The Department of Transportation has taken steps to transition to cloud computing, such as establishing a multi-modal Cloud Working Group, but it has not taken other actions needed to ensure an effective transition, the department’s inspector general has said.
It said, for example, that Transportation has not established or updated guidance on contracting for IT services to include cloud systems and lacks requirements for specific contract clauses needed to ensure that cloud service providers keep agencies’ data secure and available, such as provisions that cover maintenance of data integrity, accessibility, and confidentiality.
The department also has not established standards for assessing costs and benefits of cloud systems, and cloud system oversight is ineffective, the IG said.
The department agreed with recommendations including to develop guidance for acquisition of cloud services, cost and savings analysis, and operational support for use of those services, and to develop a process to verify that non-disclosure agreements and language regarding discovery and investigatory access requirements are included in future cloud contracts.