Cloud Computing: Background, Status of Adoption by Federal Agencies, and Congressional Action
Released: 2020-03-25T00:00:00

Introduction

Since 2009, the federal government has been shifting its data storage needs to cloud-based services and away from agency-owned, in-house data centers. This shift is intended to achieve two goals: reduce the total investment by the federal government in information technology (IT), which currently stands at about $90 billion each year, and realize other stated advantages of cloud adoption , including efficiency, accessibility, collaboration, reliability, and security. However, challenges remain as agencies shift to cloud services. According to a survey conducted in September 2018, federal IT managers continue to express long-held concerns about security in certain cloud environments, the complexity of migrating existing ("legacy") applications to the cloud, a lack of skilled staff to manage certain cloud environments, and uncertain funding.

This report explains what cloud computing is, including different models for cloud deployment and services, and describes the federal government's planning for IT reform. It also provides information on assessments that have been conducted on agency cloud adoption. Finally, the report provides a summary of recent congressional action and presents some possible mechanisms for Congress to monitor agencies as they implement cloud computing.

What Is Cloud Computing?

Cloud computing is a new name for an old concept: the delivery of computing services from a remote location. Cloud computing services are delivered through a network, usually the internet. Some analysts see this approach as analogous to the networked delivery of electricity, water, and other utilities through the electric grid, water delivery systems, and other distribution infrastructure. In some ways, cloud computing is reminiscent of computing before the advent of the personal computer, when users shared the power of a central mainframe computer through video terminals or other devices. Cloud computing, however, is much more powerful and flexible, and information technology advances may permit the approach to become nearly ubiquitous.

Cloud computing differs from local computing, in which local machines perform most tasks and store the relevant data. Some cloud services are adaptations of familiar applications, such as email and word processing. Others are new services that never existed as a local application, such as social networks.

As cloud computing has developed, varied and sometimes nebulous descriptions of what it is and what it is not have been commonplace. Such ambiguity can create uncertainties that may impede innovation and adoption. The National Institute of Standards and Technology (NIST) has developed standardized language describing cloud computing to help clear up that ambiguity:

Cloud computing is a model for enabling ubiquitous, convenient, on-demand network access to a shared pool of configurable computing resources (e.g., networks, servers, storage, applications, and services) that can be rapidly provisioned and released with minimal management effort or service provider interaction. This cloud model promotes availability and is composed of five essential characteristics, three service models, and four deployment models.

The first sentence of the definition basically states that cloud computing is a way of providing convenient, flexible access to a broad range of computing resources over a network. The characteristics and models referred to in the second sentence provide the specificity necessary to clarify what cloud computing is and is not, described below.

Characteristics of Cloud Computing6

Cloud computing differs from local computing in many ways. NIST has identified five characteristics in particular:

On-demand self-service: A user can directly access the needed computing capabilities from the source, no matter what specific resource is required. An analogy is that a television viewer or radio listener can change stations at will. Broad network access: A user is not tied to one location but can access resources from anywhere the network (typically the internet) is available. Resource pooling: Many users share the same overall set of resources from a provider, using what they need, without having to concern themselves with where those resources originate. An analogy is that homeowners and businesses do not need to know which specific power plants generated the electricity they are using [although some do care, and specifically buy power from "green" sources]. Rapid elasticity: Users can quickly increase or decrease their use of a computing resource in response to their immediate needs. An analogy is that electricity customers can use as little or as much power as they need, within the capacity of their connections to the grid. Measured service: The amount of usage by a customer is monitored by the provider and can be used for billing or other purposes. An analogy is the metered use of electricity, water, natural gas, and other utilities.

Deployment Models7

NIST has identified four standard models, or types, of cloud computing that can be implemented to satisfy the varying needs of users or providers. Those modelsâpublic, private, community, and hybridâvary in where the hardware is located, what entity is responsible for maintaining the system, and who can use system resources. An extensive list of deployment model adoption by federal agencies is in the April 2019 report by the Government Accountability Office, Cloud Computing: Agencies Have Increased Usage and Realized Benefits, but Cost and Savings Data Need to Be Better Tracked .

Public

In public cloud (sometimes called external cloud ) computing, a provider supplies one or more cloud-computing services to a large group of independent customers, such as the general public. Customers use the service over the internet through web browsers or other software applications. Providers usually sell these services on a metered basis, an approach that is sometimes called "utility computing." Some common examples of services using a public cloud model include internet backup and file synchronization and web-based media services. Public clouds may have price and flexibility advantages over other deployment models, but security and other concerns could restrict federal use. The public cloud deployment model is used predominantly by businesses with low privacy concerns.

Private

A private cloud (sometimes called an internal cloud ) works like public cloud computing, but on a private network controlled and used by a single organization. It is a cloud used by a company itselfârather than its customers. Private clouds may provide services that are similar to those provided by public cloud providers, but potentially with fewer risks. Potential disadvantages include cost and logistical challenges associated with purchasing and managing the required hardware and software. Private clouds can provide internal services such as data storage as well as external services to the public or other users.

