Define Your Cloud Vision for Federal Government

Define your cloud vision before it defines you.

Use the cloud's strengths. Mitigate its weaknesses.

Federal government agencies and departments are subject to bodies that issue guidelines and requirements on modernizing technology and digital transformation (e.g. the Treasury Board Secretariat – Canada). However, despite the existence of these strategies and frameworks, you may still encounter challenges articulating your cloud vision: how to derive value and mitigate risk in the cloud.

The challenge in articulating this vision lies in the fact that the cloud isn't magic. It's not necessarily cheaper, better, or even available for the thing you want it to do. It's not mysterious or a cure-all, and it does take a bit of effort to systematize your approach and make consistent, defensible decisions about your cloud services. That's where this blueprint comes in.

Your cloud vision is the culmination of this effort all boiled down into a single statement: "This is how we want to use the cloud." That simple statement should, of course, be representative of – and built from – a broader, contextual strategy discussion that answers the following questions: What should go to the cloud? What kind of cloud makes sense? Should the cloud deployment be public, private, or hybrid? What does a migration look like? What risks and roadblocks need to be considered when exploring your cloud migration options? What are the "day 2" activities that you will need to undertake after you've gotten the ball rolling? Government cloud is always going to be more complicated due to compliance and certification requirements and obligations to fairness and accountability; this will need to be part of the vision.

Taken as a whole, answering these questions is a difficult task. But with the framework provided here, it's as easy as – well, let's just say it's easier.

Jeremy Roberts
Research Director, Infrastructure and Operations
Info-Tech Research Group

Executive Summary

Your Challenge

• As a federal agency, you are directed by policies and strategies that encourage cloud adoption, for example, to take advantage of the cloud's economies of scale, while also maintaining security.
• You need to define a realistic value proposition that is specific to your agency or department beyond outsourcing opportunities or assumptions about cost savings that may not be borne out.
• Though the use of cloud is now widespread in government, you have yet to establish a basic cloud vision that expresses a shared understanding of what value you expect to derive from the cloud and how risks will be mitigated.

Common Obstacles

• Organizations jump to the cloud before defining their cloud vision and without any clear plan for realizing the cloud's benefits.
• The COVID-19 pandemic accelerated cloud migration, but these decisions were made in an ad hoc, rather than systematic, fashion.
• You lack a consistent framework to assess workloads' suitability for the cloud.
• Moving to the cloud comes with downstream impacts: changes to roles, new training needs, new financial models, and a new approach to support.

Info-Tech's Approach

• Evaluate workloads' suitability for the cloud using Info-Tech's methodology to select the optimal migration (or non-migration) path based on the value of cloud characteristics.
• Codify risks tied to workloads' cloud suitability and plan mitigations.
• Build a roadmap of initiatives for actions by workload and risk mitigation.
• Define a cloud vision to share with stakeholders.

Info-Tech Insight:

1) Base migration decisions on cloud characteristics. If your justification for the migration is simply getting your workload out of the data center, think again.

2) Address the risks up front in your migration plan.

3) The cloud changes roles and calls for different skill sets, but Ops is here to stay.

Common challenges for federal government

• Without a foot in the cloud, federal government risks being left behind in outmoded ways of thinking and doing things.
• Recruitment: The CIO Council (US) reports "recruiting and hiring issues" as the most frequently recurring issue in its Future of Federal IT Workforce update. Pay scales can be a part of this: "While professionals in the mid-ranges of the GS scale perform well compared with their private sector counterparts, entry-level positions and senior executives lag behind in compensation. This makes it especially hard to recruit and retain top talent."
• Cloud reskilling and upskilling is easier said than done; without dedicated professional development plans, time-pressed teams will be challenged to adapt.
• Governments operate under the expectation of transparency and accountability. However, it can be challenging to track total cost savings and avoidances in a consistent way.
• Government usually ends up in a multicloud environment due to the need to deal with multiple vendors. This adds complexity: the need to define multiple sets of architecture and different skill sets.
• Cloud services tend to be consumed through a centralized procurement group, which can be challenged by slowness.

61% of IT leaders in government anticipated cloud networking and engineering as the most in-demand skills for their upcoming projects.

However, 65% said no when asked, "Has your agency's IT management team estimated the cost associated with the gap in IT skills?"

Source: Workscoop/Fedscoop, 2019

Other common obstacles when defining a cloud vision

Standard cloud challenges

These barriers make this task difficult to address for many organizations:

• Organizations jump to the cloud before defining their cloud vision and without any clear plan for realizing the cloud's benefits.
• Many organizations already have a foot in the cloud, but the choice to explore these solutions was made in an ad hoc, rather than systematic, fashion. The cloud just sort of happened.
• The lack of a consistent assessment framework means that some workloads that probably belong in the cloud are kept on-premises or with hosted service providers – and vice versa.

