5 Myths of Cloud Migration at Federal Agencies

It’s full steam ahead—Federal organizations have the green light to move ahead with IT modernization efforts. From the Modernizing Government Technology Act and the White House American Technology Council Report to the 2018 President’s Management Agenda, the vision—and the need—for IT modernization is clear.

Cloud migration is a top priority in the push to modernize federal IT systems. Many government organizations recognize the importance of adopting cloud services, but often have misconceptions around cost savings and security risks, among other things.

Here are five key myths about cloud migration—and the reality. 

Myth No. 1: The cloud is always cheaper.

The Reality: As part of a migration strategy, you should consider the application’s or solution’s total cost of ownership. For siloed, non-transactional applications, a standard “lift and shift” migration to the cloud might not be worth it. There are many reasons to move to the cloud, including easily deploying new capabilities to your applications, or elastic scaling based on demand. But for some workloads, you may not see an immediate drop in operational costs.

Myth No. 2: All our organizational data should be in the cloud. All our data processing should take place there, too.

The Reality: There’s not always enough pipe and bandwidth for all your data to be in the cloud. Attempting to move large amounts of data from the cloud to the end user, or to “the edge,” can strangle the network. With data-intensive workloads or analysis that requires a significant amount of processing (e.g., machine learning algorithms), a hybrid architecture or decentralized data processing may be a more reasonable model.

Myth No. 3: Cloud is inherently insecure. It can’t support my organization’s most sensitive workloads or data.

The Reality: Not true. The proliferation of industry-mandated security frameworks—such as the Federal Risk and Authorization Management Program (FedRAMP), the Risk Management Framework (RMF), and the National Institute of Standards and Technology (NIST)—as well as contemporary tooling and monitoring, and dedicated cloud service provider (CSP) enclaves that align to a broad set of data sensitivity levels means the commercial cloud can address nearly all workloads, including those managed by the Department of Defense (DOD) and intelligence communities. The critical aspect of an organization’s migration and hosting strategy can be found in the ability of the application owner, integrator, and CSP to properly delineate where responsibility lies for securing the different layers of application and infrastructure architecture.

Myth No. 4: To take advantage of the cloud, my organization should adopt an enterprise-wide, or application-wide, cloud-native architectural approach.

The Reality: There’s tremendous efficiency and flexibility in being able to decompose your workloads into container-based microservices that can be independently updated, scaled, and deployed. However, shifting to a cloud-native environment doesn’t have to be a “big bang” event. Establishing interim milestones such as introducing domain-driven design, containerizing traditional applications, and maturing your DevSecOps pipeline will move you down the path to cloud native and provide transitional operational efficiencies and benefits.

Myth No. 5: In the event of a disruptive event such as a power outage, natural disaster, or cyber attack, we need a multi-CSP strategy as our failover and disaster recovery (DR) plan for application workloads.

The Reality: Architecting cross-CSP backup and recovery for a single workload can result in paying a high cost for a low-risk event. The chance is infinitesimal that all of your cloud service provider’s availability zones would go down at the same time. Instead, start by building fault tolerance into your architecture, take advantage of multiple availability zones within your cloud service provider’s ecosystem, and conduct a risk-based cost-benefit analysis as a part of DR planning.

The reality is, government agencies need to consider many issues—cost, security and scale, among others—in a cloud move. The Federal Government and DOD, in conjunction with CSPs, are lowering the barrier to cloud migration. Integrators that understand the mission and agency data can help federal agencies develop and implement a strategic cloud approach that balances long-term organizational needs with technological advances.