Federal Cloud Computing Vision and Strategy

1. Cloud Computing InitiativeVision and Strategy Document(DRAFT) February 2010 GSA Confidential and Proprietary – Not for Distribution

2. Federal Cloud Computing Vision and Mission Cloud Computing Vision Statement Establish secure, easy to use, rapidly provisioned IT services for the Federal Government, including: Agile and simple acquisition and certification processes; Elastic, usage-based delivery of pooled computing resources; Portable, reusable and interoperable business-driven tools; Browser-based ubiquitous internet access to services; and Always on and available, utility-like solutions. Cloud Computing Mission Statement Drive the government-wide adoption of cost effective, green and sustainable Federal cloud computing solutions. 2 2 This information is draft and has not been published, please do not disseminate

3. Cloud Capabilities Must be Tailored to Government’s Unique Needs Federal Government Considerations for Cloud Computing Cloud Computing Services Security & Data Privacy Delivery & Operations Interoperability & Integration • Software as a Service (SaaS) • Citizen Engagement (Wikis, Blogs, Data.gov) • Government Productivity (Cloud based tools) • Business Enablement (Salesforce.com) • Enterprise Applications (Core Mission & Business Svcs) Offer different levels of security and data privacy based on the application and nature of the services provided. Potential standardize Low, Med and High categories for Simplicity. Enable adoption of Cloud Computing services in different Cloud models including Public, Private, Hybrid and Community models. Develop interoperability standards in conjunction with the industry to provide interoperability at the data infrastructure, platform and application levels. • Platform as a Service (PaaS) • Database and Database Management Systems • Developer / Testing Tools • Virtual Environments • Infrastructure as a Service (IaaS) • Computing • Storage • Application hosting GSA Confidential and Proprietary – Not for Distribution 3

4. The NIST Definition Offers Multiple Delivery Models for Cloud Computing Outsourced Cloud Sourcing Models Government High Private Cloud Commercially Hosted: Publically available Cloud Computing services offered through commercial sources that are dedicated and separate from the Public both physically and logically and must to remain within the U.S. borders to support heighted data security and privacy requirements. Access to these services are provided through a dedicated Government Intranet and is not accessible from the Public Internet. Private Government Cloud : The cloud infrastructure is operated solely for an organization. It may be managed by the organization or a third party and may exist on premise or off premise. Private Commercially Hosted Cloud Government Dedicated Intranet Private Government Cloud Trust (Security and Data Privacy) Community Cloud: The cloud infrastructure is shared by several organizations and supports a specific community that has shared concerns (e.g., mission, security requirements, policy, and compliance considerations). It may be managed by the organizations or a third party and may exist on premise or off premise. Hybrid Cloud: The cloud infrastructure is a composition of two or more clouds (private, community, or public) that remain unique entities but are bound together by standardized or proprietary technology that enables data and application portability (e.g., cloud bursting). Public Cloud: The cloud infrastructure is made available to the general public or a large industry group and is owned by an organization selling cloud services. Community Cloud Public Cloud Public Internet Low Hybrid Government Cloud GSA Confidential and Proprietary – Not for Distribution 4

5. Federal Cloud Computing Goals and Objectives • Enable Implementation and Adoption • Assist and Guide Agencies to Implement and Roll out Cloud Solutions (e.g. Service Provisioning) • Facilitate Identification of Agency Partners for Pilot Activities • Develop Methodologies to Effectively Assess and Implement Services • Develop and Disseminate Cloud Services Operating and Business Models • Enable Sustainable & Cost-Effective Computing (Green IT, TCO) • Develop and Manage Business Case Templates • Identify Core Evaluative Criteria • Identify Cloud Computing Performance Metrics (Enterprise and Technical) • Develop Case Studies, Best Practices/Lessons Learned to Specifically Demonstrate Support of Sustainability and Cost Effective Computing • Operate as a Service Provider • Identify and Offer Government Wide Services (e-mail, instant messaging, Web 2.0 tools, etc) • Assist Agencies in Determining Their Role in Developing/Hosting Services • Facilitate Common Interfaces to Integrate Existing Federal Cloud service environments • Conduct Outreach Activities • Develop the Cloud Services Communications Plan • Design and Implement a Central Information Portal for Federal Cloud Computing • Develop and Manage Content for Communications • Manage Cloud-related Wikis, Blogs, Portal, and other collaborative media • Develop and present Training • Establish and Manage Governance • Manage Cloud Computing Executive Steering Committee and Cloud Computing Agency Advisory Council • Establish and Manage Communities of Practice and Working Groups • Coordinate Policy and Strategy Development and Participation in other Governance bodies related to Cloud Computing activities (e.g. Security, Records Management, eDiscovery) • Establish a Federal C&A Process • Provide Procurement Leadership • Develop Acquisition Vehicles to Ease Agency Procurement of Cloud Computing Solutions • Coordinate across the Federal Acquisition community to ensure adoption and implementation of cloud-related procurement policies and processes • Facilitate Adoption of the Cloud Computing Storefront • Drive Cloud Technology Innovation • Identify Common Cloud Services and Foster Standards Development and Security Policies • Develop Architectures that Allow Agencies to More Effectively Implement and Leverage Cloud Computing Services • Establish, Manage and Coordinate Cloud Computing Developer Communities and Application Libraries • Enable the Reuse, Modularity and Interoperability of Cloud Computing Services 5 This information is draft and has not been published, please do not disseminate