Community

A community cloud allows a group of organizations with similar requirements to share infrastructure, thereby potentially realizing more of the benefits of public cloud computing than is possible with a purely private cloud. Because a community cloud has a much smaller user base than a public cloud, it may be more expensive to establish and operate, but it may also allow for more customization to meet the users' needs. It may also meet user-specific security and other requirements more effectively than a public cloud. Just like private cloud, community cloud is technically no different from public cloud. The only difference is who is allowed to use it.

Hybrid

A hybrid cloud uses a combination of internal (private or community) and external (public) providers. For example, a user could employ a private or community cloud to provide applications and store current data, but use a public cloud for archiving data. The flexibility of this deployment model may make it particularly attractive to many organizations. By combining different deployment models, users can choose the right balance for their organization between legal compliance, security, and scalability.

Service Models11

Cloud computing can provide various kinds of services, ranging from basic computing tasks to the provision of sophisticated applications. While these services can be categorized in different ways, the NIST definition uses three basic service models , described below.

Software as a Service (SaaS)

In the SaaS model, customers use applications that the provider supplies and makes available remotely on demand, rather than using applications installed on a local workstation or server. SaaS is the most readily visible and simplest service model to the end user. In many cases, SaaS applications are accessible through hardware or software "thin clients." Examples include web-based services such as Google Apps and online storage such as DropBox.

Platform as a Service (PaaS)

With PaaS, customers create applications on the provider's infrastructure using tools, such as programming languages, supplied by the provider. Facebook is one example of such an application. Such a platform could include hosting capability and development tools to facilitate building, testing, and launching a web application. The user controls the applications created via the platform, and the provider controls and maintains the underlying infrastructure, including networks, servers, and platform upgrades.

Infrastructure as a Service (IaaS)

IaaS providers supply fundamental computing resources that customers can use however they wish. Customers can install, use, and control whatever operating systems and applications they desire, as they might otherwise do on desktop computers or local servers. The provider maintains the underlying cloud infrastructure. Examples of IaaS are Amazon Web Services and Microsoft Azure.

Service Model Comparison

A simple local-computing analogy for these three kinds of services would be the purchase of a desktop computer, which serves as infrastructure on which the user installs a chosen operating system such as Windows or Linux and uses it as a platform to create custom applications and run whatever software is needed. By providing these infrastructure, platform, and software services remotely, a cloud provider frees its customers from having to provide local infrastructure and support. In the case of IaaS, the user need not have a local workstation, using instead a thin client with minimal need for computing power.

Federal Agency Cloud Adoption16

Planning for cloud adoption by federal agencies began with the 2010 publication by the Federal Chief Information Officer (CIO) of "A 25-Point Implementation Plan to Reform Federal IT Management." The reforms put forth in the plan were focused on eliminating barriers that were impeding effective management of IT programs throughout the federal government. In the plan, the Federal CIO recognized that too many past federal IT projects had run over budget, fallen behind schedule, or failed to deliver promised functionality. The plan stated that the federal government would shift to a "Cloud First" strategy, which it stated would be more economical, faster, and more flexible.

Increased cloud adoption is also a stated goal of the Federal Information Technology Acquisition Reform Act (FITARA), enacted on December 19, 2014. Among other provisions, FITARA required the Federal CIO, in conjunction with federal agencies, to refocus the Federal Data Center Consolidation Initiative (FDCCI) to include adoption of cloud services. The FDCCI was superseded by the Data Center Optimization Initiative (DCOI) in August 2016.

In the 2017 "Report to the President on Federal IT Modernization," the Office of Management and Budget (OMB) pledged to update the federal government's legacy Federal Cloud Computing Strategy ("Cloud First"). Fulfilling this requirement, the Administration developed a new strategy, Cloud Smart, published as a draft on September 24, 2018.

The DCOI was updated in June 2019. Among other requirements, the updated DCOI placed a freeze on funds or resources to build new agency-owned data centers or significantly expand existing agency-owned data centers without approval from OMB. It also requires agencies to evaluate options for the consolidation and closure of existing data centers, in alignment with the Cloud Smart Strategy.

The Cloud Smart Strategy

On June 24, 2019, the Federal CIO issued the Cloud Smart Strategy to provide agencies with practical implementation guidance to achieve the potential of cloud-based technologies. The new strategy is founded on three pillars:

Security: Modernize security policies to focus on risk-based decisionmaking, automation, and moving protections closer to data. Procurement: Improve the ability of agencies to purchase cloud solutions through repeatable practices and sharing knowledge. Workforce: Upskill, retrain, and recruit key talent for cybersecurity, acquisition, and cloud engineering.

