Federal_Cloud_Policy_-_FINAL.pdf

F E B R U A R Y 8 , 2 0 11

Vivek Kundra U.S. Chief Information Officer

FEDER A L CLOU D

COMPU T ING STR ATEGY

i★ ★

TABLE OF CONTENTS

Executive Summary 1

I Unleashing the Power of Cloud 5

1 Defining cloud computing 5

2 Cloud is a fundamental shift in IT 6

3 Cloud computing can significantly improve public sector IT 6

II Decision Framework for Cloud Migration 11

1 Selecting services to move to the cloud 11

2 Provisioning cloud services effectively 15

3 Managing services rather than assets 16

III Case Examples to Illustrate Framework 19

1 Tailoring solution to protect security and maximize value 19

2 Provisioning to ensure competitiveness and capture value 20

3 Re-defining IT from an asset to a service 22

IV Catalyzing Cloud Adoption 25

1 Leveraging cloud computing accelerators 25

2 Ensuring a secure, trustworthy environment 26

3 Streamlining procurement processes 28

4 Establishing cloud computing standards 29

5 Recognizing the international dimensions of cloud computing 30

6 Laying a solid governance foundation 31

V Conclusion 33

Appendix 1: Potential Spending on Cloud Computing By Agency 35

Appendix 2: Agency Resources for Cloud Computing 37

1★ ★

EXECUTIVE SUMMARY

The Federal Government’s current Information Technology (IT) environment is characterized by low asset utilization, a fragmented demand for resources, duplicative systems, environments which are dif-ficult to manage, and long procurement lead times These inefficiencies negatively impact the Federal Government’s ability to serve the American public

Cloud computing has the potential to play a major part in addressing these inefficiencies and improving government service delivery The cloud computing model can significantly help agencies grappling with the need to provide highly reliable, innovative services quickly despite resource constraints

Commercial service providers are expanding their available cloud offerings to include the entire tradi-tional IT stack of hardware and software infrastructure, middleware platforms, application system com-ponents, software services, and turnkey applications The private sector has taken advantage of these technologies to improve resource utilization, increase service responsiveness, and accrue meaningful benefits in efficiency, agility, and innovation Similarly, for the Federal Government, cloud computing holds tremendous potential to deliver public value by increasing operational efficiency and responding faster to constituent needs

An estimated $20 billion of the Federal Government’s $80 billion in IT spending is a potential target for migration to cloud computing solutions (Appendix 1) 1

Figure 1: Estimated portion of Federal IT spend able to move to the cloud

1 Based on agency estimates as reported to the Office of Management and Budget (OMB)

F Ed ER A L C L O U d CO M p U T I N g S T R AT E g Y

2★ ★

To harness the benefits of cloud computing, we have instituted a Cloud First policy This policy is intended to accelerate the pace at which the government will realize the value of cloud computing by requiring agencies to evaluate safe, secure cloud computing options before making any new investments

By leveraging shared infrastructure and economies of scale, cloud computing presents a compelling business model for Federal leadership Organizations will be able to measure and pay for only the IT resources they consume, increase or decrease their usage to match requirements and budget con-straints, and leverage the shared underlying capacity of IT resources via a network Resources needed to support mission critical capabilities can be provisioned more rapidly and with minimal overhead and routine provider interaction

Cloud computing can be implemented using a variety of deployment models – private, community, public, or a hybrid combination

Cloud computing offers the government an opportunity to be more efficient, agile, and innovative through more effective use of IT investments, and by applying innovations developed in the private sector If an agency wants to launch a new innovative program, it can quickly do so by leveraging cloud infrastructure without having to acquire significant hardware, lowering both time and cost barriers to deployment

This Federal Cloud Computing Strategy is designed to:

• Articulate the benefits, considerations, and trade-offs of cloud computing

• Provide a decision framework and case examples to support agencies in migrating towards cloud computing

• Highlight cloud computing implementation resources

• Identify Federal Government activities and roles and responsibilities for catalyzing cloud adoption

Following the publication of this strategy, each agency will re-evaluate its technology sourcing strategy to include consideration and application of cloud computing solutions as part of the budget process Consistent with the Cloud First policy, agencies will modify their IT portfolios to fully take advantage of the benefits of cloud computing in order to maximize capacity utilization, improve IT flexibility and responsiveness, and minimize cost

EX E C U T I V E S U M M A RY

3★ ★

Figure 2: Cloud benefits: Efficiency, Agility, Innovation

EFFICIENCY

Cloud Benefits Current Environment

• Improved asset utilization (server utilization > 60-70%)

• Aggregated demand and accelerated system con-solidation (e g , Federal Data Center Consolidation Initiative)

• Improved productivity in application develop-ment, application management, network, and end-user

• Low asset utilization (server utilization < 30% typical)