6. Federal Cloud Computing Goals and Primary Objectives and Initiatives Goal Area Primary Objective Primary Initiative Establish a Security Working Group Establish Security Initiative and Implement and Manage a Federal C&A Process Establish and Manage Governance Create Federal policies on security, standards, and governance Lead Drive Cloud Technology Innovation Identify Common Cloud Services & Foster Standards Development & Security Policies Develop Requirements for Portability Standards Develop Acquisition Vehicles to Ease Agency Procurement of Cloud Computing Solutions Develop Acquisition Roadmap Provide Procurement Leadership Provide cloud computing solutions in support of Federal agency missions Facilitate Implementation Assist & Guide Agencies to Implement Cloud Solutions (e.g. Service Provisioning) Identify and Facilitate Cloud Computing Agency Pilots Enable Operate as a Solutions Provider Develop the Cloud Services Business Model Develop Services Roadmap Design and Implement a Central Information Portal for Federal Cloud Computing Establish Communications Initiative and Develop Portal Conduct Outreach Activities Provide strategic roadmaps, best practices, and acquisition guidance Enable Sustainable & Cost-Effective Computing (Green IT, TCO) Identify Cloud Computing Performance Metrics Establish Performance Metrics Initiative Support Define Data Center Optimization Strategy Develop Data Center Analysis and Agency Goals 6 6 This information is draft and has not been published, please do not disseminate

7. Federal Cloud Computing Transition Plan Workstream 2010 2011 … Program Management/ Governance/ Communications Manage ESC, CCAC and Working Groups (ongoing) Conduct Outreach Activities (Summits, Online Discussions, Training, etc.) Finalize Communications Plan Develop Portal Coordinate with Working Groups and Agencies to Collect Content for Portal (ongoing) Coordinate Policy and Strategy Development (eDiscovery, Records Management, Privacy, etc.) Identify Integration and Coordination Points between Working Groups and other Government Fora (ongoing) Standards Develop Standards Roadmap Work with Industry Standards Bodies (ongoing) Validate Standards Use Cases Identify Security Standards Requirements Work with Agencies on Enabling Standards Adoption (ongoing) Identify Manageability Standards Requirements Identify Interoperability and Portability Standards Requirements Security Stand Up Federal C&A Process Work with Agencies and Industry to Facilitate Use of the Federal C&A (ongoing) Fully Inventory Security Challenges (e.g. identify FISMA gaps) Implement and Manage Pilots Identify Pilots or Other Projects that can Test Security Issues Identify Security Policy Issues, Coordinate Feedback and Determine Recommendations Acquisition/ Procurement/ Services Develop Acquisition Roadmap Coordinate Across the Federal Acquisition Community to Implement Procurement Policies Develop Services Roadmap Establish, Manage and Coordinate Developer Communities and Application Libraries Award IaaS Release PaaS RFI Develop Guidelines for Leveraging Contract Vehicles Develop Draft SOWs Facilitate Adoption of Apps.Gov Maintenance of Apps.Gov (ongoing) Adoption and Implementation (Sustainable and Cost-Effective Computing and Data Center Consolidation and Optimization) Identify Technology Center Initiatives and Agency Pilots Implement, Manage Pilots and Capture Best Practices and Lessons Learned Develop Cloud Computing Maturity Model Develop Cloud Computing Implementation Guide for Agencies Establish Performance Metrics Initiative Identify Cloud Computing Performance Metrics Develop Cloud Segment Architectures Assist Agencies in Implementing/Providing Cloud Solutions and Services Develop Data Center Recommendations for Agencies Develop and Manage Templates Develop Analytic Framework Develop Data Center Assessment Guide and Maturity Model Conduct Data Center Analysis Identify Data Center Pilots and Develop Tools Assist Agencies in Data Center Optimization Strategies This plan is currently under consideration and should be considered Notional/Draft. 7 7

