation 26)

The Secretary of Transportation should ensure that the CIO of 

Transportation completes an assessment of all IT investments for 

suitability for migration to a cloud computing service, in accordance with 

OMB guidance. (Recommendation 27)

The Secretary of Transportation should ensure that the CIO of 

Transportation establishes a consistent and repeatable mechanism to 

track savings and cost avoidances from the migration and deployment of 

cloud services. (Recommendation 28)

The Secretary of Veterans Affairs should ensure that the CIO of VA 

completes an assessment of all IT investments for suitability for migration 

to a cloud computing service, in accordance with OMB guidance. 

(Recommendation 29)

The Secretary of Veterans Affairs should ensure that the CIO of VA 

establishes a consistent and repeatable mechanism to track savings and 

cost avoidances from the migration and deployment of cloud services. 

(Recommendation 30)

The Administrator of General Services should ensure that the CIO of GSA 

establishes a consistent and repeatable mechanism to track savings and 

cost avoidances from the migration and deployment of cloud services. 

(Recommendation 31)

The Administrator of the Small Business Administration should ensure 

that the CIO of SBA establishes a consistent and repeatable mechanism 

to track savings and cost avoidances from the migration and deployment 

of cloud services. (Recommendation 32)

The Commissioner of the Social Security Administration should ensure 

that the CIO of SSA updates the agency’s guidance on assessing IT 

investments for suitability for cloud computing services to include a 
Page 52 GAO-19-58 IT Cloud Computing

requirement to assess existing investments for these services. 

(Recommendation 33)

The Commissioner of the Social Security Administration should ensure 

that the CIO of SSA completes an assessment of all IT investments for 

suitability for migration to a cloud computing service, in accordance with 

OMB guidance. (Recommendation 34)

The Commissioner of the Social Security Administration should ensure 

that the CIO of SSA establishes a consistent and repeatable mechanism 

to track savings and cost avoidances from the migration and deployment 

of cloud services. (Recommendation 35)

We provided a draft of this report to OMB and the 16 agencies for their 

review and comment. In response, 14 agencies provided comments 

stating that they agreed with our recommendations; one agency stated 

that it agreed with one recommendation but disagreed with another; and 

two agencies did not state whether they agreed or disagreed with the 

recommendations. In addition, multiple agencies provided technical 

comments, which we incorporated into the report, as appropriate.

The following 14 agencies agreed with our recommendations:

• In written comments from Commerce, Education, Energy, HHS, DHS, 

State, Transportation, VA, and GSA, these agencies stated that they 

agreed with the recommendations directed to them. In addition, each 

of the agencies indicated that it planned, or already had begun taking 

actions, to address the recommendations. The agencies’ comments 

are reprinted in appendixes VII through XV, respectively. 

• In emails received from Agriculture’s Director of Strategic Planning, 

Policy, Egovernment and Audits in the Office of the CIO on February 

11, 2019, and from Justice’s Audit Liaison Specialist in the Internal 

Review and Evaluation Office on February 15, 2019, both of these 

departments stated that they agreed with our recommendations.

• In written comments from Labor, the department stated that it agreed 

with our recommendations. The department also described actions 

taken to address our recommendation that it update its guidance on 

assessing IT investments for suitability for cloud computing services 

to include a requirement to assess existing investments for these 

services. Specifically, Labor stated that it had taken steps to ensure 

that its agencies included an assessment of cloud computing 

Agency Comments 

and Our Evaluation
Page 53 GAO-19-58 IT Cloud Computing

suitability as they moved forward with their investments and that this 

process had been integrated into Labor’s budget process. We 

followed up with the department and obtained a copy of Labor’s 

guidance. 

However, in examining this guidance,60 we found it to be the same as 

what Labor had previously provided to us during the course of our 

audit. Further, as we mentioned earlier regarding our analysis of the 

department’s guidance for assessing investments for suitability for 

cloud services, Labor had required existing investments that were 

already using cloud services to migrate to the department’s new 

consolidated cloud environment; however, it did not require existing 

systems not using cloud services to be assessed for these services. 

Without receiving any additional information from the department that 

supported its actions to address our recommendation prior to this 

report’s issuance, we believe our recommendation to Labor is still 

appropriate. The department’s comments are reprinted in appendix 

XVI. 

• In written comments from SBA, the agency agreed with our 

recommendation. Also, in additional comments sent by a GAO liaison

in the Office of Congressional and Legislative Affairs via email on 

March 11, 2019, SBA provided updated information regarding the 

benefits that the agency had realized from using cloud services for its 

system that was profiled in appendix VI of the draft report. 

Specifically, SBA officials in charge of the system provided a revised 

list of realized benefits from the cloud services. However, the officials 

did not provide any supporting documentation regarding the revised 

benefits; therefore, we were not able to validate the revised list of 

benefits prior to the issuance of this report. As a result, we removed 

the profile from the report in order to be consistent with our 

methodology for reporting examples of systems that had realized 

benefits from the acquisition of cloud services, and notified SBA of 

this decision. SBA’s comments are reprinted in appendix XVII.

• In written comments from SSA, the agency agreed with our 

recommendations. Also, in additional comments that a management 

analyst from the office of the Deputy Commissioner for Analytics, 

Review and Oversight provided via email on January 11, 2019, SSA 

noted that the agency was in the process of acquiring a new vendor 

solution for its system that was profiled in appendix VI of the draft 

 

60Department of Labor, DOL OCIO Cloud Consolidation Initiative (DC2

I) Application and 

Service Migration to DOL Cloud, version 1.5 (March 2018).
Page 54 GAO-19-58 IT Cloud Computing

report. However, during further discussion with SSA officials in charge 

of the system on January 17, 2019, the officials confirmed that the 

agency had not yet identified all of the potential benefits related to the 

use of cloud services as a result of a change in their vendor solution. 

Thus, we removed the profile from our report in order to be consistent 

with our methodology for reporting examples of systems that had 

realized benefits from the acquisition of cloud services, and notified 

SSA of this decision. SSA’s comments are reprinted in appendix 

XVIII.

One agency agreed with one recommendation and disagreed with a 

second recommendation:

• Defense provided written comments in which it agreed with our 

recommendation to complete an assessment of all IT investments for 

suitability for migration to a cloud computing service. However, the 

agency did not agree with our recommendation that it establish a 

mechanism to track savings and cost avoidances from the migration 

and deployment of cloud services. Specifically, Defense stated that it 

did not agree with our recommendation because there was no 

standard, consistent way to capture such savings or cost avoidance. 

The department stated that it would work with OMB on whether or

how to collect such information, and, if practical, report such 

information in accordance with OMB guidance. 

However, as we noted in our report, for the past 6 years, OMB has 

required agencies to report on savings and cost avoidances from 

implementing IT reform initiatives, including savings realized from the 

migration to cloud services. Tracking savings and cost avoidances for 

cloud initiatives is important in order to ensure that Defense is 

effectively managing and overseeing its cloud initiatives. In addition, it 

is essential that OMB and Congress have sufficient data to see the 

results of Defense’s cloud initiatives and understand whether the 

department is achieving savings using cloud services. Consequently, 

we believe our recommendation to track savings and cost avoidances 

from the migration and deployment of cloud services is still warranted. 

The department’s comments are reprinted in appendix XIX.

Finally, we received comments via email from Treasury’s Supervisory IT 

Specialist in the Office of the CIO on February 22, 2019, and OMB’s 

Liaison to GAO on February 25, 2019. In these comments these two 

agencies did not state whether they agreed or disagreed with the 

recommendations that we directed to them. 
Page 55 GAO-19-58 IT Cloud Computing

As agreed with your offices, unless you publicly announce the contents of 

this report earlier, we plan no further distribution until 30 days from the 

report date. At that time, we will send copies of this report to the Director 

of the Office of Management and Budget, the Secretaries and agency 

heads of the departments and agencies in this report, and other 

interested parties. This report will also be available at no charge on our 

website at http://www.gao.gov. 

If you or your staffs have any questions on matters discussed in this 

report, please contact me at (202) 512-4456 or harriscc@gao.gov. 

Contact points for our Offices of Congressional Relations and Public 

Affairs may be found on the last page of this report. GAO staff who made 

major contributions to this report are listed in appendix XX. 

Carol C. Harris

Director, Information Technology

 Acquisition Management Issues
Page 56 GAO-19-58 IT Cloud Computing

List of Requesters

The Honorable Elijah E. Cummings

Chairman

The Honorable Jim Jordan

Ranking Member

Committee on Oversight and Reform

House of Representatives

The Honorable Gerry Connolly

Chairman

The Honorable Mark Meadows

Ranking Member

Subcommittee on Government Operations

Committee on Oversight and Reform

House of Representatives

The Honorable Will Hurd

House of Representatives

The Honorable Robin L. Kelly

House of Representatives
Appendix I: Objectives, Scope, and 

Methodology

Page 57 GAO-19-58 IT Cloud Computing

Our objectives for this engagement were to (1) evaluate selected 

agencies’ progress in implementing cloud services, (2) review the extent 

to which selected agencies have increased spending on cloud services 

and achieved cost savings or avoidances, and (3) describe examples of 

cloud investments with significant or notable benefits that have been 

identified by selected agencies.

For this review, we selected a sample of agencies based on the size of 

their total information technology (IT) budget for fiscal year 2017. 

Specifically, we categorized each of the 24 Chief Financial Officers Act

agencies1 by the size of its IT budget: large (more than $3 billion), 

medium ($1 billion to $3 billion), and small (less than $1 billion), as 

reported on the Office of Management and Budget’s (OMB) IT 

Dashboard2 for 2017. We then selected up to six agencies with the 

largest budgets from each budget category.

Using these criteria, we selected 16 agencies, including seven agencies 

from our prior work on cloud services conducted in 2012 and 2014.3

These agencies were the Department of Agriculture (Agriculture), 

Department of Commerce (Commerce), Department of Defense 

(Defense), Department of Education (Education), Department of Energy 

(Energy), Department of Health and Human Services (HHS), Department 

of Homeland Security (DHS), Department of Justice (Justice), 

Department of Labor (Labor), Department of State (State), Department of 

Transportation (Transportation), Department of the Treasury (Treasury), 

Department of Veterans Affairs (VA), General Services Administration 

(GSA), Small Business Administration (SBA), and Social Security 

Administration (SSA).

 

1

The 24 major agencies listed in the Chief Financial Officers Act of 1990 are the 

Departments of Agriculture, Commerce, Defense, Education, Energy, Health and Human 

Services, Homeland Security, Housing and Urban Development, the Interior, Justice, 

Labor, State, Transportation, the Treasury, and Veterans Affairs; the Environmental 

Protection Agency, General Services Administration, National Aeronautics and Space 

Administration, National Science Foundation, U.S. Nuclear Regulatory Commission, Office 

of Personnel Management, Small Business Administration, Social Security Administration, 

and U.S. Agency for International Development. 31 U.S.C. § 901(b). 

2

OMB, IT Dashboard, 2017 (https://itdashboard.gov).

3

GAO, Cloud Computing: Additional Opportunities and Savings Need to Be Pursued, 

GAO-14-753 (Washington, D.C.: Sept. 25, 2014); and Information Technology Reform: 

Progress Made but Future Cloud Computing Efforts Should be Better Planned, GAO-12-

756 (Washington, D.C.: July 11, 2012). 

Appendix I: Objectives, Scope, and 

Methodology
Appendix I: Objectives, Scope, and 

Methodology

Page 58 GAO-19-58 IT Cloud Computing

To address the first objective, we obtained and analyzed IT Dashboard 

data related to the 16 selected agencies’ use of cloud services for fiscal 

years 2016 through 2018, and their projected use in 2019. We chose to 

begin with fiscal year 2016 because we had previously reported on 

federal agencies’ use of cloud services through fiscal year 2014 and fiscal 

year 2015 data was not available. Specifically, the Dashboard includes 

agency responses to a cloud-related question from OMB’s capital 

planning guidance.4 The question asks whether a cloud alternative was 

evaluated for the investment, or components or systems within the 

investment. We reviewed agency responses that were submitted for fiscal 

years 2016 through 2019 as part of the annual budget submission 

process in order to determine whether a specific investment was using 

cloud services.

During this 4-year period, OMB made changes to the options that 

agencies were required to choose from which indicated whether an 

investment was using cloud services. For OMB’s capital planning 

guidance for fiscal years 2016 and 2017, we selected responses that 

indicated that the agency “had evaluated a cloud alternative and chose a 

cloud alternative” with a particular cloud deployment model.5 In addition, 

for OMB’s capital planning guidance for fiscal years 2018 and 2019, we 

selected responses that indicated the “investment or a portion of the 

investment is leveraging cloud computing”.6 We then determined the total 

 

4

OMB, FY 2016 IT Budget–Capital Planning Guidance (Washington, D.C.: June 27, 

2014); FY 2017 IT Budget–Capital Planning Guidance (Washington, D.C.: June 16, 2015); 

FY 2018 IT Budget–Capital Planning Guidance (Washington, D.C.: June 30, 2016); and 

FY 2019 IT Budget–Capital Planning Guidance (Washington, D.C.: Aug. 1, 2017). 

5

OMB required agencies to select one of the following options: (1) the agency evaluated a 

cloud alternative and chose a cloud alternative with a public deployment model for some 

or all of the investment; (2) the agency evaluated a cloud alternative and chose a cloud 

alternative with a private deployment model for some or all of the investment; (3) the 

agency evaluated a cloud alternative and chose a cloud alternative with a community 

deployment model for some or all of the investment; (4) the agency evaluated a cloud 

alternative and chose a cloud alternative with hybrid/mixed deployment models for some 

or all of the investment. This option also applies if the investment contains more than one 

cloud alternative deployment model; (5) the agency evaluated a cloud alternative but did 

not choose a cloud alternative for any of the investment; and (6) the agency did not 

evaluate a cloud alternative but plans to evaluate a cloud alternative by the end of the 

budget year.

6

OMB required agencies to select from one of the following options: (1) this investment or 

a portion of this investment is leveraging cloud computing; (2) this investment is migrating 

to the cloud; (3) this investment is considering cloud computing; (4) cloud computing has 

not been considered; (5) cloud computing is not applicable for any portion of this 

Investment; and (6) cloud computing has been considered but was not selected. 
Appendix I: Objectives, Scope, and 

Methodology

Page 59 GAO-19-58 IT Cloud Computing

number of investments using cloud services and calculated the 

percentage of investments using these services based on the total 

number of reported investments by each agency for each fiscal year.

To ensure the accuracy and completeness of the selected agencies’ data 

on the use of cloud services, we downloaded this data from the IT 

Dashboard on October 3, 2017, March 7, 2018, and October 9, 2018. We 

took this step because agencies may update their data on a quarterly 

basis throughout the fiscal year. In addition, we presented the results of 

our analysis to officials in charge of cloud services within the Office of the 

Chief Information Officer (CIO) at each selected agency. We asked these 

officials to verify the completeness and accuracy of this data and provide 

any updates as appropriate. Officials at all 16 agencies confirmed the 

total number of investments using cloud services for fiscal years 2016 

through 2018 and their projected use for fiscal year 2019. Based on these 

steps, we determined that these data were sufficiently reliable to report on 

agencies’ progress in using cloud services.

