Specifically,  FISMA requires that information security programs include, among other  things, the following:  risk-based policies and procedures that cost-effectively reduce  information security risks to an acceptable level and ensure that  information security is addressed throughout the life cycle of each  information system;   periodic testing and evaluation of the effectiveness of information security  policies, procedures, and practices that include testing of management,  operational, and technical controls for every system identified in the  agency’s required inventory of major information systems;   a process for planning, implementing, evaluating, and documenting  remedial actions to address any deficiencies in the information security  policies, procedures, and practices of the agency;    procedures for detecting, reporting, and responding to security incidents;    plans and procedures to ensure continuity of operations for information  systems that support the operations and assets of the agency. In addition to the service models that describe what can be provided, NIST  and other entities describe four deployment models that relate to how the  cloud service is provided. A public cloud is available to  any paying customer and is owned and operated by the service provider. Cloud Computing Has Both Positive and Negative Information Security Implications

Cloud computing can both increase and decrease the security of  information systems. Potential information security benefits include those  related to the use of virtualization, such as faster deployment of patches,  and from economies of scale, such as potentially reduced costs for  disaster recovery. Risks include those related to dependence on the  security assurances of a vendor; dependence on the vendor; and concerns  related to multitenancy, or sharing computing resources among different  organizations. However, these risks may vary based on the cloud  deployment model. For example, NIST states that private clouds may have a lower  threat exposure than community clouds, which may have a lower threat  exposure than public clouds. Federal Agencies Have Begun Efforts to Address Information Security Issues for Cloud Computing, but Specific Guidance Is Lacking and Efforts Remain Incomplete

Federal agencies have started to address information security when using  cloud computing; however, they have not always developed corresponding  guidance. Furthermore, agencies that have implemented cloud computing  efforts have faced challenges in implementing existing federal information  security guidance and identified the need to streamline and automate the  process of implementing this guidance. While several governmentwide  cloud computing security activities are under way by organizations such  as OMB and the General Services Administration (GSA), significant work  remains to be completed. Other agency concerns related to the division of information security  responsibilities between customer and vendor. However, these initiatives have not yet been  completed. Cloud computing is an emerging model  for IT, and NIST has not yet established guidance specific to cloud  computing. Until federal guidance and processes that  specifically address information security for cloud computing are  developed, agencies may be hesitant to implement cloud computing, and  those programs that have been implemented may not have effective  information security controls in place. To assist federal agencies in implementing appropriate information  security controls when using cloud computing, we recommend that the  Secretary of Commerce direct the Administrator of NIST to issue cloud  computing information security guidance to federal agencies to more fully  address key cloud computing domain areas that are lacking in SP 800-53,  such as virtualization, data center operations, and portability and  interoperability, and include a process for defining roles and  responsibilities of cloud computing service providers and customers. The Office of  Management and Budget’s comments are reprinted in appendix III. In written comments on a draft of this report, the Administrator of GSA  stated that GSA agreed in part with our findings and recommendation to  complete the procurement for infrastructure as a service cloud computing  technologies and ensure that it includes full consideration of the  information security challenges of cloud computing. Appendix I: Objectives, Scope, and Methodology

The objectives of our review were to (1) identify the models of cloud  computing; (2) identify the information security implications of using  cloud computing services in the federal government; and (3) assess federal  guidance and efforts to address information security when using cloud  computing. To identify cloud computing models, we reviewed publications, white  papers, and other documentation from public and private sector  organizations. We then obtained relevant information through interviews  with officials from the National Institute of Standards and Technology  (NIST) and private sector organizations that offer cloud computing  services.
Why GAO Did This Study

Cloud computing, an emerging form of computing where users have access to scalable, on-demand capabilities that are provided through Internet-based technologies, has the potential to provide information technology services more quickly and at a lower cost, but also to introduce information security risks. Accordingly, GAO was asked to (1) identify the models of cloud computing, (2) identify the information security implications of using cloud computing services in the federal government, and (3) assess federal guidance and efforts to address information security when using cloud computing. To do so, GAO reviewed relevant publications, white papers, and other documentation from federal agencies and industry groups; conducted interviews with representatives from these organizations; and surveyed 24 major federal agencies.

What GAO Found

Cloud computing has several service and deployment models. The service models include the provision of infrastructure, computing platforms, and software as a service. The deployment models relate to how the cloud service is provided. They include a private cloud, operated solely for an organization; a community cloud, shared by several organizations; and a public cloud, available to any paying customer. Cloud computing can both increase and decrease the security of information systems in federal agencies. Potential information security benefits include those related to the use of virtualization, such as faster deployment of patches, and from economies of scale, such as potentially reduced costs for disaster recovery. Risks include dependence on the security practices and assurances of a vendor, dependency on the vendor, and concerns related to sharing of computing resources. However, these risks may vary based on the cloud deployment model. Private clouds may have a lower threat exposure than public clouds, but evaluating this risk requires an examination of the specific security controls in place for the cloud's implementation. Federal agencies have begun efforts to address information security issues for cloud computing, but key guidance is lacking and efforts remain incomplete. Although individual agencies have identified security measures needed when using cloud computing, they have not always developed corresponding guidance. For example, only nine agencies reported having approved and documented policies and procedures for writing comprehensive agreements with vendors when using cloud computing. Agencies have also identified challenges in implementing existing federal information security guidance and the need to streamline and automate the process of implementing this guidance. These concerns include having a process to assess vendor compliance with government information security requirements and the division of information security responsibilities between the customer and vendor. Furthermore, while several governmentwide cloud computing security initiatives are under way by organizations such as the Office of Management and Budget (OMB) and the General Services Administration (GSA), little has been completed as a result of these efforts. For example, OMB has not yet finished a cloud computing strategy. GSA has begun a procurement for cloud computing services, but has faced challenges in completing the procurement due in part to information security concerns. In addition, while the Department of Commerce's National Institute of Standards and Technology has begun efforts to address cloud computing information security, it has not yet issued cloud-specific security guidance. Until specific guidance and processes are developed to guide agencies in planning for and establishing information security for cloud computing, they may not have effective information security controls in place for cloud computing programs.

What GAO Recommends

GAO is recommending that the Office of Management and Budget, General Services Administration, and the Department of Commerce take several steps to address cloud computing security, including completion of a strategy, consideration of security in a planned procurement of cloud computing services, and issuance of guidance related to cloud computing security. In comments on a draft of this report, these agencies generally concurred with GAO's recommendations and described efforts under way to implement them.