Cloud Computing: Additional Opportunities and Savings Need to Be Pursued
Highlights
What GAO Found
Each of the seven agencies reviewed implemented additional cloud computing services since GAO last reported on their progress in 2012. For example, since then, the total number of cloud computing services implemented by the agencies increased by 80 services, from 21 to 101. The agencies also added to the amount they reported spending on cloud services by $222 million, from $307 million to $529 million. Further, the agencies increased the percentage of their information technology (IT) budgets allocated to cloud services; however, as shown in the table, the overall increase was just 1 percent.
Amount Agencies Allocated to Cloud Services (for Fiscal Years 2012 and 2014)
|
Department/Agency |
Percent of IT budget reported spent on cloud in 2012 |
Percent budgeted for cloud in 2014 |
|
Agriculture |
1 |
3 |
|
General Services Administration |
2 |
5 |
|
Health and Human Services |
0 |
1 |
|
Homeland Security |
1 |
2 |
|
Small Business Administration |
0 |
3 |
|
State |
1 |
2 |
|
Treasury |
5 |
6 |
|
Total |
1 |
2 |
Source: GAO analysis of agency data. l GAO-14-753
The agencies' relatively small increase in cloud spending as a percent of their overall IT budgets, is attributed in part, to the fact that these agencies collectively had not considered cloud computing services for about 67 percent of their investments. With regard to why these investments had not been assessed, the agencies said it was in large part due to these being legacy investments in operations and maintenance; the agencies had only planned to consider cloud options for these investments when they were to be modernized or replaced. This is inconsistent with Office of Management and Budget policy that calls for cloud solutions to be considered first whenever a secure, reliable, and cost-effective option exists regardless of where the investment is in its life cycle. Until the agencies fully assess all their IT investments, they will not be able to achieve the resulting benefits of operational efficiencies and cost savings.
The agencies collectively reported cost savings of about $96 million from the implementation of 22 of the 101 cloud services. These savings included both one-time and multiyear savings. For example, the General Services Administration saved $2.6 million by migrating to a cloud customer service solution, and Homeland Security saved $1.2 million from fiscal years 2011 through 2013 by implementing a cloud-based collaboration service. Agency officials cited two major reasons for why the other services they had implemented did not save money. First, a motivation for changing to some of the cloud-based services was not to reduce spending, but to improve service. Second, in selected cases, the cloud computing service opened up a new service or provided a higher quality of service; while this provided useful benefits to the agency, the associated costs negated any savings.
Why GAO Did This Study
Cloud computing is a relatively new process for acquiring and delivering computing services via information technology (IT) networks. Specifically, it is a means for enabling on-demand access to shared and scalable pools of computing resources with the goal of minimizing management effort and service provider interaction. To encourage federal agencies to pursue the potential efficiencies associated with cloud computing, the Office of Management and Budget (OMB) issued a “Cloud First” policy in 2011 that required agency Chief Information Officers to implement a cloud-based service whenever there was a secure, reliable, and cost-effective option.
GAO was asked to assess agencies' progress in implementing cloud services. GAO's objectives included assessing selected agencies' progress in using such services and determining the extent to which the agencies have experienced cost savings. GAO selected for review the seven agencies that it reported on in 2012 in order to compare their progress since then in implementing cloud services; the agencies were selected using the size of their IT budgets and experience in using cloud services. GAO also analyzed agency cost savings and related documentation and interviewed agency and OMB officials.
Recommendations
GAO is recommending, among other things, that the seven agencies assess the IT investments identified in this report that have yet to be evaluated for suitability for cloud computing services. Of the seven agencies, six agreed with GAO's recommendations, and one had no comments.