• Fragmented demand and duplicative systems

• Difficult-to-manage systems

AGILITY

Cloud Benefits Current Environment

• Purchase “as-a-service” from trusted cloud providers

• Near-instantaneous increases and reductions in capacity

• More responsive to urgent agency needs

• Years required to build data centers for new services

• Months required to increase capacity of existing services

INNOVATION

Cloud Benefits Current Environment

• Shift focus from asset ownership to service management

• Tap into private sector innovation

• Encourages entrepreneurial culture

• Better linked to emerging technologies (e g , devices)

• Burdened by asset management

• De-coupled from private sector innovation engines

• Risk-adverse culture

5★ ★

I. UNLEASHINg THE pOWER OF CLOUd

Cloud computing describes a broad movement to treat IT services as a commodity with the ability to dynamically increase or decrease capacity to match usage needs By leveraging shared infrastructure and economies of scale, cloud computing presents Federal leadership with a compelling business model It allows users to control the computing services they access, while sharing the investment in the underlying IT resources among consumers When the computing resources are provided by another organization over a wide-area network, cloud computing is similar to an electric power utility The pro-viders benefit from economies of scale, which in turn enables them to lower individual usage costs and centralize infrastructure costs Users pay for what they consume, can increase or decrease their usage, and leverage the shared underlying resources With a cloud computing approach, a cloud customer can spend less time managing complex IT resources and more time investing in core mission work

1. Defining cloud computing Cloud computing is defined by the National Institute of Standards and Technology (NIST)2 as “a model for enabling convenient, on-demand network access to a shared pool of configurable computing resources (e g , networks, servers, storage, applications, and services) that can be rapidly provisioned and released with minimal management effort or service provider interaction ”3 NIST has identified five essential characteristics of cloud computing: on-demand service, broad network access, resource pooling, rapid elasticity, and measured service 4

Cloud computing is defined to have several deployment models, each of which provides distinct trade-offs for agencies which are migrating applications to a cloud environment NIST defines the cloud deployment models as follows:

• Private cloud. The cloud infrastructure is operated solely for an organization It may be managed by the organization or a third party and may exist on premise or off premise

• Community cloud. The cloud infrastructure is shared by several organizations and supports a specific community that has shared concerns (e g , mission, security requirements, policy, and compliance considerations) It may be managed by the organizations or a third party and may exist on premise or off premise

• Public cloud. The cloud infrastructure is made available to the general public or a large industry group and is owned by an organization selling cloud services

• Hybrid cloud The cloud infrastructure is a composition of two or more clouds (private, com-munity, or public) that remain unique entities but are bound together by standardized or proprietary technology that enables data and application portability (e g , cloud bursting for load-balancing between clouds)

2 http://csrc nist gov/groups/SNS/cloud-computing/cloud-def-v15 doc 3 http://csrc nist gov/groups/SNS/cloud-computing/cloud-def-v15 doc 4 http://csrc nist gov/groups/SNS/cloud-computing/cloud-def-v15 doc http://csrc.nist.gov/groups/SNS/cloud-computing/cloud-def-v15.doc http://csrc.nist.gov/groups/SNS/cloud-computing/cloud-def-v15.doc http://csrc.nist.gov/groups/SNS/cloud-computing/cloud-def-v15.doc

6★ ★

Cloud computing can also categorized into service models These are defined by NIST to be:

• Cloud Software as a Service (SaaS). The capability provided to the consumer is to use the pro-vider’s applications running on a cloud infrastructure The applications are accessible from various client devices through a thin client interface such as a web browser (e g , web-based email) The consumer does not manage or control the underlying cloud infrastructure including network, servers, operating systems, storage, or even individual application capabilities, with the possible exception of limited user-specific application configuration settings

• Cloud Platform as a Service (PaaS) The capability provided to the consumer is the ability to deploy onto the cloud infrastructure consumer-created or acquired applications created using programming languages and tools supported by the provider The consumer does not manage or control the underlying cloud infrastructure including network, servers, operating systems, or storage, but has control over the deployed applications and possibly application hosting environment configurations

• Cloud Infrastructure as a Service (IaaS). The capability provided to the consumer is to provision processing, storage, networks, and other fundamental computing resources where the con-sumer is able to deploy and run arbitrary software, which can include operating systems and applications The consumer does not manage or control the underlying cloud infrastructure but has control over operating systems, storage, deployed applications, and possibly limited control of select networking components (e g , host firewalls)

2. Cloud is a fundamental shift in IT Cloud computing enables IT systems to be scalable and elastic End users do not need to determine their exact computing resource requirements upfront Instead, they provision computing resources as required, on-demand Using cloud computing services, a Federal agency does not need to own data center infrastructure to launch a capability that serves millions of users

