FROM PROMISE TO REALITY - Forbesimages.forbes.com/forbesinsights/StudyPDFs/Microsoft_Govt_Cloud-REPORT.pdf · things like web-hosting and email. And if you think about it, we actually

FROM PROMISE TO REALITYHOW LOCAL, STATE AND FEDERAL GOVERNMENT AGENCIES ACHIEVE RESULTS IN THE CLOUD

IN ASSOCIATION WITH:

CONTENTS

Foreword ........................................................................................................................................2

The state of the cloud ...............................................................................................................3

Profiles in progress .....................................................................................................................8

One deputy chief’s video experience...............................................................................10

Certifications: Know your acronyms ................................................................................ 14

In times of crisis—the cloud is ready ................................................................................. 19

Federal cloud deployment ...................................................................................................20

Additional considerations ..................................................................................................... 23

Conclusion: Building on successes ................................................................................... 24

About this report ..................................................................................................................... 24

2 | FROM PROMISE TO REALITY

FOREWORD • Gain deep insights.• Better serve your constituents.• Accomplish your primary objectives. • Optimize and do more with less.

hink about any government agency, whether federal, state or local, and the whole of its mission can be defined within the above terms.

Now think about these organi-zations’ IT departments and the technology they are or could be using to help them achieve these goals. In nearly any instance, the achieve-ment of any government agency’s complex mission objectives—the above objectives—could and would be substantially enabled by the adoption of cloud services.

Stated reasons for caution surrounding cloud adoption are well known. Initial concerns include perceptions of complex migration chal-lenges, uncertain costs and loss of control. Add challenges such as determining which appli-cations should move to the cloud and which should stay put. Finally, many believed data security, often at the core of resistance, could not be achieved in the cloud.

The above concerns remain legitimate. But today each can be countered by real-world cloud-adoption-by-government-agency success stories. Today the costs are well understood, and those with up-and-running cloud environments know the savings are real. As for applications, cloud-borne Software as a Service (SaaS) and Platform as a Service (PaaS) models make the development, maintenance and continuous upgrade of desktop and mobile tools easier than ever before. Countless agencies now remark that they never imagined having access to such deep insights that allow them to take action, as well as such a dynamic, innovative, feature-rich and scalable toolset at their fingertips.

As for data security, government agencies are learning that the cloud can address their deepest concerns. At Microsoft, transparency, security, privacy and trust are the core tenets of

our business. We devote dedicated world-class security-focused resources across our data cen-ters, networks and applications to ensure the security and privacy of our customers’ data.

Certainly there may be applications that manage data that must be kept behind agency firewalls and in private cloud environments. In these instances we are committed to ensuring that a hybrid cloud solution can be configured in a way that can be both cost effective and secure. Many clients remark that our processes and technologies often address risks that previously had not even been identified by their agencies.

In testament to our commitment and capa-bilities in data security, accreditations thus far achieved by Microsoft include some of the most demanding in government today. Start with our acceptance within the Federal Risk and Authorization Management Program (FedRAMP)—the backbone of government IT procurement. Next add accreditations such as Criminal Justice Information Services (CJIS), Internal Revenue Services (IRS) 1075 as well as the Health Insurance Portability and Accountability Act (HIPAA). The point is: Microsoft is also committed to achieving the certifications that are important to our govern-ment customers.

So what is the state of cloud adoption by government today? What are the success sto-ries? As this report illustrates, there have been tremendous strides in the provision of cloud-based services for government. The question becomes, what can the cloud do for your agency and its mission?

CURT KOLCUNVice President,U.S. Public Sector,Microsoft Corp.

At Microsoft,

transparency,

security, privacy

and trust are

the core tenets

of our business.

COPYRIGHT © 2015 FORBES INSIGHTS | 3

In other words, at the highest levels of government, cloud is deemed to be so mission-effective, it is to be the default choice in any IT acquisition, upgrade or migration.

or years, many agencies resisted, citing concerns such as cost of migration or, even more vocally, data security needs. However, resistance based on such concerns is fading, as more and more government agencies gain experience, familiar-

ity and success with cloud environments. What began as a national policy initiative is now

cascading, not merely at the federal level but also into the practices of numerous state and local jurisdictions. Indeed, a growing number of state CIOs have imple-mented cloud-first policies of their own. Certainly, such pronouncements provide a measure of inducement for government agencies to explore these technolo-gies. However, there is nothing more compelling than actual success stories. In that vein, consider:

• The City of Miami The U.S. economy’s lingering downturn “has been tough on budgets,” says Kevin Burns, CIO for the City of Miami. Cutbacks have been significant, “so we’re trying to save money wherever we can with-out shortchanging the mission.” And “one of the most effective ways I’ve seen of getting more done with less is to embrace the cloud,” says Burns. Doing so “frees up our resources, monetarily and personnel-wise, to a remarkable, very significant degree.” So instead of “spending time on tasks that don’t create much value,

like managing server stacks or upgrading to new oper-ating systems,” explains Burns, “we can instead focus on the true needs of our citizens and partners.”

Currently, the city is migrating much of its formerly desktop-based or otherwise locally based software plat-form to a cloud environment, says Burns. That means word processing, spreadsheets, email and other basic business tools “will be cloud-based and, as a result, much more efficient.”

So far, says Burns, “the migration is going extremely well.” Where this leads, however, is to a state where routine, time-consuming tasks like software provi-sioning, updating and upgrading become automatic, performed by the cloud provider. By corollary, the city’s IT personnel now have more time to concentrate on the needs of city business units—and citizens. A good example is the city’s new application scheduling building inspections, “not only making the department more efficient, but also improving the experience for citizens,” says Burns (see below).

What began as a national policy initiative is now cascading, not merely at the federal

level but also into the practices of numerous state and local jurisdictions.

Famously, in December 2010, Vivek Kundra,

then CIO for the whole of the U.S. federal

government, announced the nation’s “cloud

first” policy. That is, no new federal IT proj-

ect of any significance was to move forward

without first evaluating a cloud approach.

