In an Aug. 16 post on the FEDRamp site, Director Matt Goodrich said the new blog would provide stakeholders with a better sense of what new projects were in the works and how they can ease cloud acquisition.

“At FedRAMP we’re constantly engaging with those around us to hear what’s going on and what’s on people’s minds,” he said in the post. “However, we haven’t always been the best at sharing what’s going on in the FedRAMP world or what’s on our mind outside of our individual conversations with stakeholders.”

Goodrich said the new blog would be posting two articles a week with updates highlighting features like explanatory features on how agencies are using FEDRamp, updated templates and news, how-to posts and feedback channels for how to improve the program.

“This blog will give us a space to share the latest and greatest information as it happens. We know that transparency and collaboration is the only way to truly meet all of your needs, and Focus on FedRAMP is designed with that in mind.”

Much of DoD’s new cloud policy centers on giving more power to the military services to buy their own commercial cloud services. The policy also speeds acquisition by federating the process and, officials hope, lowers the cost by ramping up competition.

The developments in cloud policy of late have been spearheaded by DoD CIO Terry Halvorsen, who is looking beyond just the military when it comes to commercial cloud. He’s eyeing broader government cloud policy – and the effects his efforts may have in the wider context – but Halvorsen also is looking outside traditional military and government boundaries.

See More: Federal approaches to public cloud services

To that end, Halvorsen is evaluating the concept of commercial cloud providers operating within DoD facilities. For example, a so-called “commercial data distribution center” located on a military base could serving both DoD and non-DoD customers. Doing so would provide military-grade security for data and applications belonging to DoD, as well as those of non-government entities – say, financial institutions.

Currently, at least one cloud vendor operates in federal space – Hewlett Packard for the Navy – but that scenario involves only DoD data.

The on-base commercial cloud center could expand revenue options for commercial cloud providers, driving competition for such contracts and, in turn, better prices for DoD. Halvorsen said there’s already demonstrated interest in the community.

“I have received some proposals. I will tell you that, on the proposal basis, they look very attractive…we’re going to walk through those, almost like a war game of those proposals, to see how would we accomplish them,” Halvorsen said in a March 18 press conference. “Part of that war game would include some of the lawyers saying okay, if I wanted to do this and this is the way I operated, would that cause me any issues with legislation or law? So really, it is now taking some of those proposals, doing a war game through that to walk through what’s doable today – do the assumptions about cost hold? Do the assumptions about timelines hold? At the end of that war game, we’ll figure out how we go to a pilot type activity.”

The “war game” could help flag potential issues, such as regulatory snags. For example, currently there are legal limits on what goods and services can be sold from government installations. Also, the physical security that would be afforded to a commercial provider operating on a military base could give that vendor an unfair advantage in future contract competition – an issue that could require new legislation in the future, Halvorsen noted.

A law enforcement agency within the Department of Justice, ATF moved atf.gov to a Drupal platform operated by Acquia and hosted on the Amazon Web Services cloud infrastructure. In the same year, the bureau also moved 7,500 email users to the Microsoft Office 365 cloud-based messaging and collaboration platform, said Rick Holgate, ATF’s assistant director for science and technology and CIO.

Many agencies seeking to modernize and deliver a digital experience to citizens are using Drupal, an open source web content management system, which lets organizations launch new websites quickly and customize functionality based on mission and audience. The White House and the DOJ websites are powered by Drupal.

Meanwhile, agencies have turned to Google Apps for Government or Microsoft Office 365, the two primary cloud-based messaging and office productivity platforms, to bring down the costs for maintaining and administrating email and office applications. Both products offer agencies more robust tools for helping staff more easily share documents, participate in workgroups, and access email and information from mobile devices.

Email is typically the first application that agencies move to the cloud, according to a survey of 150 federal IT leaders conducted by MeriTalk, a public-private partnership focused on improving the outcomes of government IT. Fifty percent of those who have implemented cloud say they have moved email. Additionally, 45 percent report they have moved Web hosting, and 43 percent have migrated servers/storage, according to the report, Cloud Without The Commitment.

ATF’s move to Microsoft Office 365 “insulated us from obsolescence,” a benefit that is hard to measure in dollars, Holgate said recently at the Microsoft Federal Executive Forum 2015, in Washington, D.C. The agency moved 7,500 email users from Microsoft Outlook, giving the ATF workforce larger mailboxes along with robust collaborations tools.

The Outlook mailboxes maxed out at 250 megabytes, but with the switch to Office 365 users immediately got 5 gigabytes of storage capacity as well as SharePoint collaboration software, which they did not have prior to the move to the cloud, Holgate told Federal Times in an interview. Other improvements included archiving and discovery capabilities as well improved availability.

One of the main challenges was achieving the level of security that would meet the requirements of a law enforcement agency such as the ATF. After reviewing audit logs, agency officials determined that Microsoft Office 365 adhered to the security controls detailed in the National Institute of Standards and Technology’s Special Publication 800-53. However, the real concerns involved the background checks and security clearances of Microsoft’s operational team who would have access to ATF data.