3. Cloud computing can significantly improve public sector IT A number of government agencies are adopting cloud technologies and are realizing considerable benefits For instance, NASA Nebula,5 through a community cloud, gives researchers access to IT services relatively inexpensively in minutes Prior to adopting this approach, it would take researchers months to procure and configure comparable IT resources and significant

5 http://nebula nasa gov/services/ http://nebula nasa gov/blog/ http://nebula.nasa.gov/services http://nebula.nasa.gov/blog

I . U N LE A S H I N g T H E p OW ER O F C L O U d

7★ ★ management oversight to monitor and upgrade systems Applying cloud technologies across the entire Federal Government can yield tremendous benefits in efficiency, agility, and innovation These benefits are described below

Efficiency improvements will shift resources towards higher-value activities

In FY2010, approximately thirty cents of every dollar invested in Federal IT was spent on data center infra-structure 6 Unfortunately, only a fraction of this investment delivers real, measurable impact for American citizens By using the cloud computing model for IT services, we will be able to reduce our data center infrastructure expenditure by approximately 30%7 (which contributes to the estimated $20 billion of IT spending that could be migrated to cloud computing solutions) Similar efficiency improvements will be seen in software applications and end-user support These savings can be used to increase capacity or be re invested in agency missions, including citizen-facing services and inventing and deploying new innovations Cloud computing can allow IT organizations to simplify, as they no longer have to maintain complex, heterogeneous technology environments Focus will shift from the technology itself to the core competencies and mission of the agency

Assets will be better utilized Across the public and private sectors, data center infrastructure investments are not utilized to their fullest potential For example, according to a recent survey, many agencies are not fully utilizing their available storage capacity and are utilizing less than 30% of their available server capacity 8 Low utiliza-tion is not necessarily a consequence of poor management, but, instead, a result of the need to ensure that there is reserve capacity to meet periodic or unexpected demand for key functions

With cloud computing, IT infrastructure resources are pooled and shared across large numbers of applications and organizations Cloud computing can complement data center consolidation efforts by shifting workloads and applications to infrastructures owned and operated by third parties Capacity can be provisioned to address the peak demand across a group of applications, rather than for a single application When demand is aggregated in this fashion and properly managed, the peaks and troughs of demand smooth out, providing a more consistent and manageable demand profile

As utilization is improved, more value is derived from the existing assets, reducing the need to continu-ously increase capacity Fewer machines mean less spending on hardware, software, and operations maintenance, real estate, and power consumption

Demand aggregation will reduce duplication The shift to cloud computing can help to mitigate the fragmented data, application, and infrastructure silo issues associated with federated organizational and funding models by focusing on IT services as a utility IT services become candidates for more cost effective procurement and management, similar to the model currently used for buildings and utility services

6 President’s FY2011 Budget 7 Gartner IT Key Metrics Data 2009, Bloomberg, McKinsey analysis 8 Agency Data Center Consolidation Plans submitted to OMB, August 2010

8★ ★

Cloud computing has the potential to provide a more interoperable and portable environment for data and systems With the appropriate standards, over time, organizations may be able to move to common services and platforms

Data center consolidation can be accelerated In February 2010, we launched the Federal Data Center Consolidation Initiative (FDCCI) to con-solidate the Federal Government’s fragmented data center environment Through the FDCCI, agencies have formulated detailed consolidation plans and technical roadmaps to eliminate a minimum of 800 data centers by 2015 9

Cloud computing can accelerate data center consolidation efforts by reducing the number of applica-tions hosted within government-owned data centers For those that continue to be owned and operated directly by Federal agencies (e g , by implementing private IaaS clouds), environments will be more interoperable and portable, which will decrease data center consolidation and integration costs because it reduces unnecessary heterogeneity and complexity in the IT environment

IT will be simpler and more productive Cloud computing also provides an indirect productivity benefit to all services in the IT stack For example, less effort will be required to stand up and develop software testing environments, enabling application development teams to integrate and test frequently in production-representative environments at a fraction of the cost of providing this infrastructure separately

Agility improvements will make services more responsive

The impact of cloud computing will be far more than economic Cloud computing will also allow agen-cies to improve services and respond to changing needs and regulations much more quickly

With traditional infrastructure, IT service reliability is strongly dependent upon an organization’s ability to predict service demand, which is not always possible For example, the IT system used in the Car Allowance and Rebate System (CARS, more commonly known as “Cash-For-Clunkers”) had numerous failures because the load was considerably higher than what its system could handle The sponsor for “Cash-for-Clunkers,” the National Highway Traffic Safety Administration (NHTSA) anticipated a demand of 250,000 transactions over a four month period, but within just 90 days, the system processed approxi-mately 690,000 CARS transactions Within three days of the first dealer registrations, the system was overwhelmed, leading to numerous outages and service disruptions The $1 billion appropriated for the program was nearly exhausted within one week and an additional $2 billion dollars was appropriated to triple the potential number of transactions just nine days after the program began NHTSA deployed a customized commercial application hosted in a traditional data center environment, but the CARS system presented a very good example of an unpredictable service demand and a short development window that could have been more efficiently handled using a cloud computing approach Cloud computing will allow agencies to rapidly scale up to meet unpredictable demand thus minimizing

