Cloud Computing: Additional Opportunities and Savings Need to Be Pursued
Published: 2014-09-25T00:00:00

Fast Facts:

Highlights:
section_title: Why GAO Did This Study
paragraphs: Cloud computing is a relatively new process for acquiring and delivering computing services via information technology (IT) networks. Specifically, it is a means for enabling on-demand access to shared and scalable pools of computing resources with the goal of minimizing management effort and service provider interaction. To encourage federal agencies to pursue the potential efficiencies associated with cloud computing, the Office of Management and Budget (OMB) issued a “Cloud First” policy in 2011 that required agency Chief Information Officers to implement a cloud-based service whenever there was a secure, reliable, and cost-effective option.
GAO was asked to assess agencies' progress in implementing cloud services. GAO's objectives included assessing selected agencies' progress in using such services and determining the extent to which the agencies have experienced cost savings. GAO selected for review the seven agencies that it reported on in 2012 in order to compare their progress since then in implementing cloud services; the agencies were selected using the size of their IT budgets and experience in using cloud services. GAO also analyzed agency cost savings and related documentation and interviewed agency and OMB officials.
section_title: What GAO Found
paragraphs: Each of the seven agencies reviewed implemented additional cloud computing services since GAO last reported on their progress in 2012. For example, since then, the total number of cloud computing services implemented by the agencies increased by 80 services, from 21 to 101. The agencies also added to the amount they reported spending on cloud services by $222 million, from $307 million to $529 million. Further, the agencies increased the percentage of their information technology (IT) budgets allocated to cloud services; however, as shown in the table, the overall increase was just 1 percent.
The agencies' relatively small increase in cloud spending as a percent of their overall IT budgets, is attributed in part, to the fact that these agencies collectively had not considered cloud computing services for about 67 percent of their investments. With regard to why these investments had not been assessed, the agencies said it was in large part due to these being legacy investments in operations and maintenance; the agencies had only planned to consider cloud options for these investments when they were to be modernized or replaced. This is inconsistent with Office of Management and Budget policy that calls for cloud solutions to be considered first whenever a secure, reliable, and cost-effective option exists regardless of where the investment is in its life cycle. Until the agencies fully assess all their IT investments, they will not be able to achieve the resulting benefits of operational efficiencies and cost savings.
The agencies collectively reported cost savings of about $96 million from the implementation of 22 of the 101 cloud services. These savings included both one-time and multiyear savings. For example, the General Services Administration saved $2.6 million by migrating to a cloud customer service solution, and Homeland Security saved $1.2 million from fiscal years 2011 through 2013 by implementing a cloud-based collaboration service. Agency officials cited two major reasons for why the other services they had implemented did not save money. First, a motivation for changing to some of the cloud-based services was not to reduce spending, but to improve service. Second, in selected cases, the cloud computing service opened up a new service or provided a higher quality of service; while this provided useful benefits to the agency, the associated costs negated any savings.
section_title: What GAO Recommends
paragraphs: GAO is recommending, among other things, that the seven agencies assess the IT investments identified in this report that have yet to be evaluated for suitability for cloud computing services. Of the seven agencies, six agreed with GAO's recommendations, and one had no comments.

section_title: Letter
paragraphs: Cloud computing is a relatively new and emerging process for acquiring  and delivering computing services via information technology (IT)  networks, including the Internet. According to the National Institute of  Standards and Technology (NIST), cloud computing is a means for  enabling on-demand access to shared and scalable pools of computing  resources with the goal of minimizing management effort or service  provider interaction. As a result, cloud computing offers potential  increased benefits, including faster service and reduced IT costs,  compared to traditional IT processes currently being used by federal  agencies and others.
To encourage federal agencies to begin taking advantage of cloud  computing services, the Office of Management and Budget (OMB) issued  guidance in December 2010 on implementing these services. The  guidance identified cloud computing as having the potential to play a  major part in achieving operational efficiencies in the federal  government’s IT environment, including improving asset use and reducing  duplicative systems. To help achieve these efficiencies, OMB developed  a “Cloud First” policy (dated February 2011) that required each agency’s  chief information officer (CIO) to implement a cloud service whenever  there was a secure, reliable, cost-effective option. In July 2012, we  reported on the status and progress of seven agencies in implementing  this new policy.
More recently, you asked us to assess, among other things, the seven  agencies’ progress in implementing cloud services since our 2012 report.  Specifically, our objectives were to (1) assess these selected agencies’  progress in using cloud computing services, (2) determine the extent to  which the selected agencies have experienced cost savings when such  services have been deployed, and (3) identify any challenges the  selected agencies are facing as they use cloud computing.
To address our first objective, we selected the same seven agencies that  were reported on in 2012 so we could compare any progress made since  then. (The agencies were selected using a combination of size of the  agency’s IT budget and prior experience in using cloud services.) We  analyzed documentation from the agencies, including data on the number  of and funding for current cloud services and compared this with the  results from our 2012 report. In addition, we interviewed agency officials  responsible for cloud services to corroborate progress. Further, we  reviewed agency data on the extent to which the seven agencies had  assessed new and ongoing investments for potential cloud services. We  also interviewed OMB officials to understand cloud computing guidance  for federal agencies. Based on the procedures described, we concluded  that the data presented are sufficiently reliable for our purposes.