In addition, we compared each selected agency’s cloud guidance to 

OMB’s Cloud First guidance. We interviewed Office of the CIO officials in 

charge of cloud services at each agency regarding their guidance. In 

addition, we interviewed OMB staff from the Office of E-Government and 

Information Technology regarding its guidance. Because of the wide 

variety of responses and documents we received from the agencies 

related to their guidance for assessing investments for cloud computing 

services, we conducted a content analysis of the information in order to 

determine compliance with OMB’s guidance. In doing so, team members 

individually reviewed agencies’ responses and documents and assigned 

them to various categories and subcategories. Team members then 

compared their categorization schemes, discussed the differences, and 

reached agreement on the final characterization of compliance with OMB 

guidance. In cases where agencies provided multiple policies or 

documents, we followed up to clarify which portions were considered by 

the agency to support the requirement to assess all investments for cloud 

services.

In analyzing whether the agencies’ guidance on assessing investments 

for cloud services met OMB criteria, we assessed whether the guidance 

clearly identified a requirement for evaluating both new and existing 

investments for cloud services. Agencies found to not have guidance 

which clearly defined the assessment process were evaluated as such for 

one of two reasons: either the agency’s formal guidance did not 
Appendix I: Objectives, Scope, and 

Methodology

Page 60 GAO-19-58 IT Cloud Computing

completely address our assessment criteria or the agency’s guidance had 

not yet been established or finalized.

In analyzing whether agencies had met OMB’s requirement to evaluate 

each investment for cloud services, we assessed the number of 

investments that had completed assessments based on the fiscal year 

2019 budget submission. Agencies found not to have met the 

requirement were evaluated as such if the agency had 10 or more 

investments that had not yet been evaluated for cloud services. We set 

this threshold based on a reasonable interpretation of the intent of OMB’s 

guidance requiring assessments of all investments.

For our second objective, we obtained and analyzed IT Dashboard data 

related to the 16 agencies’ spending on cloud services for fiscal years 

2015 through 2018. We chose to begin with fiscal year 2015 because we 

had previously reported on federal agencies’ spending on cloud services 

through fiscal year 2014. Agencies report actual spending costs by fiscal 

year on the IT Dashboard as part of the next fiscal year reporting. To 

determine actual cloud spending costs for each fiscal year, we used 

agency spending data reported each subsequent fiscal year (from fiscal 

years 2017 through 2018) as of October 5, 2018.

In addition, we administered a data collection instrument to each of the 16 

agencies to obtain and analyze spending and savings data by the 16 

selected agencies for fiscal years 2014 through 2018 and plans for future 

planned costs. We requested that these agencies provide spending and 

savings data broken down by investment, as OMB only requires federal 

agencies to report total spending by cloud deployment model on the IT 

Dashboard, and agencies were not required to identify whether any 

reported savings were cloud-related. This instrument was administered 

from November 2017 to January 2018.

In the data collection instrument, we asked the selected agencies to 

complete information on each of their cloud investments, including the 

title of the application or system leveraging cloud, the cloud deployment 

and service models, and the associated cloud spending and net cloud 

savings or avoidances from fiscal year 2014 through fiscal year 2018 and 

beyond, as agencies generally submitted data on planned spending for 

one or more fiscal years beyond 2018. Due to the varied scale of cloud 

implementation efforts ongoing at these agencies, we asked agencies to 

only provide all applications, systems, or investments leveraging cloud 

with total life-cycle costs of $1 million or more. We also asked agencies to 

provide spending and savings or cost avoidances figures in whole 
Appendix I: Objectives, Scope, and 

Methodology

Page 61 GAO-19-58 IT Cloud Computing

numbers in order to avoid errors in rounding numbers when we calculated 

the reported figures in millions.

We took the following steps to help ensure the reliability of the data we 

collected. First, to minimize errors that might occur from respondents 

interpreting our instrument differently from our intended purpose, we 

reviewed the data collection instrument with agency officials who would 

be completing the instrument during meetings in October and November 

2017. Second, we reviewed the completed spreadsheets to identify 

missing data or other errors, and consulted with our data quality expert 

about these issues as appropriate.

All agencies completed the data collection instrument by May 2018. For 

those agencies that provided rounded (rather than exact) spending or 

savings figures, we recalculated the data into whole numbers and 

confirmed our calculations with the agencies. In addition, one agency 

broke down its savings data into savings and cost avoidances; we 

combined these reported figures for each investment and, after 

consultation with a GAO data subject matter expert, confirmed with all the 

other agencies in our review that their information on savings also 

included cost avoidances.

We also reviewed the associated notes regarding agencies’ qualifications 

of the provided data and followed up with agency officials to clarify the 

responses as appropriate. These notes included information on whether 

certain spending or savings data were unavailable, whether certain costs 

were excluded from the spending information provided to us or whether 

there were other qualifications of the provided data.

Lastly, we presented the results of our analysis of IT Dashboard data and 

the data obtained from the data collection instrument to each of the 

selected agencies between June and August 2018. We asked the 

agencies to verify the completeness and accuracy of these data and 

provide any updates as appropriate. All 16 agencies provided updated 

information regarding the list of investments using cloud services with lifecycle costs of $1 million or more and six agencies (Agriculture, 

Commerce, Justice, Transportation, Treasury, and VA) provided updated 

information related to spending and savings for these investments, which 

we have incorporated as appropriate. Based on the measures we took to 

ensure the reliability of the data provided by the agencies and reported on 

the IT Dashboard, we determined that the data were sufficiently reliable 

for the purpose of this report.
Appendix I: Objectives, Scope, and 

Methodology

Page 62 GAO-19-58 IT Cloud Computing

For the third objective, we obtained and reviewed available 

documentation discussing examples of cloud computing investments 

reported by the selected agencies as having produced notable benefits 

and key practices that ensure the effort was successful. We also 

interviewed officials from the Office of the CIO and other components in 

charge of cloud services regarding these benefits.

In order to develop our list of questions for these meetings, we first 

conducted research to identify the range of benefits that could be 

achieved from acquiring cloud services. We reviewed OMB, GSA, and 

CIO Council cloud guidance; our prior work;7 and key leading cloud 

practices from GSA’s Federal Cloud Computing Center of Excellence. 

Based on this work, we developed a list of seven key areas of benefits: 

(1) improving efficiency and operations; (2) promoting agility and 

responsiveness; (3) achieving business growth; (4) reducing cost; (5) 

meeting regulatory requirements; (6) enhancing customer experience; 

and (7) ensuring mission outcomes. During meetings with agency officials 

in the Office of the CIO and other components in charge of cloud 

services, we asked officials whether they had identified any significant or 

notable benefits in these seven areas. As these seven areas might not 

represent all potential benefits, we also asked officials to describe any 

additional benefits not included in these areas.

In addition, as part of these meetings, we asked officials from the Office 

of the CIO at each selected agency to identify up to three examples of 

investments that benefited from the acquisition of cloud services. We 

asked agencies to exclude examples of email deployments to the cloud to 

ensure a wider variety of examples of investments with benefits. Fifteen 

of the 16 agencies in our review identified at least one or more examples 

of cloud investments that had produced significant or notable benefits,

while one agency—HHS—reported that it did not have any such 

examples because it did not have any completed migration efforts. 

Because of the open-ended nature of the 15 agencies’ responses to our 

questions, we conducted a content analysis of the information we 

received in order to identify and summarize the benefits and key practices 

that were identified by the 15 agencies. We reviewed the benefits and key 

practices reported by the agencies and grouped them using the seven 

key benefit areas that our prior research had identified. We discussed the 

groupings of the reported benefits, and reached agreement on these 

 

7

GAO-12-756 and GAO-14-753. 
Appendix I: Objectives, Scope, and 

Methodology

Page 63 GAO-19-58 IT Cloud Computing

categories. We grouped the benefit categories together based on 

commonalities such as purpose, impact, and capabilities, and 

summarized the benefits reported. Based on discussion, we confirmed a 

list of benefits and key practices and totaled the number of agencies that 

reported each of these.

In addition, to select systems or investments to profile, we reviewed the 

34 examples provided by the 15 agencies and narrowed the list to 11 

examples. We selected these examples using the following factors: the 

type of system, whether the system supported the mission or business 

operations of the agency or component, and the availability of information 

related to the benefits achieved from acquiring cloud services. In doing 

so, we sought to have a mix of systems that provided mission critical 

services to the agency or the public, illustrated a range of cloud 

computing benefits, and included detailed information on the benefits 

achieved from using cloud services. 

In technical comments received on a draft of this report, two agencies 

provided new information regarding the use of cloud services for their 

systems that were profiled in appendix VI of the draft report. Based on the 

additional information provided by the two agencies, we determined there 

was no longer sufficient detail regarding what benefits were realized for 

these systems. Therefore, we removed the two agencies’ profiled 

examples from the report in order to be consistent with our methodology 

for reporting examples of systems that had realized benefits from the 

acquisition of cloud services. We then notified both agencies of this 

decision. 

We conducted this performance audit from September 2017 to April 2019 

in accordance with generally accepted government auditing standards. 

Those standards require that we plan and perform the audit to obtain 

sufficient, appropriate evidence to provide a reasonable basis for our 

findings and conclusions based on our audit objectives. We believe that 

the evidence obtained provides a reasonable basis for our findings and 

conclusions based on our audit objectives.
Appendix II: Status of Cloud-related 

Recommendations in the 2017 American 

Technology Council Report

Page 64 GAO-19-58 IT Cloud Computing

In May 2017, the Administration established the American Technology 

Council to help transform and modernize federal IT and how the 

government uses and delivers digital services. Subsequently, in 

December 2017, the American Technology Council issued a Report to the 

President on Federal IT Modernization1 and made eight cloud computingrelated recommendations that are relevant to the focus of our review. 

Table 9 outlines the cloud-related recommendations contained in the 

report and the current status of these recommendations as of July 2018, 

according to Office of Management and Budget (OMB) staff from the 

Office of E-Government and Information Technology.

Table 9: Status of Recommendations Related to Advancing Cloud Computing Within the Federal Government in the Report to 

the President on Information Technology (IT) Modernization, According to Office of Management and Budget (OMB), as of 

July 2018

Recommendation 

number

Responsible 

party Required action

Current recommendation status 

according to OMB

13 OMB Submit a data call to agencies requesting 

submission of both in-progress and pending 

projects for cloud migration.

OMB completed this action in December 

2017.

14 Federal 

Agencies

Propose a cloud migration plan that highlights 

needed changes to requisite policies and 

capabilities to facilitate faster migration.

Agencies submitted plans to OMB in 

January 2018. OMB was in the process of 

verifying the information provided and 

planned to send out a second data call in 

July 2018. a

25 OMB Issue data call that will have agencies identify 

systems that may be ready for cloud migration 

and can be migrated securely but have not yet 

migrated due to perceived or encountered 

difficulties.

OMB completed this action in December 

2017.

26 Federal 

Agencies

Respond to OMB data call regarding systems 

that may be ready for cloud migration and can be 

migrated securely but have not yet migrated due 

to perceived or encountered difficulties.

Agencies have provided data on their 

systems to OMB.

27 OMB and 

General 

Services 

Administration

Review the impediments to moving to the cloud 

outlined by agencies and prioritize an infusion of 

technical talent, capital, and the updating of 

security policy (developed iteratively to solve 

agency-specific issues) as needed to enable 

prioritized cloud migrations.

OMB has completed its review and will be 

addressing these issues in the upcoming 

Cloud Computing Strategy to be issued in 

the next few months. The new draft strategy 

for comment issued in September 24, 2018 

identified a range of action items that will be 

undertaken over the next eighteen months, 

including the release of new security-related 

policies.

 

1

White House American Technology Council, Report to the President on Federal IT 

Modernization (Washington, D.C.: Dec. 13, 2017). 

Appendix II: Status of Cloud-related 

Recommendations in the 2017 American 

Technology Council Report
Appendix II: Status of Cloud-related 

Recommendations in the 2017 American 

Technology Council Report

Page 65 GAO-19-58 IT Cloud Computing

Recommendation 

number

Responsible 

party Required action

Current recommendation status 

according to OMB

29 OMB, in 

coordination 

with Department 

of Homeland 

Security and 

other Federal 

partners

Update the Federal Cloud Computing Strategy, 

which will provide additional guidance to 

agencies on the most impactful use cases for 

cloud adoption and how best to conduct 

appropriate operational security in cloud 

environments.

OMB issued a draft strategy for comment on 

September 24, 2018.

30 OMB Conduct a thorough review of all relevant 

policies pertaining to IT modernization, cloud 

migration, infrastructure consolidation, and 

shared services, among others, and initiate 

revisions, rescissions, or other rapid policy 

updates that may improve the ability of agencies 

to modernize effectively, securely, and efficiently. 

If necessary, OMB is to issue further guidance 

that will augment and enhance existing Federal 

technology and information security policy.

OMB officials reported that this task was

ongoing. The officials stated that certain 

policy issues are to be addressed in the 

forthcoming update to the Cloud Computing 

Strategy. The new draft strategy, which was 

issued for comment on September 24, 2018, 

identified a range of action items that are to 

be undertaken over the next 18 months, 

including the release of new policies and 

guidance related to cloud computing 

services. 

36 OMB Establish a comprehensive strategy for driving 

the accelerated migration of agency email and 

collaboration tools to the cloud for departments 

and agencies that still have not adopted cloudbased email.

Information about the progress of email 

migration is to be released as part of the 

updated Cloud Computing Strategy. The 

new draft strategy, which was issued for 

comment on September 24, 2018, identified 

a range of action items that are to be 

undertaken over the next 18 months, but 

there was no specific mention of agency 

email in the list.

Source: GAO analysis of OMB data. | GAO-19-58

a

OMB was unable to provide an updated status of this planned action in time to be included in the 

final report. 
Appendix III: Selected Agency Cloud 

Investments for Fiscal Years 2016 through 

2019 

Page 66 GAO-19-58 IT Cloud Computing

The Office of Management and Budget (OMB) requires federal agencies 

to evaluate each investment, or components or systems within the 

investment, for cloud services, regardless of the overall life cycle stage of 

the investment. Agencies are required to report the status of each 

investment’s evaluation as part of the annual budget submission, as 

noted in OMB’s annual capital planning guidance.1 Table 10 lists the total 

number of investments using cloud services and the total number of all IT 

investments for fiscal years 2016 through 2019 for 16 selected agencies, 

as reported on the IT Dashboard as of October 9, 2018.

