5 ways to benefit from NIST's cloud road map now

Most government technology managers face the common problem of how to keep up with policy flow, the steady and sometimes torrential stream of IT directives, guidance and requirements from oversight agencies on how to modernize agency systems.  

But in area of cloud computing, at least, help is on the way. On Nov. 2, the National Institute of Standards and Technology released a “cloud computing technology road map,” a set of steps to setting up cloud systems that its creators said would help clear their path to cloud adoption.

Related coverage:

NIST releases 'Bible of cloud implementation'

The draft document, "U.S. Government Cloud Computing Technology Roadmap, Release 1.0" (NIST Special Publication 500-293) defines high-priority requirements for standards, official guidance and technology developments that need to be met for agencies to accelerate their migration to the cloud model.

“The Tech Roadmap aggregates the ocean of information out there regarding the cloud,” said Fred Whiteside, manager of the Commerce Department’s critical infrastructure protection program. The plan “takes the finger of the federal manager and places it on the things he needs to know to move forward with cloud adoption,” said Whiteside, who is also chairman of the NIST Cloud Computing Security Working Group.

Deployed correctly, cloud computing has the potential to greatly reduce waste, increase data center efficiency and usage rates, and lower operating costs, federal officials said. It should also eventually cut down the policy thicket.

Dawn Leaf, NIST’s senior executive for cloud computing, said the road map provides both strategic and tactical guidance to agencies. Focusing on near-term guidance, she listed five steps agency managers can take right now to benefit from the road map.

1. Ask cloud vendors to map their services to the NIST Cloud Reference Architecture.

As they make procurement decisions and pick cloud services, agency managers should ask their prospective cloud providers to map their cloud services to the NIST Cloud Computing Reference Architecture. The reference architecture can be used to compare the different cloud offerings and help agencies to better understand the types of services the vendors offer, Leaf said.

Released in September, the reference architecture establishes a vendor- and technology-neutral architecture that lays out the central elements of cloud computing for federal CIOs, procurement officials and IT program managers.

The reference architecture is not a “how-to” design solution and implementation. Instead, it intends to foster understanding of the operational intricacies in cloud computing. As such, it provides an overview of the actors in the cloud computing process and their roles, Leaf said, and shows the architectural components associated with managing and providing cloud services

2. Determine vendor support for cloud standards.

Agencies can look at NIST’s cloud standards inventory and ask their vendors if they are using them, Leaf said. They should also have the firms  demonstrate that use, she added. The Open Virtualization Format, for example, developed by the Distributed Management Task Force, is a packaging standard designed to address the portability and deployment of virtual appliances. OVF enables simplified and error-free deployment of virtual appliances across multiple virtualization platforms. Another specification, The Open Cloud Computing Interface, developed by the Open Grid Forum, is designed for the deployment, management and monitoring of virtual workloads.

3. Compare agency business use cases.

Agency managers can look at the business use cases in the Tech Roadmap and compare these with their own plans. This will help them identify issues and concerns that already have been identified, Leaf said.

NIST is working with agencies to define target business use cases that are complex or have technical hurdles and standards gaps that need to be overcome. The business use cases from agencies and departments summarized in the Tech Roadmap have perceived obstacles that prevent immediate implementation or require workarounds. After target business use cases are developed, they are analyzed to determine which business requirements are pertinent to the cloud.

For instance, the Federal Aviation Administration, together with the Federal Cloud First Task Force and other federal agencies, is seeking a cloud-based electronic discovery solution, motivated by the agency’s moving e-mail to the cloud. This would be composed of an archive, identification and collection capability, data preservation capability, and the processing and exporting of content.

“The objective is to implement a cloud-based [electronic discovery] solution that can analyze both in-house and cloud-based e-mail systems because of the time that the project will take to migrate the FAA’s e-mail from in-house systems to the cloud,” according to the Tech Roadmap. During the migration of e-mail, the ability to respond to electronic discovery and Freedom of Information Act requests is necessary.

Leaf said agencies should have their technical teams review low-level technical use cases within the Standards Acceleration to Jumpstart Adoption of Cloud Computing project and portal. SAJACC focuses on cloud consumers’ technical requirements needed to generate concrete data about how different kinds of cloud system interfaces can support portability, interoperability and security. The set of technical use cases developed by the SAJACC project describes how groups of users and their resources may interact with one or more cloud computing systems to achieve specific goals.

4. Focus on deployment.

NIST’s "Cloud Computing Synopsis and Recommendations" (Special Publication 800-146) explains the different types of cloud deployments — private, public, hybrid and community clouds — as well as the different types of services, including infrastructure and software and platform as a service. Leaf said managers should review this publication and compare how these deployments and cloud models would work in conjunction with the network boundaries of their physical information systems.

The road map also contains scenarios for 12 types of cloud deployment models that relate to guidance issued in the Federal Cloud Computing Strategy released by the Office of Management and Budget in February and technical work in the second volume, Leaf said.

5. Focus on security.

NIST’s road map will also help agency managers gain a better understanding of security challenges of the cloud, high-priority security requirements, and current and future risk mitigation measures requirements. “So there are a lot of tools out there now that aren’t strategic that can help [agency managers] make their decisions,” Leaf said.

Leaf added that people are used to getting guidance and then applying technology. The problem, she said, is that technology is evolving so rapidly that often guidance and technology deployment are happening at the same time, and that can be frustrating for many people.

Peter Gallagher, managing partner for portfolio solutions with Unisys Federal, said, “When we look at cloud road maps, in some cases [government and industry] are taking too broad a view of what the issues are.” Unisys works with federal agencies such as the General Services Administration to move applications to the cloud.

Gallagher said NIST offers a good definition of the cloud that includes the three service models: infrastructure, software and platform as a service. From a practical perspective, he added, Unisys breaks up deployment of cloud services into smaller chunks. Instead of talking about a cloud strategy, Unisys thinks in terms of an infrastructure-, software- or platform-as-a-service strategy when deploying cloud applications.

The driving force is the use of data and applications, Gallagher said, “so we first look at what applications are being used and how.” Then the company can focus on how to use resource that add value to a particular agency.