For the second objective, we analyzed agency cost savings data for each  cloud service through fiscal year 2013 and identified any additional  benefits. In addition, we analyzed agency documentation and interviewed  appropriate officials to (1) corroborate the reported cost savings and cost  avoidances and (2) obtain information on other benefits from  implemented cloud services. In doing this, we determined that the data  were sufficiently reliable for the purpose of this report.
Regarding our third objective, we interviewed officials from each of the  selected agencies and asked them to identify challenges associated with  implementation of their cloud computing services. We then assessed and  categorized the challenges and totaled the number of times each  challenge was cited by agency officials. In order to identify the common  challenges, we generalized challenges that were mentioned by two or  more agencies.
We conducted this performance audit from December 2013 through  August 2014 in accordance with generally accepted government auditing  standards. Those standards require that we plan and perform the audit to  obtain sufficient, appropriate evidence to provide a reasonable basis for  our findings and conclusions based on our audit objectives. We believe  that the evidence obtained provides a reasonable basis for our findings  and conclusions based on our audit objectives. Further details of our  objectives, scope, and methodology are included in appendix I.
subsections: section_title: Background
paragraphs: Over the last 15 years, the federal government’s increasing demand for IT  has led to a dramatic rise in operational costs to develop, implement, and  maintain systems and services. Annually, the federal government spends  more than $80 billion on IT. While the use of IT has the potential to  greatly improve service for federal employees and American taxpayers, it  has also led to federal agencies’ reliance on custom IT systems that  can—and have—become risky, costly, and unproductive mistakes. As  part of a comprehensive effort to increase the operational efficiency of  federal IT systems and deliver greater value to taxpayers, federal  agencies are being required by OMB to shift their IT services to a cloud  computing option when feasible.
subsections: section_title: Overview of Cloud-based Computing Services
paragraphs: According to NIST, cloud computing is a means “for enabling convenient,  on-demand network access to a shared pool of configurable computing  resources that can be rapidly provisioned and released with minimal  management effort or service provider interaction.” NIST also states that  an application should possess five essential characteristics to be  considered cloud computing: on-demand self service, broad network  access, resource pooling, rapid elasticity, and measured service.  Essentially, cloud computing applications are network-based and scalable  on demand.
According to OMB, cloud computing offers these benefits to federal  agencies:
Economical: cloud computing is a pay-as-you-go approach to IT, in  which a low initial investment is required to begin, and additional  investment is needed only as system use increases.
Flexible: IT departments that anticipate fluctuations in user demand  no longer need to scramble for additional hardware and software.  With cloud computing, they can add or subtract capacity quickly and  easily.
Fast: cloud computing eliminates long procurement and certification  processes, while providing a near-limitless selection of services.
According to NIST, cloud computing offers three service models:  Infrastructure as a service—the service provider delivers and  manages the basic computing infrastructure of servers, software,  storage, and network equipment on which a platform (i.e., operating  system and programming tools and services) to develop and execute  applications can be developed by the consumer.
Platform as a service—the service provider delivers and manages the  underlying infrastructure (i.e., servers, software, storage, and network  equipment), as well as the platform (i.e., operating system, and  programming tools and services) on which the consumer can create  applications using programming tools supported by the service  provider or other sources.
Software as a service—the service provider delivers one or more  applications and the computational resources and underlying  infrastructure to run them for use on demand as a turnkey service.
As can be seen in figure 1, each service model offers unique functionality,  with consumer control of the environment decreasing from infrastructure  to platform to software.
NIST has also defined four deployment models for providing cloud  services: private, community, public, and hybrid.
In a private cloud, the service is set up specifically for one  organization, although there may be multiple customers within that  organization and the cloud may exist on or off the customer’s  premises.  In a community cloud, the service is set up for organizations with  similar requirements. The cloud may be managed by the  organizations or a third party and may exist on or off the  organization’s premises.
A public cloud is available to the general public and is owned and  operated by the service provider.
A hybrid cloud is a composite of two or more of the above deployment  models (private, community, or public) that are bound together by  standardized or proprietary technology that enables data and  application portability.
According to federal guidance, these deployment models determine the  number of consumers and the nature of other consumers’ data that may  be present in a cloud environment. A public cloud should not allow a  consumer to know or control other consumers of a cloud service  provider’s environment. However, a private cloud can allow for ultimate  control in selecting who has access to a cloud environment. Community  clouds and hybrid clouds allow for a mixed degree of control and  knowledge of other consumers. Additionally, the cost for cloud services  typically increases as control over other consumers and knowledge of  these consumers increase.
section_title: OMB Has Issued Guidance for Cloud-based Computing Services
paragraphs: According to OMB, the federal government needs to shift from building  custom computer systems to adopting cloud technologies and shared  services, which will improve the government’s operational efficiencies and  result in substantial cost savings. To help agencies achieve these  benefits, OMB required agencies to immediately shift to a “Cloud First”  policy and increase their use of available cloud-based and shared  services whenever a secure, reliable, and cost-effective cloud service  exists.