9 OMB, 25-point implementation plan to reform Federal information technology management, December 9, 2010, http://www cio gov/documents/25-Point-Implementation-Plan-to-Reform-Federal%20IT pdf http://www.cio.gov/documents/25-Point-Implementation-Plan-to-Reform-Federal%20IT.pdf

I . U N LE A S H I N g T H E p OW ER O F C L O U d

9★ ★ similar disruptions Notably, cloud computing also provides an important option for agencies in meeting short-term computing needs such as the one above; agencies need not invest in infrastructure in cases where service is needed for a limited period of time

Services will be more scalable With a larger pool of resources to draw from, individual cloud services are unlikely to encounter capac-ity constraints As a result, government services such as “Cash-for-Clunkers” would be able to more rapidly increase capacity and avoid service outages Given appropriate service level agreements and governance to ensure overall capacity is met, cloud computing will make the government’s IT invest-ments less sensitive to the uncertainty in demand forecasts for individual programs, which frequently emerge rapidly in response to national program needs which cannot be foreseen in the early stages of the Federal budget cycle

Innovation improvements will rapidly enhance service effectiveness

Cloud computing will not only make our IT services more efficient and agile, it will also serve as an enabler for innovation Cloud computing allows the Federal Government to use its IT investments in a more innovative way and to more easily adopt innovations from the private sector Cloud computing will also help our IT services take advantage of leading-edge technologies including devices such as tablet computers and smart phones

IT innovation has transformed how the private sector operates and revolutionized the efficiency, con-venience, and effectiveness with which it serves its customers In our everyday lives, we can track the status of a shipment; order a pizza or a pair of shoes; make travel, hotel, and restaurant reservations;

and collaborate with friends and colleagues – all online, anytime, and anywhere Yet, when it comes to dealing with the Federal Government, we too often need to stand in line, hold on the phone, or mail in a paper form For many reasons such as policy and other constraints, the Federal Government has not innovated as quickly as the private sector and has consequently missed out on many of the benefits offered through IT

Encourage entrepreneurial culture by reducing risk Cloud-based projects can be conceived, developed, and tested with smaller initial investments than traditional IT investments Rather than laboriously building data center capacity to support a new development environment, capacity can be provisioned in small increments through cloud comput-ing technologies After the small initial investment is made, the project can be evaluated for additional investment or cancellation Projects that show promise can gain valuable insights through the evalua-tion process Less promising projects can be cancelled with minimal losses This “start small” approach collectively reduces the risk associated with new application development Reducing the minimum required investment size will also provide a more experimental development environment in which innovation can flourish

11★ ★

II. dECISION FRAMEWORK FOR CLOUd MIgRATION

The broad scope and size of the cloud transformation will require a meaningful shift in how government organizations think of IT Organizations that previously thought of IT as an investment in locally owned and operated applications, servers, and networks will now need to think of IT in terms of services, com-moditized computing resources, agile capacity provisioning tools, and their enabling effect for American citizens This new way of thinking will have a broad impact across the entire IT service lifecycle – from capability inception through delivery and operations

The following structured framework presents a strategic perspective for agencies in terms of thinking about and planning for cloud migration

Figure 3: Decision Framework for Cloud Migration

A broad set of principles and considerations for each of these three major migration steps is presented below Please refer to Section 3 for an illustration of how these considerations can be applied, using Federal case study examples

1. Selecting services to move to the cloud Successful organizations carefully consider their broad IT portfolios and create roadmaps for cloud deployment and migration These roadmaps prioritize services that have high expected value and high readiness to maximize benefits received and minimize delivery risk Defining exactly which cloud

Shift IT mindset from assets to services

Build new skill sets as required

Actively monitor SLAs to ensure compliance and continuous improvement

Re - evaluate vendor and service models periodically to maximize benefits and minimize risks

Identify which IT services to move and when

– Identify sources of value for cloud migrations:

efficiency, agility, innovation

– Determine cloud readiness: security, market availability, government readiness, and technology lifecycle

Select

? Aggregate demand at Department level where possible

Ensure interoperability and integration with IT portfolio

Contract effectively to ensure agency needs are met

Realize value by repurposing or decommissioning legacy assets and redeploying freed resources

Provision Manage

Framework is flexible and can be adjusted to meet individual age ncy needs Framework is flexible and can be adjusted to meet individual age ncy needs

Shift IT mindset from assets to services

Build new skill sets as required

Actively monitor SLAs to ensure compliance and continuous improvement

Re - evaluate vendor and service models periodically to maximize benefits and minimize risks