Table 10: Cloud Computing Investments and Information Technology (IT) Investments, as Reported on the IT Dashboard by 16 

Selected Agencies, for Fiscal Years 2016-2019 (projected)

Agency

Cloud investments/ 

IT investments,

fiscal year 2016

Cloud investments/ 

IT investments,

fiscal year 2017

Cloud investments/ 

IT investments,

fiscal year 2018

Cloud investments/ 

IT investments,

fiscal year 2019

Total number

Department of Agriculture 21/216 23/204 46/233 53/225

Department of Commerce 22/143 22/142 35/153 45/167

Department of Defense 146/3,245 106/3,158 73/2,689 88/2,735

Department of Education 19/194 19/172 8/158 11/146

Department of Energy 69/786 88/813 30/455 32/365

Department of Health and Human 

Services 

83/618 107/617 115/675 140/727

Department of Homeland Security 74/357 94/350 59/355 69/391

Department of Justice 22/239 24/233 20/231 35/250

Department of Labor 25/151 29/154 28/150 27/158

Department of State 10/83 13/82 7/83 17/94

Department of the Treasury 11/299 19/315 17/286 28/273

Department of Transportation 32/404 38/379 28/356 42/357

Department of Veterans Affairs 5/33 5/32 3/41 6/62

General Services Administration 17/103 26/114 39/111 43/114

Small Business Administration 4/29 4/26 5/27 4/26

Social Security Administration 7/51 7/48 7/53 23/66

Total 567/6,951 624/6,839 520/6,056 663/6,157

Source: GAO analysis of IT Dashboard data as of October 9, 2018. | GAO-19-58

 

1

See OMB, FY 2016 IT Budget–Capital Planning Guidance (Washington, D.C.: June 27, 

2014); FY 2017 IT Budget–Capital Planning Guidance (Washington, D.C.: June 16, 2015); 

FY 2018 IT Budget–Capital Planning Guidance (Washington, D.C.: June 30, 2016); and 

FY 2019 IT Budget–Capital Planning Guidance (Washington, D.C.: Aug. 1, 2017). 

Appendix III: Selected Agency Cloud 

Investments for Fiscal Years 2016 through 

2019
Appendix IV: Selected Agency Cloud Spending 

for Fiscal Years 2015 through 2018 

Page 67 GAO-19-58 IT Cloud Computing

The Office of Management and Budget (OMB) requires federal agencies 

to report total cloud spending based on the cloud deployment model as 

part of the annual budget submission, as noted in OMB’s annual capital 

planning guidance for fiscal years 2015 through 2018.1 Table 11 lists the 

total agency-reported cloud spending and total IT spending for fiscal 

years 2015 through 2018 for the 16 agencies in our review, as reported 

on the IT Dashboard as of October 5, 2018.

Table 11: Cloud and IT Spending, as Reported on the IT Dashboard by 16 Selected Agencies for Fiscal Years (FY) 2015-2018 

(in millions of dollars)

Agency

IT 

spending,

FY 2015

Cloud 

spending,

FY 2015

IT 

spending, 

FY 2016

Cloud 

spending,

FY 2016

IT 

spending,

FY 2017

Cloud 

spending,

FY 2017 

IT 

spending,

FY 2018

Cloud 

spending,

FY 2018a

Department of Agriculture 3,057.07 80.30 3,418.00 78.53 2,998.08 135.89 2,116.03 55.37

Department of Commerce 2,106.64 222.88 2,312.40 274.93 2,432.70 225.13 2627.07 225.82

Department of Defense 3,0414.27 1,233.65 3,0780.25 1,258.43 17,424.98 153.26 18,585.05 100.21

Department of Education 686.94 62.30 688.56 65.20 699.56 69.17 686.69 6.52

Department of Energy 1,587.75 39.02 1,654.51 45.50 1,818.53 38.33 1,986.30 21.20

Department of Health and 

Human Services 

1,3637.66 64.92 12,566.03 81.41 13,934.64 527.42 5,698.91 150.87

Department of Homeland 

Security 

5,914.24 242.75 6,203.51 230.24 6,767.88 155.20 6,843.29 141.16

Department of Justice 2,646.85 30.92 2,699.14 34.68 2,699.48 34.64 2,788.15 33.56

Department of Labor 667.13 55.68 713.83 60.73 703.38 39.57 715.23 28.68

Department of State 1,576.85 14.92 1,966.18 19.21 1,909.89 80.94 2,286.43 89.95

Department of the 

Treasury

3,769.68 134.39 3,939.82 145.47 4,226.86 128.45 4,538.30 42.37

Department of 

Transportation

3,280.70 19.61 3,507.20 25.77 3,105.09 28.18 3,086.04 22.98

Department of Veterans 

Affairs 

4,199.53 29.56 4,403.41 27.91 4,364.56 286.60 4,395.39 280.25

General Services 

Administration

649.61 20.65 710.16 54.82 768.44 91.46 680.58 81.83

 

1

See OMB, FY 2015 Guidance on Exhibits 53 and 300 (Washington, D.C.: July 1, 2013); 

FY 2016 IT Budget–Capital Planning Guidance (Washington, D.C.: June 27, 2014); FY

2017 IT Budget–Capital Planning Guidance (Washington, D.C.: June 16, 2015); and FY 

2018 IT Budget–Capital Planning Guidance (Washington, D.C.: June 30, 2016).

Appendix IV: Selected Agency Cloud 

Spending for Fiscal Years 2015 through 

2018
Appendix IV: Selected Agency Cloud Spending 

for Fiscal Years 2015 through 2018 

Page 68 GAO-19-58 IT Cloud Computing

Agency

IT 

spending,

FY 2015

Cloud 

spending,

FY 2015

IT 

spending, 

FY 2016

Cloud 

spending,

FY 2016

IT 

spending,

FY 2017

Cloud 

spending,

FY 2017 

IT 

spending,

FY 2018

Cloud 

spending,

FY 2018a

Small Business 

Administration

102.50 4.32 95.14 4.74 97.90 7.06 101.56 9.01

Social Security 

Administration

1,861.60 58.14 1,501.32 41.00 1,624.87 38.99 1,618.41 50.30

Total 76,159.01 2,314.01 77,159.44 2,448.56 65,576.82 2,040.26 58,753.44 1,340.08

Source: GAO analysis of agency data on IT Dashboard as of October 5, 2018. | GAO-19-58

a

Although agency-reported cloud spending for fiscal year 2018 was obtained from the IT Dashboard 

on October 5, 2018, the agencies last updated their data between January and March 2018. 
Appendix V: Description of Cloud Computing 

Investments Provided by Selected Agencies 

for Fiscal Year 2018 

Page 69 GAO-19-58 IT Cloud Computing

Sixteen selected agencies provided us with information on their 

investments related to spending on cloud services of at least $1 million or 

more in life-cycle costs.1 Table 12 identifies the investments for fiscal year 

2018 that these agencies submitted to GAO as of October 2018. This list 

includes the name of the investment, the cloud deployment model, and 

the cloud service model.

Table 12: Information on Investments Using Cloud Services and Associated Service and Deployment Model Provided by 16 

Selected Agencies for Fiscal Year 2018, as of October 2018 

Agency/Investment

Cloud

deployment model

Cloud

service model 

Department of Agriculture

Agricultural Marketing Service, Infrastructure Wide Area Network, and De-Militarized Zone, 

BlackBoard 

Public Software

Agricultural Marketing Service, Infrastructure Wide Area Network, and De-Militarized Zone Public Software

Agricultural Marketing Service, Web-Based Supply Chain Management, Business 

Intelligence, Cloud prototype

Public Platform

Animal and Plant Health Inspection Service , Electronic Permits System Private Platform

Animal and Plant Health Inspection Service , Integrated Plant Health Information System Private Platform

Animal and Plant Health Inspection Service, Agricultural Quarantine Activity System Private Platform

Animal and Plant Health Inspection Service, Animal Care Information System Private Platform

Animal and Plant Health Inspection Service, Certification, Accreditation, Registration, 

Permitting, and Other Licensing, eFile

Public Software

Animal and Plant Health Inspection Service, Cloud Bundle Public Platform

Animal and Plant Health Inspection Service, Cloud Bundle Private Platform

Animal and Plant Health Inspection Service, Enterprise Infrastructure, Cloud Public Platform

Animal and Plant Health Inspection Service, Investigation Tracking Enforcement 

Management System

Private Platform

Animal and Plant Health Inspection Service, Marketing and Regulatory Programs Business 

Services Program Support, Cloud

Public Software

Animal and Plant Health Inspection Service, Marketing and Regulatory Programs Business 

Services Program Support, Cloud

Public Software

Animal and Plant Health Inspection Service, Marketing and Regulatory Programs Business 

Services Program Support, Employee Qualification System 2.0

Public Platform

 

1

We collected this information to obtain and analyze agency spending and savings on 

investments using cloud services. We requested that agencies provide spending and 

savings data broken down by investment, as OMB only required agencies to report total 

spending by cloud deployment model on the IT Dashboard, and did not require agencies 

to identify whether any reported savings were cloud-related.

Appendix V: Description of Cloud Computing 

Investments Provided by Selected Agencies 

for Fiscal Year 2018
Appendix V: Description of Cloud Computing 

Investments Provided by Selected Agencies 

for Fiscal Year 2018 

Page 70 GAO-19-58 IT Cloud Computing

Agency/Investment

Cloud

deployment model

Cloud

service model 

Animal and Plant Health Inspection Service, Marketing and Regulatory Programs Business 

Services Program Support, eSignLive

Public Software

Animal and Plant Health Inspection Service, Marketing and Regulatory Programs Business 

Services Program Support, Geographic Information System Cloud

Public Software

Animal and Plant Health Inspection Service, Phytosanitary Certificate Issuance and Tracking 

System

Private Platform

Animal and Plant Health Inspection Service, Phytosanitary Certificate Issuance and Tracking 

System, Cognos

Private Platform

Client Technology Services, Infrastructure, Enterprise EMS/OFFICE 365 Product Line Private Software

Client Technology Services, Infrastructure, Remedy Cloud Public Software

Departmental Management, Office of Human Resources Management, OneUSDA, 

Onboarding/eRecurit

Private Software

Departmental Management, Office of Operation, Agriculture Automated Warning and 

Information Response System, Office of Operation Emergency Notification Systems, 

Private Platform

Departmental Management, Office of Procurement and Property Management, Integrated 

Acquisition System

Private Platform

Departmental Management, Office of the Chief Information Officer, Client Technology 

Services, Enterprise Messaging Systems-Cloud Services, Government Community Cloud 

migration

Public Software

Economic Research Service, Information Technology Infrastructure General Support System, 

Cloud Migration

Public Infrastructure

Enterprise Data Center & Hosting Shared Services Private Infrastructure 

and Platform

Farm Service Agency, 109 Information Technology Management: Bridges to Opportunity Public Software

Farm Service Agency, 95 Digital Communications Platforms Support: AskFSA Public Software

Farm Service Agency, 95 Digital Communications Platforms Support: GovDelivery Public Software

Food Safety and Inspection Service, Web Service, Ask Karen Public Platform

Food Safety and Inspection Service, Web Service, AskExpert Public Platform

Food Safety and Inspection Service, Web Service, AskFSIS Public Platform

Food Safety and Inspection Service, Web Service, CallSat Customer Satisfaction Public Platform

Food Safety and Inspection Service, Web Service, FSIS.USDA.Gov site Public Platform

Food Safety and Inspection Service, Web Service, GovDelivery Communications Suite Public Platform

Food Safety and Inspection Service, Web Service, Small Plant Helpdesk Public Platform

Foreign Agricultural Service, Infrastructure, Office Automation, and Telecommunications, 

Enterprise Data Center 

Private Platform

Foreign Agriculture Service, Global Crop Production Intelligence System Public Software

Foreign Agriculture Service, Infrastructure, Office Automation, and Telecommunications, 

Information Technology Service Management 

Public Software

Foreign Agriculture Service, Infrastructure, Office Automation, and Telecommunications, 

Internet Mapping Service

Community Software

Forest Service Computer Base Public Software
Appendix V: Description of Cloud Computing 

Investments Provided by Selected Agencies 

for Fiscal Year 2018 

Page 71 GAO-19-58 IT Cloud Computing

Agency/Investment

Cloud

deployment model

Cloud

service model 

Forest Service Computer Base: ArcGIS Online Public Software

Forest Service Computer Base: Check In/Out Public Software

Forest Service Computer Base: ESRI Managed Cloud Hybrid Software

Forest Service Computer Base: Pilot Public Infrastructure

Forest Service Computer Base: Pinyon Public Software

National Agriculture Statistics Service, Information Technology Infrastructure, Information 

Technology Service Management

Public Software

National Agriculture Statistics Service, Information Technology Infrastructure, Web Portal, 

Mobility

Public Platform

National Resources Conservation Service, Information Technology Management -

Conservation Delivery Streamline Initiative

Hybrid Platform

National Resources Conservation Service, Information Technology Management –Office of 

the Chief Information Officer, Infrastructure Framework

Public Infrastructure

National Resources Conservation Service, Information Technology Management –Office of 

the Chief Information Officer, Infrastructure Framework

Public Infrastructure

National Resources Conservation Service, Information Technology Management, Box Public Software

National Resources Conservation Service, Information Technology Management, Project 

Portfolio Management Online

Public Software

Office of the Chief Financial Officer, Federal Shared Service Provider, Pegasys, Cloud 

Migration

Private Infrastructure

Office of the Chief Financial Officer, Financial Management Modernization Initiative, Cloud 

Migration

Private Platform

Risk Management Agency, 13 Enterprise Information Technology Acquisition, Escrow Community Platform

Department of Commerce

Bureau of Economic Analysis Regional Dashboard Public Platform

Bureau of Economic Analysis website Public Platform

Bureau of Industry and Security , Collaboration Tools Public Platform and 

Software 

Bureau of Industry and Security, Infrastructure Public Infrastructure

Census, Cloud Computing Services Hybrid Infrastructure

National Oceanic and Atmospheric Administration, Collaboration Tools Community Software

National Oceanic and Atmospheric Administration, Enterprise Service Management, 

Workflow Automation

Community Software

National Oceanic and Atmospheric Administration, Web Operations Center Hybrid Platform

Office of the Secretary, Office of Acquisition Management, Commerce Business Environment Private Infrastructure

Office of the Secretary, Office of Financial Management, Commerce Business Systems Private Infrastructure

Office of the Secretary, Office of Financial Management, Sunflower Enterprise Personal 

Property Management System

Private Infrastructure

Office of the Secretary, Office of Human Resource Management, Commerce Learning Center Private Software

Office of the Secretary, Office of Human Resource Management, General Support Systems Private Infrastructure
Appendix V: Description of Cloud Computing 

Investments Provided by Selected Agencies 

for Fiscal Year 2018 

Page 72 GAO-19-58 IT Cloud Computing

Agency/Investment

Cloud

deployment model

Cloud

service model 

Office of the Secretary, Office of Human Resource Management, Human Resource 

Management System

Private Software

Office of the Secretary, Office of Human Resource Management, NFC Fee for Service Private Software

Office of the Secretary, Office of Human Resource Management, Web-based Time and 

Attendance System

Private Infrastructure

Department of Defense

Academic and Professionally Accredited Enterprise Education Enclave Public Software

Acquisition Career Management System Public Infrastructure

Advanced Distributed Learning Service Public Platform

Air Force Combined Mishap Reduction System Public Platform

Aircraft Parts Tracking Public Platform

All Other Navy/United States Marine Corps Computing Infrastructure Private Platform