THE STATE OF THE CLOUD


• The Illinois Department of Healthcare and Family Services

When he was appointed in September 2011, one of the first actions taken by incoming departmental CIO Stephen DePooter was “an assessment of the various IT applications in use.” One of those applications, essen-tially a case management tool, “turned out to be in dire need of replacement.” In fact, the data security risks were so great “we had to turn it off—immediately.” So while field workers renewed their familiarity with pen- and paper-based processes, DePooter and his team got busy on identifying a suitable alternative. After a rigor-ous review of the options, what they learned was that “with no question, the best way forward was a cloud solution.” Within just 16 weeks, the group fielded a fully functional application “that exceeded my—and our users’—expectations.” From here, DePooter believes the agency “will be going to the cloud whenever it can.”

• The State of Alabama Brunson White, the state’s secretary of information technology, says his mission is “to work with various agencies across the state to develop policies that can fix government.” Technology, says White, “is the best way I know of to improve efficiency and effectiveness.” And when it comes to technology, “the cloud is transforma-tive.” So far, the state has seen numerous successful cloud migrations of basic functionality at a number of its key agencies. Based on these initial successes, says White, “it is our ambition to do more—a lot more. We’re excited to show that Alabama is a leader in cloud adoption.”

THE U.S. DEPARTMENT OF DEFENSE HEADS TO THE CLOUD

Speaking at a CCCAG event on February 12, 2015, Terry Halvorsen, CIO at the DoD, said

that while he agrees the agency may be somewhat “behind in going to the cloud,” this is

merely “a self-measure.” Go to any of the Fortune 50, says Halvorsen, “and ask them

where they are with their cloud and how much of their own products they have put in the

cloud—you’ll get some surprising answers.” Overall, says the CIO, “we are behind some,

and I want to go faster. But it’s worthy to note that I don’t think we are that far behind the

commercial sector.”


The calm before the storm? The above vignettes are only a tiny sampling of today’s success stories. Nonetheless, widespread adoption of cloud technologies by the public sector overall remains relatively slow to materialize.

In evidence, a September 2014 GAO report (“Additional Opportunities and Savings Need to Be Pursued”) on the progress of seven key federal agencies shows total spending on cloud-based services as a per-centage of total IT spending is a mere 2%. Meanwhile, looking at the whole of public-sector IT spend-ing, Shawn P. McCarthy, research director for IDC Government Insights, pegs this figure at “around 4%.”

McCarthy admits disappointment in the overall pace of growth, saying, “I would have expected this to weigh in around 5% or 5.5% by now.” But at the same time, he adds a sense of optimism. “I think what we’re seeing in this 4%,” says McCarthy, “is this initial thrust of activity where agencies were moving on the simple things like web-hosting and email. And if you think about it, we actually moved pretty far pretty fast.”

Any current sign of slow or slowing adoption, says McCarthy, is likely due to the fact “that we’re moving past the low-hanging fruit toward more of the mis-sion-critical [stuff ].” What may be happening now is therefore a brief lull, a slowdown in the rate of growth, but not in growth itself. And this, says McCarthy, is “because from here, the next cloud installations, they’re becoming more challenging, with more-sensitive data and systems, and that takes longer to implement.” Overall, says McCarthy, “I would not be surprised if in the coming months and year, we don’t see some really large initiatives” at a number of major government entities, which could “really move the needle.”

In fact, enterprise software firm Deltek’s Federal Industry Analysis predicts a 21% compound annual growth rate in federal spending on cloud, reaching $6.5 billion by 2019. Others present similar figures in terms of overall cloud adoption by government. David Hantman is general manager of the Cloud Computing Caucus Advisory Group (CCCAG), a non-profit advisory group supporting the goals of the Cloud Computing Caucus, launched jointly by California Republican Congressman Darrell Issa and Virginia Democrat Gerry Connolly.

The CCCAG focuses on building awareness and understanding of the role of cloud computing in soci-ety, industry and government. Accordingly, Hantman and his colleagues interact regularly with government officials to discuss issues relating to the cloud and, as a

result, hear firsthand concerns such as “the costs sav-ings aren’t real, the technologies aren’t proven” or “there’s not enough data security.” But in reality, “the cost savings are real—they just don’t always translate to direct dollar savings right away. Sometimes they come in the form of increased capabilities and efficiencies,” says Hantman. “We are also seeing that the technolo-gies are proven, and if anything, all of the experience shows that data security can actually be significantly enhanced by the cloud.”

In addition, Hantman sees promise in initia-tives such as the Federal Risk and Authorization Management Program (FedRAMP). The role of FedRAMP, says Hantman, “is to review and certify third-party cloud providers for government use.” As more and more IT providers and services are certified, “agencies will have more options, and it will become harder to justify doing things the same old way.”

So while a go-slow approach is still dominant today, Hantman believes this will soon lead “to a surge” in cloud adoption. Think, for example, about the Department of Defense (DoD), an agency whose data is the textbook definition of both sensitive and mis-sion critical. According to Hantman, “Until recently, they’ve been very hesitant to move to the cloud.”

But “the DoD right now is running a number of pilot programs and engaging in an active dialogue with technology providers,” says Hantman, “sharing more information about the sorts of applications needed and the associated essential levels of data security.” DoD is signaling “its willingness and interest,” he said, and “they have a budget” worthy of the private sector’s focus.

Overall, says Hantman, it’s hard to argue with suc-cess. So “as more and more government agencies find success—as success and familiarity grows—the pace of adoption will accelerate.”

Deltek’s Federal Industry Analysis predicts a 21% compound annual growth rate in

federal spending on cloud, reaching $6.5 billion by 2019.

“We are on the brink of a surge in cloud. As more and more

government agencies find success—as success and

familiarity grows—the pace of adoption will accelerate.”

— David Hantman General Manager,

the Cloud Computing Caucus Advisory Group (CCCAG)

HOW LOCAL, STATE AND FEDERAL GOVERNMENT AGENCIES ACHIEVE RESULTS IN THE CLOUD

THE CLOUD:

• “Makes [us] more efficient so we can focus on the true needs of our citizens.”

• “Is easier, faster and better: so much more flexible, so much easier to maintain, so much more cost-effective and so much more secure— it doesn’t make any sense to do it any other way.”