Recommendations for Executive Action
| Agency Affected | Recommendation | Status |
|---|---|---|
| Department of Homeland Security | To help ensure continued progress in the implementation of cloud computing services, the Secretaries of Agriculture, Health and Human Services, Homeland Security, State, and the Treasury; and the Administrators of the General Services Administration and Small Business Administration should direct their respective Chief Information Officers to ensure that all IT investments are assessed for suitability for migration to a cloud computing service. |
In response to our recommendation, in November 2014, DHS established criteria for evaluating investments for cloud computing service alternatives, and updated its capital planning and investment control guidance to include requirements for completing this evaluation. Further, DHS established a work plan to review individual systems that comprise each investment for suitability to cloud. As a result, DHS provided us evidence that in August 2016 it had assessed all its fiscal year 2016 IT investments for suitability for migration to a cloud computing service.
|
| Department of Agriculture | To help ensure continued progress in the implementation of cloud computing services, the Secretaries of Agriculture, Health and Human Services, Homeland Security, State, and the Treasury; and the Administrators of the General Services Administration and Small Business Administration should direct their respective Chief Information Officers to ensure that all IT investments are assessed for suitability for migration to a cloud computing service. |
The Department of Agriculture (Agriculture) has taken steps to address our recommendation. Specifically, in September 2015, Agriculture finalized its Departmental Regulation (3650-001), which calls for information technology (IT) investments and information systems to follow a cloud first approach. In addition, in March 2017, the department finalized its Cloud Strategy, describing, among other things, the establishment of a Cloud Strategy and Policy Office that will help the department's components adopt cloud computing. As of February 2018, Agriculture reported on the IT Dashboard that the majority of its applicable IT investments had been assessed for suitability for migration to a cloud computing service. By finalizing cloud computing assessment guidance and ensuring that all IT investments are assessed for suitability for the cloud Agriculture is better positioned to gain operational efficiencies and cost savings from the implementation of cloud services.
|
| Department of Health and Human Services | To help ensure continued progress in the implementation of cloud computing services, the Secretaries of Agriculture, Health and Human Services, Homeland Security, State, and the Treasury; and the Administrators of the General Services Administration and Small Business Administration should direct their respective Chief Information Officers to ensure that all IT investments are assessed for suitability for migration to a cloud computing service. |
In response to our recommendation, in June 2015, HHS established a requirement for evaluating investments for cloud computing service alternatives, including a strategy and timeline for implementing it. Further, HHS requires that a justification be included when cloud was not chosen or no review was planned. As a result, in November 2016, HHS provided us evidence that it has assessed all their fiscal year 2016 IT investments for suitability for migration to a cloud computing service.
|
| Department of the Treasury | To help ensure continued progress in the implementation of cloud computing services, the Secretaries of Agriculture, Health and Human Services, Homeland Security, State, and the Treasury; and the Administrators of the General Services Administration and Small Business Administration should direct their respective Chief Information Officers to ensure that all IT investments are assessed for suitability for migration to a cloud computing service. |
The Department of the Treasury (Treasury) has taken steps to address our recommendation. In August 2017, Treasury finalized its Cloud Strategy Migration Framework, which includes a process for assessing information technology (IT) applications to determine whether or not the application is a good candidate for cloud migration. By finalizing cloud computing assessment guidance to ensure that all IT investments are assessed for suitability for the cloud, Treasury is better positioned to gain operational efficiencies and cost savings from the implementation of cloud services.
|
| Department of State | To help ensure continued progress in the implementation of cloud computing services, the Secretaries of Agriculture, Health and Human Services, Homeland Security, State, and the Treasury; and the Administrators of the General Services Administration and Small Business Administration should direct their respective Chief Information Officers to ensure that all IT investments are assessed for suitability for migration to a cloud computing service. |
The Department of State (State) has taken steps to address our recommendation. Specifically, in October 2015, State finalized its Cloud Computing Policy (5 FAM 1100), which calls for information technology (IT) projects to follow a cloud first approach by implementing cloud services whenever they are cost effective, meet system/owner mission requirements, and provide the required level of security and performance. In addition, in October 2015, the department finalized its Cloud Computing (5 FAH-8 H-350) guidance, describing, among other things, a Cloud Computing Governance Board in place to assess the department's use of cloud services and providers, along with a requirement that new projects assess cloud alternatives during the planning stage. As of January 2018, State reported on the IT Dashboard that all of its applicable IT investments had been assessed for suitability for migration to a cloud computing service. By finalizing cloud computing assessment guidance and ensuring that all IT investments are assessed for suitability for the cloud State is better positioned to gain operational efficiencies and cost savings from the implementation of cloud services.
