15 - FSA Integrated Cloud Strategy.pdf

FSA Integrated Cloud Strategy

July 2024

FSA Cloud Strategy 1

FSA’s Cloud Vision FSA’s Cloud Goals FSA’s EA Guiding Principles Current State Integrated Cloud Vision Transition Roadmap Two to Five Year Plan Five to Seven Year Plan Conclusion

Executive Summary Federal Student Aid (FSA) is taking decisive steps to simplify and modernize its cloud infrastructure, enhancing support for Federal, Financial, and School Partners and improving the tools for the FSA workforce.

The current fragmented, multi-cloud environment will be transformed into an integrated multi-cloud environment.

Transitioning from a siloed multi-cloud environment to an integrated multi-cloud environment involves transforming isolated, independently managed cloud infrastructures into a cohesive, unified system.

However, the intention is to embrace the different strengths of each cloud offer rather than move to universal tooling.

In a siloed setup, each cloud environment operates in isolation, with little to no interoperability, leading to inefficiencies, duplicated efforts, and increased complexity in management and security. Moving to an integrated multi-cloud environment entails implementing standardization, automation, and interoperability across all cloud services. This transformation enables seamless data and application sharing, centralized management, and unified security protocols. The result is a streamlined, agile, and cost-effective cloud ecosystem that supports dynamic workload distribution, enhances disaster recovery, mitigates vendor lock-in, and aligns with overarching strategic goals, providing a scalable and future-ready platform for organizational growth and innovation. By moving to an integrated multi-cloud environment over the next five years, FSA will have the flexibility to continue to support a multi-cloud environment or transition to a singular unified cloud.

This Integrated Cloud Strategy will ensure FSA is marching towards the same vision. A successful implementation of the integrated cloud environment requires a unified vision of the target state that addresses operational, technical, and security considerations. The vision described in this document serves as a guide to harvest the benefits of such an implementation at FSA.

The Integrated Cloud Strategy introduces the recommended approaches and techniques to guide the implementation of the target integrated cloud. It includes a description of the key shared cloud services to support an integrated multi-cloud environment and an implementation roadmap with specific goals set for both an initial 2-5 year period and a subsequent 5-7 year period.

The detailed planning and context-specific decisions necessary to implement the vision are not within the scope of this document but will be addressed subsequently. The specific architectural alternatives and guidance for selecting the most appropriate alternative for a given set of requirements will be assembled in the form of implementation plans to be developed during a planning phase.

This strategy recognizes that early adopters have made initial architectural decisions to build on and replicate proven approaches. In particular, existing operational capabilities provide a foundational platform to inform and shape the cloud implementation plans. The strategy aligns with the emerging Federal Data Strategy and leverages the principles, mandates, and best practices of the Federal Cloud Computing Strategy.

Implementation of a common vision and approaches will also provide an “Exit Strategy” for cloud decisions that must be revised after implementation due to changing conditions.

This document is organized to first, provide a high-level overview of FSA’s cloud integration strategy goals and objectives, such as services reuse, self-sufficient application packaging, use of automation, orchestration, use of “infrastructure as code,” and support for cost optimization. And then, to define a series of steps as a roadmap for the implementation of the needed functions of the integrated target state. Understanding the vision and roadmap presented in this document will guide FSA’s selection of appropriate integration approaches and tools.

Sections:

Margaret Glick Federal Student Aid, Chief Information Officer

FSA Cloud Strategy 2

FSA’s Cloud Vision

What is a Cloud?

A cloud is a network of remote servers which are hooked together and meant to operate as a single ecosystem. These servers are designed to either store and manage data, run applications, or deliver content or a service such as web mail, office productivity software, or business transactions. Instead of accessing files and data from a local or personal computer, users access them online from any Internet-capable device or application. The information in a cloud is available anytime and anywhere for authorized users.

Cloud Strategy Compliance For federal agencies, including FSA, cloud computing holds tremendous potential to deliver public value by increasing operational efficiency and responding faster to constituent needs.

However, many vendors have used the term “cloud” to describe products and platforms that do not always offer the promised degree of efficiency, flexibility, and value. Therefore, the increased adoption of cloud services across the Federal Government calls for a standard definition to reduce potential investment risks. The NIST Definition of Cloud Computing, establishes a baseline for cloud characteristics and clearly defining cloud deployment and cloud service models. In addition, the Federal Risk and Authorization Management Program (FedRAMP), a government-wide program that promotes the adoption of secure cloud services across the federal government, provides a standardized approach to security assessment, authorization, and continuous monitoring for cloud products and services.

Key Strategic Directions

• Federally Managed environment.

