Cloud Services Confusion in OMB’s October Guidance
Published: October 28, 2015
Cloud ComputingOMBShared Services
New IT acquisition guidance released by OMB in October 2015 contains confusing provisions concerning cloud services.
The White House and Office of Management and Budget have been active on the technology front with U.S. Chief Information Officer, Tony Scott, out briefing the media on a spate of new guidance, policies, and initiatives. The latest bit of policy news announced on October 21, 2015 is the publication of new draft guidance for the purchase of information technology by federal agencies. This guidance, known as the Circular A-130, proposes 72 single-spaced pages of changes governing many facets of federal information resources management. There is a good bit of proposed language that pertains to cloud computing, but some of it is confusing in that it appears to contradict OMB’s standing “Cloud First” policy.
Is Cloud Second?
Page 14, line 497, notes that priority in the selection of IT technologies and services should be given “first, to the use of available and suitable existing Federal information systems, software, technologies, and shared services and/or information processing facilities [and] second, to the acquisition of commercially available off-the-shelf components and/or software-as-a-service solutions.”
Does the new guidance change “Cloud First” to cloud second? It appears to encourage agencies to utilize existing resources before considering commercial cloud options. The key term here is “suitable,” which is not defined. Surely an argument can be made that legacy systems are “suitable” for some purposes despite the fact that they are unsecure, non-interoperable, and expensive to maintain. It seems unlikely, though, that this is the kind of suitability envisioned by OMB. We’ll see if this language remains in the guidance once the final version is released.
Or is Cloud First … again?
Page 15, line 514, notes that “IT needs are [to be] met through acquiring scalable, provisioned IT services when it is cost-effective to do so rather than the agency developing its own information system or equipment.” What are provisioned services, you ask? The guidance defines them as “subcategories of Development, Modernization and Enhancement (DME) and Operations and Maintenance (O&M). Examples of Provisioned IT Services may include the purchase of E-Gov Line of Business from another Federal Agency, or the purchase of software-as-a-service (SaaS), platform-as-a-service (PaaS), infrastructure-as-a-service (IaaS) from a private service provider, or the purchase of shared services or cloud services. Provisioned IT Service excludes software licenses but includes both Intra- and Inter-agency shared services.”
Clear as mud, right? Here the guidance appears to encourage agencies to use cloud-based solutions, presumably because building on-premise systems and solutions will always cost more than buying those services from commercial cloud providers or agency providers. It sounds good on paper, but many agencies continue to invest heavily in on-premise cloud solutions for reasons other than cost. Then there is the fact that the rates charged by agency providers like the Defense Information Systems Agency (DISA) can be higher than those charged by commercial providers, but because of risk aversion Defense customers will pay the extra cost to have their data hosted in the MilCloud. Agencies will be required to weigh these other considerations via a cost-benefit analysis for each system and/or capability they propose to move to a cloud environment. It remains to be seen if this additional bureaucratic process will slow the adoption of cloud.
Interoperability
Page 15, line 526, of the Circular states that “IT investments must facilitate interoperability, application portability, and scalability across networks of heterogeneous hardware, software, and telecommunications platforms.” While not directed specifically at cloud, concern about interoperability and cloud solutions is growing among agency customers who do not want to be locked in with a single provider for years on end. This language is sure to remain in the final guidance, so commercial providers are encouraged to get to work enabling interoperability in their systems. Doing so could provide a competitive advantage in the near term.
Cloud Storage
Lastly, page 15, line 537, notes “records management functions are [to be] incorporated into the design, development, and implementation of information systems, to include storage solutions and cloud-based services.” OMB wants vendors to offer cloud-based storage when responding to proposals so agencies could respond to this by adding cloud-based storage requirements to statements of work. Vendors ought to be ready for it, just in case.