Identify which IT services to move and when

– Identify sources of value for cloud migrations:

efficiency, agility, innovation

– Determine cloud readiness: security, market availability, government readiness, and technology lifecycle

Select

Aggregate demand at Department level where possible

Ensure interoperability and integration with IT portfolio

Contract effectively to ensure agency needs are met

Realize value by repurposing or decommissioning legacy assets and redeploying freed resources

Provision Manage

Framework is flexible and can be adjusted to meet individual age Framework is flexible and can be adjusted to meet individual agency needs

12★ ★ services an organization intends to provide or consume is a fundamental initiation phase activity in developing an agency roadmap

The chart shown below uses two dimensions to help plan cloud migrations: Value and Readiness The Value dimension captures cloud benefits in the three areas discussed in Section 1 (i e , efficiency, agil-ity, and innovation) The Readiness dimension broadly captures the ability for the IT service to move to the cloud in the near-term Security, service and market characteristics, government readiness, and lifecycle stage are key considerations As shown below, services with relatively high value and readiness are strong candidates to move to the cloud first

Figure 4: Selecting Services for Cloud Migration

The relative weight of the value and readiness dimensions can be adjusted to meet the individual needs of agencies Some agencies may stress innovation and security while others may stress efficiency and government readiness However, the logic and structure of the framework should be applicable for all agencies

Described below are a number of considerations for value and readiness that agencies may find helpful when completing this evaluation

I I . d E C I S I O N F R A M EWO R K F O R C L O U d M I g R AT I O N

13★ ★

Identify sources of value

As described in Section 1, cloud computing provides three primary sources of business value: efficiency, agility, and innovation Listed below are a number of considerations for each value category

Agencies should feel free to stress one or more of these sources of value according to their individual needs and mission goals For instance, some agencies may place a higher value on agility, while others may stress cost savings brought about by greater computing efficiency

Efficiency: Efficiency gains can come in many forms, including higher computer resource utilization due to the employment of contemporary virtualization technologies, and tools that extend the reach of the system administrator, lowering labor costs Efficiency improvements can often have a direct impact on ongoing bottom line costs Further, the nature of some costs will change from being capital investment in hardware and infrastructure (CapEx) to a pay-as-you go (OpEx) model with the cloud, depending on the cloud deployment model being used Services that have relatively high per-user costs, have low utilization rates, are expensive to maintain and upgrade, or are fragmented should receive a relatively high priority for consideration

Agility: Many cloud computing efforts support rapid automated provisioning of computing and storage resources In this way, cloud computing approaches put IT agility in the hands of users, and this can be a qualitative benefit Existing services that require long lead times to upgrade or increase / decrease capacity should receive a relatively high priority for consideration, and so should new or urgently needed services to compress delivery timelines as much as possible Services that are easy to upgrade, are not sensitive to demand fluctuations, or are unlikely to need upgrades in the long-term can receive a relatively low priority

Innovation: Agencies can compare their current services to contemporary marketplace offerings, or look at their customer satisfaction scores, overall usage trends, and functionality to identify the need for potential improvements through innovation Services that would most benefit from innovation should receive a relatively high priority

Determine cloud readiness

It is not sufficient to consider only the potential value of moving to cloud services Agencies should make risk-based decisions which carefully consider the readiness of commercial or government providers to fulfill their Federal needs These can be wide-ranging, but likely will include: security requirements, service and marketplace characteristics, application readiness, government readiness, and program’s stage in the technology lifecycle Similar to the value estimation, agencies should be free to stress one or more of these readiness considerations according to their individual needs

Security Requirements: Federal Government IT programs have a wide range of security requirements Federal Information Security Management Act (FISMA) requirements include but are not limited to:

compliance with Federal Information Processing Standards agency specific policies; Authorization to Operate requirements; and vulnerability and security event monitoring, logging, and reporting It is essential that the decision to apply a specific cloud computing model to support mission capability considers these requirements Agencies have the responsibility to ensure that a safe, secure cloud solu-tion is available to provide a prospective IT service, and should carefully consider agency security needs across a number of dimensions, including but not limited to:

14★ ★

• Statutory compliance to laws, regulations, and agency requirements

• Data characteristics to assess which fundamental protections an application’s data set requires

• Privacy and confidentiality to protect against accidental and nefarious access to information

• Integrity to ensure data is authorized, complete, and accurate

• Data controls and access policies to determine where data can be stored and who can access physical locations

• Governance to ensure that cloud computing service providers are sufficiently transparent, have adequate security and management controls, and provide the information necessary for the agency to appropriately and independently assess and monitor the efficacy of those controls

For additional discussion and considerations regarding trust and security in the context of cloud com-puting, please refer to the online NIST cloud computing resources 10

Service characteristics: Service characteristics can include service interoperability, availability, perfor-mance, performance measurement approaches, reliability, scalability, portability, vendor reliability, and architectural compatibility