• Standardization leveraging efficiency.

• Automation using latest innovations.

• Reuse of sharable services.

Note, however, that the way these decisions are implemented may change as the organization matures in its cloud journey.

FSA Cloud Strategy 3

High-Level Integrated Cloud Platform Vision A birds-eye-view of the vision for an Integrated Cloud Platform is depicted in the following diagram where FSA’s cloud platform is represented by two large clouds sharing a services layer and surrounded by smaller clouds representing the various external entities which interface with FSA. Secure Federal Tax Information (FTI) services will be provided as common services by the small FSA FTI Cloud. The icons band at the top depicts interactions with FSA’s Customers, School Partners, Financial Partners, Federal Partners, and Employees.

Business Benefits of the Cloud Platform With the implementation of the Cloud Strategy and FSA Integrated Cloud Platform, a better customer experience will be enabled for the students and borrowers that depend on FSA for their college funding.

Increased Security Decreased Cost Increased Quality and Speed of Delivery Decreased Complexity Increased Reusability Decreased Development Time

FSA Cloud Strategy 4

FSA’s Cloud Goals Four Cloud Goals have been established for FSA to execute and fully achieve the FSA Cloud Vision. Each of the FSA Cloud Goals have specific actions on how they can be achieved, described below.

FSA Cloud Goal Actions

1. Transform to a Scalable Organization

• Review and negotiate with cloud vendors for unbundled infrastructure and software services.

• Establish a cloud enabled organization by improving workforce readiness.

• Define standards to onboard vendors and reduce cloud sprawl.

2. Promote Transparency

• Implement the FSA-owned common pipeline to increase visibility into vendor processes, data security, and requirements across multiple vendors.

• Determine migration pattern (e.g., Lift and Shift, Refactoring) and Total Cost of Ownership Model to transition FSA systems to the standards-based FSA Integrated Cloud Platform

• Define vendor onboarding process to gain consistency for application development and maintain a vendor-neutral solution.

3. Optimize IT Services

• Conduct the cloud readiness assessment to determine the best deployment path for each system to the standards-based FSA Integrated Cloud Platform.

• Apply operational standards and tools to maximize manageability and sustainability of source code, container repository, infrastructure, and other technologies.

4. Implement Zero Trust Architecture

• Apply security standards consistent with the latest legislation and leading cybersecurity practices.

• Leverage cloud technologies to implement security rich features prioritizing zero-trust architecture to comply with the President’s Executive Order issued in May of 2021.

• Build DevSecOps pipeline with a standardized set of security standards to securely migrate or onboard new applications to the cloud.

FSA’s EA Guiding Principles Guiding Principle

Establishing a Centralized Single Authoritative Source of Data

Delivering an Outstanding Customer Driven Experience

Enhanced Reuse of Existing Assets

Safeguard Data and Information (Cybersecurity)

Implementing Modern and Scalable Solutions and Platforms for the Integrated Cloud

Data Driven Customer Insights and Improved Productivity

Minimizing and Controlling Technical Diversity

Quicker Time to Market and Flexibility

FSA Cloud Strategy 5

Current State The current state presents a disparate multi-cloud environment which introduces cost inefficiencies, diminishing functionality and undue complexity. In FSA’s current multi-cloud environment, each cloud has its own support and service contract that needs to be maintained. Each cloud environment has its own unique configuration that needs to be documented and managed. Furthermore, each cloud hosting contract has its own government oversight and management team who is responsible for overseeing the execution of the contract. This multi-vendor cloud hosting strategy has led to a siloed architecture, duplicative resources, non-integrated processes, and a disjointed operating environment. These management and technical constraints have limited FSA’s ability to enable cross-organization collaboration and improve service to the citizenry, as well as improve transparency within ED and FSA.

Current Multi-Cloud Environment

Current Shared Cloud Characteristics On the positive side, there exist some common technologies and tools amongst the different clouds which present opportunities for establishing shared hardware and software standards. For example, Amazon Web Services (AWS) products and services are widely used, as well as Cisco and VMware products, Microsoft, and Oracle products.