— Kevin Burns CIO, the City of Miami

5,000 • Reduction in the number of calls

per month since launching a new cloud-based building department application

1,000 today / 1,700 by midyear 2015

• Number of city workers using a cloud-based environment for their basic IT needs• The increase (still growing) in the number of

building/worksite inspections being scheduled in an efficient online manner versus the prior, “call and wait all day” model

200%

• Annual average growth rate in federal spending on cloud, reaching $6.5 billion by 2019

(Source: Deltek’s Federal Industry Analysis)

21%

(Source: Kevin Burns, CIO, the City of Miami)

• Public sector cloud will account for more than half of global software, server and storage spending growth by 2018, according to IDC

(Source: IDC’s Worldwide and Regional Public Cloud IT Services 2014-2018 Forecast)

>50%

CLOUD ADOPTION: ABOUT TO SURGE A FEW

KEY INSIGHTS

EASIER, FASTER, BETTER: THE CITY OF MIAMI

Learn more about the Microsoft Cloud for Government www.microsoft.com/government

HOW LOCAL, STATE AND FEDERAL GOVERNMENT AGENCIES ACHIEVE RESULTS IN THE CLOUD

• The City of Oakland was “a pioneer” in the use of police body-worn cameras.

• Benefits include reductions in “use of force” incidents and “complaints.”

• “Local police departments need a lot of personnel and expertise to manage video: this is an ideal application for the cloud.”

— Eric Breshears former Deputy Chief, the City of Oakland

THE CLOUD:

• “Gave us everything we needed.”

• “The security is just excellent.”

• “We can spin up additional resources as fast as our service agreement allows.”

• “As soon as other [agencies] started seeing this in the field, they all wanted to know how they could get on it too.”

— Stephen DePooter Former CIO, the Illinois Department of Healthcare and Family Services

20• The approximate number of

police body-worn cameras piloted in 2009

200 • The number in operation by

March 2010

19,000 cases / 3,000 referrals • Total number of activities tracked within the solution

(Source: Stephen DePooter, former CIO, IDHFS)

• Reduction in wait time to process/review/approve and report data

75%10 Days

• Length of time from case creation to a case contact – about half the pre-cloud time

(Source: Eric Breshears, former Deputy Chief, the City of Oakland

EVERYTHING NEEDED: THE ILLINOIS DEPARTMENT OF HEALTHCARE AND FAMILY SERVICES

A PIONEER IN POLICE BODY-WORN CAMERAS: CITY OF OAKLAND

• Full deployment in 2013, including K-9 patrols and tactical teams

600cameras

FedRAMP The Federal Risk and Authorization Management Program (FedRAMP), certifying cloud services for use by federal agencies

CJIS Criminal Justice Information Services – an information backbone for the Federal Bureau of Investigation

IRS 1075 Sets out Internal Revenue Service encryption standards all agencies must follow to protect taxpayer information

HIPAA The Department of Health and Human Services establishes Health Insurance Portability and Accountability (HIPAA) guidelines for the protection of individual health records

ECSB The Defense Information Services Agency operates what it calls the Enterprise Cloud Service Broker (ECSB)

Take a Microsoft Cloud for Government Trial: http://po.st/OneGovCloud

ACCREDITATIONS Some of the most vital accreditations leading cloud providers exhibit include:

http://www.microsoft.com/government

http://po.st/OneGovCloud


PROFILES IN PROGRESSThe overall percentage of government IT now residing in

the cloud may not be all that was hoped for when cloud-

first policies were first being announced. However, the

number of government cloud implementations is growing

rapidly. Judging from the results of these relatively early

adopters, the pace of future implementations is very likely

to accelerate. Consider three broad areas where cloud

environments are delivering remarkable value:

The number of

government cloud

implementations is

growing rapidly.

LAW ENFORCEMENT

CASE MANAGEMENT

eGOVERNMENT


teve Ward is CEO of VIEVU, a company that designs, manufactures and markets wear-able video cameras and software for both law enforcement and private professionals world-wide. For various reasons, there is today “a

tremendous surge,” says Ward, in the number of police departments equipping their officers with personal video cameras. Demand, says Ward, “is very strong.”

But what many police departments would be sur-prised to learn, says Ward, “is the vast amount of data these cameras produce,” which can be as much as a gigabyte per day per officer. In addition to massive stor-age needs, this proliferation of police-recorded video in turn leads to additional challenges such as control-ling access while still sharing with district attorneys, defense attorneys and various courts.

Police departments want this equipment. As Ward explains, “This improves their effectiveness in the field and their relationship with the public.” However, “most police departments do not want to get into the business of storing, sharing and protecting literally pet-abytes of video data.”

As it turns out, the need for police video “is a problem that is tailor-made for the cloud,” says Ward. “There’s absolutely no need for local law enforcers to start running their own data farm. All of these pro-cesses—storage, security, retrieval, sharing—can be accomplished in the cloud very effectively and at very reasonable cost.”

But what about government resistance to the cloud—especially in areas where data security is criti-cal? Here’s where matters become “really interesting,” says Ward. It is routine for all local police depart-ments to exchange data with the FBI. But owing to the highly sensitive nature of this information, any net-work that handshakes with the FBI’s servers must first obtain Criminal Justice Information Services (CJIS) certification. These are “extremely rigorous standards,” says Ward. Moreover, before any system can link to CJIS, “the providers have to sign a CJIS Security Addendum,” which essentially states, “they take full responsibility for data security.”

All of this is why Ward is pleased to tell the world that his cloud-driven offerings “are the first, ever, to run on a cloud platform built to support CJIS.” To be more specific, VIEVU partners with Microsoft, which in turn runs Azure Government, a cloud networking platform designed specifically for government use. And indeed, Microsoft has signed agreements to support CJIS compliance with a number of states, including California, Texas, Michigan and Kansas. So in essence, VIEVU’s video storage runs on Azure Government, which is contractually held to the same CJIS Security Policy to which the FBI holds police departments. Says Ward, “This is a real breakthrough, and we’re already seeing explosive growth.”

LAW ENFORCEMENT

One of the areas becoming an absolute

hotbed in government adoption of the

cloud is law enforcement.


