Implementing the cloud-first policy? Start with e-mail.

Agency managers charged with moving applications to a cloud platform over the next 18 months should start with Web-enabled applications such as e-mail to meet the Obama Administration’s “cloud-first” mandates, government and industry observers say.

As part of the Office of Management and Budget’s 25-point plan to reform federal information technology management announced recently by federal CIO Vivek Kundra, agencies must adopt a cloud-first policy that requires them to move three applications to the cloud over the next 12 to 18 months. Agencies have to identify the three “must move” services within three months, and move one of those services to the cloud within 12 months and the remaining two within 18 month.

The 25-point plan includes several steps required to put in place the infrastructure, vehicles and policies needed to support cloud computing – that’s positive, said Bob Otto, executive vice president of advisory services with Agilex, an IT consulting firm.

However, “when you factor in planning requirements, you’re asking agencies to make a leap into the unknown at this point as many of these [cloud] standards are not fully defined,” said Otto, a former chief technology officer and CIO with the U.S. Postal Service.

Otto thinks many agencies can achieve the migration to the cloud – a computing model where shared resources, software and information are provided to users on demand – within OMB’s timeframe. In many situations, though, they will do so by leveraging existing software-as-a-service options and outsourcing smaller point solutions. “This is great, but it also means that we probably won’t see a broader shift to cloud infrastructure initially,” he said.

Related Coverage:

The trick is to identify programs that are already Web-enabled or Internet-ready, said Bruce Hart, chief operating officer for cloud service provider Terremark, and a former IT director of the CIA.

Another example would be any type of shared Web delivery or Web-delivered application that agencies provide for their own employees, such as e-mail or Microsoft’s SharePoint collaboration software, Hart said. Other specialty applications would be good candidates for the cloud, including administrative services, human resource forms, logistics and travel applications.

In fact, this process has been going on for the past two years with Terremark’s federal clients, he said. Terremark works with several government agencies – Data.gov, Federal Communications Commission, General Services Administration, Library of Congress, and USA.gov – to redesign their websites and help them move from in-house servers to infrastructure-as-a-service platforms.

Earlier this month, the GSA and USDA announced plans to move agency e-mail systems to cloud providers.

The cloud-first policy will help make IT reform real, said Sanjeev “Sonny” Bhagowalia, deputy associate administrator with GSA’s Office Of Citizen Services and Innovative Technologies,

“We’re going to make this happen. We’re going to make this real,” Bhagowalia, said to a group of agency and industry executives attending FedScoop’s Cloud Shoot Out Dec. 9 in Washington, D.C.

There are still a lot of challenges that need to be worked out with the cloud, such as data sovereignty, privacy and security; but the reality is that cloud computing allows the government to operate more efficiently and effectively, Bhagowalia said.

Cloud computing will propel innovation, he said, making government/industry collaboration easier. The pay-as-you-go and use-what-you-need model “puts power in the hands of the end users,” he said, adding that is why the General Services Administration and agencies such as NASA are involved.

GSA will soon release details about how government agencies can order cloud storage, virtual machines and Web hosting services via the Apps.gov storefront, Bhagowalia said. In October, GSA awarded 12 vendors an infrastructure-as-a-service contract to provide federal, state, local and tribal agencies with cloud services.

GSA also extended to Jan. 17, 2011 the period in which agencies, industry and other stakeholders can comment on the Federal Risk and Authorization Management Program to allow everyone more time to respond. Public comment on FedRAMP --a governmentwide security accreditation program for cloud services and products -- was originally scheduled to close Dec. 11.

Challenges and pitfalls

As agencies take steps to move applications to public cloud providers, they should make sure funding for the migration is in order and that their cloud initiatives are set up in a way to ensure success, Terremark’s Hart said.

Agency managers need to be clever about picking things where there is a bias toward success, he said. They also need to fund cloud migration out of operating funds rather than having to create initiatives that go through OMB or Congressional committees.

“To the extent that we politicize this as a government, the more difficult it is going to become,” Hart said.

From a technology perspective, cloud is becoming fairly mature, Agilex’s Otto said. What’s immature are some of the policies and standards surrounding government adoption.

For example, what type of security certifications do I need? Otto asked. The potential challenges arise from the fact that these specifications haven’t been fully tested in the real world. “As a government CIO, I want to pilot some of these approaches first before fully committing.” This experimentation is going to create some initial delays in adoption but over the long-term will pave the way for more successful adoption, he said.

Having a clear path forward to determine the security requirements they must use to evaluate cloud service vendors offerings is a challenge for agencies, said Gigi Schumm, vice president and general manager of Symantec Public Sector.

“FedRAMP when finalized over the next six months will help eliminate the ambiguity,” Schumm said.

Additionally, determining the scope of the existing computing environment in order to determine what to actually move to a cloud environment will require extensive research and planning, Schumm said.

“At the end of the day, agency managers have to create the will to move to the cloud, Hart said. “Culturally it is difficult for them.” They are used to seeing their servers in their basement where they feel they have control. There is a sense of risk and aversion to giving up physical control, he said.

Ultimately, there has to be a commitment among agency leaders that works its way down into the actual execution layers of the government “that says we are going to do this because we have been directed to,” Hart said.

Cloud providers that work with the government are wrapping themselves in security such as Federal Information Security Management Act specifications and National Institute of Standards and Technology security standards. Agencies might find that not only are they becoming more agile and achieving economies of scale, but can become more secure than they were in their physical computing environments, Hart said.