Current State FSA Multi-Cloud Environment

Information Assurance and Security Single Sign On (SSO)

FSA Employees FSA Contractors Customers Financial Partners

School Partners

Federal PartnersFSA Customers, Partners, and Employees

OCIO Services

(Information Assurance, Collaboration, Messaging, File, Print, Laptops)

Servicer 3 Servicer 4 Servicer 5

Servicer 1 Servicer 2

FSA Loan Servicers

Cloud On-prem

Data Center

Cloud 1

SaaS 1 SaaS 2 SaaS N

FedRAMP Cloud Providers / SaaS Products

Cloud On-prem

Data Center

Cloud 2

Cloud N

FSA SOCFSA SOC

FSA SOC

FSA FTI Cloud

System 1 System 2 System N System 1 System 2 System N

System 1 System 2 System N

System 1 System 2 System 3

FSA Cloud Strategy 6

Integrated Cloud Vision The future state integrated cloud will be achieved through a “Tenant and Shared Services” architectural model. This model has been described as similar to an apartment building in which different tenants have individual living spaces but share the utilities and common areas. In FSA’s integrated cloud environment tenants will share common services for Business Support, Security & Operations, and Infrastructure & Platform. Tenants will include FSA systems, products and/or services. Each tenant will consume as many of these as services as needed for its individual operations.

Support of Goals and Economies of Scale

The following sections will describe how the shared services will support FSA’s goals and present opportunities for economies of scale within the cloud tenants.

FSA Cloud Strategy 7

Business Support Shared Services The Business Support shared services of the Integrated Cloud environment are designed to facilitate a better customer experience for the students and borrowers that depend on FSA for their college funding. Reusable business capabilities will be built-into and executed throughout the platform to be shared by all tenants. This may require some organizational alignment around a set of key principles and priorities for cloud adoption to prevent cross-functional conflict. Implementation guides will be developed based on this document to provide vendors with a clear understanding of FSA standards and requirements. The goals of transforming FSA to a Scalable Organization, Promote Transparency, Optimize IT Services, and Implement a Zero Trust Architecture will be supported by the following Business Support shared services:

• Shared account management tools and the implementation of the latest security enhancements and mandates across the platform will provide Increased Security.

• Shared collaboration tools and project trackers will support Increased Quality and Decreased Development Time.

• Reusability of common functions, such as access management, cybersecurity scanning and monitoring, and the use of standardized architectural frameworks will present opportunities for economies of scale and decreased cost.

• Shared Infrastructure design patterns will decrease current diversity and complexity.

The Integrated Cloud Platform will enable FSA to have a centralized pipeline with standards that multiple vendors will use to develop and deploy applications. FSA will have control over the standards vendors will use as they are onboarded and transparency into how applications are being developed all while keeping the solution vendor-agnostic. Standard Software as a Service (SaaS) tools will be defined and integrated for use within the Integrated Cloud Platform.

Stakeholders will leverage the Integrated Cloud Platform as the vehicle to integrate with multiple FedRAMP Cloud Providers and SaaS products, and components of the platform itself: Information Assurance and Security, Reusable Services / Management / Utilities, Production, and Non-Production.

The FSA FTI Cloud will be available to tenants of the Integrated Cloud Platform, and it will utilize the platform standards, while remaining separate due to 1075 compliance. FSA Loan Servicers are included in a separate cloud and will be accessible to the platform. Additionally, the platform will have the ability to integrate with cloud services (e.g., Salesforce, Appian, Office 365).

FSA Cloud Strategy 8

Security & Operations Shared Services The Security & Operations shared services of the Integrated Cloud Platform are designed to support continuously enhanced security and the standardized implementation of operations support tools.

Reusable security and operations capabilities will be built into and executed throughout the platform to be shared by all tenants.

Security Vision The Security Vision outlines how cybersecurity will be built into and executed throughout the platform, leveraging cloud technologies to implement security based on a zero-trust architecture which will be supported by five security “pillars”: Identity, Device, Network, Application, and Data security. The security standards will be applied in a manner consistent with the latest legislation and leading cybersecurity practices.

The goals of Optimizing IT Services, and to Implement a Zero Trust Architecture will be supported by the following Security & Operations shared services:

• Shared Identity and Access management tools will provide Increased Security.

• Shared Web Application Firewall tool will protect web applications and Application

Programming Interfaces (APIs) from malicious web traffic and application-layer attacks.

• Shared Infrastructure & Application Scanning will support the constant improvement of FSA’s infrastructure and the delivery of better user experiences, as well as improved security.

• Shared Capacity Planning tools will provide the ability to decrease the cost of operations by indicating when to increase or decrease use of infrastructure components.

• Shared Log Aggregation, Monitoring & Alerting tools will support the optimization of IT systems availability, consistency, and security, and the protection of data.

FSA Cloud Strategy 9

Operations Vision The Operations Vision presents how FSA will focus on the prevention of incidents and management of cybersecurity threats during all development processes and within the Development, Security, and Operations pipeline. Standardizing the security scans, tools, and processes in the pipeline to reduce the time required for obtaining an Authority to Operate (ATO) for new systems coming online.