8. Cloud Computing Initiative: Governance Model Gov Agencies The Cloud Computing PMO is the nucleus of Cloud Computing Initiative for the Federal Government, setting direction, establishing guidelines and defining the future vision and architecture • Cloud Computing Vision / Mission • Information Portal • Market Research / Use Cases • Policies and Guidelines • Enterprise Architecture • Apps.gov / Procurement Support • Information Dissemination • Virtual Online Summits • Data Call • Requirements • Interests & Feedback • RFI/RFPs • Definitions • Security Requirements • Standards Requirements • SLAs CCPMO • Standards Requirements • Security Processes • Procurement Approaches • Best Practices • Gov-wide Communications Vendors CCESC/ CCAC Security Cloud Computing Working Groups Standards • Compliant Services and Offerings • Input to Standards • Collaboration on Developing Standards & Best Practices • Direction and Guidance • Facilitation • Schedule and Coordination Ops Excellence Comm 8

9. Working Groups Provide Support Across All of the Goal Areas and are Driven by the CCPMO Cloud Computing Program Management Office Goal Area • Security Working Group • Identify Functional Leader and Membership • Develop Objectives for Cloud Computing Advisory Council Security Working Group (e.g. Establish a Federal C&A Process) • Define Intended Deliverables • Develop Security Roadmap • Standards Working Group • Identify Functional Leader and Membership • Develop Objectives for Group • Define Intended Deliverables • Develop Standards Roadmap • Operational Excellence Working Group • Identify Functional Leader and Membership • Develop Objectives for Group • Define Intended Deliverables • Develop Operational Excellence Roadmap • Assist and Guide Agencies to Implement and Roll out Cloud Solutions • Develop Case Studies, Best Practices/Lessons Learned • Facilitate Identification of Agency Partners for Pilot Activities • Develop Methodologies to Effectively Assess and Implement Services • Develop and Disseminate Operating Models and Business Processes • Communications Working Group • Identify Functional Leader and Membership • Develop Objectives for Group • Define Intended Deliverables • Develop the Cloud Services Communications Plan • Design and Implement a Central Information Portal for Federal Cloud Computing • Develop and Manage Content for Communications • Develop and Conduct Training Establish and Manage Governance Each Working Group will ultimately establish its own objectives and plan of action – items referenced here are just a sample Provide Procurement Leadership Enable Adoption and Implementation Operate as a Service Provider Conduct Outreach Activities Drive Cloud Technology Innovation Enable Sustainable & Cost-Effective Computing (Green IT, TCO)

10. Government Cloud Services ModelOnline User Interface GSA Confidential and Proprietary – Not for Distribution 10

11. Federal Cloud ComputingCloud Program Services Model To deliver the Online User Interface, the government must address the following Service Components… 1 2 3 1 2 4 Application Library Customizable User Page Cloud Services 7 5 3 Online User Storage Provisioning / Admin Tools 6 Cloud Standards / Interoperability Collaboration Access / Connectivity 4 6 7 5 Security / Data Privacy 8 8 GSA Confidential and Proprietary – Not for Distribution 11

12. Government Cloud Services ModelCloud Relationship View Government Private Clouds Commercially Hosted Private Clouds Behind the scenes are the core cloud services that support the daily functions for Government employees Government Private Clouds DMZ DMZ Government Hybrid Clouds Single Sign on Security C&A Provisioning Integration Procurement Financials Reporting Management Public Cloud Vendors Public Cloud Vendors Internet GSA Confidential and Proprietary – Not for Distribution 12

13. Federal Cloud Computing Draft Services Framework Customer / Account Mgmt User Tools User Profile Mgmt Software as a Service (SaaS) / Applications Application Integration User/ Admin Portal Reporting & Analytics Citizen Engagement Gov Productivity Gov Enterprise Apps Wikis / Blogs Email / IM Business Svcs Apps Order Mgmt Social Networking Virtual Desktop Core Mission Apps API’s Analytic Tools Agency Website Hosting Office Automation Legacy Apps (Mainframes) Trouble Mgmt Data Mgmt Workflow Engine Platform as a Service (PaaS) Reporting Cloud Services Database Testing Tools Developer Tools EAI Billing / Invoice Tracking Knowledge Mgmt DBMS Directory Services Mobile Device Integration Product Catalog Infrastructure as a Service (IaaS) Data Migration Tools Storage Virtual Machines Web Servers Server Hosting CDN ETL Service Mgmt & Provisioning Service Provisioning SLA Mgmt Inventory Mgmt CoS/QoS Mgmt Utilization Monitoring App Perf Monitoring DR / Backup Operations Mgmt Security & Data Privacy Core Foundational Capabilities Auditing & Accounting Authentication & Authorization Data/Network Security Data Privacy Certification & Compliance Data Center Facilities Hosting Centers Routers / Firewalls LAN/WAN Internet Access GSA Confidential and Proprietary – Not for Distribution 13