The Department of Transportation (DOT) recently began shifting to cloud computing, including forming a multi-modal Cloud Working Group, but has not yet developed a clear process to guarantee a smooth transition.
As of this week, the DOT still needs to create or update the department’s guidelines for contracting IT services, including cloud systems. Because of this, the guidelines do not account for requirements on specific contract clauses that will guarantee the cloud service providers maintain secure and available data from the agency. These steps must be taken to maintain data accessibility, security and confidentiality. Each of the cloud contracts with the DOT still needs a provision for this data.
In addition, the DOT still needs to create standards that will assess the benefits and costs of cloud systems. Because of this, operating administrators are unable to determine whether the cloud achieves expected benefits, including cost-effectiveness.
The DOT must create an accurate inventory of its own cloud systems to guarantee effective information system risk management. The department said it has 14 cloud systems, but just 11 of these are legitimate cloud systems. However, only five were correctly identified in the
DOT inventory of IT systems. Four were identified as non-cloud
systems, and two were not even in the inventory.
Experts have offered remedies for these issues, and DOT has been receptive to these recommendations.
