What GAO Found
In 2019, the Office of Management and Budget (OMB) updated its Federal Cloud Computing Strategy and established 14 key requirements for agencies to implement within three areas—security, procurement, and workforce. Cloud computing enables on-demand access to shared computing resources . The Department of Defense (DOD) has addressed 11 of the 14 OMB requirements, but gaps exist in its workforce planning (see table). These gaps include identifying the future skills needed for cloud-based services and conducting regular evaluations of customer experiences and user needs. In addition, DOD has not yet developed and executed communication plans to inform employees of changes related to using these services. Addressing these workforce areas is essential to realizing the benefits of cloud computing.
Extent to Which DOD Guidance Has Addressed 14 OMB Key IT Cloud Requirements as of April 2022
|
Requirement area |
Fully addressed |
Partially addressed |
Not addressed |
|
Security |
Four |
— |
— |
|
Procurement |
Five |
— |
— |
|
Workforce |
Two |
Two |
One |
Legend: — = not applicable.
Source: GAO analysis of Department of Defense (DOD) documentation. | GAO-22-104070
In order to meet OMB’s application rationalization requirement, DOD has partially implemented the first step noted in leading implementation practices. The department has established a scope for its rationalization efforts and is working to formalize a governance group with the authority to set requirements and issue guidance. However, DOD’s lack of established timeframes for completing the remaining activities has impacted its efforts to make progress on subsequent leading practice steps. In addition, DOD has not developed a long-term plan for rationalization implementation with measurable objectives, milestones, and timelines. This is due to significant changes to its approach over the past 2 years; long time frames for implementing enterprise-wide initiatives; and a lack of definition by DOD regarding who is responsible for ensuring rationalization activities are successful. Without measureable objectives, milestones, and time frames for rationalization efforts—and holding department components accountable for these efforts—DOD will be less likely to make consistent measurable progress on rationalization or effectively reduce IT duplication.
In its fiscal year 2019 guidance, OMB began requiring agencies to use Technology Business Management (TBM)—a framework for increasing the granularity in agency-reported IT spending data by grouping related costs together—as part of the annual budget submission. DOD has reported its budget data using TBM cost categories. However, GAO identified weaknesses in the completeness of DOD components’ cloud spending data. As a result, DOD’s cloud spending is likely underreported. This was due in part to nonspecific department guidance on reporting these data and the control processes needed to ensure reliable data. In addition, the Army and Air Force did not follow leading TBM implementation practices. Until the Army and Air Force address TBM practices, and the DOD Chief Information Officer updates the department’s guidance on reporting TBM data and ensuring its reliability, DOD will lack complete information needed to make decisions on its IT investments.
Why GAO Did This Study
In fiscal year 2022, DOD plans to spend approximately $38.6 billion on unclassified IT investments. To help drive cloud adoption, OMB requires agencies to modernize, retire, or consolidate their portfolios of software applications—a process known as application rationalization. OMB also requires agencies to use TBM to categorize IT and cloud-related spending.
GAO was asked to assess DOD’s reported use of cloud services. This report examines the extent to which (1) DOD’s planned cloud strategy addresses key requirements in OMB’s federal cloud strategy, (2) the department has plans for developing and implementing an enterprise-wide application rationalization process, and (3) DOD is using TBM to track and report spending data for cloud services. To do so, GAO analyzed relevant DOD policies, guidance, and other documentation on cloud services and application rationalization. It also assessed the department’s cloud investment data for fiscal years 2021 and 2022 and department-wide guidance and training on implementing TBM. GAO also interviewed DOD officials.