Across these areas, the strategy identifies 22 "action items" to be completed not later than December 2020. As of November 2019, over half had been completed. (See Table 1 and Table 2 . )

2019 GAO Report

In April 2019, the Government Accountability Office (GAO) published a report examining the status of cloud adoption at 16 agencies. GAO found that 10 of the agencies reported increasing their use of cloud services from FY2016 through FY2019. All 16 agencies had made progress in implementing cloud services, meaning they had established assessment guidance, performed assessments, and implemented services, but the extent of their progress varied. For example, not all had followed OMB guidance that directs agencies to review all IT investments for compatibility with cloud services. GAO also found that

16 agencies reported an increase in their cloud service spending since 2015. 13 of the 16 agencies saved a total of $291 million to date from using cloud services. 15 of the 16 agencies identified significant benefits from acquiring cloud services, including improved customer service and the acquisition of more cost-effective options for managing IT services. 15 of the 16 agencies identified nine cloud investments that enhanced the availability of weather-related information; facilitated collaboration and information sharing among federal, state, and local agencies related to homeland security; and provided benefits information to veterans.

In collecting the information requested by GAO, agency CIOs identified the following challenges:

Spending data were not consistently tracked. Different methods were used to calculate cloud spending costs. Interpreting changes in OMB and related guidance created confusion regarding what spending data should be tracked.

As a result of these challenges, GAO concluded that agency-reported cloud spending and savings figures were likely underreported.

GAO made one recommendation to OMB on cloud savings reporting, and 34 recommendations to the 16 agencies on cloud assessments and savings. To OMB, GAO recommended that agencies be required to explicitly report, at least on a quarterly basis, the savings and cost avoidance associated with cloud computing investments. The 34 recommendations to the agencies included directing CIOs to

establish guidance to assess new and existing IT investments for suitability for cloud computing services; complete an assessment of existing IT investments for suitability for migration to a cloud computing service; and establish a consistent and repeatable mechanism to track savings and cost avoidances from the migration and deployment of cloud services.

Congressional Activity: 116th Congress

Congress has conducted ongoing oversight of IT acquisitions, including cloud computing activity, for many years. This section summarizes cloud-related legislation and hearings in the 116 th Congress.

Legislation

The Federal Risk and Authorization Management Program (FedRAMP) Authorization Act ( H.R. 3941 ), introduced on July 24, 2019, by Representative Gerald Connolly, would establish a risk management, authorization, and continuous monitoring process to "leverage cloud computing services using a risk-based approach consistent with the Federal Information Security Modernization Act of 2014."

Hearings

On July 17, 2019, the House Committee on Oversight and Reform Subcommittee on Government Operations held a hearing titled "To the Cloud! The Cloudy Role of FedRAMP in IT Modernization." The purpose of this hearing was to examine the extent to which FedRAMP has reduced duplicative efforts, inconsistencies, and cost inefficiencies associated with the cloud security authorization process.

On October 18, 2019, the Committee on Financial Services Task Force on Artificial Intelligence (AI) held a hearing, "AI and the Evolution of Cloud Computing: Evaluating How Financial Data Is Stored, Protected, and Maintained by Cloud Providers." Among other topics, the hearing explored how AI could be used to improve cloud management functions.

FITARA Scorecard

Since November 2015, a year after FITARA became law, the House Committee on Oversight and Reform has held two FITARA oversight hearings per year. These hearings provide a "scorecard" on various aspects of FITARA implementation, including data center optimization, which is an indication of the extent of agency adoption of cloud computing. Thus far in the 116 th Congress, these hearings were held on June 26, 2019, and December 11, 2019.

Options for Congress

As Congress monitors the progress of federal departments and agencies in implementing cloud computing, its options for ongoing oversight include holding hearings; requesting review of an agency's status by either the agency itself or the GAO; and assessing the agency's progress and projected goals against the stated goals of the Cloud Smart Strategy.

Hearings

Committees might choose to focus hearings on OMB, which oversees the management of the Cloud Smart Strategy at the agency level. This role makes OMB the central point of information regarding the status of agency planning and implementation. If OMB management practices for cloud computing are lacking, the impact could potentially affect the performance of all agencies. Consistent congressional review of OMB's management practices with respect to the Cloud Smart Strategy could help to detect and correct problems in a timely manner.

Alternatively, or in addition, committees might choose to hold hearings to receive status reports directly from the CIOs of particular agencies under their jurisdictions.

Review of Agency Cloud Computing Plans and Implementation Assessments

As plans to migrate to cloud services within the federal government are created and implemented, policymakers may choose to monitor how agencies are following federal directives and responding to GAO assessments. Such monitoring could be achieved through assessments conducted internally by a department or agency itself, externally by GAO, or directly by a committee of jurisdiction. A model for internal assessments and reporting could be based on progress made on the uncompleted items of the Cloud Smart Strategy.

Review of External Status Reports

GAO conducts status reports on cloud adoption across the federal agencies, such as the April 2019 report discussed above, but it has not issued separate reports focused on the status of individual departments or agencies.

When examining shortcomings in individual agencies' implementation of the Cloud Smart Strategy, as identified by GAO, Congress might consider requesting follow-up reviews focused on particular challenges.