In order to accelerate the adoption of cloud computing services across  the government, in December 2010, OMB made cloud computing an  integral part of its 25 Point Implementation Plan to Reform Federal  Information Technology Management. The plan specified six major  goals: align the acquisition process with the technology cycle, align the budget process with the technology cycle, and apply “light technology” and shared services.  strengthen program management,  streamline governance and improve accountability,  increase engagement with industry,  To achieve these goals, the plan outlined 25 action items for agencies,  such as completing plans to consolidate 800 data centers by 2015 and  developing a governmentwide strategy to hasten the adoption of cloud  computing services. To accelerate the shift, OMB required agencies to  identify, plan, and fully migrate three services to a cloud-based one by  June 2012.
In February 2011, OMB issued the Federal Cloud Computing Strategy,  as called for in its 25-Point Plan. The strategy provided definitions of  cloud computing services; benefits of cloud services, such as accelerating  data center consolidations; a decision framework for migrating services to  a cloud environment; case studies to support agencies’ migration to  cloud computing services; and roles and responsibilities for federal  agencies. For example, the strategy states that NIST’s role is to lead and  collaborate with federal, state, and local government agency chief  information officers, private sector experts, and international bodies to  identify standards and guidance and prioritize the adoption of cloud  computing services.
In a December 2011 memo, OMB established the Federal Risk and  Authorization Management Program (FedRAMP), a governmentwide  program to provide joint authorizations and continuous security  monitoring services for cloud computing services for all federal agencies.  Among other things, the memo required the General Services  Administration (GSA) to issue a concept of operations, which was  completed in February 2012. The concept of operations states that  FedRAMP is to: ensure that cloud computing services have adequate information eliminate duplication of effort and reduce risk management costs; and enable rapid and cost-effective procurement of information  systems/services for federal agencies.
GSA initiated FedRAMP operations, which the agency referred to as  initial operational capabilities, in June 2012.
section_title: Prior GAO Work Identified Progress and Improvements Needed in Implementing Cloud- based Computing Services
paragraphs: We have previously reported on federal agencies’ efforts to implement  cloud computing services, and on progress oversight agencies have  made to help federal agencies in those efforts. These include:  In May 2010, we reported on the efforts of multiple agencies to ensure  the security of governmentwide cloud computing services. We noted  that, while OMB, GSA, and NIST had initiated efforts to ensure secure  cloud computing services, OMB had not yet finished a cloud  computing strategy; GSA had begun a procurement for expanding  cloud computing services, but had not yet developed specific plans for  establishing a shared information security assessment and  authorization process; and NIST had not yet issued cloud-specific  security guidance. We recommended that OMB establish milestones  to complete a strategy for federal cloud computing and ensure it  addressed information security challenges. These include having a  process to assess vendor compliance with government information  security requirements and division of information security  responsibilities between the customer and vendor. OMB agreed with  our recommendations and subsequently published a strategy in  February 2011 that addressed the importance of information security  when using cloud computing, but it did not fully address several key  challenges confronting agencies, such as the appropriate use of  attestation standards for control assessments of cloud computing  service providers, and division of information security-related  responsibilities between customer and provider. We also  recommended that GSA consider security in its procurement for cloud  services, including consideration of a shared assessment and  authorization process. GSA generally agreed with our  recommendations and has since developed its FedRAMP program,  an assessment and authorization process for systems shared among  federal agencies. Finally, we recommended that NIST issue guidance  specific to cloud-based computing security. NIST agreed with our  recommendations and has since issued multiple publications that  address such guidance.
In April 2012, we reported that more needed to be done to implement  OMB’s 25-Point Plan and measure its results. Among other things,  we reported that, of the 10 key action items that we reviewed, 3 had  been completed and 7 had been partially completed by December  2011. In particular, OMB and agencies’ cloud-related efforts only  partially addressed requirements. Specifically, agencies’ plans were  missing key elements, such as a discussion of needed resources, a  migration schedule, and plans for retiring legacy systems. As a result,  we recommended, among other things, that the Secretaries of  Homeland Security and Veterans Affairs, and the Attorney General  direct their respective CIOs to complete elements missing from the  agencies’ plans for migrating services to a cloud computing  environment. Officials from each of the agencies generally agreed  with our recommendations and have taken steps to implement them.
In July 2012, we reported that the seven federal agencies we  reviewed had made progress in meeting OMB’s requirement to  implement three cloud computing services by June 2012.  Specifically, the seven agencies had implemented 21 cloud computing  services and spent a total of $307 million for cloud computing in fiscal  year 2012, about 1 percent of their total IT budgets. However, two  agencies reported that they did not have plans to meet OMB’s  deadline to implement three services by June 2012, but would do so  by calendar year’s end. Agencies also shared seven common  challenges that they experienced in moving services to cloud  computing. The seven challenges included:
Meeting federal security requirements: Cloud service vendors  may not be familiar with security requirements that are unique to  government agencies, such as continuous monitoring and  maintaining an inventory of systems.
Obtaining guidance: Existing federal guidance for using cloud  services may be insufficient or incomplete. Agencies cited a  number of areas where additional guidance is needed, such as  purchasing commodity IT and assessing Federal Information  Security Management Act security levels.
Acquiring knowledge and expertise: Agencies may not have  the necessary tools or resources, such as expertise among staff,  to implement cloud services.
Certifying and accrediting vendors: Agencies may not have a  mechanism for certifying that vendors meet standards for security,  in part because FedRAMP had not yet been made operational  (i.e., reached initial operating capabilities).