ONE DEPUTY CHIEF’S VIDEO EXPERIENCEIn January 2015, Eric Breshears became director of product management for Forensic Logic, a CJIS-compliant, web-based company providing immediate access to data needed by law enforcement officers on the ground. But just before that, he retired from his position as deputy chief of police in one of the first cities to “install” police video in a big way: Oakland, Calif.

F O R E N S I C L O G I C


Explosive growth in the use of the cloud to enable broader adoption of video cameras for police officers is no surprise to Breshears. Oakland was, in fact, “a pio-neer,” says the former deputy chief. “We ran a pilot of 20 or so cameras beginning in 2009.” By March 2010, the city had deployed almost 200 cameras to patrol officers. Then in 2013, the city reached full deployment, includ-ing additional functions such as K-9 patrols and tactical teams. Today, says Breshears, Oakland’s police depart-ment uses “over 600 cameras.”

Cameras can be invaluable to law enforcement, says Bres-hears. Benefits can include not only reductions in “use of force” incidents, but also “as the number of cameras increased in Oakland, complaints decreased.”

Still, there are challenges. Local departments “need a lot of personnel and expertise to manage all of this video.” For this reason, says Breshears, “this is an ideal applica-tion for the cloud.”

Even so, Breshears believes the future of video won’t be realized until law enforcers can put video to work in real time. “The real value is when cameras become a part of larger components such as early warning systems and search engines that allow the viewing and review of video to take place in conjunction with crime fighting and risk management. The officer is on the scene, and supervi-sors and commanders are on alert that an event is taking place.” Advanced tools can also be developed to help pri-oritize response and later analysis/storage. “Voice analy-sis, where certain words like ‘get down’ or ‘hands behind your back’ or swearing—those could be used to flag the most critical situations,” says Breshears. “The ability to utilize voice and video analytics that allow for a rapid search and notifications will be critical as the amount of stored video rapidly increases.”

As for his new career at Forensic Logic, essentially, “what we provide are Big Data-driven search/analytics tools” that can improve “coordination and response” and later on “investigation and prosecution.” As Breshears explains, “We build relationships between disparate systems and advanced search capabilities.” When officers are sent to a location, “they need a lot of information: who is at the scene, vehicles, warrants.” Plus, “they also collect a great deal of information.”

Later on, such data can be analyzed. There are “defined data sets” like names and addresses, and “unstructured” ones like the words in an officer’s statement, says Bres-hears. “What we can do is help the department build relationships between the data.” This not only “aids inves-tigation” but can also be used in a predictive manner, “to improve deployment,” says Breshears.

But no matter which video and related data tools are used in which ways, “one thing I can tell you is that it will all be delivered in the cloud,” says Breshears. “It’s the most cost-effective and secure manner imaginable. I don’t see this developing any other way.”

“Local departments need a lot of personnel and expertise to manage all of this video. For this reason, this is an ideal

application for the cloud.”

— Eric Breshears Director of Project Management,

Forensic Logic


CASE MANAGEMENT

The term “case management” can be

applied to a wide range of activities.

Generally, it describes any instance

where a government worker needs

access to various “client” files, often

residing on a range of databases.

case management workflow in government is in many ways analogous to a customer his-tory in the private sector. In both instances, the goal is to

associate past history and future needs and interactions with an individual.

Today, Stephen DePooter is prin-cipal consultant with Michigan-based Health Management Associates (HMA). But as the former CIO for the Illinois Department of Healthcare and Family Services (DHFS), DePooter managed that agency’s IT infrastructure and appli-cations. The key agency challenge, he recalls, involved managing the IT behind approximately $18 billion in annual state Medicaid claims. At the same time, DHFS also backstopped the state’s child support program, representing another $2 billion in payments.

Case management is very relevant for the DHFS. About 10 years ago, DHFS started using an application to help oper-ationalize a Medicaid program known as

“Money Follows the Person.” The pro-gram’s goal was “to help patients move from an institutional to a community setting,” says DePooter. Getting it done requires referrals, clinical evaluations and related activities, meaning field workers are collecting and using sensitive patient information.

When DePooter took office, a routine review showed significant security issues with the associated application. The vul-nerabilities were so great “that we had to take it out of production,” or in non-IT speak, “shut it down, immediately.” Such an action was not taken lightly, particu-larly since it forced workers to revert to labor-intensive, but for the time being more secure, paper-based processes.


Knowing the situation required fast action, DePooter was able to identify three options. These included:

• Write a new program from scratch • Procure a potentially costly case management

solution • Consider a cloud solution The first two options were not appealing. Due to

the structure of the state’s IT operations, “it would have taken us a lot of time doing everything required before they could spin us a server—and that’s not including the time needed for developing, testing and fielding a completely new application,” says DePooter. As for procuring a solution, a key problem was that the “Money Follows…” program didn’t have much longer to run. Consequently, says DePooter, “we didn’t want to spend a ton of money or go through the procure-ment trials for something relatively short term.”

That left the team with one final option, a CRM solution delivered in the cloud. Indeed, Illinois is, in fact, a cloud-first state, “meaning we generally need to rule out cloud before taking on any non-cloud solu-tion.” However, continues DePooter, “once we took the time to look, we saw the cloud approach gave us everything we needed.” Some of those needs included:

• Speed With workers using pens and paper, time was of the essence. But when DePooter and his team looked at how quickly a cloud-based solution could be fine-tuned and implemented, “we were very impressed.” Development, “adding a few plug-ins and some code that wasn’t part of the offering,” says DePooter, took about 12 weeks. Start to finish, beginning with the outlining and documentation of needs, then through training and full implementation, “took 16 weeks,” says DePooter.

• Security “The security was just excellent,” says DePooter, and was further enhanced by the fact that the chosen pro-vider “uses a cloud that is dedicated to government and met all of our needed certifications.”

• Scalability A huge benefit, says the former CIO, was that “we could expand on demand—basically spin up additional resources as fast as our service level agreement allows.”

• Interoperability DePooter says another big advantage was the ease in linking with other systems, for example, building an interface “to link referral data to actual cases.” Plus, “we were able to tie in to our legacy mainframe to do a match between new referrals and recipient eligibility.” In this instance, says DePooter, “that sped up the exist-ing process from six weeks to 24 hours.”