ATF needed to understand “who had access to our data and if we could trust people who had access to our data with that level of access,” Holgate said. It took ATF “the course of a year” to solve personnel security issues before the agency moved to Office 365 in a dedicated environment that supports International Traffic in Arms Regulations. ATF is looking to evolve into the next version of Microsoft Office 365 for ITAR, which will offer more agility and scalability, Holgate noted. The agency will also explore the possibility of putting more E-forms into the cloud, he said.

The ATF issued a task order for Microsoft Office 365 in June 2012 as part of a DOJ enterprise agreement contract. By January 2013, the agency had defined its requirements and initiated user awareness and adoption plans. The agency’s IT team had also “cleaned” on premise Microsoft Active Directory and public folders in preparation for the move to the cloud. They also ordered, tested and activated network circuits through the DOJ’s wide-area network, the Justice Unified Telecommunications Network or JUTNet. Other transition work included the validation of network ports and firewall rules, upgrading mobility device management tools for Office 365 compatibility, synchronization of the ATF Active Directory, and pilot testing, according to a presentation Holgate has given on the migration effort. Actually migration of the workforce to Office 365 took about a week, he said. ATF eventually deployed Office 365 Dedicated for ITAR in mid-2013.

Enterprise identity management is a key prerequisite and information and content governance must be defined prior to deployment, according to Holgate.

DOL found email business case easy to make

Selling the idea of deploying a cloud-based email solution wasn’t a difficult sale at the Department of Labor, said CIO Dawn Leaf, who also spoke at the Microsoft Federal Executive Forum. There was a business case for it because the workforce wanted large mailboxes and more storage space.

Last year, DOL completed migration of nine different legacy email systems to a single federal community cloud service, Microsoft Office 365. That move gave DOL’s 17,000-employee workforce 400 times as much storage as they had before.

The challenge was standardizing across a federated organization. The IT staff had to modify the firewalls, and move a more consolidated infrastructure just to get to the new service. “There is a fair amount you have do to your infrastructure to be able to access the final services. We found 150 inconsistencies across our agencies – per agency – in our network and access infrastructure to get to the cloud,” Leaf said.

In making its transition to Office 365 for Government, the Environmental Protection Agency moved more than 25,000 employee mailboxes, some of which it discovered held more than a million e-mails. The transition, completed in 2013 is expected to save the EPA approximately $12 million over the four-year contract period.

“The move to Office 365 grew from a pilot of advanced collaboration tools that would help the agency conduct our operations more efficiently and support our work with multiple stakeholders,” said Harrell Watkins, acting chief technology officer and acting director of EPA’s Office of Technology Operations and Planning.

Going forward, any existing production applications slated to move to the public cloud will most certainly require re-engineering and customization. “As such, consideration for moving systems and applications to the public cloud will coincide with the [IT] refresh cycle. This ensures we minimize any stranded depreciation or sunk costs,” Watkins said.

DoD’s cloud strategy has evolved significantly in recent months, including by declaring the Defense Information Systems Agency would no longer be the Pentagon’s cloud broker, empowering defense components to do their own cloud-service buying. A new security requirements guide released in January streamlined the security classifications for data and vendor requirements. With the promise of savings and improved mission effectiveness, DoD leaders are now accelerating their adoption of commercial cloud services, starting with public-facing data.

The department also has five pilot programs under way, including one testing out higher-security level 4 data with Amazon Web Services dealing with sensitive data. So far, AWS is the only provider to meet the requirements to do so, but officials hope that the pilots will help to better define how DoD does cloud.

One of the biggest emerging issues in DoD’s cloud strategy is the use of cloud access points, where commercial providers will connect to the secure DoD network. Outside of a couple small pilot programs being run by DISA and the Navy, the access points still are in development, but they will be a requirement for commercial providers doing high-security cloud business with the Pentagon as officials look to reduce the attack surface for potential breaches.

“The cloud access point currently is the leveraging point of our information assurance defense [for] applications that run in the cloud,” said Pete Dinsmore, deputy CTO for mission assurance at DISA. All traffic, either from Internet-facing users or DoD users using virtual private networks to access DoD networks, “comes through the cloud access point to protect users from malicious software.”

According to DoD CIO Terry Halvorsen, the cloud access points remain under construction as officials use the pilots to figure out the best way forward. But they’re looking to move fast, Halvorsen indicated.

“When I get that right, I actually further reduce my security problem,” he said. “Some of it is just about physical footprint. If I have fewer points where I connect to the broad commercial network, it’s easier to secure. DISA is moving very quickly; this is actually one place where I’m happy with the movement. We can’t tell industry the exact solution yet – we really have to make sure we’ve done the right threat analysis. But I suspect that within the next 90 days we’ll be able to start standing up the cloud access points.”

