The secrets of great teams
At USDA, a handful of IT leaders built a FedRAMP-certified cloud service -- ahead of schedule and under budget. Here's how they did it.
The homegrown cloud service offered by the Agriculture Department has deep institutional roots.
In 1962 — in the early days of mainframe computing, punched cards and tape — then-Secretary Orville Lothrop Freeman wrote a memo warning that USDA was headed down a path of duplicative spending on IT programs.
The memo was unearthed earlier this year by someone in USDA’s National IT Center (NITC) around the time the group was pushing for certification for its private cloud under the government’s Federal Risk and Authorization Management Program (FedRAMP). In June, USDA’s cloud offering became just the sixth infrastructure as a service to receive provisional certification under those federal security standards. It joined private-sector giants such as Amazon, Hewlett-Packard, CGI Federal, Autonomic Resources and Lockheed Martin.
Jim Steven, USDA’s acting associate CIO for data center operations and director of NITC, enjoyed the moment. “People were asking themselves, ‘Who are these guys from Podunk, Missouri?’” he said.
Although Kansas City, where NITC is based, isn’t exactly Podunk, it is a long way from the Beltway or other national technology clusters such as Silicon Valley, Boston and Seattle. But FedRAMP certification was not just a way to show that a homegrown project from a government agency could compete with the big boys. It was also a clear example of how effective a small team can be when it has carefully crafted goals.
Ahead of the cloud curve
Steven, who is in his 30th year at NITC, began work back in 2007 on what became USDA’s cloud service. IT leaders wanted to pare back growth and consolidate sprawling data centers, but they didn’t want to simply replace them with a centralized operation, Steven said. Instead, they approached it as a business problem of how to save money on equipment, power and real estate and make those savings last over time.
NITC formed a team to see what could be done internally that would meet all the security requirements and satisfy their customers across the agency. The group that initially worked on the project was small: Steven, his counterpart at USDA’s National Finance Center, a former senior adviser to the agency CIO and the CIO at the time, Charles Christopherson. They put together a business case for developing their own internal infrastructure, estimated the costs involved and presented their plan to the USDA secretary during the final months of the George W. Bush administration.
“A secondary benefit [was] security,” Steven said, “but the key thing is cost. You gain a lot by investing in a couple of different platforms versus doing things 34 different ways.”
In 2008, the team came up with a set of solutions for an internal shared environment that, as Steven said, “morphed into the cloud word.” Team members began production in 2009, with the Foreign Agricultural Service being the first USDA component to adopt the cloud service, and they have enhanced it over time.
The agency was two years into its cloud efforts when the Obama administration’s 25-point plan for reforming IT management was released in 2010, which meant USDA had a significant head start on some of the key goals. And when the FedRAMP requirements were released in 2012, NITC leaders quickly began planning how to make certification a reality.
Almost since the beginning, USDA’s cloud service attracted customers from across government. The ability to help other agencies — rather than the prospect of glory — is what prompted NITC to seek FedRAMP certification in the first place.
“Reading the language [from the Office of Management and Budget], it’s mandatory to get certification,” Steven said. “What drove it is that we have to provide levels of certification to current customers and future customers.”
He made FedRAMP certification the No. 1 priority for fiscal 2013 and set a target date of Sept. 30. His team was able to get the job done by the end of June and returned half of the roughly $300,000 designated for the process.
“While we were able to leverage our [Federal Information Security Management Act] cloud certification in the FedRAMP process, by no means was it easy,” Steven said. “The documentation is totally different — a lot more volume and a lot more detail than traditional FISMA accreditations.”
Steven tries to strike a balance between having team members in carefully defined roles while encouraging input from across the organization. An NITC technical review board evaluates ideas from technical staffers in a peer-based environment. Promising ideas are sent to an executive steering committee led by Steven and his deputy, and they decide whether to authorize expenditures of money or time to pursue the ideas. On-site contractors have also proven to be good resources. That collaborative environment is leading to the next generation of technologies for the USDA cloud.
Steven said agile development methodologies were critical to managing USDA’s FedRAMP certification process. He held daily 20-minute standup meetings to make sure his team was on target throughout the six-month project. About 30 people contributed to the effort, with about six handling the project on a full-time basis. Steven made sure colleagues took care of the key players’ other daily responsibilities.
“That’s just making sure nobody gets headed off in the wrong direction — keeping a laser focus on the goal,” he said. “Pressure is not the right word. It’s not oversight, it’s helping your people understand priorities. I hope people didn’t see it as micromanagement. I think the results speak for themselves.”
A work in progress
Michael Meskill, the lead cloud solutions architect on the project and the winner of an FCW Rising Star award this year, was instrumental in improving the performance of USDA’s cloud service while saving money on physical infrastructure. He rates the team environment at NITC very highly.
“Forming a team of talented people and deploying a solution that will benefit a vast number of people throughout the country is the sort of opportunity that seldom presents itself in most IT jobs,” he said. He added that he expects USDA’s cloud service to be giving Amazon and Rackspace some serious competition in the coming years.
USDA CIO Cheryl Cook said new efficiencies and improvements to the USDA cloud have lowered the costs for customers and resulted in more than $20 million in savings in the past fiscal year. Users outside USDA include the Labor Department’s benefits office, the Department of Homeland Security’s Office of Inspector General and a number of sites hosted by the General Services Administration, including the Federal Acquisition Institute.
The FedRAMP recognition is also serving as a useful publicity tool. Unlike its private-sector competitors, NITC has no budget to market its services. Instead, a new three-person team in USDA’s Washington, D.C., headquarters will handle local business, and Steven talks up the service to other agencies when he’s in town — what he calls “getting up and down Constitution Avenue.”
According to Cook, the agency is taking about a dozen calls a week from prospective clients, including state and local governments. That is a fruitful market for USDA given its work with agricultural communities nationwide.
NITC is under constant pressure from customers to expand its offerings. Next year, officials plan to add software-defined networking and enhanced provisioning so that users can change their capacity on demand rather than wait for requests to be processed. In the event that USDA exceeds its own capacity, officials have a deal with Verizon Terremark to supply additional hosting resources.
The attitude at NITC is that the USDA cloud is a work in progress. Steven keeps in touch with customers via a portfolio services group and taps industry representatives for insight into the next growth areas and to test new equipment to see if it meets the needs of USDA’s users.
“I like to think we want to stay in midstream,” Steven said. “We don’t want to tie up to the dock because everybody else passes you by.”
NEXT STORY: New Year's resolutions for federal CIOs