Ensuring data portability and interoperability: To preserve  their ability to change vendors in the future, agencies may attempt  to avoid platforms or technologies that “lock” customers into a  particular product.
Overcoming cultural barriers: Agency culture may act as an  obstacle to implementing cloud services.
Procuring services on a consumption (on-demand) basis:  Because of the on-demand, scalable nature of cloud services, it  can be difficult to define specific quantities and costs. These  uncertainties make contracting and budgeting difficult due to the  fluctuating costs associated with scalable and incremental cloud  service procurements.
While each of the seven agencies had submitted plans to OMB for  implementing their cloud services, a majority of the plans were missing  required elements. Agencies have also identified opportunities for future  cloud service implementations, such as moving storage and help desk  services to a cloud environment. We made recommendations to seven  agencies to develop planning information, such as estimated costs and  legacy IT systems’ retirement plans for existing and planned services.  The agencies generally agreed with our recommendations and have  taken actions to implement them.
section_title: Agencies Have Made Progress in Implementing Cloud Computing Services, but Progress Is Uneven
paragraphs: OMB’s Cloud First policy requires federal agencies to implement cloud  computing services whenever a secure, reliable, and cost-effective cloud  option exists. In July 2012, we found that all of the seven agencies had  among other things, identified at least three services to implement in a  cloud environment, and all but two had implemented three cloud  computing services.
Since then, the agencies have added more cloud computing services. In  total, the number of cloud computing services implemented increased  from 21 to 101, an increase of 80 services. Table 1 lists the number of  cloud computing services implemented by each agency in 2012 and  2014.
While the number of cloud computing services increased by 80 since  2012, the number implemented by each agency during that time varied.  For example, since 2012, HHS had implemented 33 such services, while  SBA, State, and Treasury had implemented 3, 11, and 2, respectively. (A  brief description of the 101 cloud computing services implemented by  each agency is included in app. II.)
These agencies also increased the amount they budgeted and reported  spending on cloud computing services. Specifically, the seven agencies,  collectively, reported their spending increased by $222 million, from $307  million to $529 million. Table 2 shows the amount each agency (1)  reported spending on cloud computing services in fiscal year 2012 and  (2) planned to spend in fiscal year 2014.
Although collectively the amount budgeted in 2014 by the agencies ($529  million) is an overall increase of 72 percent, the amounts and  percentages varied significantly across the agencies. For example, USDA  increased its planned cloud spending by $71 million (a 394 percent  change over 2012), while Treasury budgeted $37 million more (a 22  percent increase over 2012).
Further, the agencies also increased the collective percentage of their IT  budgets allocated to cloud computing services. Specifically, as shown in  table 3, the agencies collectively doubled the percentage of their IT  budgets from 1 to 2 percent during the fiscal year 2012 -14 period.  However, on an individual agency basis, the percentage increase varied.  For example, GSA increased the percentage of its IT budget allocated to  cloud computing from 2 to 5 percent while DHS increased its allocation  from 1 to 2 percent.
Even though the agencies collectively and individually increased the  percentage of their IT budgets allocated to cloud services, our analysis  showed that the agencies are still devoting a large portion of their IT  budgets to non-cloud computing expenditures. Specifically, as shown in  table 3, the agencies in 2014 were collectively budgeting 2 percent of  their IT budgets to cloud services, while the remaining 98 percent were  dedicated to non-cloud expenditures.
Officials from OMB and the agencies attributed the agencies’ varying  degrees of progress in part, to the following: in implementing its Cloud  First policy, OMB has granted the agencies discretion in determining  whether and which services are to be migrated. Specifically, officials from  OMB’s Office of E-Government & Information Technology told us that  they initially had established goals for the agencies but instead granted  them the latitude to annually assess all their investments and identify  those investments that were appropriate for their agency to migrate. As a  result, some agencies have been more aggressive than others in moving  services to the cloud.
In addition, the agencies’ relatively low percentage of budget allocated to  cloud spending is due in large part to the fact that the agencies have not  assessed a majority of their investments, although OMB’s guidance calls  for agencies to assess all their IT services for migration to the cloud  irrespective of where each investment is in its life cycle. Specifically, as  shown in table 4, the agencies collectively had not assessed about 67  percent of their 2000 investments. Table 4 provides further detail on the  number of investments in fiscal year 2014 that were chosen for cloud  computing services; the number of investments that were evaluated for  cloud computing services, but an alternative was chosen; and the number  not evaluated for cloud computing services.
A key reason cited by the agency officials for why most of their  investments had not been evaluated for cloud services was that they  were largely legacy investments in operations and maintenance; the  agencies had only planned to consider cloud options when the  investments were to be modernized or replaced at the end of their life  cycle. Agency officials added that it was a challenge to assess and  ultimately replace such legacy systems because agency personnel were  often reluctant to cede direct control of mission-critical IT resources.  While we recognize the cultural challenge to moving investments to the  cloud (which is discussed in more detail later in this report), OMB  guidance nonetheless calls for agencies to continually assess all  investments irrespective of where they are in their life cycle. Agency  officials were aware of the OMB guidance and said they had plans to  assess their unevaluated investments in the near future. Nevertheless,  the agencies for the most part were not able to provide us with specific  dates for when assessments of these investments were to be performed.  Establishing such milestones is an important management tool to  ensuring policy outcomes—including those envisioned by OMB’s cloud  policy—are achieved in an efficient and effective manner.