|
| General Services Administration | To help ensure continued progress in the implementation of cloud computing services, the Secretaries of Agriculture, Health and Human Services, Homeland Security, State, and the Treasury; and the Administrators of the General Services Administration and Small Business Administration should direct their respective Chief Information Officers to ensure that all IT investments are assessed for suitability for migration to a cloud computing service. |
In response to our recommendation, GSA established criteria for evaluating investments for cloud computing service alternatives, and updated its capital planning and investment control guidance to include requirements for completing this evaluation. Further, GSA established a work plan to evaluate the suitability of migrating GSA?s information technology systems and applications to cloud-based solutions. As a result, GSA has assessed all their fiscal year 2016 IT investments for suitability for migration to a cloud computing service.
|
| Small Business Administration | To help ensure continued progress in the implementation of cloud computing services, the Secretaries of Agriculture, Health and Human Services, Homeland Security, State, and the Treasury; and the Administrators of the General Services Administration and Small Business Administration should direct their respective Chief Information Officers to ensure that all IT investments are assessed for suitability for migration to a cloud computing service. |
The Small Business Administration (SBA) has taken steps to address our recommendation. Specifically, in June 2014, SBA finalized its Cloud Strategy which calls for legacy applications to be evaluated for cloud readiness using an extensive review process with criteria established by both information technology (IT) and business leaders. In addition, in October 2014, the agency finalized its Standard Operating Procedure 90-82 Procedure for Managing SBA IT Investments - IT Investment Review Board, which describes the role of the agency's Business Technology Investment Council in reviewing new and existing IT investments to determine whether cloud computing should be used. As of June 2018, SBA reported on the IT Dashboard that more than 92 percent of its applicable IT investments had been assessed for suitability for migration to a cloud computing service. By finalizing cloud computing assessment guidance and ensuring that all IT investments are assessed for suitability for the cloud, SBA is better positioned to gain operational efficiencies and cost savings from the implementation of cloud services.
|
| Department of Homeland Security | To help ensure continued progress in the implementation of cloud computing services, the Secretaries of Agriculture, Health and Human Services, Homeland Security, State, and the Treasury; and the Administrators of the General Services Administration and Small Business Administration should direct their respective Chief Information Officers to establish evaluation dates for those investments identified in this report that have not been assessed for migration to the cloud. |
In response to our recommendation, in November 2014, DHS established a work plan and evaluation dates for assessing investments for suitability for migration to a cloud computing service. As a result, DHS provided us evidence that in August 2016 it had completed its assessments and reported all their fiscal year 2016 IT investments had been assessed for suitability for migration to a cloud computing service.
|
| Department of Agriculture | To help ensure continued progress in the implementation of cloud computing services, the Secretaries of Agriculture, Health and Human Services, Homeland Security, State, and the Treasury; and the Administrators of the General Services Administration and Small Business Administration should direct their respective Chief Information Officers to establish evaluation dates for those investments identified in this report that have not been assessed for migration to the cloud. |
The Department of Agriculture (Agriculture) has taken steps to address our recommendation. In February 2018, Agriculture reported on the information technology (IT) Dashboard that more than 85 percent of its applicable IT investments had been assessed for cloud migration, consistent with its September 2015 policy, Departmental Regulation (3650-001), that calls for IT investments and information systems to follow a cloud first approach. By finalizing evaluation dates and conducting assessments for the majority of its applicable IT investments for cloud migration, Agriculture is better positioned to gain operational efficiencies and cost savings from the implementation of cloud services.
|
| Department of Health and Human Services | To help ensure continued progress in the implementation of cloud computing services, the Secretaries of Agriculture, Health and Human Services, Homeland Security, State, and the Treasury; and the Administrators of the General Services Administration and Small Business Administration should direct their respective Chief Information Officers to establish evaluation dates for those investments identified in this report that have not been assessed for migration to the cloud. |
In response to our recommendation, in June 2015, HHS established a requirement to update each investment?s cloud alternative strategy as part of its fiscal year-end budget data reporting. This included the requirement that each investment in its IT portfolio establish evaluation dates for implementing a cloud alternative, and a justification for why a cloud alternative was not chosen or no review planned. As a result, HHS provided us evidence in November 2016 that it has assessed all their fiscal year 2016 IT investments for suitability for migration to a cloud computing service.