30% of all cloud spend is self-reported as waste. Many workloads that end up in the cloud don't belong there. Many workloads that do belong in the cloud aren't properly migrated.
Source: Flexera, 2021

44% of respondents report themselves as under-skilled in the cloud management space.
Source: Pluralsight, 2021

Your opportunity

This research is designed to help organizations who need to:

• Identify workloads that are good candidates for the cloud.
• Develop a consistent, cost-effective approach to cloud services.
• Outline and mitigate risks.
• Define your organization's cloud archetype.
• Map initiatives on a roadmap.
• Communicate your cloud vision to stakeholders so they can understand the reasons behind a cloud decision and differentiate between different cloud service and deployment models.
• Understand the risks, roadblocks, and limitations of the cloud.

"Cloud-based services can . . . provide your organization with a richer set of capabilities and free up your organization's IT resources. However, using cloud services does not automatically ensure that protections are applied to the assets that fall under these services. With cloud services, your organization's senior decision makers are still accountable for protecting the confidentiality, integrity, and availability of IT services and information."

– Canadian Centre for Cyber Security

Info-Tech's approach

The Info-Tech difference:

1. Determine the hypothesized value of cloud for your organization.
2. Evaluate workloads with 6Rs framework.
3. Identify and mitigate risks.
4. Identify cloud archetype.
5. Plot initiatives on a roadmap.
6. Write action plan statement and goal statement.

What is the cloud, how is it deployed, and how is service provided?

A workload-first approach will allow you to take full advantage of the cloud's strengths

• Under all but the most exceptional circumstances, good cloud strategies will incorporate different service models. Very few organizations are "IaaS shops" or "SaaS shops," even if they lean heavily in one direction.
• These different service models (including non-cloud options like colocation and on-premises infrastructure) each have different strengths. Part of your cloud strategy should involve determining which of the services makes the most sense for you.
• Own the cloud by understanding which cloud (or non-cloud!) offering makes the most sense for you given your unique context.

Migration paths

In a 2016 blog post, Amazon introduced a framework for understanding cloud migration strategies. The framework presented here is slightly modified – including a "relocate" component rather than a "retire" component – but otherwise hews close to the standard.

These migration paths reflect organizational capabilities and desired outcomes in terms of service models – cloud or otherwise. Retention means keeping the workload where it is, in a datacenter or a colocation service, or relocating to a colocation or hosted software environment. These represent the "non-cloud" migration paths.

In the graphic on the right, the paths within the red box lead to the cloud. Rehosting means lifting and shifting to an infrastructure environment. Migrating a virtual machine from your VMware environment on premises to Azure Virtual machines is a quick way to realize some benefits from the cloud. Migrating from SQL Server on premises to a cloud-based SQL solution looks a bit more like changing platforms (replatforming). It involves basic infrastructure modification without a substantial architectural component.

Refactoring is the most expensive of the options and involves engaging the software development lifecycle to build a custom solution, fundamentally rewriting the solution to be cloud native and take advantage of cloud-native architectures. This can result in a PaaS or an IaaS solution.

Finally, repurchasing means simply going to market and procuring a new solution. This may involve migrating data, but it does not require the migration of components.

Migration paths

• Retain (Revisit)
  Keep the application in its current form, at least for now. This doesn't preclude revisiting it in the future.
• Relocate
  Move the workload between datacenters or to a hosted software/colocation provider.
• Rehost
  Move the application to the cloud (IaaS) and continue to run it in more or less the same form as it currently runs.
• Replatform
  Move the application to the cloud and perform a few changes for cloud optimizations.
• Refactor
  Rewrite the application, taking advantage of cloud-native architectures.
• Repurchase
  Replace with an alternative, cloud-native application and migrate the data.

Support model

Support models by characteristic

IT services, including cloud services, can be delivered and managed in multiple ways depending on the nature of the workload and the organization's intended path forward. Three high-level options are presented here and may be more or less valuable based on the duration of the expected engagement with the service (temporary or permanent), the skills specialization required, and the flexibility necessary to complete the job.

By way of example, a highly technical, short-term project with significant flexibility requirements might be a good fit for an expensive consultant, whereas post-implementation maintenance of a cloud email system requires relatively little specialization and flexibility and would therefore be a better fit for internal management.

There is no universally applicable rule here, but there are some workloads that are generally a good fit for the cloud and others that are not as effective, with that fit being conditional on the appropriate support model being employed.