Until the agencies assess their IT investments that have yet to be  evaluated for suitability for migration to the cloud, they will not know which  services are likely candidates for migration to cloud computing services,  and therefore will not gain the operational efficiencies and cost savings  associated with using such services.
section_title: Agencies Reported Cost Savings from Implementation of Cloud Computing Services
paragraphs: Agencies reported that they had cost savings from implementing 22 out  of 101 cloud computing services through fiscal year 2013. Specifically,  they collectively saved about $96 million by implementing these 22  services. Table 5 lists the total number of cloud computing services  reported by each agency, the number of cloud services with cost savings,  and the total savings.
These savings included both one-time savings and life-cycle savings. For  example, GSA had a one-time cost savings of $2.6 million by migrating to  a cloud customer service solution, which was a less expensive alternative  than upgrading its existing system. DHS had a cumulate savings of $1.2  million through fiscal year 2013 for its collaboration platform that is used  to build applications and manage documents, which was implemented in  fiscal year 2011.
According to agency officials, two major factors governed why the  remaining services (79) did not achieve savings. First, a motivation for  changing to some of the cloud-based services was not to reduce  spending, but to improve service. Second, in selected cases, the cloud  computing service opened up a new service or provided a higher quality  of service; while this provided useful benefits to the agency, the  associated costs negated any savings.
In addition to these cost savings, agency officials identified the following  benefits from migrating systems and services to a cloud computing  service.
Decreased time to deploy: A cloud computing service can be  deployed more quickly and migrating a system to a cloud allows an  agency to run it for a short period of time and then shut it down,  without having to develop a unique infrastructure for it.  Increased flexibility: Cloud computing services are useful for  systems that have varying use throughout a year, as the cloud service  can be easily scaled up when there is high demand.
Reduced IT infrastructure: Implementation of cloud computing  services reduces the amount of IT infrastructure required onsite, in  particular, data center resources.
section_title: Agencies Continue to Experience Challenges in Implementing Cloud Computing Services
paragraphs: Officials from the agencies we reviewed cited five challenges they have  experienced in implementing cloud computing services. Of the five, two  challenges—meeting federal security requirements and overcoming  cultural barriers—were previously identified and discussed in our 2012  report.
According to the officials, meeting federal security requirements was a  continuing challenge because the requirements for new services are a  moving target (i.e., the requirements are regularly being updated to  address new threats, vulnerabilities, and technologies, and vendors may  not be able to meet them). For example, NIST recently made revisions to  its cloud security requirements and agencies are still in the process of  getting familiar with them. As a result, agencies fear making mistakes that  could negatively impact the security of systems and data. With regard to  overcoming cultural barriers, DHS officials said that shifting to a new  business model from a legacy business model requires cultural change,  which continues to be a challenge at the department. In addition, GSA  officials said that, as they move the management of servers and software  off site, a continuing challenge is getting agency staff to adapt to an  operational environment where they do not have direct control and  access to agency IT resources.
In addition to the two challenges repeated from 2012, officials reported  these three new challenges.
Meeting new network infrastructure requirements. Current  network infrastructure, topology (network configuration), or bandwidth  (data transmission rate) is often insufficient to meet new infrastructure  needs when agencies transition to cloud computing services. For  example, officials at State said that legacy systems with a particular  infrastructure designed to meet certain federal requirements will need  to be reengineered to work in a multi-tiered cloud environment. USDA  officials stated that they would need to consider redesigning their  network topology to accommodate new cloud service bandwidth  requirements and traffic streams.
Having appropriate expertise for acquisition processes. Migrating  legacy systems to cloud computing services requires knowledgeable  acquisition staff and appropriate processes. For example, HHS  officials stated that while the department has the capability to  purchase cloud services, it has found post award management to be a  challenge. These officials added that to respond to this challenge,  HHS is working with its personnel as well as other stakeholders, such  as GSA, to develop best practices for cloud post award management  and related acquisition activities. In addition, DHS officials said that  efforts to transition from legacy systems to cloud computing services  require streamlining their IT services supply chain, which requires an  evaluation of the component processes and time to fully implement  this transformation.
Funding for implementation. Funding for the initial implementation  of a cloud service can be a significant cost to agencies. For example,  officials at State said that the cost of migrating an application to a  cloud service poses a challenge in the current budget environment  where IT budgets are declining. In addition, GSA officials stated that  initial implementation requires additional funding that has not been  made available.
While these challenges are formidable, OMB and GSA have provided  guidance and services to help agencies address many of these  challenges. For example, GSA developed FedRAMP, which is a program  to create processes for security authorizations and allow agencies to  leverage security authorizations on a governmentwide basis in an effort to  streamline the certification and accreditation process. GSA also provides  continuous monitoring services for cloud computing services for all  federal agencies.
In addition, OMB’s Federal Cloud Computing Strategy addresses how  agencies can overcome redesign and implementation challenges. In  particular, the strategy states that agencies should ensure that their  network infrastructure can support the demand for higher bandwidth  before migrating to a cloud service. The strategy also directs agencies to  assess readiness for migration to a cloud service by determining the  suitability of the existing legacy application and data to either migrate to  the cloud service (i.e., rehost an application in a cloud environment) or be  replaced by a cloud service (i.e., retire the legacy system and replace  with a commercial equivalent).
