Four federal departments have not fully implemented cloud security practices, GAO says

A Government Accountability Office report examining the implementation of cloud security practices at four department-level agencies found that none of them have fully applied those practices to date. 

The report, released on Thursday, describes the efforts at the departments of Agriculture, Homeland Security, Labor and Treasury in implementing six key cloud security practices, finding differing degrees of progress, depending on the agency. 

"Cloud services offers federal agencies a means to buy services more quickly and possibly at a lower cost than building, operating and maintaining these computing resources themselves," GAO said in a letter to several members of Congress who follow information technology policy. "However, as we have previously reported, the use of cloud computing also poses cybersecurity risks. These risks arise when agencies and cloud service providers do not effectively implement security controls over cloud services.”

GAO noted that some of the agencies had fully implemented at least some cloud security practices across their systems, with USDA, DHS and DOL each ensuring that they had defined security responsibilities across their systems and had documented incident response and recovery procedures.

But the agencies split from there. DHS and DOL had fully documented their identity, credential, and access management policies and procedures, a key zero trust metric, but Labor Department officials had only finished implementing continuous monitoring on two of its four systems. Meanwhile, DHS officials had only partially put continuous monitoring in place on its four systems, as had USDA on its three. 

When it came to defining security performance metrics with CSPs in their service level agreements, USDA, DHS and DOL did not implement an evaluation criteria or practice on at least one system, ranging from a lack of defined performance measurement and enforcement mechanisms to agreements that did not have defined performance metrics.

Most starkly, all of the agencies lagged on addressing Federal Risk and Authorization Management Program requirements, with each of them failing to require their CSPs to comply with the cloud security program on at least one system.

The Treasury Department was the only agency to have fully implemented all six security practices on at least one network, but it has yet to executed any of them across all of four networks. 

“Fully implementing the selected key practices will support the agencies’ efforts to ensure the confidentiality, integrity and availability of agency information in their cloud systems,” the report said.

GAO offered a total of 35 recommendations to the four agencies. USDA, Treasury and DHS officials generally concurred with their recommendations, with DHS offering more technical detail to the GAO.

DOL officials neither agreed nor disagreed with the recommendations, but offered GAO information on its actions to address while providing other details. 

“Increased cloud computing adoption opens the door for the federal government to provide higher quality services at lower costs," said Rep. Gerry Connolly (D-Va.) in a statement about the report. "But any successful modernization strategy must also have security measures baked throughout. Embracing new technologies cannot sacrifice product quality, cost, or cybersecurity. GAO’s recent cloud security report rightly pushes agencies to bolster their continuous monitoring efforts."