1. Provide common user services and platform services through consolidation of infrastructure and existing software licenses.
2. Provide two private clouds: an unclassified DoD cloud and a classified DoD cloud.
3. Improve end-user device access by migrating end-user applications to the cloud and migrating end-users to a Virtual Desktop Interface (VDI) environment.

1. Develop methods, when using commercial cloud service providers, which protect data in transit and at rest, authenticate users, and apply appropriate access controls.
2. Provide virtual container technologies supporting secure unclassified operating environments on a wider variety of approved end-user devices.
   

1. Move to a commercial-government hybrid cloud computing environment with DoD retaining the identity provider role.
2. Improve service interoperability across core, intermediate and tactical edge environments.
   

Second, the FAA may choose to compete brand new contracts for NextGen requirements. The $64,000 question at this point is will the FAA leverage cloud computing for its needs? Publicly, the FAA’s progress toward the cloud has been slow. Behind the scenes, however, it is beginning to look like the agency is growing more comfortable with using cloud-based solutions. For example, Noblis has been providing cloud computing support for the FAA’s System-Wide Information Management (SWIM) program since June 2012. That order was awarded via Enterprise Communications Support Services (ECSS) contract # DTFAWA11D00051. More recently the FAA Office of Airports awarded a contract to L-3 Services (a subsidiary of L-3 Communications) for its System of Airports Reporting (SOAR) II requirement. Section 4.2.3 of the Statement of Work called specifically for the awardee to complete an assessment of a potential cloud computing solution for SOAR II. Strictly speaking, SOAR II is not a NextGen system, but because it interfaces with NextGen systems I am wondering how long it will be before a lot more Market Surveys calling for NextGen related cloud solutions start appearing on FedBizOpps.gov.

Agencies across government are struggling these days to leverage rapidly evolving new technologies and approaches like advanced data analytics and cloud computing. Introducing these technologies and approaches into an IT enterprise that is not ready for them can be disruptive. This much is known. Less well understood is the fact that even planning for big data and cloud investments can be disruptive because of the requirements development needed.

Take for example the efforts of the Defense Intelligence Community to bring stand up the Intelligence Community IT Enterprise (ICITE), a platform for sharing information across agency clouds and organizational boundaries. The challenges facing the IC in this area were the subject of a recent panel on Big Data Analytics hosted by the DC chapter of the Armed Forces Communications & Electronics Association (AFCEA). This panel brought together three speakers to offer insight into what is happening at their respective agencies, including Keith Barber, Director of the NSG Expeditionary Architecture Program Office at the National Geospatial-Intelligence Agency (NGA), Agustin “Gus” Taveras, Jr., CTO in the Directorate for IT Management at the Defense Intelligence Agency (DIA), and John Marshall, CTO in the Intelligence Directorate of the Joint Chiefs of Staff.

The panel’s discussion swirled loosely around the challenges that the IC is facing when it comes to sharing data and employing new technologies. It is worth remembering that these agencies are out in front of adoption of big data tools and cloud computing, so their experience can prove valuable for understanding where other federal agencies are likely to encounter roadblocks. Mr. Barber began the discussion by noting that even the IC struggles to keep up with rapid technological evolution. Citing a recent article that appeared in the Harvard Business Review, Barber said that government must get a better handle on where the “big data economy” is headed so that it can leverage private sector developments. Most important in all of this is knowing simply where to start. As Barber sees it, the IC needs to begin asking the right questions to get the right answers; questions like which data sets do we go after, what tools do we need, and how do we best share data? Sharing the data is a key issue that Mr. Barber believes the IC will remain preoccupied with for years to come.

DIA CTO Gus Taveras agreed that data sharing is a critical piece of the evolving IC big data environment and he suggested the ICITE program is the answer. In general, ICITE is the IC’s version of “ruthless standardization” as it forces the Intel agencies to move to a common enterprise framework. Taveras noted ironically that Sequestration has helped accelerate the push toward ICITE. The biggest challenges Taveras sees are in the realms of procurement and requirements development. Here he referred back to the concept of asking the right questions. How do we pay industry for services, Taveras asked? Is a metering model the best or is there some other way to do it? As an aside, it was surreal to hear that even now, well into the adoption of cloud computing by the public sector, there is confusion about the best payment and contracting model.

Then there is the issue of requirements development. Taveras explained that as CTO the hardest thing about big data analytics is understanding what analysts and other customers need. Determining requirements is complicated by the fact that there is no “one tool fits all” solution available. In some cases, analysts may be happy with the capabilities the currently have, but they would like enhancements. This would be less expensive than buying an entirely new solution, but understanding how enhancements are acquired is a challenge. Underlying Mr. Taveras’ comments was a sense that analytics tools are evolving so rapidly that his personnel do not know what they can use.

Then there is the question of contracting. How does one contract for new capabilities when the requirements development process does not function effectively? How, indeed? This admission by Mr. Taveras raised the twin red flags of scope creep and shifting requirements that have plagued government contracts for decades. And if previous generations of contracted efforts faced these challenges imagine how much more daunting they could become as big data and cloud computing solutions grow in complexity and variety. Caveat venditor!

Originally published for Federal Industry Analysis: Analysts Perspectives Blog. Stay ahead of the competition by discovering more about GovWin IQ. Follow on twitter @FIAGovWin.

Following on the heels of updates to federal information security guidance, the General Services Administration (GSA) recently released a Request for Information (RFI) on incorporating updates into its Federal Risk and Authorization Management Program (FedRAMP).

The Third Party Assessment Organizations (3PAOs) undergo an accreditation process to verify their ability to provide independent reviews of cloud service provider (CSP) system security controls. According to the RFI published mid -February 2013, “the purpose of this notice is to allow the vendor community the opportunity to provide feedback, input, and changes to FedRAMP’s 3PAO Program Requirements.” At the time the RFI was issued, 16 organizations have received 3PAO accreditation.

On February 5, 2013, the National Institute of Standards and Technology released a final draft update on information security (Special Publications 800-53). The changes included in the latest version include additional security controls related to cloud computing. Those familiar with the FedRAMP program will recall that the program’s security baseline draws on the controls from the previous version of this document. The release of this latest draft raises questions about whether (or rather, how soon) FedRAMP security controls will be updated.

In the early phases of establishing the program, FedRAMP officials suggested that the program’s security controls would evolve along with guidance and technology. Ultimately, this adaptability becomes the burden of 3PAOs and authorized CSPs, both of whom are responsible for ensuring systems continue to comply with FedRAMP requirements, even as they change. Communication with federal customers regarding any change to service or risk management will also be a factor.