• Cost effectiveness All-in, says DePooter, “this saved money—and we liked the fact that it’s subscription, so we could budget appropriately.”

The application “pushes the needed data,” says DePooter, “in ways that end-users were telling us makes their jobs easier,” thus improving performance. A sur-prise for DePooter was the extent to which end-users were embracing the application—and asking for more:

“What was really great about this is the way it can be con-figured. If you want to change the look or design a new report, it’s really easy. To make any kind of change in the past meant needing technical development and that took us into IT gover-nance procedures: unit testing, user acceptance testing, version control, etc. But now that functionality is at that user’s finger-tips—it no longer requires high-end, technical development. They can make improvements much faster than they could with the monolithic systems of the past.”

As a next step, DePooter began helping sister agen-cies gain access to similar applications. “As soon as others started seeing this in the field, they all wanted to know how they could get on it too.” One related agency has a particular focus on residents from Cook County, Ill. Now, says DePooter, “they can take their demographic data, ingest that data and build a horizontal view across multiple agencies.” So now “they can do trending” and related analysis “leading to better prioritization and optimization of efforts.” The more agencies that partici-pate, “the greater the value,” says the former CIO.


For many years, the most vocal objections to cloud migra-tion in government have been over data security. But today that argument has lost its credibility. As Brunson White, secretary of information technology for the State of Alabama, explains, “For cloud providers, particularly those specializing in cloud for government—data security is everything.” Which means, says White, “that they are state-of-the-art in every way.” So it’s not surprising, he concludes, that the best providers “are gaining accredita-tion” from a range of critical government entities.

Another critical aspect of all of the above is that there will often be instances in government where data security and related protocols overlap. What some call a “trifecta” in accreditation could potentially occur any time a child welfare worker makes a home visit. Immediately, HIPAA standards come into play, as the worker will likely be called upon to make a health assessment. In addition, both IRS 1075 and CJIS rules may be invoked, as child support pay-ments and criminal acts are often associated with such visits. Thus, any cloud application for such case managers would need to comply with all three sets of rules, and very likely will conform to the overall most rigorous standard.

CERTIFICATIONS: KNOW YOUR ACRONYMSNot all clouds are created equally. Government data is sensitive. Which means the cloud in which it is to reside needs to be secure.

G O V E R N M E N T A C C R E D I TAT I O N S


Note that only leading providers of cloud-based ser-vices using the latest in data security techniques as well as authentication and control environments can gain the above certifications. Nonetheless, that the above agen-

cies are indeed vetting and ultimately conferring certi-fications pays testament to the quality of data security leading cloud providers today provide.

Some of the most vital accreditations government agencies may encounter include:

The Federal Risk and Authorization Management Program (FedRAMP) reviews and certifies cloud providers and applications for government use. Once FedRAMP issues an “authority to operate” (ATO), a cloud program is cleared for use.

Providing the information backbone for the Federal Bureau of Investigation, Criminal Justice Information Services manages some of the nation’s most sensitive data. As such, CJIS interaction is essential to all federal, state and local law enforcement agencies—and any network seeking access must be CJIS certified. Note also: cloud providers must sign a “CJIS Security Addendum,” acknowledging their legal accountability for data security.

A key set of rules from the Internal Revenue Service, IRS 1075 sets out the encryption standards all agencies must follow to protect taxpayer information.

The Department of Health and Human Services establishes Health Insurance Portability and Accountability (HIPAA) guidelines for the protection of individual health records.

The Defense Information Services Agency operates what it calls the Enterprise Cloud Service Broker (ECSB). The goal of this entity is to evaluate and certify private-sector cloud providers for specific Department of Defense applications.

FedRAMP

CJIS

IRS 1075

HIPAA

ECSB

The State of AlabamaBrunson White is an executive who spent over 30 years in the private sector. Today he is Alabama’s secretary of infor-mation technology, a position recently created by the legislature to help the state develop and implement initiatives to strengthen IT practices. “By improving how we look at IT, how we operate, we can find ways to be more efficient,” says White. Along the way, “we will also be in a better position to improve the qual-ity of government services for the people of Alabama. That’s our true mission.”

A key challenge for White is that the role is more to “influence” rather than direct the various state agencies. “While we have the authority to direct and the responsibility to govern,” says White, “we are trying very hard to engage the state agencies in the governance pro-cess.” That is, “we don’t go in and direct change,” says White.

Rather, the executive works with other state IT executives to develop bet-ter policies, “more in line with today’s realities.” So as opposed to a cram down approach, “this is very much grass roots,”

says White. “We talk, we share, we bring groups together to better understand what the others are doing—it’s collegial.” Bottom line, “we believe that good gover-nance starts and ends with a conversation.”

Nonetheless, today, says White, “the cloud is turning everything on its ear.” What really called attention to the benefits was Alabama Medicaid’s imple-mentation of a hybrid cloud in support of its Health Information Exchange (HIE) project. The initial HIE project started in April 2014 and was fully operational by October 2014, supporting development, test and production workloads.

Alabama Medicaid then leveraged the hybrid cloud to support a much larger eligibility and enrollment project, stand-ing up a 40-server development and test environment in one day and cutting months from the procurement and imple-mentation time cycle. This latter project will soon be standing up the production environment in the hybrid cloud, which will again advance time-to-market, allowing users to see more functionality in a significantly shorter time.


eGOVERNMENT

The term eGovernment applies in any

case where a government agency uses

technology to improve service and

efficiency, typically at significantly lower

cost. It can be used to describe everything

from enabling citizens to renew a driver’s

license or vehicle registration online to using

email and mobile applications to streamline

applications and permitting processes.


Going forward, Medicaid projects will make use of a mix of a private government cloud and on-premise serv-ers, seamlessly wired together as a hybrid cloud. Now, as more Medicaid projects arise, the team can spin up needed infrastructure within minutes.