All Weapons Information System Public Infrastructure

Alternative Dispute Resolution System Public Software

Case Management Tracking Analysis & Reporting System Hybrid Platform

Cellular Phones Private Platform

Chief of Information Social Media Audio Visual Services Public Infrastructure

Civilian Personnel Online Hybrid Infrastructure

Classified - Various Private Platform

Classified - Various Private Software

Classified - Various Community Infrastructure

Continuous Monitoring Program Private Platform

Contracting Information Technology Private Infrastructure

Core Data Centers and Installation Processing Nodes Private Infrastructure

Core Data Centers and Installation Processing Nodes Private Platform

Core Services Architecture Private Infrastructure

Customer Relationship Management Software as a Service Private Software

Data Collection And Scheduling Tool Community Platform

Defense Contract Audit Agency Integrated Information Network Public Software

Defense Contract Audit Agency LiveLink Records Management System Public Infrastructure

Defense Contract Audit Agency LiveLink Records Management System Public Software

Defense Environmental Network and Information Exchange-Knowledge-Based Corporate 

Reporting System

Public Infrastructure

Defense Talent Management System Private Software

Department of Defense Electronic Official Personnel Folder Private Software

Department of the Army Mobilization Processing System Private Infrastructure

Department of the Army Mobilization Processing System - Unclassified Private Infrastructure
Appendix V: Description of Cloud Computing 

Investments Provided by Selected Agencies 

for Fiscal Year 2018 

Page 73 GAO-19-58 IT Cloud Computing

Agency/Investment

Cloud

deployment model

Cloud

service model 

Department of the Navy Heritage Asset Management System - Collections Management 

System

Private Infrastructure

Department of the Navy Heritage Asset Management System - Collections Management 

System

Private Infrastructure

Electronic 332 System Private Platform

Electronic Construction Management System Private Infrastructure

Enterprise Information Environment Computing Infrastructure Assets Public Infrastructure

Enterprise Information Environment Core Enterprise Services Public Infrastructure

Enterprise Information Environment Core Enterprise Services Public Software

Enterprise Information Environment Mission Area Computing Infrastructure 

Domain/Computing Services_Server Services

Private Platform

Enterprise Information Environment Mission Area Core Enterprise Services/App 

Services_Service Desk

Private Platform

Enterprise Proactive Real-Property Interactive Space Management System Private Infrastructure

Enterprise Protection Risk Management Community Infrastructure

Family Separation Allowance Information Management Capabilities Hybrid Infrastructure

Family Separation Allowance Information Management Capabilities Hybrid Infrastructure

Fleet Home Town News Center Public Infrastructure

Fleet Home Town News Center Public Platform

Force Management Tools Public Infrastructure

Fourth Estate Manpower Tracking System Private Platform

Global Energy Information System Public Platform

Information Technology Division SharePoint, Web Services Public Infrastructure

Integrated Budget Documentation & Execution System Public Platform

Integrated Digital Environment Service Center Private Software

Joint Training Capability Development Private Infrastructure

Keyport Integrated Production and Application Development System Community Infrastructure

Logistics Execution Information System Private Platform

Maintenance & Ship Work Planning Private Infrastructure

Maintenance work request Public Platform

Manpower Authorization Man-day Management System Public Infrastructure

Manpower Programming and Execution System Public Infrastructure

Manpower, Personnel, Training and Education Network, Operations, and Other 

Communications Support

Public Software

Marine Corps Recruiting Command Advertising Information Technology System Public Infrastructure

Mobilization Common Operating Picture Private Infrastructure

Mobilization Common Operating Picture Messaging System Private Infrastructure

Mobilization Common Operating Picture - Unclassified Private Infrastructure
Appendix V: Description of Cloud Computing 

Investments Provided by Selected Agencies 

for Fiscal Year 2018 

Page 74 GAO-19-58 IT Cloud Computing

Agency/Investment

Cloud

deployment model

Cloud

service model 

Mobilization Deployment Information System Private Infrastructure

Module Test Repair Activity Community Platform

Naval Audit Service Information Management System Private Platform

Naval Reserve Force Reserve Affairs Capabilities Hybrid Software

Naval Systems Engineering Resource Center - Unclassified Hybrid Infrastructure

Naval Tactical Command Support System Private Platform

Naval War College Public Software

Naval Sea Systems Command Headquarters Next Generation Enterprise Network Private Platform 

Naval Sea Systems Command Headquarters Related Technical Activities Public Infrastructure

Navy Chief Of Information Website Public Infrastructure

Navy Consolidated Brig Physical Security System Public Software

Navy Maritime Maintenance Enterprise Solution Community Infrastructure

Network Enterprise Center Staff Operations Costs Private Infrastructure

Next Generation Enterprise Network Increment 1 Private Platform

NLign Analytics Private Platform

Ogden Air Logistics Complex’s 309th Software Maintenance Group Work Center Public Platform

Overseas Contingency Operations Individual Private Infrastructure

Overseas Contingency Operations Temporary Change of Station Private Infrastructure

Pacific Fleet Base-Level Communications Capabilities Private Platform

Pacific Fleet Systems Support Private Platform

Part Number Supply Support Request System Private Platform

Physical Sciences Laboratory Information Management System Plus Private Platform

Planned Labor Workload Tool Private Platform

Priority Requisition Information Management Enterprise Private Platform

Program Manager Soldier Weapons Collaborative Data Environment Private Platform

Programmed Depot Maintenance Scheduling System Web Public Platform

Promotion Testing System Private Platform

Propulsion Engineering Workspace Private Platform

Science & Technology Private Infrastructure

Science & Technology Private Software

Senior Leader Development Management System Private Infrastructure

Shipyard Management Information System Support Private Platform

Shipyard Management Information System Support Public Platform

Space and Naval Warfare Systems Command System Center Information Technology 

Division Data Center

Private Platform

Strategic Management System Private Infrastructure

System Metric and Reporting Tool Private Platform
Appendix V: Description of Cloud Computing 

Investments Provided by Selected Agencies 

for Fiscal Year 2018 

Page 75 GAO-19-58 IT Cloud Computing

Agency/Investment

Cloud

deployment model

Cloud

service model 

System Metric and Reporting Tool Private Software

Technical Assurance System Community Infrastructure

Time Labor Management System Public Software

Tools for Environmental Management Configuration Information Public Platform

Tools for Environmental Management Restoration Information Public Platform

Total Ammunition Management Information System Public Infrastructure

Total Ammunition Management Information System Public Infrastructure

Total Component Management Public Platform

Tour Of Duty Private Infrastructure

Training Scheduling System Private Platform

Transportation Coordinators’ Automated Information for Movements System II Private Software

Warfighting Battlespace Awareness Tools Hybrid Infrastructure

Warfighting Command and Control Tools Public Infrastructure

Warfighting Mission Area Force Support, Force Management Public Platform

Web Compliance Assessment and Sustainment System Community Platform

Yellow Ribbon Reintegration Program Web Portal Private Infrastructure

Department of Education

Cloud Based Storage Community Software

Federal Student Aid Information Center Community Software

Institute of Education Sciences Support (consolidated investment) Public Infrastructure

Next Generation Data Center Private Infrastructure

Ombudsman Case Tracking System, Federal Student Aid Feedback and Dispute System Community Software

Department of Energy

Cloud Service Provider Community Software

Cloud Service Provider - Analysis Public Infrastructure

Collaboration: Video and Voice Services Public Software

Collaboration: Video and Voice Services – Oak Ridge National Laboratory Public Software

Co-Located Data Center Hybrid Infrastructure

Content Management System Community Software

Content Management System Hybrid Platform

Content Management System Vendor 1 Public Infrastructure

Content Management System Vendor 2 Community Infrastructure

Digital Experience Platform Public Software

Digital Experience Platform - Community Cloud Community Software

Digital Experience Platform - Community Infrastructure as a Service Community Infrastructure

Digital Experience Platform - Electronic Infrastructure Public Software
Appendix V: Description of Cloud Computing 

Investments Provided by Selected Agencies 

for Fiscal Year 2018 

Page 76 GAO-19-58 IT Cloud Computing

Agency/Investment

Cloud

deployment model

Cloud

service model 

Digital Experience Platform - E-Mail Software as a Service Infrastructure Public Software

Digital Experience Platform - Enhanced Licenses Community Software

Digital Experience Platform - Government Community Cloud Community Software

Digital Experience Platform - Implementation Community Software

Digital Experience Platform - Licenses Public Software

Digital Experience Platform - Not Mission Critical Community Software

Digital Experience Platform - Private Cloud Private Software

Digital Experience Platform - Public Cloud E-Mail Public Software

Digital Experience Platform – Enterprise License Agreement National Renewable Energy 

Laboratory

Community Software

Environmental, Health and Safety - Public Software as a Service Cloud Public Software

Finance and Human Resources Private Software

Finance and Human Resources Private Software

Finance and Human Resources - Cloud Labor Public Software

Finance and Human Resources - Infrastructure Public Software

Finance and Human Resources Public Software

Finance and Human Resources - Public Software as a Service Cloud Infrastructure Public Software

Industrial Plant Management Community Platform

Information Technology Service Manager - Licenses Public Software

Information Technology Service Manager – Software as a Service Infrastructure Public Software

Information Technology Service Manager - Workflow Private Platform

Information Technology Service Manager - Workflow Licenses Private Software

Information Technology Service Manager - Workflow Oak Ridge National Laboratory Community Platform

Investment Modeling Community Infrastructure

Online Training Community Software

Security Software as a Service Hybrid Software

Survey Tool Community Software

Training Community Software

Department of Health and Human Services

Administration for Community Living Digital Hybrid Infrastructure, 

Platform and 

Software 

Agency for Healthcare Research and Quality Cloud Public Infrastructure

Centers for Disease Control and Prevention, End User Infrastructure Private Infrastructure 

and Platform 

Centers for Disease Control and Prevention, Information Technology Infrastructure Private Infrastructure 

and Platform 
Appendix V: Description of Cloud Computing 

Investments Provided by Selected Agencies 

for Fiscal Year 2018 

Page 77 GAO-19-58 IT Cloud Computing

Agency/Investment

Cloud

deployment model

Cloud

service model 

Centers for Disease Control and Prevention, Public Health Information Network: BioSense Public Infrastructure 

and Platform 

Centers for Medicare and Medicaid Services, Accountable Care Organization, Model Support Hybrid Infrastructure

Centers for Medicare and Medicaid Services, Beneficiary e-Services Public Infrastructure, 

Platform and 

Software 

Centers for Medicare and Medicaid Services, Case Hearings and Appeals Public Infrastructure, 

Platform and 

Software 

Centers for Medicare and Medicaid Services, Enterprise Identity Management Hybrid Infrastructure, 

Platform and 

Software 

Centers for Medicare and Medicaid Services, Healthcare Web Support Private Infrastructure, 

Platform and 

Software 

Centers for Medicare and Medicaid Services, Innovation Core Systems Private Infrastructure 

and Platform

Centers for Medicare and Medicaid Services, IT Infrastructure Hybrid Infrastructure 

and Platform

Centers for Medicare and Medicaid Services, Medicaid & Children’s Health Insurance 

Program, Business Information and Solutions

Private Infrastructure 

and Platform

Centers for Medicare and Medicaid Services, Oncology Payment Model Hybrid Infrastructure

Centers for Medicare and Medicaid Services, Plan Enrollment, Health Plan Management 

System

Private Infrastructure 

and Platform

Centers for Medicare and Medicaid Services, Quality Payment Program Public Infrastructure 

and Platform

Continued Implementation of Homeland Security Presidential Directive-12 (formerly known as 

IAM@HHS)

Private Infrastructure 

and Platform

Food and Drug Administration, Center for Devices and Radiological Health Administrative 

Support Systems 

Community Infrastructure 

and Platform

Food and Drug Administration, Center for Devices and Radiological Health High Performance 

Computing

Private Infrastructure 

and Platform

Food and Drug Administration, Office of Information Management and Technology Email Hybrid Infrastructure 

and Platform

Food and Drug Administration, Office of Information Management and Technology, 

Information Technology Infrastructure & Data Center Management

Hybrid Infrastructure 

and Platform

Department of Health and Human Services, Cybersecurity Operations Program Investment Public Infrastructure 

and Platform

Department of Health and Human Services, Email as a Service Investment Community Software

Department of Health and Human Services, Enterprise Human Capital Management 

Investment

Hybrid Infrastructure 

and Platform

Department of Health and Human Services, Financial Business Intelligence System 

Investment

Private Infrastructure 

and Platform
Appendix V: Description of Cloud Computing 

Investments Provided by Selected Agencies 

for Fiscal Year 2018 

Page 78 GAO-19-58 IT Cloud Computing

Agency/Investment

Cloud

deployment model

Cloud

service model 

Department of Health and Human Service, ,Grant Solutions Center of Excellence Public Infrastructure 

and Platform

Department of Health and Human Services, Unified Financial Management System 

Investment

Private Infrastructure 

and Platform

Health Resources and Services Administration, Bureau of Health Workforce, National 

Practitioner Data Bank 

Public Infrastructure 

and Platform

Health Resources and Services Administration, Office of Information Technology Core 

Business Support System

Public Software 

Indian Health Service, Health Information Technology Systems and Support Private Infrastructure, 

Platform and 

Software 

Indian Health Service, Infrastructure, Office Automation, & Telecommunications Private Infrastructure

National Institutes of Health, Electronic System Electronic Research Administration Hybrid Infrastructure 

and Platform

National Institutes of Health, Electronic System Business System Private Infrastructure 

and Platform

National Institutes of Health Information, Technology Data Centers and Cloud Services Hybrid Infrastructure, 

Platform and 

Software 

National Institutes of Health Information, Technology End User Devices, Tools & Support Hybrid Infrastructure, 

Platform and 

Software 

National Institutes of Health, National Cancer Institute, Administration and Management 

Support Applications and Tools

Public Software

National Institutes of Health, National Cancer Institute, Enterprise Architecture, Capital 

Planning, Information Technology Management & Oversight 

Public Software

National Institutes of Health, National Cancer Institute, Genomic Data Commons Private Infrastructure 

and Platform

National Institutes of Health, National Cancer Institute, Sci Mission Clinical Trials and 

Management Support Tools 

Private Software

National Institutes of Health, National Cancer Institute, Sci Mission Research Knowledge 

Dissemination Tools

Hybrid Infrastructure, 

Platform and 

Software 

National Institutes of Health, National Heart, Lung, and Blood Institute, Administration and 

Management Support Applications and Tools

Public Infrastructure 

and Platform 

National Institutes of Health, National Heart, Lung, and Blood Institute, Sci Mission 

Biomedical Data Repositories & Analytical Tools

Private Software

National Institutes of Health, National Heart, Lung, and Blood Institute, Sci Mission 

Extramural Research Management and Support Tools

Public Software

National Institutes of Health, National Institute of Allergy and Infectious Diseases, Sci Mission 

Biomedical Data Repositories & Analytical Tools

Public Infrastructure 

and Platform

National Institutes of Health, National Institute of Allergy and Infectious Diseases, Sci Mission 

