As part of a comprehensive  effort to increase the operational efficiency of federal technology assets  and deliver greater value to the American taxpayer, federal agencies are  shifting to the deployment of cloud services. In comments on  a draft of this report, each of the agencies generally agreed with our  recommendations. Agencies Have Made Progress Implementing OMB’s Cloud First Policy, but Better Planning Is Needed for Future Efforts

OMB requires federal agencies to immediately shift to a “Cloud First”  policy by implementing cloud-based solutions whenever a secure,  reliable, and cost-effective cloud option exists. To accelerate the shift,  OMB required agencies, by February 2011, to identify three IT services to  be migrated to a cloud solution and develop a plan for each of the three  services, migrate one of the services to a cloud-based solution by  December 2011, and migrate the remaining services by June 2012. Each agency has incorporated cloud computing requirements into its  policies and processes. For example, the Department of State (State)  incorporated into its plan a review of its IT investment portfolio to  identify candidates for cloud solutions. Each agency identified at least three services by February 2011 to  implement in a cloud environment and reported that the agency had  implemented at least one cloud service by December 2011. While each agency submitted plans to OMB for its selected services, all  but 1 of the 20 plans submitted to OMB were missing one or more key  required elements. According to agency officials, information was  missing because it was not available at the time the plans were submitted  to OMB or it was deemed not to be relevant. Additionally, each of the agencies identified opportunities for future cloud  implementations. Procuring services on a consumption (on-demand) basis: Because of  the on-demand, scalable nature of cloud services, it can be difficult to  define specific quantities and costs. Recently issued federal guidance and initiatives recognize many of these  challenges. Two agencies do not plan to meet OMB’s requirement to fully  implement three services to a cloud environment by June 2012, but plan  to do so by year end. Further, agencies’ plans for implementing these services were often  missing key information, such as performance goals or legacy system  retirement plans. Until agencies’ cloud implementations are  sufficiently planned and relevant systems are retired, the benefits of  federal efforts to implement cloud solutions—improved operational  efficiencies and reduced costs associated with retiring legacy systems— may be delayed or not fully realized. Recommendations for Executive Action

To help ensure the success of agencies’ implementation of cloud-based  solutions, we are recommending that the Secretaries of Agriculture,  Health and Human Services, Homeland Security, State, and the  Treasury; and the Administrators of the General Services Administration  and Small Business Administration direct their respective CIOs to take the  following two actions: establish estimated costs, performance goals, and plans to retire  associated legacy systems for each cloud-based service discussed in  this report, as applicable; and develop, at a minimum, estimated costs, milestones, performance  goals, and plans for retiring legacy systems, as applicable, for  planned additional cloud-based services. Appendix I: Objectives, Scope, and Methodology

Our objectives were to (1) assess the progress selected agencies have  made in implementing the federal “Cloud First” policy and (2) identify  challenges selected agencies are facing as they implement the policy. Finally, we interviewed officials  from the National Institute of Standards and Technology (NIST) and OMB  to understand cloud computing standards, requirements, and guidance  for federal agencies.
Why GAO Did This Study

As part of a comprehensive effort to increase the operational efficiency of federal technology assets, federal agencies are shifting how they deploy IT services. OMB issued a Cloud First policy in December 2010 that requires federal agencies to implement cloud-based solutions whenever a secure, reliable, and cost-effective cloud option exists; and to migrate three technology services to a cloud solution by June 2012. Cloud computing provides on-demand access to a shared pool of computing resources; can be provisioned on a scalable basis; and reportedly has the potential to deliver services faster, more efficiently, and at a lower cost than custom-developed systems.
GAO was asked to (1) assess the progress selected agencies have made in implementing this policy and (2) identify challenges they are facing in implementing the policy. To do so, GAO (1) selected seven agencies, analyzed agency documentation, and interviewed agency and OMB officials; and (2) identified, assessed, and categorized common challenges.

What GAO Found

The selected federal agencies have made progress implementing the Office of Management and Budgets (OMB) Cloud First policy. Consistent with this policy, each of the seven agencies incorporated cloud computing requirements into their policies and processes. For example, one agency had incorporated a review of its information technology (IT) investment portfolio to identify candidates for a cloud solution into its IT plan. Further, each of the seven agencies met the OMB deadlines to identify three cloud implementations by February 2011 and to implement at least one service by December 2011. However, two agencies do not plan to meet OMBs deadline to implement three services by June 2012, but plan to do so by calendar year end, ranging from August to December. Each of the seven agencies has also identified opportunities for future cloud implementations, such as moving storage and help desk services to a cloud environment. While each of the seven agencies submitted plans to OMB for implementing the cloud solutions, all but one plan were missing key required elements. For example, 7 of the 20 plans did not include estimated costs and none of the plans for services that were to migrate existing functionality to a cloud-based service included plans for retiring or repurposing the associated legacy systems. According to agency officials, this was largely because the information was not available at the time the plans were developed. Until agencies cloud implementations are sufficiently planned and relevant systems are retired, the benefits of federal efforts to implement cloud solutionsimproved operational efficiencies and reduced costsmay be delayed or not fully realized.
GAO identified seven common challenges associated with the implementation of OMBs Cloud First policy.
Common Challenges to Cloud Computing
1. Meeting Federal Security Requirements
2. Obtaining guidance
3. Acquiring knowledge and expertise
4. Certifying and accrediting vendors
5. Ensuring data portability and interoperability
6. Overcoming cultural barriers
7. Procuring services on a consumption (on-demand) basis
Recently issued federal guidance and initiatives recognize many of these challenges, such as the National Institute of Standards and Technology standards and guidance, and the General Services Administrations program to assist federal agencies certify and accredit potential cloud service providers.

What GAO Recommends

GAO is making recommendations to seven agencies to develop key planning information, such as estimated costs and legacy IT systems retirement plans for existing and planned services. The agencies generally agreed with GAOs recommendations. State disagreed with one recommendation, noting that legacy retirement plans were not applicable to its existing cloud services. GAO maintains that the recommendation is applicable for reasons discussed in this report.