Approximately 15 percent of NASA’s applications and websites are hosted in private clouds, with the rest in public or hybrid environments, according to Roopangi Kadakia, web services executive in NASA’s CIO Office.

See More: Federal approaches to public cloud services

“The entire NASA engineering network was moved over, which was a pretty big infrastructure, as well as tiny little applications,” she said.

Since getting started in spring 2013, NASA has migrated almost 160 applications to the cloud — most of which are in a public or hybrid environment. Another 40 apps were consolidated, archived or decommissioned in the process.

NASA also maintains a huge web presence, with more than 250,000 pages, 1.4 million assets in its content management system and more than 3 terabytes of information under the NASA.gov domain alone. During streaming events, the site can get upwards of 150,000 simultaneous users at a time.

“If it wasn’t in the cloud — if we were moving into a data center — there’s no way we would have been able to do that,” Kadakia said. “If you had to build that with actual hardware, the cost would have been crazy and it wouldn’t have met the timeline.”

Kadakia said she expected the migration of the .gov domain to take as long as 10 months. NASA and integrators at InfoZen were able to do it in 13 weeks.

“This is a flagship for the entire government,” said Raj Ananthanpillai, InfoZen chairman, president and CEO. “Every agency is calling them and then calling us, as well, saying, ‘Hey, how did you guys do these things.'”

Getting started

During the initial planning, NASA’s strategy was reminiscent of an adage made popular by Mahatma Gandhi: Live as if you were to die tomorrow; learn as if you were to live forever.

“In the cloud, you really have to strategically think about what your future needs are but you build for what you need right now,” Kadakia said, noting a primary benefit of cloud is the ability to adapt quickly to future needs.

She suggested agencies start by outlining their strategic goals.

“What are the outcomes you’re really looking for? Is it just cost savings?” she said, pointing out that initial migrations costs are often high, particularly for legacy systems.

Savings should be one of the goals (see below) but not the primary impetus. Other factors like consolidating data centers, providing a place for infrastructure- and device-agnostic development and creating an agile environment can be more concrete starting places.

“Start with what you’re most comfortable with,” Kadakia advised. “If your risk threshold isn’t very high, I wouldn’t start with financial services, for instance.”

She also stressed the importance of knowing your requirements before getting started – whether you need public, private or hybrid cloud; what kind of security is needed; what level of resources are needed.

“But don’t try to know everything,” she warned. “Perfection will lead you nowhere.”

A big part of that is finding an industry partner.

Ananthanpillai warned against going straight to a cloud service provider and suggested instead starting with a broker who can help review all the options.

“They want to sell you whatever they have,” he said. “You want to go to an integrator like us that can scout the market, scout the requirements that they’re looking for and say, these are the pieces that can go in a public cloud without any issue and these are the pieces … that should go in a private cloud.”

Working with an independent broker can ensure an agency gets exactly what it needs while also keeping costs down.

Cost savings

Once the migration was complete, NASA saw an immediate 40 percent drop in operations and maintenance costs, according to Kadakia. By 2014, Web Services was able to cut OCIO O&M costs by an additional 25 percent, mostly through savings on IT labor.

“We do a lot more automated patch management, alerting, monitoring and spinning up and spinning down of instances, which were very difficult to do” in the past, Kadakia said. “A lot of our new O&M savings are really about labor cost savings, which is exactly what I wanted to see. One of the best reasons to move to the cloud is to do more with less.”

The migration itself was costly, Kadakia said, though the initial O&M savings more than covered the expense, providing an immediate return on investment.

The ability to use only as much infrastructure as needed at any given time has also made the agency more cost-conscious in general, she said, providing a much needed cultural shift at a time when budgets are going downward.

Security in public cloud

Cost reduction helped with the cultural issues around cloud migration, however security was still a major roadblock to getting agency buy-in. The idea of using non-dedicated infrastructure to host federal data was unsettling for some.

“Other than the NASA Engineering Network that could potentially hold ITAR data, we felt very comfortable with our entire plan for protecting that data because of the way they had architected their system from the very beginning,” Kadakia said. “Others weren’t as confident.”

InfoZen was able to assuage some of those doubts by providing an added layer of monitoring.

Security “really has not been an issue for us other than getting past people’s own perception of how secure these infrastructures really are,” said Chet Hayes, InfoZen CTO. “In conjunction with the security Amazon provides, we actually provide continuous monitoring security-as-a-service as part of our offering for NASA.”

This provides a “much more robust” security posture than NASA had previously, Hayes pointed out, as it layers InfoZen, Amazon and NASA’s internal security services.

More to be done

The next step for NASA is figuring out how to securely share appropriate (and only appropriate) information with non-credentialed contractors.

“If I’m working with the University of Colorado building a portion of some system, how do I share that?” Kadakia said. Once some technical kinks are worked out, “That will be a big value-add that we could provide. And we’re providing that at a cost that is very competitive with commercial entities.”