Extramural Research Management and Support Tools

Public Infrastructure 

and Platform
Appendix V: Description of Cloud Computing 

Investments Provided by Selected Agencies 

for Fiscal Year 2018 

Page 79 GAO-19-58 IT Cloud Computing

Agency/Investment

Cloud

deployment model

Cloud

service model 

National Institutes of Health, National Institute of Child Health and Human Development, Sci 

Mission Biomedical Data Repositories & Analytical Tools

Public Infrastructure 

and Platform

National Institutes of Health, National Institute of Mental Health, Sci Mission Biomedical Data 

Repositories & Analytical Tools

Public Infrastructure 

and Platform

Office of Inspector General, Data Analytics Hybrid Infrastructure, 

Platform and 

Software 

Office of Inspector General, Support Services Hybrid Infrastructure, 

Platform and 

Software 

Office of the Secretary, Assistant Secretary for Administration, E-Gov Travel Support Center 

of Excellence 

Public Infrastructure 

and Platform

Office of the Secretary, Assistant Secretary for Administration, Health and Human Services 

Asset - Property Management Information System ( Sunflower)

Private Infrastructure 

and Platform

Office of the Secretary, Assistant Secretary for Administration, Health and Human Services 

Careers System

Community Infrastructure 

and Platform

Office of the Secretary, Assistant Secretary for Administration Learning Management System Public Infrastructure 

and Platform

Office of the Secretary, Assistant Secretary for Administration Physical Access Control 

Systems’ Affiliation Project

Private Infrastructure 

and Platform

Office of the Secretary, Assistant Secretary for Administration, PSC Revenue, Invoicing

and Cost Estimation System 

Private Infrastructure 

and Platform

Office of the Secretary, Office of the Assistant Secretary for Financial Resources, 

Departmental Contracts Information System

Private Infrastructure 

and Platform

Office of the Secretary, Office of the Assistant Secretary for Financial Resources, Department 

of Health and Human Services Consolidated Financial Reporting System

Private Infrastructure 

and Platform

Office of the Secretary, Office of the Assistant Secretary for Health, Commissioned Corps 

Force Management Solution

Private Infrastructure 

and Platform

Office of the Secretary, Office of the Assistant Secretary for Health, Office on Women’s 

Health Websites Communications Initiative

Private Infrastructure 

and Platform

Office of the Secretary, Office of the Assistant Secretary for Public Affairs, Department of 

Health and Human Services Web Management Investment

Private Infrastructure 

and Platform

Office of the Secretary, Office of Medicare Hearings and Appeals, Electronic Case 

Adjudication Processing Environment

Private Infrastructure 

and Platform

Department of Homeland Security

Coast Guard, One View-Ozone Widget Framework Public Infrastructure

Department of Homeland Security, Management Directorate, Enterprise Data Management 

Office, Collibra Data Governance 

Public Software

Department of Homeland Security, Management Directorate, Enterprise Information 

Technology Service Division, Workplace as a Service 

Private Software

Department of Homeland Security, Management Directorate, Enterprise IT Service Division, 

Public Cloud Web Content Management as a Service 

Public Infrastructure
Appendix V: Description of Cloud Computing 

Investments Provided by Selected Agencies 

for Fiscal Year 2018 

Page 80 GAO-19-58 IT Cloud Computing

Agency/Investment

Cloud

deployment model

Cloud

service model 

Department of Homeland Security, Management Directorate, Infrastructure Operations, Office 

365 Software 

Public Software

Department of Homeland Security, Management Directorate, Office of the Chief Information 

Officer, OneNet, Email

Private Software

Department of Homeland Security, Management Directorate, Office of the Chief Information 

Officer, Homeland Security Information Network 

Public Infrastructure

Domestic Nuclear Detection Office, Joint Analysis Center Collaborative Information System 

2.0 

Public Infrastructure

Federal Emergency Management Agency, Applicant Case Tracker Public Infrastructure

Federal Emergency Management Agency, Crisis Management System Public Infrastructure

Federal Emergency Management Agency, Deployment Tracking System Public Infrastructure

Federal Emergency Management Agency, HSEEP System, Preparedness Toolkit Public Infrastructure

Federal Emergency Management Agency, Human Capital Investments, Career Path Tool Public Infrastructure

Federal Emergency Management Agency, Infrastructure, Email as a Service Public Software

Federal Emergency Management Agency, Internet, Digital Imagery and Media on Demand, Public Infrastructure

Federal Emergency Management Agency, National Flood Insurance Program, Community 

Information System, Citizen Corps 

Public Software

Federal Emergency Management Agency, National Flood Insurance Program, Information 

Technology Systems and Services, ReInsurance Broker System 

Public Infrastructure

Federal Emergency Management Agency, Recovery Management Tools, Disaster 

Management Support Environment Cloud Environment 

Public Infrastructure

Federal Law Enforcement Training Centers, All Other IT Costs, Mobile Application Public Infrastructure

Federal Law Enforcement Training Centers, Infrastructure, Enterprise Training Cloud Public Infrastructure

Federal Law Enforcement Training Centers, Online Campus, eFLETC Public Software

National Protection and Programs, Directorate Automated Biometric Identification System, 

Operational Data Store 

Public Infrastructure

National Protection and Programs, Directorate Interagency Security Committee-Compliance 

System

Public Infrastructure

National Protection and Programs, Directorate National Cybersecurity and Communications 

Integration Center, Trusted Automated eXchange of Indicator Information Server 

Public Infrastructure

National Protection and Programs Directorate, Communication Assets Survey and Mapping 

tool, Next Generation

Public Infrastructure

Office of Inspector General, Infrastructure, Data Analytics Cloud System Public Infrastructure

Transportation Security Administration, Information Technology Infrastructure Program, Alert 

& Warning System

Public Software

Transportation Security Administration, Information Technology Infrastructure Program, Core 

Services 

Public Infrastructure

Transportation Security Administration, Information Technology Infrastructure Program, DEV Public Software

Transportation Security Administration, Information Technology Infrastructure Program, 

Enterprise App Central

Public Infrastructure
Appendix V: Description of Cloud Computing 

Investments Provided by Selected Agencies 

for Fiscal Year 2018 

Page 81 GAO-19-58 IT Cloud Computing

Agency/Investment

Cloud

deployment model

Cloud

service model 

Transportation Security Administration Information Technology Infrastructure Program, 

Security Platform for Enterprise Compliance, Testing, and Reporting,

Public Infrastructure

U.S. Citizenship and Immigration Services Information Security, Identity Credential and 

Access Management 

Public Infrastructure

U.S. Citizenship and Immigration Services MyUSCIS Public Infrastructure

U.S. Citizenship and Immigration Services Scheduling, National Appointment Scheduling 

System

Public Infrastructure

U.S. Citizenship and Immigration Services Standard Tool Program, Salesforce Tracking 

Activities and Relationships System 

Public Software

U.S. Citizenship and Immigration Services Standard Tool Program, Standard Development 

Tool 

Public Software

U.S. Citizenship and Immigration Services Transformation, Electronic Immigration System 2 Public Infrastructure

U.S. Coast Guard Incident Management Software System, Incident Management Software 

System 

Public Infrastructure

U.S. Customs and Border Patrol Automated Commercial Environment Public Infrastructure

U.S. Customs and Border Patrol Biometric Entry-Exit, Traveler Verification Service Public Infrastructure

U.S. Customs and Border Patrol Electronic System for Travel Authorization, Data Cube Public Infrastructure

U.S. Customs and Border Patrol Electronic Visa Update System Public Software

U.S. Customs and Border Patrol Office 365, Small OIT Projects Public Software

U.S. Customs and Border Patrol Right Now Web for Customer Service Center, Complaint 

Management System, 

Public Infrastructure

U.S. Immigration and Customs Enforcement Analytics, FALCON Public Infrastructure

U.S. Immigration and Customs Enforcement Critical Foundational Infrastructure, Cloud 

Collaboration Software Suite

Public Software

U.S. Immigration and Customs Enforcement Critical Foundational Infrastructure, Cloud 

General Support System 

Public Infrastructure

U.S. Immigration and Customs Enforcement Executive Secretary Systems, Correspondence 

and Task Tracking System 

Public Infrastructure

U.S. Immigration and Customs Enforcement Investigative Application Support, HSI 

Application Platform

Public Infrastructure

U.S. Immigration and Customs Enforcement Office of the Principal Legal Advisor Systems, 

Electronic Service 

Public Infrastructure

U.S. Immigration and Customs Enforcement Student and Exchange Visitor Information 

System Modernization

Public Infrastructure

Department of Justice

Bureau of Alcohol, Tobacco, Firearms & Explosives Cloud Computing Community Infrastructure, 

Platform and 

Software 

Bureau of Alcohol, Tobacco, Firearms & Explosives Mission and Business Systems Support Community Infrastructure

Bureau of Prisons Network Community Infrastructure 

and Platform
Appendix V: Description of Cloud Computing 

Investments Provided by Selected Agencies 

for Fiscal Year 2018 

Page 82 GAO-19-58 IT Cloud Computing

Agency/Investment

Cloud

deployment model

Cloud

service model 

Drug Enforcement Agency Firebird Private Infrastructure

Drug Enforcement Agency Speedway Private Infrastructure

Federal Bureau of Investigation Criminal Justice Information Services Disaster Recovery Private Infrastructure

Federal Bureau of Investigation Combined DNA Index System Private Infrastructure 

and Platform

Federal Bureau of Investigation Digital Collection Private Infrastructure, 

Platform and 

Software 

Federal Bureau of Investigation Human Resource Source Private Infrastructure 

and Platform

Federal Bureau of Investigation Intelligence Community Information Technology Enterprise Public Software

Federal Bureau of Investigation Innocence Lost Database Web Archival Tool Private Infrastructure 

and Platform

Federal Bureau of Investigation Law Enforcement Online Private Software

Federal Bureau of Investigation Mobility Program Office Public Infrastructure 

and Platform

Federal Bureau of Investigation National Data Exchange Program Private Infrastructure 

and Platform

Federal Bureau of Investigation National Cyber Investigative Joint Task Force Lighthouse Private Infrastructure 

and Platform

Federal Bureau of Investigation Prometheus Private Platform

Justice Management Division Cybersecurity Initiatives Public Infrastructure 

and Platform

Justice Management Division Data Centers Initiatives Community Infrastructure 

and Platform

Justice Management Division Information Technology Planning and Management Public Software

Justice Management Division Information Technology Transformation Initiatives Hybrid Infrastructure 

and Platform

Office of Justice Programs Infrastructure and Information Technology Management Public Infrastructure 

and Platform

Office of Justice Programs Servers and Storage Community Infrastructure

United States Attorneys Information Technology Program Management Public Infrastructure 

and Platform

United States Attorneys Information Technology Security Program Public Infrastructure 

and Platform

United States Attorneys Litigation Technology Service Center Public Infrastructure

United States National Central Bureau Federal Local Information Sharing Community Software

Justice Management Division Cybersecurity Services, Justice Security Operations Center Public Software

United States Attorneys Office Automation (Non-Justice Consolidated Office Network) Private Infrastructure, 

Platform and 

Software 
Appendix V: Description of Cloud Computing 

Investments Provided by Selected Agencies 

for Fiscal Year 2018 

Page 83 GAO-19-58 IT Cloud Computing

Agency/Investment

Cloud

deployment model

Cloud

service model 

United States Marshal Service Mission Modernization, Capture Community Infrastructure 

and Platform

Department of Labor

Cloud Email Public Software

Department of Labor Enterprise Cloud Hybrid Infrastructure, 

Platform and 

Software 

Department of Labor Case Management Platform Hybrid Platform

Department of State

Application Services Private Software

Architecture Services Public Software

Architecture Services Hybrid Platform

Buildings Management Integrated Systems Private Platform

Centralized Data Collection and Integration System Public Software

Centralized Data Collection and Integration System Hybrid Platform

Data Center Services and Hosting Public Platform

Data Center Services and Hosting Private Software

Defense Trade Services Hybrid Platform

Defense Trade Services Private Software

Enterprise Network and Bandwidth Services Private Software

Enterprise Network and Bandwidth Services Hybrid Platform

Global E-Travel Program Community Software

Information Resource Management System, Operations and Maintenance Public Software

Information Resource Management System, Operations and Maintenance Public Platform

myServices Private Software

Department of the Treasury

Bureau of Engraving and Printing, Manufacturing Support Suite, Maximo Private Software

Cloud-based e-mail and collaboration and productivity tools Hybrid Software

Community Development Financial Institutions Fund, Awards Management Information 

System

Community Software

Workplace.gov Community Cloud Infrastructure Community Infrastructure, 

Platform and 

Software 

Fiscal Agency Accounting Services investment, Business Suite Private Infrastructure, 

Platform and 

Software 

Fiscal Central Accounting Services investment Private Infrastructure 

and Platform
Appendix V: Description of Cloud Computing 

Investments Provided by Selected Agencies 

for Fiscal Year 2018 

Page 84 GAO-19-58 IT Cloud Computing

Agency/Investment

Cloud

deployment model

Cloud

service model 

Fiscal Enterprise Initiatives and Capabilities investment, Financial Information Repository Public Infrastructure 

and Platform 

Fiscal Information Technology Infrastructure Services investment, Messaging and 

Collaboration

Public Infrastructure, 

Platform and 

Software 

Fiscal USAspending.gov investment, Data Act Operating Infrastructure Community Infrastructure 

and Platform

Fiscal USAspending.gov Community Infrastructure 

and Platform

IRS.gov, Integrated Enterprise Portal Public Infrastructure

Office of the Comptroller of the Currency, Information Technology Customer Support Community Software

Office of the Comptroller of the Currency, Mobile Data Management Community Platform

Office of the Comptroller of the Currency, email Community Software

Tax and Trade Bureau, General Support System, Mission applications Support Services Private Infrastructure

Tax and Trade Bureau, Information Technology Infrastructure Mainframes and Servers 

Services and Support 

Private Infrastructure

Tax and Trade Bureau, Information Technology, Infrastructure End User Systems and 

Support 

Private Infrastructure 

and Software

Department of Transportation

Department of Transportation: Common Operating Environment Public Infrastructure 

and Platform

Department of Transportation: Common Operating Environment Public Software

Department of Transportation: Common Operating Environment Public Platform

Federal Aviation AdministrationXX137: Enterprise IT Management Private Platform and 

Software 

Federal Aviation AdministrationXX141: Infrastructure/Operations Management Hybrid Infrastructure 

and Platform

Federal Aviation AdministrationXX172: Emergency Notification System Program Hybrid Software

Federal Highway AdministrationX040: Information Technology Enterprise Services (formerly 

consolidated with DOTXX070)

Public Software

Federal Motor Carrier Safety Administration201: Legacy Inspection System Public Infrastructure

Federal Motor Carrier Safety Administration603: Hosting Data Center Public Infrastructure

Federal Motor Carrier Safety Administration704: Customer Relationship Management System Public Software

Federal Transit AdministartionXX028: Information Management Platform Community Platform

National Highway Transit Safety Administration348: Grants Management Suite Public Software

National Highway Transit Safety Administration020: Artemis Public Software

Department of Veterans Affairs

4Cast Financial Planning Hybrid Platform

Appeals Modernization Hybrid Infrastructure

Beneficiary Travel Self-Service System Hybrid Infrastructure
Appendix V: Description of Cloud Computing 