Other cloud initiatives are also under way. For example, “we’re working on a rollout of Office 365 to all executive level agencies,” says White. For now, this cloud-based delivery of productivity tools, includ-ing consolidated email and unified messaging, is being piloted by six or so agencies. But soon, the rollout will encompass some 160 agencies ranging from small to as large as 4,000 to 5,000 seats for the state’s department of human resources.

Elsewhere in the state, another project team is working to create “the Alabama Cloud.” This, says White, is an even larger-scale cloud implementation designed to help the state centralize its procurement and management of IT resources while at the same time speeding provisioning for various state agencies. Essentially, when an agency needs computing power, it can simply put in a ticket version, and within minutes a server can be spinning.

Overall, says White, the cloud is a huge enabler of the state’s goal to improve efficiency and productivity, and ultimately, “improve our ability to serve the peo-ple of Alabama.”

The City of MiamiDoing more with less. For Kevin Burns, CIO for the City of Miami, “that’s what we do here every day—because we have to.”

Burns and his team are the IT back-bone for between 4,000 and 4,500 City of Miami employees, a figure that peaks dur-ing summers, “when we hire more parks and recreation staff.” The various supported departments and functions include building, planning, zoning, finance, HR, public safety (both police and fire), code enforcement, solid waste management and public works.

As Burns explains, “We maintain all the systems and servers, manage and secure the data, provide all the networking, the phones, the devices—the whole of the IT and telecommunications footprint.” It would be a full plate for any IT department. Nonetheless, as Burns explains, “the work-load never gets any lighter.”

Pressure to perform In fact, quite the opposite. Instead, the pressure to per-form is only increasing. For starters, the City of Miami, like many other major metropolitan areas, is still reel-ing from lingering recession. Consequently, headcount for the city’s IT department has been slashed from over 100 in 2006 to “just over 50 today,” says Burns.

In addition, as CIO, Burns pushes his team to do the best they can with the resources available. “We view our business units, the departments we work with, as partners. It’s their job to perform for the people

of Miami—to provide the highest level of service they can as efficiently as possible.” That, says Burns, “is a mission and a focus we share.” Accordingly, the culture in the IT department “is one of doing whatever it takes to move at the pace our business units need.”

Which leads to yet another driver of greater IT department workloads: expectations driven by the incessant advance of technology. Citizens, city offi-cials and city workers alike, says Burns, all see the ever-improving levels of service being achieved in the private sector. “If you can bank or shop online, or by


mobile, why can’t you interact with government in the same way? Why should you have to drive downtown, park and then perhaps wait in line to do business with the city?” Everyone today, says Burns, “expects more convenience and service, never less. They know when there are better ways to get things done, and they won-der in cases where government isn’t doing it.”

Technology to the rescue So Burns and his team are working closely with city business units to harness technology to improve pro-cesses, making them more efficient and effective. This begins with Office 365, which today is being deployed “within a cloud environment developed by Microsoft specifically for government users,” says Burns. “It is purpose defined—specifically for government—so it addresses many of our needs without any adjustments.”

From here, the city is working to update existing applications or create brand-new mobile, cloud-driven tools. A good example is an application being devel-oped by the building department. “Imagine you’re a homeowner or a contractor, and you’re told an inspec-tor is coming today, but there’s no way to know exactly when,” says Burns. Such instances mean citizens “spend more time than they should just waiting around.”

Enter technology. Imagine an application that allows citizens to track the schedule and the where-abouts of the inspector in question. As Burns explains, “They can follow the inspector throughout the day via GPS.” A location indicator even changes color to show when one inspection concludes and another stands next in line. Citizens can now “plan better, making more effective use of their own time,” says Burns.

In addition to providing better service to citizens, the building department can also make more efficient use of its own resources. Managers can, for example, track individual workloads and evaluate factors such as distances, locations, traffic and weather to more effec-tively optimize scheduling. They can also see progress in real time and make adjustments as needed. The City of Miami’s building inspectors and code enforcement teams are also, today, equipped with the ability to upload or download needed photos or documents and to issue permits or other documents on site “without having to return to the office,” says Burns.

One difference between the City of Miami and cer-tain other government organizations is that, as opposed to maintaining data secrecy, “our drive today is to make our data even more transparent,” says Burns. “We are looking to publish more data, make even more available on the web, or by mobile, so that citizens have greater, not less access, to the services and information they need.”

Nonetheless, Burns says the cloud environment “actually improves” security. “All of our data, today, is stored in [Microsoft’s] Government Cloud. Whereas, yes, we have always paid attention to security, we cannot possibly apply as many resources to these issues—on the scale—of Microsoft.” To be approved for FedRAMP, for example, “Microsoft has had to pass every security constraint the federal government feels it necessary to put in front of them.” Today, “secu-rity means having all sorts of checks and balances,” say Burns. For example, “we are using dual authentica-tion for log on. Then, any data [transferred] over the Internet or wireless is encrypted on both sides—before leaving or entering any application or device.” And for the most sensitive data, “there are even more security measures,” says Burns.

Overall, Burns says that the cloud makes every-thing from day-to-day maintenance to new application development “easier, faster and better.” The executive is so confident and pleased with progress to date that a key plank of the city’s IT strategy “is that from now on, any functionality that we add or improve must be (1) mobile and (2) cloud-based.” Applications that reside in the cloud, he explains, “are just so much more flexible, so much easier to maintain, so much more cost-effec-tive and so much more secure—it doesn’t make any sense to do it any other way.”

“Applications that reside in the cloud are just so much more flexible, so much easier to maintain, so much more cost-effective

and so much more secure—it doesn’t make any sense to do it any other way.”

— Kevin Burns

CIO, City of Miami


One of the company’s first contracts was with a major government contractor doing business with the National Nuclear Security Administration (NNSA). As Allen explains, the contractor “gave us a call and said, we need your help building an emergency response system for nuclear emergency teams.” What began in nuclear quickly spread to related preparedness work in other fields.

Flash forward to 2011. “We got a call from the Department of Energy (DOE),” says Allen, saying “there’s a meltdown in Japan, at Fukushima, and we need you to get moving: we need to be able to collect, store, manage and share data with a whole bunch of agencies, universities and oth-ers, and we need that up and running yesterday.”