Storing information in the cloud will require a technical mechanism to achieve compliance with records management laws, policies and regulations promulgated by both the National Archives and Records Administration (NARA) and the General Services Administration (GSA) The cloud solution has to sup-port relevant record safeguards and retrieval functions, even in the context of a provider termination

Depending on the organizational missions supported by the cloud capability, Continuity of Operations (COOP) can be a driving solution requirement The purpose of a COOP capability is to ensure that mission-essential functions continue to be available in times of crisis or against a spectrum of threats Threats can include a wide range of potential emergencies, including localized acts of nature, accidents, and technological and/or attack-related emergencies

The organization should consider scalability requirements concerning the ability of the cloud solution architecture to either grow or shrink over time, with varying levels of processing, storage, or service handling capability They should also consider both the impact on their business processes if network connectivity to their cloud provider fails, resulting in a loss of IT capability, and the possibility (likelihood) of this occurrence

Requirements concerning administrative support should be included as well, covering topics such as the daily hours of prime support, problem escalation times, resolution of recurring problems, and trouble ticket submission methods

Market Characteristics: Agencies should consider the cloud market competitive landscape and matu-rity, including both fully commercial and government-provided cloud services Agencies can consider whether cloud markets are sufficiently competitive and are not dominated by a small number of players Agencies can consider whether there is a demonstrated capability to move services from one provider

10 http://csrc nist gov/groups/SNS/cloud-computing/ http://www nist gov/itl/cloud/index cfm http://csrc.nist.gov/groups/SNS/cloud-computing/ http://www.nist.gov/itl/cloud/index.cfm

15★ ★ to another, and whether there is a demonstrated capability to distribute services between two or more providers in response to service quality and capacity Agencies should consider the availability of techni-cal standards for cloud interfaces which reduce the risk of vendor lock-in

Network infrastructure, application and data readiness: Before migrating to the cloud agencies must ensure that the network infrastructure can support the demand for higher bandwidth and that there is sufficient redundancy for mission critical applications Agencies should update their continuity of operations plans to reflect the increased importance of a high-bandwidth connection to the Internet or service provider Another key factor to assess when determining readiness for migration to the cloud is the suitability of the existing legacy application and data to either migrate to the cloud (i e , rehost an application in a cloud environment) or be replaced by a cloud service (i e , retire the legacy system and replace with commercial SaaS equivalent) If the candidate application has clearly articulated and understood interfaces and business rules, and has limited and simple coupling with other systems and databases, it is a good candidate along this dimension If the application has years of accumulated and poorly documented business rules embedded in code, and a proliferation of subtle or poorly understood interdependencies with other systems, the risks of “breakage” when the legacy application is migrated or retired make this a less attractive choice for early cloud adoption

Government readiness: In addition, agencies should consider whether or not the applicable orga-nization is pragmatically ready to migrate their service to the cloud Government services which have capable and reliable managers, the ability to negotiate appropriate SLAs, related technical experience, and supportive change management cultures should receive a relatively high priority Government services which do not possess these characteristics but are otherwise strong cloud candidates should take steps to alleviate any identified concerns as a matter of priority

Technology lifecycle: Agencies should also consider where technology services (and the underlying computing assets) are in their lifecycle Services that are nearing a technology refresh, approaching the conclusion of their negotiated contract, or are dependent upon inefficient legacy software or hardware should receive a relatively high priority Technology services that were recently upgraded, locked within contract, and are based on leading-edge technology may want to wait before migrating to the cloud

2. Provisioning cloud services effectively To effectively provision selected IT services, agencies will need to re think their processes as provision-ing services rather than simply contracting assets Contracts that previously focused on metrics such as number of servers and network bandwidth now should focus on the quality of service fulfillment

Organizations that are most successful in cloud service provisioning carefully think through a number of factors, including:

Aggregate demand: When considering “commodity” and common IT services, agencies should pool their purchasing power by aggregating demand to the greatest extent possible before migrating ser-vices to the cloud Where appropriate, demand should be aggregated at the departmental level and as part of the government-wide shared services initiatives such as government-wide cloud-based email

16★ ★

Integrate services: Agencies should ensure that the provided IT services are effectively integrated into their wider application portfolio In some cases, technical experts may be required to evaluate architec-tural compatibility of the provided cloud service and other critical applications Rather than a one-time event, this principle should be followed over time to guarantee that systems remain interoperable as individual IT services evolve within the portfolio Business process change may similarly be required to properly integrate the systems (e g , adjusting call center processes)