Investments Provided by Selected Agencies 

for Fiscal Year 2018 

Page 85 GAO-19-58 IT Cloud Computing

Agency/Investment

Cloud

deployment model

Cloud

service model 

Captivate Prime Hybrid Software

Centralized Adjudication and Background Investigation System Hybrid Infrastructure

Clinician User Interface Hybrid Infrastructure

Community Care Referrals and Authorization Private Software

Data Access Services Hybrid Infrastructure

Digital Veterans Platform Hybrid Infrastructure

Email as a Service Hybrid Software

Enterprise Acquisition Systems Hybrid Platform

Enterprise Services Collaboration Portal Hybrid Platform

Environment Of Care Hybrid Infrastructure

Financial Services Center Informatica Hybrid Infrastructure

Human Resources, Personnel and Accounting System, Personnel and Accounting Integrated 

Data Decommission

Hybrid Infrastructure

Identity Access Management- Enterprise Hybrid Infrastructure

Information Technology Operations, Customer Experience Environment Hybrid Infrastructure

Information Technology Virtual Campus Hybrid Infrastructure

Insurance Capture Buffer Web Hybrid Infrastructure

Integrated Research Information System Hybrid Infrastructure

Loan Electronic Reporting Interface Redesign Hybrid Infrastructure

Loan Guaranty Hybrid Infrastructure

Medical Appointment Scheduling System Hybrid Infrastructure

Medical Care Collections Fund, Electronic Data Interchange, Transaction Applications Suite Hybrid Infrastructure

Mobile Activity Tracking Research Project Hybrid Infrastructure

Mobile Application Program - VA Online Scheduling Hybrid Infrastructure

Mobile Performance and Operational Web-Enabled Reports Hybrid Software

Online Patient Self-scheduling System Hybrid Infrastructure

Office of Small and Disadvantaged Business Utilization Vet Biz Portal Hybrid Infrastructure

Provider Profile Management System Hybrid Infrastructure

Pulse Hybrid Platform

Recruit, Enroll, Engage, Follow-up Hybrid Infrastructure

Remote Procedure Call Emulation – VistA Adaptive Maintenance Hybrid Infrastructure

Vet Ride Commercial Software

Veteran Oriented Interactive Customer Evaluation Private Infrastructure 

and Software 

Veterans360 Hybrid Infrastructure

Veterans Benefits Management System and Agile Integrated Development Environment Hybrid Infrastructure
Appendix V: Description of Cloud Computing 

Investments Provided by Selected Agencies 

for Fiscal Year 2018 

Page 86 GAO-19-58 IT Cloud Computing

Agency/Investment

Cloud

deployment model

Cloud

service model 

Veterans Health Administration, Future Technologies Lab Hybrid Infrastructure 

and Software

Vets.gov Website Hybrid Infrastructure

VistA Security Remediation Hybrid Platform

VistA Security Scanning Hybrid Platform

VistA Standardization and Virtualization Hybrid Platform

General Services Administration

Analytics Service Platform Public Infrastructure

Cloud-Based Email and Collaboration Platform Hybrid Software

Cloud-Based Service Delivery Platform Community Platform

Cloud.gov Public Platform

Cloud Infrastructure Private Infrastructure

Cloud Management Platform Website hosting Public Infrastructure

Common Gateway Interfact Website Hosting Community Infrastructure

eGov Innovation Public Infrastructure

Electronic Project Management Public Software

eSignLive, E-Signature and Digital Signature Service Hybrid Software

Frameworks Private Software

Human Capital Information Technology Systems Public Infrastructure 

and Software

Integrated Award Environment Hybrid Software

Login.gov (Consumer Identity Platform) Public Infrastructure 

and Software

National Computerized Maintenance Management System Community Software

Suite of back office and Customer Relationship Management Community Platform and 

Software 

Small Business Administration

Certify.sba.gov Private Platform

Disaster Credit Management Modernization Hybrid Infrastructure 

and Platform

SBA.gov Public Platform

Small Business Administration Cloud Hybrid Infrastructure

Social Security Administration

Anti-Fraud Enterprise Solution Public Infrastructure

Disability Case Processing System Public Infrastructure 

and Platform

Enterprise Data Warehouse Public Infrastructure

Source: GAO analysis of agency-provided cloud computing data. | GAO-19-58
Appendix VI: Profiles of Selected Cloud 

Computing Acquisitions

Page 87 GAO-19-58 IT Cloud Computing

The following nine cloud investment profiles illustrate the variety of 

benefits that the selected agencies in our review had realized from the 

acquisition of cloud services.1 These profiles describe the cloud 

investment, costs, key benefits, and the savings or avoidances 

associated with implementation of cloud services. In addition, the profiles 

detail how, among other things, the acquisition of cloud services enabled 

the agency to overcome previous challenges with legacy systems and 

acquire more cost-effective, efficient, and responsive IT resources in 

order to meet mission needs.

Each year, the Department of the Treasury’s (Treasury) Bureau of 

Engraving and Printing prints billions of dollars—referred to as Federal 

Reserve notes—for delivery to the Federal Reserve System. According to 

the Chief of the Bureau of Engraving and Printing’s Office of Enterprise 

Solutions, in October 2012, the bureau’s CIO deployed an enterprise 

resource planning system to the cloud to improve efficiency and 

operations, and enhance the availability, security, and performance of its 

systems that manage the daily business activities of the bureau.

Previously, the bureau had used 16 separate IT legacy systems that were 

facing technological obsolescence and required heavy customization 

using old programming languages. Officials in the bureau reported that 

they spent time updating and maintaining the hardware and software for 

these systems to minimize downtime that led to the need for staff to work 

overtime and decreased customer satisfaction with the system. In 

addition, the legacy systems were not integrated and certain tasks were 

performed manually, including data entry, aggregation, and product 

quality checks. Further, the legacy systems lacked robust data validation 

features; thus, database administrators had to spend time making 

corrections to data submitted by users.

By moving to the cloud, the bureau replaced the 16 systems with software 

as a service that required no customization. As a result, officials in the 

bureau reported that the bureau was able to significantly improve its 

operations and decision making. Further, officials stated that the bureau’s 

use of software as a service enabled it to procure cloud services which 

helped to ensure that the new system had increased availability, 

performance, and security to prevent delays and downtime in operations. 

 

1

Additional detail on how these agencies were selected can be found in appendix I. 

Appendix VI: Profiles of Selected Cloud 

Computing Acquisitions

Treasury’s Cloud 

Acquisition Supports 

Enterprise Resource 

Planning
Appendix VI: Profiles of Selected Cloud 

Computing Acquisitions

Page 88 GAO-19-58 IT Cloud Computing

The bureau also implemented features to improve data entry to reduce 

user errors. Figure 3 provides a summary of Treasury’s cloud acquisition.

Figure 3: Treasury’s Cloud Acquisition Supports Enterprise Resource Planning

Key Benefits

Acquiring software as a service improved operations and 

production decisions. According to Bureau of Engraving and Printing 

officials, by consolidating the bureau’s 16 legacy systems with a single 

system in the cloud, the bureau made significant improvements to its 

operations through automation, improved data quality, and increased 

availability, performance, and security. Specifically, acquiring software as 

a service enabled the bureau to purchase capabilities that its previous 

systems did not have. By doing so, this eliminated some manual data 

entry and improved the bureau’s ability to, among other things, automate 

production decisions which allowed users to focus on more critical tasks.

For example, bureau staff reported that now they enter data from monthly 

Federal Reserve Bank orders into the Manufacturing Support Suite to 

determine the denominations and quantities of currency to produce, along 

with what banks will receive it. In addition, the new system uses current 
Appendix VI: Profiles of Selected Cloud 

Computing Acquisitions

Page 89 GAO-19-58 IT Cloud Computing

production times and data to determine when to replenish existing 

inventory and supplies, such as ink and paper, in order to prevent 

operational delays and downtime. Furthermore, staff stated that they now 

make compliance decisions using automated alerts and triggers, which 

help to prevent the release of products that do not meet bureau 

standards.

According to bureau officials, the bureau has also improved data quality 

and reduced the amount of time that database administrators have to 

spend correcting errors. For example, when users enter data into the 

system, real-time data validation checks prevent common errors and 

prompt users to make corrections before submission. In addition, staff 

stated that the bureau implemented bureau-specific data checks, 

including which accounts could be associated with item categories and 

cost centers, which has reduced user errors and improved the reliability of 

the data.

Finally, the bureau has improved system availability, security, and 

performance by acquiring software as a service. For example, bureau 

officials stated that they selected a FedRAMP-approved2 provider and 

established service level agreements with the provider to help ensure 

system availability, security, and performance, including disaster recovery 

capabilities that were not available for the legacy systems. In addition, 

bureau staff said that they no longer need to update and maintain IT 

software and hardware, which has saved time and resources, and 

decreased system downtime.

The Department of Transportation’s (Transportation) Federal Transit 

Administration provides financial and technical assistance to local public 

transit systems, including buses, subways, light rail, commuter rail, 

trolleys and ferries. According to the Federal Transit Administration IT 

Director, in October 2014, the National Transit Database was migrated to 

the cloud in order to improve customer experience, mission assurance, 

agility and responsiveness. Previously, the legacy database had several 

challenges, including the use of obsolete technology, poor usability, and 

problems with data accuracy. In addition, developing new functionality for 

 

2

FedRAMP is a government-wide program providing a standardized approach to security 

assessment, authorization, and continuous monitoring for cloud products and services. 

Transportation’s Cloud 

Acquisition Stores Public 

Transit Data
Appendix VI: Profiles of Selected Cloud 

Computing Acquisitions

Page 90 GAO-19-58 IT Cloud Computing

the legacy system was a lengthy process, which decreased the ability of 

developers to respond to other user needs.

By transitioning to the cloud, the Federal Transit Administration 

established a centralized access portal for users, which consolidated 

systems, eliminating the need to remember multiple passwords for 

external users, and added a single sign on feature for internal users. Staff 

in the Federal Transit Administration also reported that they improved the 

database’s user interface by implementing improved system validation 

functionality for transit data. In addition, the cloud provided software 

developers with tools to develop functionality quicker to help improve the

database’s responsiveness to user needs. Figure 4 provides a summary 

of Transportation’s cloud acquisition.

Figure 4: Transportation’s Cloud Acquisition Stores Public Transit Data
Appendix VI: Profiles of Selected Cloud 

Computing Acquisitions

Page 91 GAO-19-58 IT Cloud Computing

Key Benefits

Automating validation features improved customer experience.

According to Federal Transit Administration officials, by moving to the 

cloud, developers established automated validation features which use 

historical data to identify outliers and prevent potential user data entry 

errors. Officials reported that analysts previously performed manual data 

validation to ensure the accuracy of customer-entered data. The new 

cloud version of the National Transit Database uses historical data to 

identify errors and leverages cross-form data validation for the current 

reporting year, which has reduced the time it takes to validate the data.

Faster development methods improved the responsiveness to user 

needs. According to Federal Transit Administration officials, with the 

deployment to the cloud, the agency adopted faster development 

processes, which led to more frequent releases of functionality. For 

example, the database’s developers regularly receive requests from 

transit customers for enhancements that would traditionally take longer to 

implement in the prior legacy environment. By leveraging the cloud 

framework and improved Agile development procedures, officials reported 

that developers can now engage users earlier to make adjustments 

based on their feedback, thereby focusing more directly on meeting 

business needs.

The General Services Administration (GSA) helps federal agencies build 

and acquire office space, products and other workspace services, and 

oversees the preservation of historic federal properties. According to 

GSA’s Chief Data Officer, in 2015, GSA began developing an enterprise 

platform pilot program, Data to Decisions, in order to improve the agility, 

responsiveness, efficiency, and operations of the agency’s data analytics 

capabilities. Previously, GSA’s data analytics operations had redundancy 

and overlap, including similar contracts and data sources, negatively 

affecting data sharing efforts across the agency.

Subsequently, in October 2015, GSA’s CIO, Chief Data Officer, and Chief 

Technology Officer moved the program to the cloud while consolidating 

existing contracts to create a centralized web portal. GSA officials 

reported that the new portal provides new data analytics capabilities for 

staff to use in generating analyses to advise decision makers at the 

agency and across other federal agencies, while also saving staff time in 

producing these analyses. For example, the centralized web portal allows 

the agency’s 400 data practitioners to, among other things, build data 

GSA’s Cloud Acquisition 

Enhances Federal Data 

Analytics
Appendix VI: Profiles of Selected Cloud 

Computing Acquisitions

Page 92 GAO-19-58 IT Cloud Computing

models, understand business operations through analytics and 

visualizations, and publish dashboards and reporting. Figure 5 provides a 

summary of GSA’s cloud acquisition.

Figure 5: GSA’s Cloud Acquisition Enhances Federal Data Analytics

Key Benefits

Providing analytical capabilities and tools to the federal government 

improved the management of resources. According to GSA officials in 

the Office of the CIO, cloud deployment has enabled the sharing of data 

and other analytical tools across the federal government to help agencies 

better manage their resources and create efficiencies in data 

management. For example, previously, agencies did not have access to 

detailed data regarding agency-owned and GSA-managed property in 

their asset portfolios. By moving to the cloud, GSA officials reported that 

they developed two tools called the Real Property Management Tool and 

the Asset Consolidation Tool. These tools were deployed to between 30 

and 40 federal agencies, which enabled these agencies to identify 

potential opportunities to consolidate their building properties or co-locate 

office spaces to help save resources. Specifically, the tools provided 

dashboards that showed expiring leases and occupancy agreements, as 
Appendix VI: Profiles of Selected Cloud 

Computing Acquisitions

Page 93 GAO-19-58 IT Cloud Computing

well as excess and underutilized space. Further, the program provided 

data to federal agencies that were not previously available. By doing so, 

officials said that smaller agencies did not have to invest in their own data 

analytics capabilities or acquire additional staff resources for data 

analytics.

Flexible and scalable technology addressed an increased demand 

for data services. According to GSA officials in the Office of the CIO, as 

the program has expanded its data analytics capabilities, program usage 

has grown over time. In particular, in 2018, of the program’s 7,200 users, 

more than 80 percent were from federal agencies other than GSA. Cloud 

deployment has allowed GSA to easily scale resources to manage 

changes in user traffic and enabled agency personnel to focus on the 

mission rather than managing a data center to respond to these changes 

in demand. For example, in 2017, GSA officials said that they sent out a 

notice to approximately 1 million federal employees who had completed 

its annual tenant satisfaction survey notifying them that the survey’s 

results were available. As a result, several thousand users tried to access 

the report on the program’s portal, affecting the program’s operations. 

Officials said that the agency was able to scale up the portal’s resources 

and capabilities to handle the demand and then scale the resources back 

once user traffic returned to normal levels.

The Department of Veterans Affairs (VA), among other duties, 

administers a variety of benefits and services that provide financial and 

other forms of assistance to veterans, their dependents, and survivors. 

