Federal agencies increasingly use cloud computing to perform their missions. Cloud services provide benefits, including on-demand access to shared resources such as networks, servers, and data storage, and can enable agencies to deliver IT services more efficiently. Additionally, cloud services can provide agencies with opportunities to obtain IT capabilities more quickly and potentially at a lower cost than building and maintaining their own computing infrastructure. In pursuing these benefits, agencies may also encounter various risks and challenges, such as managing shared cybersecurity responsibilities with the provider.

This review determined the extent to which selected agencies are ensuring contractor compliance with key cloud computing security practices. To address the objective, researchers identified a non-generalizable sample of four Chief Financial Officers Act agencies based on the number of cloud authorizations issued, excluding agencies selected in recent GAO reports. Using the median number of authorizations, agencies were randomly selected with two at or above, and two below the median: Departments of State, Transportation, Veterans Affairs (VA), and the Small Business Administration (SBA).

Resource Types: Research Report
Capabilities: Data & Information Systems, Tools & Technology
Management Processes: Monitoring & Adjustment, Performance Based Planning & Programming, Risk Management, Strategic Direction