To establish what was needed in the time allotted, “we realized this was a mission for the cloud,” says Allen. Cus-tomarily, in 2011, “any time you said cloud, that meant a roadblock of government IT regulations,” says Allen. But in this case, almost without hesitation, the DOE gave approval, “so we were pretty much among the first to set up a government cloud in Microsoft Azure,” says Allen.

The Fukushima experience had a sobering effect on Allen. “What I realized, when there’s a disaster like this, that’s not the time to start thinking about how to get orga-nized.” So he sat down and wrote a white paper on the role of cloud in emergency preparedness.

Today much of that vision resides in one of the company’s core offerings, “RadResponder.” Developed on behalf of the Federal Emergency Management Agency (FEMA) in partnership with the DOE and the Environmental Protec-tion Agency (EPA), this is a set of cloud-based applica-tions standing at the ready if and when there is a nuclear incident on U.S. soil. RadResponder coordinates and enables a wide range of capabilities empowering a net-work of nearly 800 federal, state and local emergency response organizations. Response team members across all 50 states can use RadResponder to securely collect and share scientific field data with mobile apps, establish-ing their own collaborative partnerships as needed and on the fly, using techniques borrowed from social media.

Getting this and related offerings up and running on the cloud “means that we need to know what we’re doing in privacy, security and documentation requirements across entities and standards like FedRAMP, CJIS, HIPPA, FIPS and NIST-800,” says Allen. And because everything is cloud based, “that means we can do this cost-effectively, as we’re not paying for all the servers this takes until they’re actually needed. So what we are is scalable, resil-ient and at-the-ready. We’re the folks you hope you never need, but when you do, we’ll be there.”

IN TIMES OF CRISIS— THE CLOUD IS READY Nothing spurs cloud adoption like a crisis.

Bob Allen is co-founder and CEO of Chainbridge Technologies, a software developer and related services company specializing in providing mobile solutions for emergency responders. “Basically, when the worst things happen, like a nuclear disaster or a hurricane,” says Allen, “that’s when you need us.”

C H A I N B R I D G E T E C H N O L O G I E S

FEDERAL CLOUD DEPLOYMENT State and local governments aren’t the only entities

benefiting from cloud. Already, this report has mentioned

how the FBI is opening its data reservoirs by certifying

a major cloud provider by its CJIS standards. That is, the

FBI is acknowledging that, given an appropriate control

environment, the cloud can be safe and secure for some

of the most sensitive data around. Other cases show how

cloud environments are now certified to work with data

housed under IRS 1075, HIPPA or even ECSB standards.



arcella Cavallaro, federal sales manager at ESRI, a provider of geospatially focused applications, believes the era of cloud represents an entirely new paradigm for federal agencies. A good example, she

explains, is any typical military unit or, for that matter, emergency management deployment. “When a mili-tary unit or disaster team deploys somewhere new, they need, very quickly, to get up to speed on where they’re going,” says Cavallaro. “They need total awareness of roads, bridges, waterways, structures, elevations, popu-lation density.” Today, to get that, they have to go to a specific network, which among other issues means “it takes a lot of time.”

But if this moves to the cloud, “from a ship, jungle or forward base,” says Cavallaro, with a secure log-in, “they can download not only the data they need but any applications.” Moreover, she continues, “the cloud is scalable—you can put more power behind it—which also means the people producing the data can update and edit things much faster than in a local infrastructure.”

Similar advances and improvements to current IT practice are available for everything from federal disas-ter relief programs to fire-fighting, says Cavallaro. And because such capabilities are cloud-based, “the agencies don’t have to pay for so much infrastructure, as every-thing can be scaled up or down as needed.”

Another executive seeing a poised-to-explode federal market for cloud applications is Paul Giles, federal direc-tor at document storage-focused process and technology provider Gimmal. In general, says Giles, “more and more government agencies are becoming more familiar with the cloud and, more important, more confident and com-fortable that these are highly secure data environments.” For example, achieving accreditation by FedRAMP, says Giles, “means an application or a service is meeting some of the toughest standards there are.”

As for cloud-delivered document storage and retrieval services, Giles is seeing heightened demand by the federal government at all levels. “What hap-pens in government all the time is that you get these unfunded mandates,” says Giles. A good example is the Presidential Records Management Mandate, requir-ing all federal agencies to implement “an email records management solution by 2016 and a solution for all other records by 2019,” says Giles. Moreover, he adds, “the mandate also directs agencies to embed these records within cloud architectures.”

A secure government cloud, says Giles, “is already the ideal repository for records,” not only easing ini-tial archival but also retrieval when needed. But what makes the cloud almost irresistible to federal agencies is the potential for efficiency and cost savings.

“This is an unfunded mandate—so to achieve it means these agencies have to either get it done at lower cost than they’re doing it now or cut back somewhere else in their mission.”

However, with a cloud-driven approach, “they’re finding they can actually reduce costs,” says Giles. For example, today, “we find 30% to 40% of what is being archived on servers is redundant.” But an end-to-end cloud-based solution, “can track documents from their inception. With the right processes we can vir-tually eliminate redundancy, and that reduces costs.” Overall, says Giles, “agencies are seeing they can meet the terms of this new mandate, but by using a cloud model, they’re doing it within their current budgets.”

“With the right processes we can virtually eliminate redundancy, and that

reduces costs.”

— Paul Giles Federal Director,

Gimmal


Progress, but barriers remain Although the pace of federal cloud adop-tion is accelerating, there are forces holding things back. Certainly, some of the more common include fears of the “unknown” as well as concerns over data security—both of which are being overcome by developments such as the increasing number of provider accred-itations and the growing number of agencies with practical cloud experience.

However, several executives inter-viewed for this report point to one key aspect of government operations that creates a strong—and misplaced—disin-centive for cloud migration. That is: two of the key factors driving the ratings of senior white-collar government offi-cials are (a) the number of reports and (b) the size of the budgets they are manag-ing. Federal GS (general schedule) ratings have a direct impact on these executives’ pay and promotion prospects.