Contract effectively: Agencies should also ensure that their contracts with cloud service providers set the service up for success Agencies should minimize the risk of vendor lock-in, for instance, to ensure portability and encourage competition among providers Agencies should include explicit service level agreements (SLAs) for security, continuity of operations, and service quality that meet their individual needs Agencies should include a contractual clause enabling third parties to assess security controls of cloud providers The SLA should specify the support steps that the consumer can take when the service is failing to meet the terms specified in the agreement, and should include points-of-contact and escalation procedures It is important to be precise in the definition of metrics and specify when and where they will be collected For example, performance is different when measured from the consumer or provider due to the network delays Metrics should measure characteristics under the control of the vendor Finally, the SLA should describe a mutual management process for the service levels, including periodic reporting requirements and meetings for management assessments

Realize value: Agencies should take steps during migration to ensure that they fully realize the expected value From an efficiency standpoint, legacy applications and servers should be shut down and decom-missioned or repurposed Data center real estate used to support these systems should be closed down or used to support higher value-add activities Where possible, staff supporting these systems should be trained and re-deployed to higher-value activities From an agility and innovation standpoint, processes and capabilities may also need to be refined in order to fully capture the value of the investment

3. Managing services rather than assets To be successful, agencies must manage cloud services differently than traditional IT assets As with provisioning, cloud computing will require a new way of thinking to reflect a service-based focus rather than an asset-based focus Listed below are a few considerations for agencies to effectively manage their cloud services

Shift mindset: Organizations need to re-orient the focus of all parties involved – providers, government agencies, and end users – to think of services rather than assets Organizations that successfully make this transition will effectively manage the system towards output metrics (e g , SLAs) rather than input metrics (e g , number of servers)

Actively monitor: Agencies should actively track SLAs and hold vendors accountable for failures Agencies should stay ahead of emerging security threats and ensure that their security outlook is constantly evolving faster than potential attacks Agencies may also consider incorporating business user feedback into evaluation processes Finally, agencies should track usage rates to ensure charges do not exceed funded amounts

17★ ★

It can be advantageous for a consumer to “instrument” key points on the network to measure perfor-mance of cloud service providers For example, commercial tools can report back to a centralized data store on service performance, and instrumentation agents can be placed with participating consumers and at the entry point of the service provider on the network By gathering data across providers on the performance of pre-planned instrumented service calls throughout typical work periods, service managers can better judge where performance bottlenecks arise Agencies should include requirements for service instrumentation where appropriate

Re-evaluate periodically: Agencies should periodically re-evaluate the choice of service and vendor to ensure that efficiency, agility, and innovation are maximized Agencies should ensure portability and hold competitive bids for cloud services at regular intervals Agencies should also consider increasing the scope of cloud-provided services as markets mature (e g , moving from IaaS solutions to PaaS and SaaS solutions) Opportunities to consolidate and standardize solutions between agencies should be periodically evaluated as well, particularly for “commodity” services To effectively conduct re-evaluations, agencies should maintain awareness of changes in the technology landscape, in particular, the readiness of new cloud technologies, commercial innovation, and new cloud vendors

19★ ★

III. CASE EXAMpLES TO

ILLUSTRATE FRAMEWORK

Many Federal agencies have already taken their first steps towards cloud computing In each case, the agency achieved considerable benefits to efficiency, agility, or innovation in support of its unique mission The following case studies illustrate how these Federal agencies successfully migrated toward cloud services consistent with the select / provision / manage framework outlined in Section 2

1. Tailoring solution to protect security and maximize value In 2008, the Army Experience Center (AEC) realized that it needed a new Customer Relationship Management (CRM) system to track personal and electronic engagements with prospects and help recruiting staff manage the recruitment process

After considering several options including upgrading their 10-year-old legacy proprietary data system, the Army chose a customized version of a commercially-available SaaS solution This solution met their unique security needs, fulfilled all of their functionality requirements, and was delivered at a fraction of the time and expense required to upgrade their legacy system

The Army followed many of the key factors outlined in Section 2 when migrating toward their cloud solution:

Selecting a cloud solution

The Army placed a very high priority on security when considering its CRM solution Before choosing a cloud solution, the AEC carefully weighed the sources of value and readiness of potential solutions

Efficiency: The AEC compared the cost of upgrading their existing system to configuring a new SaaS solution Initial bids to upgrade the existing system, ARISS, which relied on traditional infrastructure, ranged from $500,000 to over $1 million Initial pilots of the SaaS solution cost as little as $54,000, just over 10% of the minimum cost of an ARISS system upgrade

Agility: The AEC also considered the time required to deploy the system Despite regular upgrades over the years, it was infeasible to modify ARISS to meet the Army Experience Center’s requirements The SaaS solution could be provisioned in a fraction of the time required to upgrade the ARISS system The SaaS solution was also more scalable and would be far easier to upgrade over time

Innovation: The SaaS solution integrated directly with e-mail and Facebook, allowing recruiters to connect with participants more dynamically after they left the AEC Army recruiters could also access information from anywhere These advancements would have been very costly and time-consuming to achieve with ARISS system upgrades In effect, the SaaS solution allowed the AEC to take advantage of the cloud vendor’s innovation engine without owning or managing heavy IT assets