According to the Deputy Assistant Secretary for Enterprise Program 

Management, in March 2016, the VA CIO deployed the Vets.gov web 

portal to the cloud in order to improve veterans’ customer experience and 

scale resources to meet demand. Previously, VA officials reported that 

they had experienced challenges with its legacy websites. Specifically, 

the websites were not designed using federal government web standards, 

including browser compatibility and accommodations for the needs of 

individuals with disabilities. In addition, the websites required users to 

remember several sets of login information to access many features on 

approximately 500 websites.

By moving to the cloud, VA officials stated that the agency has been able 

to better address veterans’ needs by consolidating access to over 500 of 

the agency’s websites for benefits and services. The new easier, mobilefriendly web portal requires only one login for all 500 websites, and 

incorporates features for users with disabilities, such as blind veterans. 

VA’s Cloud Acquisition 

Improves Veteran Benefits 

and Services
Appendix VI: Profiles of Selected Cloud 

Computing Acquisitions

Page 94 GAO-19-58 IT Cloud Computing

Further, the program was able to scale up the portal’s resources to meet 

the increased demand for online benefits and services, while adopting a 

design approach that better incorporated the needs of veterans and 

delivered functionality more quickly. In November 2018, the Vets.gov 

cloud platform became the building block for the agency’s new homepage 

at VA.gov. Figure 6 provides a summary of VA’s cloud acquisition.

Figure 6: VA’s Cloud Acquisition Improves Veteran Benefits and Services

Key Benefits

Consolidating website access to benefits and services and 

incorporating veterans’ feedback improved customer service to 

veterans and reduced costs. According to VA officials in the Office of 

the CIO, by moving to the cloud, VA has worked to improve veterans’ 

access to benefits and services through its websites in several key areas. 

For example, Vets.gov is intended to be mobile-friendly and work on any 

computing device with a compliant web browser, avoiding the need to 

install separate software to apply for benefits. In addition, officials stated 

that the agency intends the portal to be easier for veterans to search for 

services. For instance, VA had previously developed an application to 
Appendix VI: Profiles of Selected Cloud 

Computing Acquisitions

Page 95 GAO-19-58 IT Cloud Computing

help veterans schedule medical appointments but VA officials reported 

that veterans could not easily locate the application after searching 

across multiple VA websites.

In addition, VA officials stated that the agency was also able to reduce 

costs because, in moving to the cloud, Vets.gov cost the agency 85 

percent less than it would have cost to build a traditionally hosted service 

with the same features. VA also retired a legacy application, which saved 

an estimated $1 million in annual contract costs.

Scalable technology and a faster veteran-centered development 

approach increased agility and responsiveness. According to VA 

officials in the Office of the CIO, moving to the cloud allowed VA to 

acquire more flexible and scalable technologies in order to scale 

resources up and down to meet demand, while incorporating a faster, 

more user-friendly design approach. For example, after its launch, 

officials said that Vets.gov received a spike in the number of veterans that 

chose to submit online applications for healthcare, which the agency was 

able to handle by scaling up resources to meet the spike in demand.

In addition, VA officials reported that the agency adopted a design 

approach in the cloud that, among other things, allowed it to adopt Agile 

methods to more quickly deliver releases. For example, based on 

feedback, VA incorporated mobile friendly design features—40 percent of 

Vets.gov users access benefits and services through a mobile device. 

Officials said that the agency has made efforts to focus on the needs of 

veterans first by using an iterative design approach that incorporates user 

feedback into the design process so that no features in the portal are 

deployed without a final usability test with a veteran. VA officials also 

reported that using the cloud has allowed the agency to deploy new 

features as soon as they are ready, in small incremental daily releases. 

Further, the officials noted that VA developers have worked with veterans 

on the portal’s healthcare claims status tracker. Specifically, veterans can 

access the status of their healthcare claims that may be experiencing a 

backlog in processing, along with an estimated decision date. Lastly, 

officials reported that by incorporating an online application, Vets.gov 

reduced the number of paper-based healthcare applications submitted by 

veterans. In fiscal year 2018, users submitted over 750,000 digital forms 

for benefits through Vets.gov.
Appendix VI: Profiles of Selected Cloud 

Computing Acquisitions

Page 96 GAO-19-58 IT Cloud Computing

The Department of Justice’s (Justice) U.S. Trustee Program (USTP) is 

responsible for overseeing the administration of bankruptcy cases and 

private trustees within the United States.3 According to USTP’s Chief 

Technology Officer, in June 2016, executives in the Program, including 

the CIO, decided to migrate USTP’s operations to the cloud to meet 

regulatory requirements, reduce costs, and improve agility, efficiency, and 

responsiveness. Officials said that their office had conducted an 

evaluation and determined that, in order to fulfill OMB’s mandate to 

consolidate agency data centers, USTP would have to spend at least $1 

million for an on-premise consolidation. Officials reported that USTP also 

faced challenges with having adequate backup capabilities and 

implementing new technological solutions due to its legacy computing 

environment and the time it took to purchase and install new hardware 

and software. Subsequently, in March 2017, the Program moved its 

operations to the cloud and avoided the cost of consolidating its data 

centers. In addition, officials in USTP said that the move to the cloud 

helped them address backup issues, and speed up the development and 

testing of new applications. Figure 7 provides a summary of Justice’s 

cloud acquisition.

 

3

Bankruptcy cases filed in Alabama and North Carolina are overseen by a Bankruptcy 

Administrator from one of the judicial districts in those states rather than the U.S. Trustee 

Program. 

Justice’s Cloud Acquisition 

Hosts Data Center
Appendix VI: Profiles of Selected Cloud 

Computing Acquisitions

Page 97 GAO-19-58 IT Cloud Computing

Figure 7: Justice’s Cloud Acquisition Hosts Data Center

Key Benefits

Avoiding an on-premise data center consolidation and streamlining 

IT operations reduced costs. According to USTP officials, by moving to 

the cloud, their office avoided at least $1 million in costs, while resolving 

internal performance issues, and streamlining the management of its 

contracts. Specifically, officials said that USTP shut down 1 of its 2 data 

centers and reduced its server inventory from 140 to 75 and the number 

of vendors from 21 to 9. In addition, the office eliminated an estimated 50-

70 monthly IT staff hours dedicated to resolving backup issues.

Flexible technology resources sped up the development of 

functionality. According to USTP officials, acquisitions of new 

technology previously took several months because of the time needed to 

estimate requirements and wait for officials to purchase and install 

hardware and software. By moving to the cloud, USTP officials stated that 

the intention is to be able to develop and test new applications faster, and 

determine their viability, with minimal time and costs. Specifically, officials 

reported that they have set up a cloud test lab to better understand 
Appendix VI: Profiles of Selected Cloud 

Computing Acquisitions

Page 98 GAO-19-58 IT Cloud Computing

system requirements by scaling up and down resources as needed and 

experimenting with new capabilities. In addition, while USTP’s legacy 

monitoring solution required consulting assistance and took months to 

implement, officials noted that they were able to set up a similar solution 

in the cloud within 1 week.

The Department of Homeland Security (DHS) collaborates with a variety 

of agencies and organizations to share information related to homeland 

security. According to the program’s Service Operations Manager, DHS’s 

CIO migrated the Homeland Security Information Network to the cloud in 

July 2017 in order to improve the system’s availability and operational 

efficiency, while reducing costs. Officials stated that, previously, the 

agency had faced challenges in ensuring the system’s redundancy and 

deploying new network enhancements quickly. This was due to the costs 

and time frames associated with acquiring new infrastructure and 

maintaining and upgrading current infrastructure. In addition, the agency 

was not able to quickly develop and deploy new capabilities to meet user 

needs.

By moving to the cloud, officials stated that the agency was able to 

implement a disaster response capability and improve the system’s

operational efficiency, while also establishing more efficient environments 

for software development and testing. In addition, the agency was able to 

shut down an existing data center, which achieved cost savings of at least 

30 percent from hosting the network in the data center. Figure 8 provides 

a summary of DHS’s cloud acquisition.

DHS’s Cloud Acquisition 

Supports Information 

Sharing and Collaboration
Appendix VI: Profiles of Selected Cloud 

Computing Acquisitions

Page 99 GAO-19-58 IT Cloud Computing

Figure 8: DHS’s Cloud Acquisition Supports Information Sharing and Collaboration

Key Benefits

Acquiring infrastructure as a service improved system availability 

and operational efficiency. According to DHS officials in the Office of 

the CIO, migrating to the cloud has improved the system’s availability and 

operational efficiency, which cost less money than the prior hosting 

solution. For example, acquiring infrastructure as a service provided 

increased redundancy over the old solution and has helped to ensure the 

network remains continuously available for daily operations and 

emergency response. The officials stated that, previously, the agency had 

not been able to implement a disaster recovery capability because it 

would cost over $1.5 million to build and maintain a second active 

network environment. Moving to the cloud enabled the agency to 

implement this capability for significantly less cost.

In addition, officials in the CIO’s office said that the acquisition of 

infrastructure as a service has enabled the agency to improve the 

operational efficiency of the system. For example, network managers can 
Appendix VI: Profiles of Selected Cloud 

Computing Acquisitions

Page 100 GAO-19-58 IT Cloud Computing

easily stand up new virtual hardware, networking, and storage 

capabilities, or make changes to existing infrastructure, in less than a day. 

Officials said that, previously, it used to take staff several months to make 

these changes manually. This allows network managers to respond very 

rapidly to changes in user demand, particularly if there are emergencies 

or natural disasters, and then scale down resources during non-use 

periods. For example, officials said that managers scaled up resources to 

support first responders from federal, state, and local governments to 

share weather, response and recovery information during Hurricanes 

Harvey, Irma, and Jose, and the West Coast wildfires. In addition, the 

officials noted that network managers now have access to the latest 

virtual hardware and the agency does not have to pay for hardware 

refreshments.

Flexible technology resources strengthened the development of 

functionality. According to DHS officials in the Office of the CIO, moving 

to the cloud enabled the agency to very inexpensively build multiple 

environments in the system for software development, testing, and 

production, which has improved the development and deployment of new 

services. Software developers now have consistent and standardized 

environments, which helps to reduce the risk of errors and security 

vulnerabilities, as well as configuration issues. DHS officials stated that all 

of these issues would previously require staff time and funding to resolve. 

The developers can also now use automation tools to deploy new code 

from development into production more quickly to help meet user needs 

for new functionality. In addition, officials noted that cloud providers are 

constantly adding new services that users can leverage to do their work 

more efficiently, without the time and cost of the agency having to 

develop or procure this capability separately.

The Department of Agriculture’s (Agriculture) U.S. Forest Service 

manages 193 million acres of federal land in order to sustain the health, 

diversity, and productivity of the nation’s forests and grasslands for 

present and future generations. According to the Acting Assistant Forest 

Service CIO for Natural Resources and Environment, in August 2017, the 

Forest Service began deploying a new enterprise content management 

and electronic records management system, called Pinyon, to the cloud 

to help improve operations and the management of electronic records. 

The move also addressed federal requirements related to electronic 

Agriculture’s Cloud 

Acquisition Improves 

Enterprise Content and 

Electronic Records 

Management
Appendix VI: Profiles of Selected Cloud 

Computing Acquisitions

Page 101 GAO-19-58 IT Cloud Computing

records management.4 Officials stated that, previously, the Forest Service 

relied on a shared storage drive for enterprise content management. 

Officials reported that this drive was highly proprietary, slow, unreliable, 

and a security vulnerability because it could not be easily maintained. In 

addition, officials reported that the shared storage drive was on the verge 

of failure because the vendor no longer supported and upgraded the 

system.

By acquiring two software as a service solutions for enterprise content 

and electronic records management, officials said that the Forest Service 

was able to quickly deploy a new system with only some limited software 

customization for the integration of the two solutions. The Forest Service 

completed this in two phases; officials deployed the enterprise content 

management solution in August 2017 and the electronic records 

management solution began deployment in August 2018. Officials 

reported that they plan to fully deploy the system by December 2018. 

Figure 9 provides a summary of Agriculture’s cloud acquisition.

 

4

By December 31, 2019, OMB and the National Archives and Records Administration will 

require federal agencies to manage all permanent electronic records to the fullest extent 

possible in an electronic format in order to transfer those records to the archives. See 

OMB and National Archives and Records Administration, Memorandum for the Heads of 

Executive Departments and Agencies and Independent Agencies: Managing Government 

Records Directive, M-12-18 (Washington, D.C.: Aug. 24, 2012).
Appendix VI: Profiles of Selected Cloud 

Computing Acquisitions

Page 102 GAO-19-58 IT Cloud Computing

Figure 9: Agriculture’s Cloud Acquisition Improves Enterprise Content and Electronic Records Management

Key Benefits

Acquisition of software as a service improved operations. According 

to Forest Service officials in the Office of the CIO, by acquiring software 

as a service, the Forest Service was able to implement new enterprise 

content management capabilities and collaboration tools quickly without 

the costs and risks associated with software development. Officials said 

that, previously, users did not have capabilities for managing their own 

content such as setting permissions, granting access privileges to 

documents, or easily managing different document versions. In addition, 

officials noted that users relied heavily on email to collaborate on daily 

work activities as other collaboration tools were not available. By 

acquiring software as a service, officials said that the Forest Service was 

able to quickly implement enhanced workflow and document 

management capabilities and add new tools for collaboration, which has 

increased staff productivity. Furthermore, acquiring software as a service 

allowed the Forest Service to integrate their new system with Agriculture’s 

electronic authentication system, which the agency could not previously 

accomplish with the legacy system. By integrating these systems, Forest 
Appendix VI: Profiles of Selected Cloud 

Computing Acquisitions

Page 103 GAO-19-58 IT Cloud Computing

Service officials said that the agency has increased the accessibility of 

the Forest Service’s information by allowing staff to securely access files 

regardless of physical location.

Going forward, officials in the Forest Service said that they are exploring 

other features and capabilities offered by the cloud vendor to help better 

meet mission needs. For example, the Forest Service regularly 

collaborates with a variety of other agencies, state and local 

governments, educational institutions and other organizations on issues 

related to managing federal lands and responding to natural disasters, 

such as wildfires. Officials noted that the Forest Service hopes to use 

shared virtual workspaces and other collaboration tools to engage these 

partners.

In addition, by acquiring software as a service, Forest Service officials 

said that they have ensured that there is a system in place that the 

vendor will automatically upgrade with new enhancements, capabilities, 

and the latest technology. For example, in order to meet new federal 

cybersecurity requirements, Forest Service officials said that they have 

been able to work with the cloud vendor to ensure the vendor 

incorporates software changes to meet these requirements.

Flexible and scalable technology enhanced the management and 

storage of electronic records. According to Forest Service officials in 

the Office of the CIO, by moving to the cloud, the Forest Service was able 

to acquire new storage capabilities that are easily scalable as its volume 

of electronic records grows over time. Officials said that, previously, the 

Forest Service used both paper-based records and a shared storage 

drive for storing work documents and other operational records. Paperbased records were stored in file cabinets and warehouses while the 

shared storage drive maintained approximately 320 million files and 250 

terabytes of data. In addition, the agency previously used tape backups 

for the shared storage drive. By moving to the cloud, officials in the Forest 

Service said that they gained unlimited storage and electronic backup 

capabilities. Further, Forest Service officials said the new system is 

intended to be able to easily scale up storage resources as needed for 

the digitization of its paper-based records and handle the future volumes 

of electronic records.

