Cloud computing helps  do this by giving agencies the ability to purchase a broad range of IT  services in a utility-based model that allows an agency to pay for only the  IT services it uses. Key Practices for Cloud Computing Service Level Agreements Can Help Agencies Manage Services More Effectively

Based on our analysis of practices recommended by the ten  organizations with expertise in the area of SLAs and OMB, we compiled  the following list of ten practices that are key for federal agencies to  incorporate into a contract to help ensure services are performed  effectively, efficiently, and securely for cloud computing services. Without  clearly defined roles, responsibilities, and terms, the agency may not be  able to appropriately measure the cloud provider’s performance. OMB Guidance Addresses Seven of the Ten Key Practices

Guidance issued in February 2012, at the direction of OMB highlighted  SLAs as being a key factor for ensuring the success of cloud-based  services and advised that federal agencies should include an SLA or a  reference within the contract when creating a cloud computing contract. Without complete guidance from OMB, there is limited assurance that  agencies will apply all the key SLA practices into their cloud computing  contracts, and therefore may be unable to hold contractors accountable  when performance falls short of their goals. Specifically, seven of the cloud  service contracts reviewed met all 10 of the key practices. Of the remaining 14 cloud service contracts, 13 incorporated five or more  of the key practices, and 1 did not meet any of the key practices. Agency officials responsible for the cloud services that did not meet or  only partially met key practices provided the following additional reasons  for not including all ten practices:
Officials from DOD’s Office of the Chief Information Officer told us that  the reason key practices were not always fully addressed is that,  when the contracts and associated SLAs were developed, they did  not have the aforementioned DOD guidance on cloud service  acquisition and use—namely, the agency’s memorandum on  acquiring cloud services that was released in December 2014, and  the current Defense Federal Acquisition Regulation Supplement,  which was finalized in August 2015. Until these agencies develop SLA guidance and incorporate all key  practices into their cloud computing contracts, they may be limited in their  ability to measure the performance of the services, and, therefore, may  not receive the services they require. To help ensure continued progress in the implementation of effective  cloud computing SLAs, we recommend that the Secretaries of Health  and Human Services, Homeland Security, Treasury, and Veterans  Affairs direct appropriate officials to develop SLA guidance and  ensure key practices are fully incorporated as the contract and  associated SLAs expire. Agency Comments and Our Evaluation

In commenting on a draft of this report, four of the agencies—DOD, DHS,  HHS, and VA—agreed with our recommendations; and OMB and one  agency (Treasury) had no comments. For example, the department will develop service level agreement guidance to include the 10 key practices. We are sending copies of this report to interested congressional  committees; the Secretaries of Defense, Health and Human Services,  Homeland Security, the Treasury, and Veterans Affairs; and the Director  of the Office of Management and Budget, and other interested parties. Appendix I: Objectives, Scope, and Methodology

Our objectives were to (1) identify key practices used in cloud computing  service level agreements (SLA) to ensure service is performed at  specified levels and (2) determine the extent to which federal agencies  have incorporated such practices into their cloud computing service level  agreements. To identify key practices used in cloud computing service level  agreements, we analyzed SLA research, studies, and guidance  developed and used by federal agencies and private entities. First,  they have the largest planned IT budgets for fiscal year 2015.
Why GAO Did This Study

Cloud computing is a means for delivering computing services via IT networks. When executed effectively, cloud-based services can allow agencies to pay for only the IT services used, thus paying less for more services. An important element of acquiring cloud services is a service level agreement that specifies, among other things, what services a cloud provider is to perform and at what level.
GAO was asked to examine federal agencies' use of SLAs. GAO's objectives were to (1) identify key practices in cloud computing SLAs and (2) determine the extent to which federal agencies have incorporated such practices into their SLAs. GAO analyzed research, studies, and guidance developed by federal and private entities to develop a list of key practices to be included in SLAs. GAO validated its list with the entities, including OMB, and analyzed 21 cloud service contracts and related documentation of five agencies (with the largest fiscal year 2015 IT budgets) against the key practices to identify any variances, their causes, and impacts.

What GAO Found

Federal and private sector guidance highlights the importance of federal agencies using a service level agreement (SLA) in a contract when acquiring information technology (IT) services through a cloud computing services provider. An SLA defines the level of service and performance expected from a provider, how that performance will be measured, and what enforcement mechanisms will be used to ensure the specified performance levels are achieved. GAO identified ten key practices to be included in an SLA, such as identifying the roles and responsibilities of major stakeholders, defining performance objectives, and specifying security metrics. The key practices, if properly implemented, can help agencies ensure services are performed effectively, efficiently, and securely. Under the direction of the Office of Management and Budget (OMB), guidance issued to agencies in February 2012 included seven of the ten key practices described in this report that could help agencies ensure the effectiveness of their cloud services contracts.
GAO determined that the five agencies and the 21 cloud service contracts it reviewed had included a majority of the ten key practices. Specifically, of the 21 cloud service contracts reviewed from the Departments of Defense, Health and Human Services, Homeland Security, Treasury, and Veterans Affairs, 7 had fulfilled all 10 of the key practices, as illustrated in the figure. The remaining 13 contracts had incorporated 5 or more of the 10 key practices and 1 had not included any practices.
Agency officials gave several reasons for why they did not include all elements of the key practices into their cloud service contracts, including that guidance directing the use of such practices had not been created when the cloud services were acquired. Unless agencies fully implement SLA key practices into their SLAs, they may not be able to adequately measure the performance of the services, and, therefore, may not be able to effectively hold the contractors accountable when performance falls short.

What GAO Recommends

GAO recommends that OMB include all ten key practices in future guidance to agencies and that Defense, Health and Human Services, Homeland Security, Treasury, and Veterans Affairs implement SLA guidance and incorporate applicable key practices into their SLAs. In commenting on a draft of this report, OMB and one agency had no comment, the remaining four agencies concurred with GAO's recommendations.