20★ ★

Security: The AEC ensured the cloud solution would be sufficiently secure The SaaS solution was flex-ible and could be configured to securely manage access, sovereignty, and data retention requirements

Market availability: The SaaS solution was able to meet all of the AEC’s requirements including the ability to track AEC visitor and engagement data, compatibility with handheld devices, and real-time integration with marketing and recruitment data

Government readiness: The AEC ensured that it was both capable and ready to migrate their services to the cloud The AEC had experience implementing new technologies, had a culture that supported experimentation and improvement, and possessed the skills and capacity to manage the transition well

Technology lifecycle: The AEC also evaluated the lifecycle of its legacy solution The legacy ARISS system was more than 10 years old in 2008 and was not burdened by contract lock-down

Provisioning IT services

During provisioning, the AEC took an approach which was distinctly different from the Army’s former approach with ARISS This approach reflected the service-based rather than asset-based nature of the cloud service

Integrate services: As the Army transferred its recruitment system to the cloud, it carefully engineered its relationship with the vendor to ensure a successful migration

Realize value: With the cloud-based solution, the AEC has been able to handle the workload of five traditional recruitment centers The system has also resulted in dramatically reduced hardware costs and IT staff costs The Army has decommissioned, or re-purposed for other systems, all hardware related to the legacy ARISS system Its people have been spending more time on more rewarding and higher-value activities, shifting time from filing reports to engaging with potential recruits

2. Provisioning to ensure competitiveness and capture value USDA recently launched a broad initiative to modernize and streamline USDA’s IT infrastructure As part of this initiative, USDA aimed to consolidate 21 fragmented e-mail systems and improve the productiv-ity of its workers Rather than continuing efforts to consolidate the fragmented environment internally, the USDA chose a proven cloud-based email solution to accelerate consolidation and take advantage of the latest communication and collaboration tools

Effective provisioning was critical for the USDA to realize the value of cloud migration Previously, the USDA had focused on contracting for its 21 email systems As a provisioner, the USDA needed to care-fully aggregate demand, ensure integration with downstream applications, reflect its priorities in its contracts, and retire legacy systems to capture value

The USDA followed many of the key factors outlined in Section 2 when migrating toward their cloud solution:

I I I . C A S E EXA M p LE S TO I LLU S T R AT E F R A M EWO R K

21★ ★

Selecting a cloud solution

The USDA carefully evaluated the sources of value and service readiness before choosing the cloud-based solution:

Efficiency: Financially, the motivation to move to cloud was compelling Eliminating the 21 fragmented e-mail systems would drastically reduce duplication, not only with software and hardware assets, but also by reducing the number of system interfaces that need to be maintained on a regular basis USDA estimates that the cloud solution will save up to $6 million per year, to include ongoing costs for hard-ware refreshment and software upgrades

Agility: Consolidating and upgrading their fragmented traditional environment would have taken years to complete With the cloud solution, USDA was able to access the cloud provider’s existing capacity to accommodate its 120,000 users Migration would require months rather than years Once complete, the solution would be more scalable to the needs of USDA

Innovation: The cloud solution allowed USDA to make the latest communication and collaboration tools available to its workers including SharePoint, Office Communications, and Live Meeting online services In addition, USDA was able to incorporate e-discovery and archive features

Market availability: The functionality offered by the cloud solution met the needs of USDA The cloud provider also had experience hosting very large email systems, including 300,000 users from a large private sector client Cloud-provided e-mail is a vibrant, competitive market with several capable market incumbents

Government readiness: Senior leadership was actively involved and highly motivated to improve the efficiency and quality of the email services The USDA CIO was personally involved in many of the decisions The broader transformation program also provided valuable delivery resources to execute the migration

Technology lifecycle: The 21 email systems were approaching the end of their usable lifecycle and were not burdened by inflexible contracts

Provisioning IT services

USDA’s provisioning approach reflected a service-based mindset rather than an asset-based mindset

Aggregate demand: USDA implemented their cloud email solution on an agency-wide level This approach maximized benefits and addressed their primary, fundamental concern – fragmented email systems The approach also allowed USDA to take full advantage of the momentum created by the broader transformation agenda

Integrate services: An auxiliary contract was awarded to a systems integrator to ensure the e-mail system was properly integrated with the various interfacing USDA systems Seven hundred applications reliant upon email were analyzed – only four had to be recoded to maintain operations

Contract effectively: USDA benchmarked their cloud provider against the industry to ensure competi-tive market rates USDA also embedded explicit SLAs into the contract, according to its mission needs

22★ ★

Realize value: Previously used IT assets are on track to be decommissioned and/or re-deployed as part of the wider IT modernization strategy Individuals formerly working on email…