In addition, by acquiring software as a service, officials in the CIO’s office 

reported that the Forest Service was able to meet the federal requirement 

for electronic records management more than a year before the 

December 2019 deadline, which the prior shared drive could not meet.
Appendix VI: Profiles of Selected Cloud 

Computing Acquisitions

Page 104 GAO-19-58 IT Cloud Computing

The Department of Commerce’s (Commerce) National Oceanic and 

Atmospheric Administration works to understand and predict changes in 

climate, weather, oceans, and coasts, and shares that knowledge and 

information with others. According to Commerce’s Acting Chief 

Information Officer, in September 2017, the National Oceanic and 

Atmospheric Administration’s CIO and National Weather Service 

leadership decided to deploy its public weather websites to the cloud in 

order to improve the agility and responsiveness of these websites in a 

cost-effective manner. Officials stated that, previously, in 2016, as a result 

of Hurricane Matthew, hundreds of millions of web requests led to failures 

with the program’s on-premise infrastructure, causing websites to become 

unavailable to the public for a period of time. Subsequently, in September 

2017, prior to the landfall of Hurricane Irma, officials stated that the 

agency launched its weather cloud content delivery network. This new 

network is intended to ensure the availability of weather-related 

information, while avoiding the additional expenses for infrastructure that 

would likely go unused during normal business operations. Figure 10

provides a summary of Commerce’s cloud acquisition.

Figure 10: Commerce’s Cloud Acquisition Enhances Access to Weather Data

Commerce’s Cloud 

Acquisition Enhances 

Access to Weather Data
Appendix VI: Profiles of Selected Cloud 

Computing Acquisitions

Page 105 GAO-19-58 IT Cloud Computing

Key Benefits

Increased service availability ensured the public’s timely access to 

extreme weather-related information. According to National Oceanic 

and Atmospheric Administration officials, the deployment of the weather 

cloud content delivery network in September 2017 helped websites 

handle the web requests for data on Hurricanes Irma and Maria by 

scaling up the resources needed to handle the increased requests. 

Normally, the weather websites receive approximately 26 million daily 

web requests from the public. However, officials noted that the number of 

requests increases dramatically during adverse weather events, such as 

hurricanes. For example, officials said that in August 2017, the websites 

began experiencing delays because of the high volume of hurricanerelated requests from Hurricane Harvey—including approximately 218 

million web requests on August 31, 2017 alone. After deployment to the 

cloud in September 2017, officials reported that over the course of two 

days, the weather cloud content delivery network successfully scaled up 

its resources and handled approximately two billion web requests 

received through the administration websites.

On-demand capabilities decreased costs. According to National 

Oceanic and Atmospheric Administration officials, by acquiring software 

as a service, it avoided the cost of expanding existing on-premise 

infrastructure to handle sudden surges in demand that only last a short 

period of time, as well as associated maintenance costs. Officials said 

that the program can now scale up the resources supporting the weather 

cloud content delivery network whenever it anticipates an adverse 

weather event that would lead to greater demand for website information.

The Department of Defense’s (Defense) U.S. Transportation Command 

(USTRANSCOM) provides common user and commercial air, land, and 

sea transportation, as well as terminal management and air refueling, in 

support of the military’s deployment, employment, sustainment, and redeployment efforts. USTRANSCOM’s Chief of Cyber Operations and 

Readiness Division reported that in January 2017, the USTRANSCOM 

Commander made the decision to migrate all of the command’s systems 

to the cloud in order to improve mission assurance, agility, 

responsiveness, efficiency, and operations. Officials reported that, 

previously, the command had experienced a massive power outage 

affecting the availability of approximately 25 legacy systems that lacked 

the capability to quickly recover from network failures. In addition, officials 

noted that the command’s system, used to manage world-wide moves of 

Defense personnel property, was not user-friendly, and was difficult to 

Defense’s Cloud 

Acquisition Enhances 

Transportation Command 

Systems
Appendix VI: Profiles of Selected Cloud 

Computing Acquisitions

Page 106 GAO-19-58 IT Cloud Computing

maintain because the agency built the system using waterfall software 

development methods. Lastly, officials said that the command had largely 

relied on manual reporting activities that took numerous staff hours to 

produce to make financial, operational, planning, and support decisions.

By beginning to transition to the cloud in January 2018, USTRANSCOM 

officials said that the command is in the process of ensuring its systems 

are secure and continuously available, and is developing capabilities to 

improve the usability of its legacy systems. In addition, officials reported 

that the command is streamlining its tracking and reporting mechanisms 

to allow users to automatically generate key reports, which will give 

decision makers access to more current and accurate information to help 

improve program operations. USTRANSCOM officials said that executive 

sponsorship is absolutely critical for migrating to the cloud to overcome 

culture change by bringing together people throughout the enterprise. In 

addition, the command’s cloud center of excellence team facilitates the 

command’s adoption of cloud by, among other things, training users and 

addressing governance issues. Figure 11 provides a summary of 

Defense’s cloud acquisition.
Appendix VI: Profiles of Selected Cloud 

Computing Acquisitions

Page 107 GAO-19-58 IT Cloud Computing

Figure 11: Defense’s Cloud Acquisition Enhances Transportation Command Systems

Key Benefits

Incorporating automated recovery from network failures and 

streamlining security increased mission assurance. According to 

USTRANSCOM officials, by moving the command’s network to the cloud, 

the command has been able to design and build its new network with 

higher levels of availability. For example, officials said that if a network 

segment becomes unavailable, the cloud technology has the capability to 

automatically reroute traffic to help reduce the amount of delay that users 

experience. In addition, officials reported that developers have been 

working to automate several hundred security checks that are part of 
Appendix VI: Profiles of Selected Cloud 

Computing Acquisitions

Page 108 GAO-19-58 IT Cloud Computing

Defense’s security technical implementation guides5 by implementing a 

repeatable, automated process instead of doing manual checks. Officials 

noted that, previously, manually checking of the status of configurations 

would take hundreds of man hours to complete. Eventually, the command 

anticipates that automation will save these hours of manual checks. The 

command plans to implement the new capability in May 2019.

Replacing a legacy system with a cloud-based system developed 

using Agile software development methodologies will enhance the 

shipment of personnel property. According to USTRANSCOM officials, 

moving to the cloud has assisted the command by replacing the legacy 

system that manages moves of Defense personnel property, like 

household goods, with a mobile prototype built in the cloud. Officials 

reported that the legacy system currently uses a variety of commercial 

products that are difficult to maintain and do not efficiently address the 

command’s complex business processes for personnel property moves,

all of which affects the usability of the system. Currently, the command is 

using Agile software development methodologies to reengineer its 

business processes to develop a solution that is mobile and user-friendly. 

The new mobile prototype is intended to allow personnel to request 

access in order to manage the moves of certain household goods. 

Officials reported that the command initially planned to deploy the 

prototype in June 2018 but deployment was delayed and a new date had 

not yet been identified.

Automating reporting and tracking mechanisms will help eliminate 

manual processes. According to USTRANSCOM officials, the command 

is in the process of automating its processes for reporting and tracking 

cargo shipments utilizing cloud technologies. Currently, the command 

employs manual processes to track and monitor a variety of its cargo 

shipments. For example, officials reported that five analysts typically 

spend one day compiling a status report that details delays with food 

shipments for Defense military exercises and operations. In addition, 

analysts currently have to query up to 11 Defense and commercial carrier 

systems to compile a report on high-priority shipments across the 

combatant commands. Officials noted that these analysts often 

 

5

Defense security technical implementation guides, developed by the Defense Information 

Systems Agency, provide the required security configuration settings for Defense devices 

and systems related to information assurance in order to securely configure these devices 

and systems. In addition, each guide also has a checklist that is used to review and certify 

that the appropriate configurations are in place. 
Appendix VI: Profiles of Selected Cloud 

Computing Acquisitions

Page 109 GAO-19-58 IT Cloud Computing

experience delays getting access to timely information and must also 

resolve conflicting information in various transportation systems. 

However, with the transition to cloud services, officials in USTRANSCOM 

reported that analysts will have the capability to automatically generate 

reports based on defined criteria, such as shipment method or 

destination, and use data feeds that officials can continuously update. By 

developing phase one of the system in the cloud in fiscal year 2018, 

officials reported that they will be able to monitor delays in a shipment 

and immediately take action to change the mode of transportation or 

source shipments from alternate suppliers. The command plans to 

release the full operational capability in fiscal year 2020, which, officials 

noted, will give authorized users near real-time access to shipment 

information, including estimates of whether a shipment will arrive on time.
Appendix VII: Comments from the Department 

of Commerce

Page 110 GAO-19-58 IT Cloud Computing

Appendix VII: Comments from the 

Department of Commerce 
Appendix VII: Comments from the Department 

of Commerce

Page 111 GAO-19-58 IT Cloud Computing
Appendix VIII: Comments from the Department 

of Education

Page 112 GAO-19-58 IT Cloud Computing

Appendix VIII: Comments from the 

Department of Education 
Appendix VIII: Comments from the Department 

of Education

Page 113 GAO-19-58 IT Cloud Computing
Appendix IX: Comments from the Department of Energy

Page 114 GAO-19-58 IT Cloud Computing

Appendix IX: Comments from the 

Department of Energy
Appendix IX: Comments from the Department of Energy

Page 115 GAO-19-58 IT Cloud Computing
Appendix X: Comments from the Health and 

Human Services 

Page 116 GAO-19-58 IT Cloud Computing

Appendix X: Comments from the Health and 

Human Services 
Appendix X: Comments from the Health and 

Human Services 

Page 117 GAO-19-58 IT Cloud Computing
Appendix XI: Comments from the Department 

of Homeland Security

Page 118 GAO-19-58 IT Cloud Computing

Appendix XI: Comments from the 

Department of Homeland Security 
Appendix XI: Comments from the Department 

of Homeland Security

Page 119 GAO-19-58 IT Cloud Computing
Appendix XI: Comments from the Department 

of Homeland Security

Page 120 GAO-19-58 IT Cloud Computing
Appendix XII: Comments from the Department 

of State

Page 121 GAO-19-58 IT Cloud Computing

Appendix XII: Comments from the 

Department of State 
Appendix XII: Comments from the Department 

of State

Page 122 GAO-19-58 IT Cloud Computing
Appendix XIII: Comments from the Department 

of Transportation

Page 123 GAO-19-58 IT Cloud Computing

Appendix XIII: Comments from the 

Department of Transportation
Appendix XIV: Comments from the Department 

of Veterans Affairs 

Page 124 GAO-19-58 IT Cloud Computing

Appendix XIV: Comments from the 

Department of Veterans Affairs 
Appendix XIV: Comments from the Department 

of Veterans Affairs 

Page 125 GAO-19-58 IT Cloud Computing
Appendix XV: Comments from the General Services 

Administration

 

Page 126 GAO-19-58 IT Cloud Computing

Appendix XV: Comments from the General 

Services Administration
Appendix XVI: Comments from the Department of 

Labor

 

Page 127 GAO-19-58 IT Cloud Computing

Appendix XVI: Comments from the 

Department of Labor
Appendix XVI: Comments from the Department of 

Labor

 

Page 128 GAO-19-58 IT Cloud Computing
Appendix XVII: Comments from the Small 

Business Administration

Page 129 GAO-19-58 IT Cloud Computing

Appendix XVII: Comments from the Small 

Business Administration
Appendix XVIII: Comments from the Social Security 

Administration

Page 130 GAO-19-58 IT Cloud Computing

Appendix XVIII: Comments from the Social 

Security Administration
Appendix XVIII: Comments from the Social Security 

Administration

Page 131 GAO-19-58 IT Cloud Computing
Appendix XIX: Comments from the Department 

of Defense

Page 132 GAO-19-58 IT Cloud Computing

Appendix XIX: Comments from the 

Department of Defense 
Appendix XIX: Comments from the Department 

of Defense

Page 133 GAO-19-58 IT Cloud Computing
Appendix XX: GAO Contact and Staff 

Acknowledgments

Page 134 GAO-19-58 IT Cloud Computing

Carol C. Harris, (202) 512-4456, or harriscc@gao.gov

In addition to the individual named above, the following staff made key 

contributions to this report: Dave Powner (Director), Dave Hinchman 

(Assistant Director), Chris Businsky, Nancy Glover, Valerie Hopkins 

(Analyst-in-Charge), Sandra Kerr, James MacAulay, Jamelyn Payan, and 

Priscilla Smith.

Appendix XX: GAO Contact and Staff 

Acknowledgments

GAO Contact

Staff 

Acknowledgments

(102299)
The Government Accountability Office, the audit, evaluation, and investigative 

arm of Congress, exists to support Congress in meeting its constitutional 

responsibilities and to help improve the performance and accountability of the 

federal government for the American people. GAO examines the use of public 

funds; evaluates federal programs and policies; and provides analyses, 

recommendations, and other assistance to help Congress make informed 

oversight, policy, and funding decisions. GAO’s commitment to good government 

is reflected in its core values of accountability, integrity, and reliability.

The fastest and easiest way to obtain copies of GAO documents at no cost is 

through GAO’s website (https://www.gao.gov). Each weekday afternoon, GAO 

posts on its website newly released reports, testimony, and correspondence. To 

have GAO e-mail you a list of newly posted products, go to https://www.gao.gov

and select “E-mail Updates.”

The price of each GAO publication reflects GAO’s actual cost of production and 

distribution and depends on the number of pages in the publication and whether 

the publication is printed in color or black and white. Pricing and ordering 

information is posted on GAO’s website, https://www.gao.gov/ordering.htm. 

Place orders by calling (202) 512-6000, toll free (866) 801-7077, or 

TDD (202) 512-2537.

Orders may be paid for using American Express, Discover Card, MasterCard, 

Visa, check, or money order. Call for additional information.

Connect with GAO on Facebook, Flickr, Twitter, and YouTube. 

Subscribe to our RSS Feeds or E-mail Updates. Listen to our Podcasts. 

Visit GAO on the web at https://www.gao.gov. 

Contact:

Website: https://www.gao.gov/fraudnet/fraudnet.htm

Automated answering system: (800) 424-5454 or (202) 512-7700

Orice Williams Brown, Managing Director, WilliamsO@gao.gov, (202) 512-4400, 

U.S. Government Accountability Office, 441 G Street NW, Room 7125, 

Washington, DC 20548

Chuck Young, Managing Director, youngc1@gao.gov, (202) 512-4800

U.S. Government Accountability Office, 441 G Street NW, Room 7149 

Washington, DC 20548

James-Christian Blockwood, Managing Director, spel@gao.gov, (202) 512-4707

U.S. Government Accountability Office, 441 G Street NW, Room 7814, 

Washington, DC 20548

GAO’s Mission

Obtaining Copies of 

GAO Reports and 

Testimony

Order by Phone

Connect with GAO

To Report Fraud, 

Waste, and Abuse in 

Federal Programs

Congressional 

Relations

Public Affairs

Strategic Planning and 

External Liaison

Please Print on Recycled Paper.