So what happens, explains an exec-utive from a major software developer, “is that the cloud is seen as something that can only hurt them in their careers.” Specifically, says the executive, “a cloud approach not only reduces headcount in any given department, it also reduces costs—the size of the needed budget.” As a result, “there are many government decision makers for whom the existing rules are a strong disincentive to consider the cloud.” As for resolving this quan-dary, none of the executives sees any easy approaches. As the executive concludes, “it’s just one of the hurdles to widespread cloud adoption in the federal government. The only thing that will overcome this, apparently, is time.”


But before choosing a provider and a migration path, additional questions for consideration include:

Have we evaluated the sensitivity of our data? Not all data is equal. Some is significantly more sensitive than other data. Before moving to the cloud, an agency should do an inventory of its data to get a sense of the level of security that will be needed in each category. This insight will greatly improve the ultimate choice of strategy and provider(s).

Do we need flexible core services? Many agencies will find their data and related processes require a mix of cloud-based and on-premise solutions. Providers should be evaluated on their ability to work within a mix of pub-lic, private, government and other hybrid combinations.

Do we work from multiple operating systems? Not all agencies are single platform—far from it. Cloud providers should be able to knit a seamless web of interoperability across multiple platforms.

Do we need access to open-source solutions? The larger the agency, the more applications it must use—or will soon need to use. A platform should be able to support a wide range of open-source environments (e.g., Linux, Hadoop, Drupal and Joomla) and languages (e.g., Java, PHP and Python).

Are we committed to code reuse? Agencies are being directed to be more efficient in application development by first looking to see if a capability already exists. Those pursuing “code reuse” should make certain their cloud provider is committed to supporting such efforts.

Are we taking advantage of all the resources available? Government agencies should consider tapping the exper-tise and resources residing in 18F (a digital and web ser-vices team with the Government Services Administration) or even the Digital Services Team (within the Office of Management and Budget). These and similar groups are charged with assisting government agencies in modern-izing their digital footprints.

MORE FORCES AT WORK

Support for Open Source Languages & Environments: A growing number of open

languages and platforms are supported by Microsoft Azure, including Java, PHP,

Node.js and Python. Additionally, many open-source environments, including

Linux, Hadoop, MongoDB, Drupal and Joomla, run on the Microsoft platform.

This type of support helps enable agencies to get started quickly and take full

advantage of our Azure cloud services.

ADDITIONAL CONSIDERATIONSThe cloud delivers a host of key benefits. These range from faster development time to greater organizational effectiveness, agility and innovation. In fact, the government’s own Cloud First strategy points out that it believes as much as $20 billion in annual costs could be shaved from federal IT spending once appropriate activities move to the cloud.


CONCLUSION: BUILDING ON SUCCESSES

rom the DoD to the City of Miami; from the FBI to the City of Oakland; from the State of Alabama to the Illinois Department of Healthcare and Family Services. All are success stories, providing examples of how cloud-based services can improve the performance and delivery of government services.

Moreover, in each instance, the agencies in question show in word and deed that they are now con-vinced of the promise of the cloud and that they are committed to expanding the breadth and depth of

their cloud deployments.Pioneers like the above—acting sometimes on their own accord and at other times relying on accreditations

such as FedRAMP, HIPAA or CJIS—are proving that the use of cloud delivers better government. That is, bet-ter and faster service for citizens, better performance against primary objectives—all within a highly reliable data security framework at lower, or at the very least optimized, cost.

Indeed, the pace of government adoption of the cloud has, overall, been less than hoped for and certainly below analyst expectations. But from here, all of the above shows that as more agencies gain more experience with cloud environments, demand for more accelerates.

The question going forward is no longer whether or not government agencies should be migrating their IT to the cloud. Instead, the question officials will soon be called upon to answer is: why have they migrated so little?

ABOUT THIS REPORTThis report was researched and written by Forbes Insights. It is sponsored by Microsoft.

Our findings are based on interviews with over a dozen senior executives from a range of government agencies, consultancies and technology providers.

Both Forbes Insights and Microsoft extend their thanks to the following executives who are quoted in the report:

• Bob Allen, Co-founder and CEO, Chainbridge Technologies

• Eric Breshears, Deputy Chief, Oakland Police Department (retired); Director of Product Management, Forensic Logic

• Kevin Burns, CIO, the City of Miami

• Marcella Cavallaro, Federal Sales Manager, ESRI

• Stephen DePooter, former CIO, the Illinois Department of Healthcare and Family Services; Principal Consultant, Health Management Associates

• Paul Giles, Federal Director, Gimmal

• David Hantman, General Manager, the Cloud Computing Caucus Advisory Group

• Shawn P. McCarthy, Research Director, IDC Government Insights

• Steve Ward, CEO, VIEVU

• Brunson White, Secretary of Information Technology, the State of Alabama

For more information, go to http://po.st/OneGovCloud

ABOUT FORBES INSIGHTSForbes Insights is the strategic research and thought leadership practice of Forbes Media, publisher of Forbes magazine and Forbes.com, whose combined media properties reach nearly 75 million business decision makers worldwide on a monthly basis. Taking advantage of a proprietary database of senior-level executives in the Forbes community, Forbes Insights conducts research on a host of topics of interest to C-level executives, senior marketing professionals, small business owners and those who aspire to positions of leadership, as well as providing deep insights into issues and trends surrounding wealth creation and wealth management.

499 Washington Blvd., Jersey City, NJ 07310 | 212.366.8890 | www.forbes.com/forbesinsights

FORBES INSIGHTS

Bruce Rogers Chief Insights Officer

Erika Maguire Project Manager

EDITORIAL

Kasia Wandycz Moreno, Director Hugo S. Moreno, Director William Millar, Report Author Kari Pagnano, Designer

RESEARCH

Ross Gagnon, Director Kimberly Kurata, Research Analyst

SALES

North America Brian McLeod, Commercial Director Mathew Muszala, Manager William Thompson, Manager

Europe/Africa Lawrence Bowden, Manager

Middle East/Asia/Pacific Serene Lee, Executive Director

http://www.forbes.com/forbesinsights

Documents

FROM PROMISE TO REALITY - Forbesimages.forbes.com/forbesinsights/StudyPDFs/Microsoft_Govt_Cloud-REPORT.pdf · things like web-hosting and email. And if you think about it, we actually