Federal technology upgrade could see security, SaaS outlay

Cybersecurity in the spotlight

The SolarWinds Orion attack, which the federal government's lead investigator said compromised nine federal agencies, has raised cybersecurity's profile. In a February 2021 White House briefing, Anne Neuberger, deputy national security advisor for cyber and emerging technology, said the government's objective is to "modernize federal defenses and reduce the risk of [the incident] happening again."

Sean McDermott

"What I find actually encouraging is the Biden administration digging up this SolarWinds hack and looking into that more," said Sean McDermott, president and CEO at Windward Consulting Group, a Herndon, Va., company that has a federal market focus. "I am hoping that the SolarWinds hack is a wakeup call to the government."

The stimulus package designates $650 million for the Cybersecurity and Infrastructure Security Agency (CISA), which plays a risk advisory role in the federal sector. CISA initiatives include the Continuous Diagnostics and Mitigation (CDM) Program, launched in 2012 to implement government network and system security tools. The government could potentially expand the CDM Program and help integrate siloed cybersecurity deployments. Agencies have begun to adopt extended detection and response (XDR) tools for a more holistic, enterprise view of security detection, said Dave McClure, principle director and federal CIO advisory services at Accenture Federal Services.

Dave McClure

"CDM tools have been around a while but are often used in disparate ways across departments or agencies," McClure said.

Accenture offers XDR for Government, an as-a-service offering authorized by the Federal Risk and Authorization Management Program (FedRAMP). The government's FedRAMP program gives seals of approval for the cloud-based services that agencies plan to adopt.

CISA's Einstein program, which aims to function as an early warning system for agencies, could also be in for some changes. Einstein 3 Accelerated, Einstein's threat detection component, faces some limitations.

Frank Loulourgas

"CISA's Einstein program was ahead of its time in the early 2000s," said Frank Loulourgas, vice president of service delivery at InterVision, an IT service provider based in Santa Clara, Calif., and St. Louis. "Currently, Einstein 3 Accelerated protects some federal traffic at the ISP level but does not extend to the contractor space or other data transmission methods."

Loulourgas said he'd like to see the Cybersecurity Maturity Model Certification (CMMC), a cybersecurity standard for the government's defense industry base, applied more broadly. The CMMC intends to have federal contractors who handle controlled unclassified information adopt a tiered, easier-to-implement security standard, he said. He cited the standard's varying security tiers, which are based on the sensitivity of data an organization handles, and third-party auditing as plusses for CMMC. Defense procurement rules currently call for self-audits.

"While the CMMC is still in its infancy, I would like to see this concept applied to all levels of federal data and organizations," Loulourgas said. "A tiered, simplified security model across all agencies that is consistently audited and reported would be a significant improvement over the current model of different requirements per agency."

Steve Levine

Steve Levine, director of federal sales at SHI International Corp., a solution provider based in Somerset, N.J., pointed to zero-trust frameworks as another cybersecurity trend to watch in the federal IT market. "Agencies are looking at vulnerabilities," he said. "They want to protect their data and their end points and the surface of attacks."

Cloud adoption trends

Cloud computing, another federal focus, has encountered some obstacles on the procurement side. The Pentagon's $10 billion Joint Enterprise Defense Infrastructure (JEDI) contract has been embroiled in legal disputes since its award to Microsoft in 2019. AWS, which bid unsuccessfully for JEDI, has contested the contract. The Department of Defense (DoD) has said it will reassess the program if a federal judge allows AWS' case to proceed.

JEDI "will likely never see the light of day," Loulourgas said. "The concept of a single cloud for government use is falling to the wayside in lieu of a multi-cloud approach."

The advent of government clouds such as AWS GovCloud and Azure Government Top Secret provide agencies with a number of options depending on data types, classification and requirements, he noted.

Levine cited the General Services Administration's IT Schedule 70 and NASA's Solutions for Enterprise-Wide Procurement V contract vehicles as popular agency destinations for cloud. Other contracts, such as the Army's Information Technology Enterprise Solution-3S Services, also support cloud offerings, he said.

While a growing roster of government cloud deals should compensate for the potential loss of JEDI, the COVID-19 pandemic seems to have created another hurdle. Cloud investment among agencies slowed in fiscal year 2020 compared with previous years. The federal cloud spending growth rate for 2020 dropped to 9% from 25% in FY 2019, according to research from Deltek, a software firm based in Herndon, Va.

In fact, one portion of the federal cloud market shrank in 2020. Deltek's analysis of DoD's Other Transaction Authority procurements found that cloud-related spending declined to $316 million in FY 2020 from a high of $383 million in FY 2019.

Alex Rossino

"These data sets lead me to believe that the impact of the federal government's COVID-19 response, especially the move to full-time remote telework, slowed investment related to the engineering of existing systems to make them cloud-ready and the implementation of some new systems," said Alex Rossino, senior principal research analyst at Deltek.

Federal cloud spending will rise in FY 2021, but the continuation of public health protocols will temper that growth, according to Deltek. Most of the COVID-19 preventive measures implemented during FY 2020 remain in place nearly halfway through FY 2021, Rossino noted. The government's fiscal year ends September 30.

By Rossino's estimate, federal FY 2021 cloud spending will reach between $8.7 billion and $9 billion, compared with $8.04 billion for FY 2020 -- an uptick in spending "but still a slower rate of growth than pre-crisis," he said.

Federal technology modernization

Cloud investment will play an important role in agencies' modernization and digital transformation efforts, industry executives said.

"The only way the government is going to modernize is by going to the cloud," McDermott said. "They can't just modernize in place like other organizations can."

The adoption of SaaS platforms will become a major part of agencies' modernization strategies, he noted. That approach could prove easier than trying to rewrite a legacy application and migrate it to the cloud.

McDermott and McClure cited expanding deployments of ServiceNow in the government sector. Windward Consulting and Accenture both work with the SaaS vendor, which has steadily grown its partner outreach in recent years. Cloud platforms, in general, let agencies obtain considerable out-of-the-box functionality but still address agency-specific needs using low-code tools.

Brendan Walsh

Cloud platforms such as ServiceNow and AWS also offer cost-efficiency, said Brendan Walsh, senior vice president of partner relations at 1901 Group, an MSP and wholly owned subsidiary of Leidos based in Reston, Va. Agencies can take advantage of a platform's FedRAMP authorization versus incurring the expense of pursuing FedRAMP status on their own for each customer and project, he said.

In addition, the cloud offers speed. Building new systems from scratch would make it difficult for agencies to address the urgency of modernization and keep up with the pace of technology change, Walsh said.

The planned $1 billion investment in TMF, meanwhile, would offer an additional boost for cloud migration and systems modernization. The capital infusion could fuel larger-than-usual projects, McClure said.

"In the past, projects under TMF have been relatively small in the $5 million to $10 million range," he said.

TMF also provides a more stable source of funding because it's a multiyear mechanism, as opposed to an annual appropriation, McClure added.