Further, GSA provides services to assist agencies with procuring and  acquiring cloud services. Specifically, GSA established contracts that the  agencies can use to obtain commodity services such as cloud  infrastructure as a service and cloud e-mail; these contracts—which were  established in October 2010 and September 2012, respectively—are  intended to reduce the burden on agencies for the most common IT  services. GSA also created working groups to support commodity service  migration by developing technical requirements for shared services to  reduce the analytical burden on individual government agencies.
Regarding funding, the strategy recommends that agencies reevaluate  their technology sourcing strategy to include consideration and  application of cloud computing services as part of their budget process.
Officials stated that they consult the Federal Cloud Computing Strategy to  guide them in their efforts to move services to the cloud. For example,  SBA officials said that they consult this guidance as they plan for and  prepare to move services to the cloud. In addition, State officials said that  they use the strategy as part of their process to prepare them in their  efforts to consider cloud services.
section_title: Conclusions
paragraphs: Since we last reported on these seven agencies, they have made varying  degrees of progress in implementing cloud computing services, and in  doing so, have saved money and realized other benefits. While the  collective and individual agency gains in implementing such services are  commendable, the seven agencies are still only investing a small fraction  of their IT budgets on cloud computing. The agencies’ modest level of  cloud investment is attributable in part to the large number of legacy  investments—nearly two thirds of all investments—that have yet to be  considered for cloud migration. This is due in part to the agencies’  practice of not assessing these investments until they are to be replaced  or modernized, which is inconsistent with OMB’s direction. Nonetheless,  the large number of agency investments to be assessed provides ample  opportunities for additional progress and substantial cost savings. An  important step to realizing this progress and savings is ensuring these  investments are assessed, which includes establishing milestones for  when the assessments are to be performed. Until this is done and the  investments are assessed, the agencies cannot know whether they are  achieving the maximum benefits, including improved operational  efficiencies and minimized costs, associated with using such services.
Agencies continue to face formidable challenges as they move their IT  services to the cloud. Two of the challenges—namely ensuring IT security  and overcoming agency culture—have persisted since we last reported.  OMB and GSA have issued guidance and established initiatives to  address the challenges, which agencies can use to help mitigate any  associated negative impacts.
section_title: Recommendation for Executive Action
paragraphs: To help ensure continued progress in the implementation of cloud  computing services, we recommend that the Secretaries of Agriculture,  Health and Human Services, Homeland Security, State, and the  Treasury; and the Administrators of the General Services Administration  and Small Business Administration direct their respective Chief  Information Officers to take the following actions:
Ensure that all IT investments are assessed for suitability for migration  to a cloud computing service.
As part of this, establish evaluation dates for those investments  identified in this report that have not been assessed for migration to  the cloud.
section_title: Agency Comments and Our Evaluation
paragraphs: In commenting on a draft of this report, six agencies—DHS, GSA, HHS,  SBA, State, and USDA—agreed with our recommendations, and one  agency (Treasury) had no comments. The specific comments from each  agency are as follows:
DHS, in its written comments—which are reprinted in appendix III— stated that it concurred with our recommendations. The department  also provided technical comments, which we have incorporated in the  report as appropriate.
In its written comments, GSA stated it agreed with our findings and  recommendations and will take appropriate action. GSA’s comments  are reprinted in appendix IV.
HHS, in comments provided via e-mail from its Audit Liaison within the  Office of the Assistant Secretary for Legislation, stated it concurred  with our recommendations. The department also provided technical  comments, which we have incorporated in the report as appropriate.
SBA, in comments provided via e-mail from its Program Manager  within the Office of Congressional and Legislative Affairs, stated that it  concurred with our report. It also commented that of the 29  investments that SBA did not evaluate for cloud computing (identified  in table 4), only 17 could be evaluated for cloud alternatives. SBA said  the other 12 investments cannot be considered for a cloud alternative,  but provided no documentation to support this statement.
USDA, in comments provided via an e-mail from its GAO Agency  Liaison within the Office of the Chief Information Officer, stated that it  agreed with our recommendations and is committed to implementing  OMB’s Cloud First policy.
State, in its written comments (which are reprinted in appendix V),  noted that it had already addressed our recommendations.  Specifically, the department said it developed and communicated  guidance to its IT investment owners on how to implement OMB’s  Cloud First policy and that all investments are currently undergoing  cloud computing alternatives analyses with the goal of having these  assessments completed by the end of calendar year 2014. State also  provided technical comments, which we have incorporated in the  report as appropriate.
Treasury, in its written comments, stated that the department had no  comments on the report and appreciated our efforts in developing it.  Treasury’s written comments are reprinted in appendix VI.
We are sending copies of this report to interested congressional  committees; the Secretaries of Agriculture, Health and Human Services,  Homeland Security, State, and the Treasury; the Administrator of the  General Services Administration and Small Business Administration; the  Director of the Office of Management and Budget: and other interested  parties. This report will also be available at no charge on our website at  http://www.gao.gov.