Security Compliance The NIST Cloud Computing Reference Architecture characterizes important aspects of cloud computing and enables agencies to directly compare cloud services and deployment strategies. In addition, the Federal Risk and Authorization Management Program (FedRAMP), a government-wide program that promotes the adoption of secure cloud services across the federal government, provides a standardized approach to security assessment, authorization, and continuous monitoring for cloud products and services. FedRAMP empowers FSA to use modern cloud technologies, with an emphasis on security and protection of federal information.

Using the functional cloud resources described in this document, FSA will be able to implement an integrated cloud environment to accomplish the objectives and fully enabling the benefits of the integrated cloud environment. The Integrated Cloud architecture must comply with Zero Trust Architecture by emphasizing the following subjects:

• Network Architecture

• Identity and Access Management

• Data Protection

• Monitoring and Logging

• Incident Response and Recovery

• Continuous Integration and Continuous Deployment

• Compliance and Governance

• Continuous Monitoring and Improvement

• SaaS Integration

Trusted Internet Connections (TIC) 3.0 implementation considerations Coordinating the strategies to become TIC 3.0 compliant, with this Integrated Cloud Strategy is necessary to maximize the security and scalability of the target environment.

FSA Cloud Strategy 10

Infrastructure & Platform Shared Services The Infrastructure & Platform shared services of the Integrated Cloud Platform are designed to support FSA’s self-sufficient application packaging strategy and the standardized implementation of DevSecOps and infrastructure deployment automation. Reusable infrastructure and platform capabilities will be built into and executed throughout the platform to be shared by all tenants.

The goals of Promote Transparency, Optimize IT Services, and Implement a Zero Trust Architecture will be supported by the following infrastructure shared services:

• Shared DevSecOps tools will provide all tenants with the means to implement FSA’s self-sufficient application packaging strategy and infrastructure deployment automation.

• Shared Container Repository will store the collection of container images by namespaces and make them available for reuse by all authorized tenants.

• Shared Infrastructure as Code approach and tools will provide the ability to configure and manage infrastructure and platform components through statements in code files.

• Shared Configuration Management Database will store infrastructure information and provide visibility of all the relationships between the hardware, software, and networks used by FSA.

• Shared Test Automation tools will ensure consistency at all levels of software and infrastructure testing.

DevSecOps Vision

The Integrated Cloud Platform will enable FSA to have a centralized pipeline with standards that multiple vendors will use to develop and deploy applications. FSA will have control over the standards vendors will use as they are onboarded, and transparency into how applications are being developed all while keeping the solution vendor-agnostic. Standard SaaS tools will be defined and integrated for use within the Integrated Cloud Platform.

The tenants of the platform will be able to utilize automation and orchestration tools to streamline provisioning, deployment, and management tasks across the cloud environment. Implementation of “infrastructure as code” practices will enable consistent and repeatable deployments.

FSA Cloud Strategy 11

API Management This strategy’s vision for the management of Application Programming Interfaces (APIs) describes how APIs will be managed within the FSA Integrated Cloud Platform. FSA will have the ability to apply consistent principles and the same architectural patterns across tenants on the platform to increase scalability, security, and performance.

By using the same architectural patterns and API management services, tenants will have the opportunity to reuse and integrate services between other tenants, reducing the amount of duplicative work performed. Any common functionality that is built will be able to be shared and used across tenants, allowing developers to focus more time on developing new application features. The same approach and tools will be used to monitor both application and data services. However, application services will be stored in an application repository, while data services will be stored in a data repository, thus, separating the data services related to the persistence of information, from the application services which involve the workflow of processes. Some of the API Management services to be provided will be Perimeter Security, Container Management, and Monitoring, as well as access to External APIs. Specific API security services will include Authentication and Authorization, Data Encryption and Transport Security, and API Threat Protection. API Monitoring and Analytics services will include API Performance Monitoring and API Usage Analytics.

This vision promotes reusability and consistency across the tenants by sharing common services and following standard processes defined by FSA on the platform. The summary of high-level objectives for the API Management Solution Services Vision are outlined below.

• Establish a developer portal with tooling to support the design, development, deployment, and Governance of APIs,

• Establish technical standards and infrastructure enabling FSA to cost effectively manage APIs as an Integrated cloud asset.

• Establish API security standards and policy implementation ensuring consistency across the Integrated cloud.

• Enable FSA to monitor APIs ensuring project teams meet performance Service Level Agreements (SLA)s.

• Enable FSA to rapidly identify and resolve production issues.

