705-34 GPO Cloud Computing and Hosted Services Policy.pdf

ORIGINATING OFFICE

Information Technology

EFFECTIVE DATE

March 28, 2019

GPO Directive 705.34 March 28, 2019

GPO Cloud Computing and Hosted Services Policy

1. Purpose. The purpose of this Directive is to provide guidance to GPO Business Units (BU) when acquiring, implementing, or utilizing Cloud Computing and Hosted Services necessary to transform GPO’s systems and streamline users’ access to GPO data and services.

Specifically, this policy guides BUs in how to increase efficiency and productivity, and decrease IT spending by minimizing the amount of unnecessary redundancy resulting from disparate planning, practices, acquisitions services, and implementation strategies. Utilizing Cloud and Hosting Services as a commodity service for GPO will reduce the complexity of building and maintaining the infrastructure as an option in IT’s toolbox. This policy will also help GPO deliver IT products and services timely and further provide flexibility and scalability in capacity, additional options in functionality, automated software updates, security, reliability, performance, and reduced carbon footprint.

2. Cancellation. This directive is effective until superseded.

3. Related GPO Directives. This policy is augmented by other GPO policies and directives, including but not limited to: 705.28A GPO Information Technology System Development Life Cycle Policy, 705.31A GPO Enterprise Architecture (EA) Policy, 825.8 Information Technology Configuration Management (CM) Policy (Directive), and 825.33B Information Technology (IT) Security Program Statement of Policy.

4. Scope. This policy defines key principle actions about cloud computing; it applies to all organizations of the GPO.

5. Background. Cloud Computing and Hosted Services deliver computing services (servers, storage, databases, networking, software, and analytics) over the internet facilitating redundancy and flexibility. It offers a diversified IT products and services portfolio to ensure freedom from one vendor or service lock-in and single point of failure. Use of such services will expand our collection of tools to deliver multiple solution options. Over the last several years, the use of Cloud Computing and Hosted Services have proliferated in the Federal government and IT industry as a whole. At GPO, BUs have also progressed rapidly; resulting in the use of multiple cloud and hosted options, such as: SalesForce, AWS, Azure, Oracle, and others for creating new applications and services; store, back up, and restore data; host websites and blogs; stream audio and video; deliver software on demand; and analyze data for patterns and make predictions for business analysis. However, it had also become evident that there was a limited consensus among BUs when it came to selecting, acquiring, implementing, testing, and securing these services.

705.34 03/28/19

This led the Office of Inspector General to cite in their 2018 OIG Report, a recommendation that the CIO develop and promulgate a policy that defines and implements key principle actions about "cloud computing" and "hosted services.

6. Policy. The Cloud Computing and Hosting Services Policy states Office of the CIO and all GPO BUs will align with IT’s enhanced Cloud Smart Strategy and industry-recognized cloud and hosting practices. Additional information on the cloud strategy can be found in the IT Strategic Plan.

Specifically, this policy will facilitate and require all cloud computing and hosting solutions to:

a. Utilize Platform as a Service (PaaS) or Application as a Service (AaaS) to develop, implement, and administer applications. (See attachment)

b. Where appropriate use the FedRAMP compliant Cloud Computing Services.

c. Expand use of Oracle Cloud Hyperion Financial Management Cost Accounting reporting tool.

d. Implement Cloud Computing best practices and approaches that leverage cloud technology with streamlined activities and faster adoption.

e. Ensure greater security throughout data transit with continuous data protection.

f. Implement the IT-approved Cloud Computing & Hosted Services architecture design, security, and roles and responsibilities’ policies.

g. Require the Cloud Computing or Hosting Service providers to submit their compliance documentation of approved federal Cloud Service or Hosting Service provider.

h. Require the Cloud Computing or Hosting Service provider to provide testing results pertaining to GPO business requirements, application performance, application and data security, storage utilization, data transmission speeds and bandwidth availability, secured file transfers, backup and recovery, GPO’s disaster recovery, and quality requirements.

i. Require the Cloud Computing or Hosting Service provider to maintain all agreed upon activity logs and within two hours inform GPO IT of any reportable occurrence of transmission, data transfer, network, GPO VPNs, application, data, security, or technical failures at provider’s site or networking connecting GPO to the provider.

Compliance with this policy, and its associated procedures and technical standards, shall be mandatory. All deviations from this policy will be documented in advance through a written waiver approved by the CIO after consultation with appropriate governance bodies or agency officials.

03/28/19

7. Roles and Responsibilities.

Role Responsibilities Chief Information Officer

(CIO)

Approval authority for policy implementation and subsequent policy changes as well as overall policy enforcement.

GPO Business Unit Managers or Directors

Ensure participation and policy compliance within their respective Divisions, Branches, and work areas. If a business unit internally manages change processes, it must be done in conformance to agency process and oversight requirements specified by IT&S Configuration Management.

Program and Project Managers

Ensure policy implementation and compliance for all GPO-wide IT initiatives.

Enterprise Architecture Ensure all IT requests are analyzed for adherence to SDLC and EA governance processes.

IT Configuration Manager

Support and oversight of each business unit managing change, enforce policies, and create supporting processes and procedures.

Deputy Director Support policy compliance across the GPO enterprise.

8. Inquiries. For additional information about this Directive, please contact the Chief Policy Officer (IT).

9. Effective Date. This Directive is effective upon issuance.

HERBERT H. JACKSON, JR.

Acting Deputy Director

03/28/19 Attachment

Terminology

Platform-as-a-Service (PaaS): leverage an on-demand environment for developing, testing, delivering, and administering software programs. PaaS is designed to aid developers quickly develop and deploy web or mobile apps, without concerns about setting up or managing the underlying infrastructure of servers, storage, network, and databases needed for development.

Application-as-a-Service (AaaS): a technique for delivering and running software applications over the Cloud. With SaaS, cloud providers often host and manage the software application and the underlying infrastructure. Cloud providers are also typically responsible for maintenance, software upgrades, and security patching. SaaS allows users to connect to the application over the Internet or by using a mobile device. IT already utilizes Microsoft Office 365 email service and SharePoint Online service and will be adding to these type of services over time. These various cloud computing stacks will be used to provide the best products and services.