If you or your staffs have any questions on matters discussed in this  report, please contact me at (202) 512-9286 or pownerd@gao.gov.  Contact points for our Offices of Congressional Relations and Public  Affairs may be found on the last page of this report. GAO staff who made  major contributions to this report are listed in appendix VII.
section_title: Appendix I: Objectives, Scope, and Methodology
paragraphs: Our engagement objectives were to (1) assess selected agencies’  progress in using cloud computing services, (2) determine the extent to  which selected agencies have experienced cost savings when such  services have been deployed, and (3) identify any challenges selected  agencies are facing as they use cloud computing.
To address our first objective, we selected the same seven agencies that  were selected for our 2012 review so that we could compare the progress  they have made. The seven agencies selected were the Departments of  Agriculture (USDA), Health and Human Services (HHS), Homeland  Security (DHS), State, and the Treasury (Treasury); and the General  Services Administration (GSA) and Small Business Administration (SBA).
We analyzed budget and related documentation from the selected  agencies, including data on the number of and funding for current cloud  computing services and compared this information with our previous  findings. In addition, we interviewed officials responsible for cloud  services to corroborate progress. Further, we reviewed agency data on  the extent to which they assessed new and ongoing investments for  potential cloud computing services. We also interviewed OMB officials to  understand cloud computing guidance for federal agencies. Based on the  procedures described, we concluded that the data presented are  sufficiently reliable for our purposes.
To address our second objective, we analyzed agency data on cost  savings and avoidances through fiscal year 2013 for those cloud services  the agencies had implemented. We also interviewed agency officials to  obtain information on other benefits the agencies had gained from  adopting cloud-based services. To determine the reliability of the data on  cost savings and avoidances, we analyzed agency documentation and  interviewed appropriate officials to corroborate the cost savings and cost  avoidances. We determined that the data were sufficiently reliable for the  purpose of this report, which was to identify the extent to which agencies  had experienced cost savings for implemented cloud services.
To address the third objective, we interviewed officials from each of the  selected agencies and asked them to identify challenges associated with  their implementation of cloud services. We then assessed and  categorized the challenges and totaled the number of times each  challenge was cited by agency officials. In order to identify the common  challenges, we generalized challenges that were mentioned by two or  more agencies. We also compared these challenges with the challenges  that agencies reported in our 2012 review.
In addition, we conducted a content analysis of the information we  received in order to identify and categorize common challenges. To do  so, three team analysts independently reviewed and drafted a series of  challenge statements based on each agency’s records. They then worked  together to resolve any discrepancies, choosing to report on challenges  that were identified by two or more agencies. These common challenges  were presented in the report. We also interviewed agency officials to  corroborate the challenges identified.
We conducted this performance audit from December 2013 through  August 2014 in accordance with generally accepted government auditing  standards. Those standards require that we plan and perform the audit to  obtain sufficient, appropriate evidence to provide a reasonable basis for  our findings and conclusions based on our audit objectives. We believe  that the evidence obtained provides a reasonable basis for our findings  and conclusions based on our audit objectives.
section_title: Appendix II: Brief Description of Cloud Computing Services Implemented by Seven Agencies Reviewed (as of July 2014)
paragraphs: Appendix II: Brief Description of  Cloud Computing Services  Implemented by Seven Agencies  Reviewed (as of July 2014)
This appendix lists the cloud computing services implemented  the seven agencies we reviewed; namely, the Departments of  Agriculture (USDA), Health and Human Services (HHS),  Homeland Security (DHS), State, and the Treasury (Treasury);  and the General Services Administration (GSA) and Small  Business Administration (SBA). It also includes as reported by  the agencies, a description of each service to be provided, the  service model, deployment model, and whether the cloud service  is approved/compliant with the Federal Risk and Authorization  Management Program (FedRAMP).
Cloud computing  service  E-mail as a Service   Provide the infrastructure for the  Description of service to be provided  department’s enterprisewide e-mail and  calendar functions.
Enable DHS users to have virtual access to  department desktop operating systems and  applications anywhere in the world.
Support DHS’s secure information  technology (IT) development, test, and  preproduction environment that mirrors the  production environment. It also is to provide  access to a suite of application life-cycle  management and automated testing  services.
Ensure that DHS’s public-facing websites are  always available. DHS adopted this service  to protect against denial of service attacks,  help manage surge requirements, and  reduce hosting costs.
Provide a secure platform that is to be used  by DHS to build applications and manage  documents. It also is to provide file  management, user collaboration, and  workflow routing capabilities.
Enable DHS with rapid provisioning in a  secure virtual operating environment and  furnish hosting for applications and services,  including operating systems, network, and  storage.
Provide components with access to a  website that allows for the consolidation of  projects.
Description of service to be provided  Allow department users to manage customer  relationships and enable the user to make  informed decisions and followup.
FedRAMP  approved/compliant?
Provide DHS with decision-making  information and promotes virtual  consolidation by integrating business  intelligence dashboards.
Support all of the department’s public  websites and provides software accessible  through the public cloud.
Provide individuals in the United States with  a capability to check their employment  eligibility status before formally seeking  employment.