|
| Department of the Treasury | To help ensure continued progress in the implementation of cloud computing services, the Secretaries of Agriculture, Health and Human Services, Homeland Security, State, and the Treasury; and the Administrators of the General Services Administration and Small Business Administration should direct their respective Chief Information Officers to establish evaluation dates for those investments identified in this report that have not been assessed for migration to the cloud. |
In September 2014, we reported that the Department of the Treasury (Treasury) had not assessed 189 out of 319 legacy information technology (IT) investments for cloud migration in accordance with OMB guidance, which required agencies to continually assess their investments regardless of where the investments were in their lifecycle. In addition, Treasury could not provide dates for when assessments of these investments would be performed. Accordingly, we recommended that the Secretary of the Treasury direct the department's CIO to establish evaluation dates for those investments identified in this report that have not been assessed for migration to the cloud. In July 2018, Treasury officials from the Office of the CIO reported that, while the department has established a process for assessing investments for cloud computing services, it did not establish specific dates for conducting assessments of all of the investments we identified as not having been assessed for migration to the cloud. Rather, according to the officials, cloud assessments are only conducted if the department determines that an investment will be replaced, redeveloped, or retired. Because such milestones for the investments we identified in our report are undetermined at this time and are unlikely to occur in the foreseeable future, we are closing this recommendation as not implemented.
|
| Department of State | To help ensure continued progress in the implementation of cloud computing services, the Secretaries of Agriculture, Health and Human Services, Homeland Security, State, and the Treasury; and the Administrators of the General Services Administration and Small Business Administration should direct their respective Chief Information Officers to establish evaluation dates for those investments identified in this report that have not been assessed for migration to the cloud. |
The Department of State (State) has taken steps to address our recommendation. In January 2018, State reported on the information technology (IT) Dashboard that all of its applicable IT investments had been assessed for cloud adoption, which is consistent with its October 2015 policy, Cloud Computing Policy (5 FAM 1100), that calls for IT projects to follow a cloud first approach. By finalizing evaluation dates and conducting assessments of each of its applicable IT investments for cloud migration, State is better positioned to gain operational efficiencies and cost savings from the implementation of cloud services.
|
| General Services Administration | To help ensure continued progress in the implementation of cloud computing services, the Secretaries of Agriculture, Health and Human Services, Homeland Security, State, and the Treasury; and the Administrators of the General Services Administration and Small Business Administration should direct their respective Chief Information Officers to establish evaluation dates for those investments identified in this report that have not been assessed for migration to the cloud. |
In response to our recommendation, GSA established a work plan, and evaluation dates for assessing investments for suitability for migration to a cloud computing service. As a result, GSA has assessed all their fiscal year 2016 IT investments for suitability for migration to a cloud computing service.
|
| Small Business Administration | To help ensure continued progress in the implementation of cloud computing services, the Secretaries of Agriculture, Health and Human Services, Homeland Security, State, and the Treasury; and the Administrators of the General Services Administration and Small Business Administration should direct their respective Chief Information Officers to establish evaluation dates for those investments identified in this report that have not been assessed for migration to the cloud. |
The Small Business Administration (SBA) has taken steps to address our recommendation. In June 2018, SBA reported on the information technology (IT) Dashboard that more than 92 percent of its applicable IT investments had been assessed for cloud migration, consistent with its October 2014 policy, Standard Operating Procedure 90-82 Procedure for Managing SBA IT Investments - IT Investment Review Board, that calls for new and existing IT investments to consider cloud solutions. By finalizing evaluation dates and conducting assessments for the majority of its applicable IT investments for cloud migration, SBA is better positioned to gain operational efficiencies and cost savings from the implementation of cloud services.
|