API

Management

Perimeter Security

Container Management

Application Monitoring

Authentication

Authorization

Data Encryption

Transport Security

API Threat Protection

FSA Cloud Strategy 12

Transition Roadmap

The first year of the transition to an Integrated Cloud as depicted in the above roadmap graphic begins with this Integrated Cloud Strategy document (Step 0) which introduces the collection of concepts to guide the implementation of FSA’s vision for cloud integration. Then it continues with Step 1, Step 1 first performs a Rationalization of the systems to select the migration path (higher effort, lowest effort, consolidate, or phase out) to follow for each system. From this point consolidated systems will be considered as one and phased out systems will not be considered. Then, the individual Implementation Plans for each system will be developed based on the migration path selected and the necessary actions to prepare the workforce for the transition will be defined. After that, the Cloud Governance and Architecture Standards will be established.

Subsequent years will continue with the following Steps 2 to 5:

Step 2 takes actions to rehost loosely coupled FSA systems with SaaS alternatives. The term “loosely coupled” refers to systems that have few or no dependencies on other systems. This represents the lowest effort and skills level of the workforce.

Step 3 continues with the refactoring of other loosely coupled systems. The term “refactoring” refers to the modification or restructuring of the system’s code or even the re-architecting of those systems to make them suitable for being hosted in a cloud, making them “cloud-native”.

This represents a low level of effort but requires a higher level of skills from the workforce.

Step 4 begins the refactoring of more tightly coupled systems which may not need rehosting. The term “tightly coupled” refers to systems that have many dependencies on other systems.

This represents a high level of effort and skills from the workforce.

Step 5 rehosts the remaining tightly coupled systems, completing the implementation.

This represents the highest level of effort and skills from the workforce.

The completion of steps two and three should occupy the next two to five years, and the final steps four and five may take the next five to seven years.

FSA Cloud Strategy 13

Two to Five Year Plan FSA goals for the initial 2-5 years

The 2-5 year period will first focus on the migration of systems with SaaS alternatives that can be lift and shifted on to the Integrated Cloud Strategy. For any systems that use SaaS software, the integration endpoints will be defined for tenant access. Tenants built using SaaS platforms will be deployable to those platforms through the platform automation and migration activities, this will involve updating deployment processes and integration endpoints. After that, FSA will proceed to migrate large systems with outdated software, but few dependencies to the Integrated Cloud Platform.

Five to Seven Year Plan

FSA goals for the final 5-7 years

During the 5-7 year period FSA will primarily migrate large systems with large technical debt and significant dependencies to a Cloud Platform. Then, FSA will migrate systems that are currently hosted in contractor cloud platforms to the Integrated Cloud Platform. These systems will be migrated last as they are currently interfaced from their clouds, so moving them before the final wave would require a duplication of interface adjustments.

FSA Cloud Strategy 14

Conclusion Federal Student Aid (FSA) is taking decisive steps to simplify and modernize its cloud infrastructure, enhancing support for Federal, Financial, and School Partners and improving the tools for the FSA workforce. The current fragmented, multi-cloud environment will be transformed into an integrated multi-cloud environment.

Transitioning from a siloed multi-cloud environment to an integrated multi-cloud environment involves transforming isolated, independently managed cloud infrastructures into a cohesive, unified system. In a siloed setup, each cloud environment operates in isolation, with little to no interoperability, leading to inefficiencies, duplicated efforts, and increased complexity in management and security.

The Integrated Cloud Strategy introduces the recommended approaches and techniques to guide the implementation of the target integrated cloud. It includes a description of the key shared cloud services to support an integrated multi-cloud environment and an implementation roadmap with specific goals set for both an initial 2-5 year period and a subsequent 5-7 year period.

Value Proposition Standing up an integrated cloud environment and migrating all FSA systems to this unified cloud will result in an enormous value to FSA, which cannot be overstated. There will be a marked increase in operational effectiveness and efficiency, from daily maintenance to major system development programs, resulting in the total level of effort becoming less, while allowing resources to be freed for other activities. Whether responding to urgent requirements, such as an executive order or cyber vulnerability response, or integrating critical systems to provide a seamless user experience or analyzing traffic data to predict traffic spikes and/or identify fraudulent activity or submitting a change request that impacts multiple systems and contracts, the future state of operations will be far less arduous, far more cohesive, and more predictable than the status quo.

Exit Strategy There is always a possibility that technology changes, policy changes, or other types of disruptions may affect the implementation of parts of this strategy. Being aware of these possibilities, this strategy document recommends the leveraging of the principles, mandates, and best practices of the Federal Cloud Computing Strategy when developing the subsequent Implementation Plans. Implementation of a common vision while considering alternate approaches will provide specific exit strategies for cloud decisions that must be revised after implementation due to changing conditions.