FedRAMP is a governmentwide program initiated by the Office of Management and  Budget to provide joint authorizations and continuous security monitoring services for  cloud computing services. FedRAMP is intended to (1) ensure that cloud computing  services have adequate information security; (2) eliminate duplication of effort and reduce  risk management costs; and (3) enable rapid and cost-effective procurement of  information systems/services for federal agencies.  DHS reported this service as not being FedRAMP approved/compliant and said it did not  need to be so because the service required a higher level of security—which DHS  referred to as a Federal Information Security Management Act high baseline—than that  provided by FedRAMP.
subsections: section_title: State
paragraphs: Description of service to be provided  Provide a tool to be used for budget  planning and formulation, and performance  reporting. The tool also is to provide the  means to generate reports to respond to ad  hoc queries from Congress and other  stakeholders about the use of foreign  assistance resources.
FedRAMP  approved/compliant?
Allow program managers of the  Nonproliferation and Disarmament Fund  access to agency data from any staff work  location.
Provide domestic and overseas agency  staff with direct access to information in  over 50 databases. The service is also to  provide additional functionality including an  integrated electronic catalog with other  online libraries.
Support a collaboration and knowledge  management environment for the  department which includes hosting for  servers and applications, and an  environment for application development  and product testing.
Provide a grants management system for  the department which supports the full life  cycle of the federal assistance process.
Enable the hosting of public web sites for  the Department of State, including its  embassies.
Provide a web-based travel management  service for the department.
Enable unclassified documents to be  available worldwide regarding the history of  the department, diplomacy, and foreign  relations.
Provide application services for the  department, including application  integration.
Support the department's centralized  electronic forms program.
Provide support for a key departmental  financial management system’s (the Joint  Financial Management System) continuity  of operations component.
Description of service to be provided  Support the Executive Secretariat's  continuity of operations planning.
Provide departmental personnel with the  capability to remotely access  e-mail  worldwide.
Provide the department's Bureau of  Diplomatic Security with an enterprise  service operations center.
section_title: Treasury
paragraphs: Description of service to be provided  Provide financial management services to  the department via a web-enabled,  integrated, accounting, budgeting,  procurement, and reporting commercial off-  the-shelf system.
Enable web-based services to internal and  external users, such as taxpayers, Internal  Revenue Service employees, and other  government agencies, as part of  administering the federal tax code.
Support an integrated system for managing  the Bureau of Engraving and Printing's day- to-day business and manufacturing  operations.
Support the department’s internal and  external web sites. If offers a full suite of web  solutions including hosting, design,  development, and deployment to web sites.
Enable the Bureau of Engraving and Printing  to manage bureau assets during their entire  life cycle, from acquisition through  decommissioning. yes  risk management costs; and (3) enable rapid and cost-effective procurement of  information systems/services for federal agencies.
subsections: section_title: Cloud computing service ArcGIS Online (public)
paragraphs: Description of service to be provided  Service model  Provide a cloud-based geospatial service  that supports data and the geographic  information system. It creates web  map/feature services, asset exchange,  versioning, templates, and cost controls  for external publication of products and  services.
Provide an internal cloud-based  geospatial shared service that supports  data and the geographic information  system. It improves cost controls by  modernizing and/or creating functions of  discovery and reuse, uniform web  map/feature services, asset exchange,  versioning, templates, group workflows  and collaboration, and enables an  integrated development environment.
Maintain a government-owned, web- based application that is designed to help  agencies in the management and control  of their initiatives, portfolios, and  investment priorities, as well as in the  preparation and submission of budget  data to OMB.
Support an electronic training system for  the department that provides online  administration of curriculum by trainers,  individualized training support, on- demand classroom registration,  customized content, collaborative tools,  and integrated back-end systems.
Allow the department to track, process,  and redact materials requested under the  Freedom of Information Act.
Microsoft Office 365  Provide IT communication services used  by USDA organizations. It is to provide  integrated communications tools for  USDA’s approximately 120,000  employees and business partners.
Provide customers with platform services  to support the development and transition  of business applications into standardized  enterprise data center service offerings.
Description of service to be provided  Service model  Provide operating platforms to securely  host customer applications. As part of  this, the National IT Center is to utilize  advanced server virtualization  technologies, strict standards, and  economies of scale to enable rapid  delivery of cost-effective, fully-managed  operating platforms with expanded  inheritable security controls.
FedRAMP  approved/compliant?
Support a single system for tracking and  managing correspondence across USDA,  including Secretarial and agency  correspondence. It is to include modern  Customer Relationship Management  features and mobile device access.
Provide delivery benefits for all content  types. It also is to provide increased  availability and other performance  benefits as well as a scalable on-demand  network.
FedRAMP is a governmentwide program initiated by the Office of Management and  Budget to provide joint authorizations and continuous security monitoring services for  cloud computing services. FedRAMP is intended to (1) ensure that cloud computing  services have adequate information security; (2) eliminate duplication of effort and reduce  risk management costs; and (3) enable rapid and cost-effective procurement of  information systems/services for federal agencies.
section_title: Appendix III: Comments from the Department of Homeland Security
section_title: Appendix V: Comments from the Department of State
section_title: Appendix VII: GAO Contact and Staff Acknowledgments
subsections: section_title: GAO Contact
section_title: Staff Acknowledgments
paragraphs: In addition to the contact name above, individuals making  contributions to this report included Gary Mountjoy (assistant  director), Gerard Aflague, Scott Borre, Nancy Glover, and Lori  Martinez.