Management of Cloud Computing Contracts and Environment
Background
The Council of Inspectors General on Integrity and Efficiency asked inspectors general in the federal community to participate in an audit of cloud computing contracts. Cloud computing provides on-demand network access to shared resources that can be rapidly released and allows customers to take advantage of cutting edge technologies at a reduced cost. Hosted services are offered by providers that host physical servers in a different location. The audit was designed to provide insight on how well the federal government is protecting data and its progress in moving towards cloud computing.
As a participant in this audit, our objectives were to determine if the U.S. Postal Service’s cloud service contracts comply with applicable standards and evaluate management’s efforts to adopt cloud computing technologies.
What the OIG Found
The Postal Service’s cloud computing contracts did not comply with all applicable Postal Service’s standards. Specifically, the Postal Service has not defined “cloud computing” and “hosted services,” established an enterprise-wide inventory of cloud computing services, required suppliers and their employees to sign non-disclosure agreements, or included all required information security clauses in its contracts.
In addition, management did not appropriately monitor applications to ensure system availability. Management also did not complete the required security analysis process for three cloud services reviewed and did not follow Postal Service policy requiring cloud service providers to meet federal government guidelines. This occurred because no group is responsible for managing cloud services, and personnel were not aware of all policy and contractual obligations.
Without proper knowledge of and control over applications in the cloud environment, the Postal Service cannot properly secure cloud computing technologies and is at increased risk of unauthorized access and disclosure of sensitive data. We claimed $33,517,151 in contractual costs for the Postal Service not following their policy and contract requirements.
What the OIG Recommended
We recommended management define “cloud computing” and “hosted services,” develop an inventory of cloud services, monitor suppliers and require them to be certified, and revise contracts to include security clauses. We also recommended management evaluate best practices for cloud computing contracts, complete the security analysis process, and ensure compliance with non-disclosure clauses.