The Defense Department maintains an ongoing push toward cloud capabilities across the military, but a failure to establish a standard, comprehensive definition of cloud computing means the effectiveness of that push can't be measured, according to DoD's watchdog agency.
The DoD Inspector General last year set out to examine whether DoD components were performing cost-benefit analyses before buying cloud services and whether those services actually were saving the Pentagon money. But the IG could identify only a "limited number if cloud computing services contracts" because of the lack of a definition as well as an integrated repository with detailed cloud contract data.
"DoD cannot determine whether it achieves actual cost savings or benefits from adopting cloud-computing services," a Dec. 28 audit report states. "In addition, without knowing what data DoD components place on the cloud, DoD may not effectively identify and monitor cloud computing security risks."
But officials within the Office of the DoD CIO, the organization at the center of the report, disagreed that cloud definitions are unclear -- noting DoD CIO's security guidance issued earlier this year -- and said there is a central tracking system for cloud contracts and budgeting.
"Earlier this year, the DoD CIO published the DoD Computing Security Requirements Guide. This guidance established a standard definition of cloud computing along with the requirements and processes for assessing cloud computing security risks," Deputy DoD CIO Dave DeVries wrote in response to the IG report. Furthermore, "the DoD CIO implemented enhancements to the department's Select and Native Programming Data Input System for Information Technology (SNaP-IT) to account for the department's cloud budget and to collect information on DoD cloud contracts. These enhancements enable improved cloud budget reporting by capturing additional details on DoD cloud investments and associated cloud contracts."
The IG, however, did not appear to agree that the measures outlined by DeVries suffice. Auditors pointed out areas of the report's recommendations where the Office of the CIO did not respond, requesting that officials from the office respond with additional details by Jan. 27.
Implementing cloud broadly across DoD and, in particular, saving money by executing cost-benefit analyses are specific areas of emphasis DoD CIO Terry Halvorsen has championed in his tenure.
"I'd like us to be further on in the cloud, because I do think it offers us some chances to improve mission, improve capability and in some cases, improve security while reducing the cost," Halvorsen said in a September call with reporters.
According to a DoD CIO spokesperson, DoD spent nearly $800 million on cloud services in 2015, and expects roughly the same figure for 2016, as reported to the Office of Management and Budget.
