States making slow, steady progress to the cloud
Connecting state and local government leaders
Budgeting, cybersecurity and legacy technology are proving stumbling blocks to migration, according to a new NASCIO report.
State governments are relative newcomers to the cloud market, and although CIOs are seeing benefits from it, migration is slow-going, a new report found.
“Most government organizations still have no more than 20% of their workloads in the cloud,” according to “A fresh look: Capitals in the Clouds,” a study that Accenture and the National Association of State CIOs released Oct. 11. Cloud first appeared on NASCIO’s State CIO Top Ten priorities list in 2010.
Several “growing pains” contribute to the low use rate, the report states. For one, many states still use annual capital expenditures to budget for cloud spending, which is not flexible enough. There are signs of a switch, however: Twenty-four percent of survey respondents said they prefer this funding model, while 54% said their use operating expenditure budget.
Another pain point is the persistence of legacy technology, with 89% of respondents saying they still have a mainframe computer, and 71% reporting they have not moved any mainframe applications to the cloud. The primary driver for moving to mainframe-as-a-service is cost savings, according to 42% of respondents. Operational simplicity (23%) and legacy applications (8%) were others.
Further complicating the matter is the range of definitions states have for “the cloud.” For instance, 20% of respondents said they consider off-premise computing to be the cloud, while 40% use the National Institute of Standards and Technology’s definition, which is what the report used, too.
Cybersecurity is a perennial challenge to cloud adoption, and this survey found that 66% of respondents feel that traditional security solutions don’t work in the cloud. The most-required cloud certification or standards programs are the Federal Risk and Authorization Management Program (63%) and vendor-specific certification (43%). When it comes to more granular security, only 66% of respondents said they have a process for managing cloud-related privileged permissions, and 63% said cloud access activities are monitored.
In states that have moved to the cloud, a majority say that their service desk isn’t integrated with cloud service providers’ (CSPs) services, but that is key to long-term success, the report states, because it allows for real-time problem-solving.
What’s more, states must keep better track of their applications, the report found. Fifty-seven percent of respondents said they have a statewide application inventory, 40% have an application risk assessment and 34% use a legacy application assessment. “The key to understanding what can be migrated to cloud, and in what order, is understanding the applications in the current application portfolio, their characteristics and their associated business priorities and risks,” the study states.
To overcome these challenges, states must not only migrate to the cloud, but also implement new operating models to maximize cloud’s benefits. For example, they need new governance models and financial processes to glean cost savings from cloud. Additionally, they must rework security to understand how to architect and configure it within cloud environments, the report states, and IT organizations must become more agile with procurement and development to make the most of cloud’s scalability.
Almost 90% of respondents said that a hybrid cloud is their ideal approach. An explosion in the number of CSPs has led some states -- 44% based on the survey -- to use external cloud brokers to help manage services, largely platform- and software-as-a-service offerings.
Only 54% of states report having a cloud IT change-management strategy, and of those, 95% report that it is integrated with the state’s IT change-management plan, according to the report.
“To effectively manage the increasing complexity of cloud environments, an IT change management process and governance structure is critically important to control the cloud environment, reduce operational and security risk and maintain service delivery agility,” according to the study.
The research is based on a May survey of 35 state government CIOs and in-depth interviews with CIOs in seven states.