Should Our Strategy Shift from Cloud First to On-Premises Due to the DoD’s Recent Memo on FedRAMP Moderate Equivalence Requirements?  

As we move further into a regulation-dominated digital era where privacy and information security are becoming critical to business success, should we expect companies doing business with the DoD to reconsider “Cloud First” for traditional on-premises solutions or data centers?  

If the DoD FedRAMP memo sticks, it is very likely. This is primarily due to the escalating costs associated with maintaining compliance for cloud services.

Cloud service providers have been the cornerstone of modern IT infrastructure, offering scalability, flexibility, and cost efficiency. However, as regulatory environments become more complex and stringent, compliance costs are soaring, and so will the cost of cloud offerings for the Defense Industrial Base (DIB). 

These costs go beyond financial investments and include the time and resources required to ensure cloud services meet industry-specific regulations (hello, DFARS 252.204-7012). And this isn’t exclusive to the DIB — the finance sector also faces increased requirements, with the Federal Trade Commission (FTC) continuing to mature its privacy and information security requirements on banking and non-banking financial institutions and their respective third-party service organizations. 

In these scenarios, companies find that maintaining control over their data on-premises can be more cost-effective and secure. This shift also offers better customization, as businesses can tailor their IT infrastructure to specific needs without the constraints of a one-size-fits-all cloud solution. 

This doesn’t mean the cloud is losing its relevance. Instead, we may be witnessing an evolution in IT and business operation strategies. In this new balanced approach, organizations weigh the benefits of the cloud against the unique compliance, security, and cost challenges they face and the advantages of bringing their digital assets on-premises to a data center (or colocation). 

In fact, we are already witnessing organizations that initially believed a cloud-only security enclave was the answer now accepting the inevitable reality that hybrid is the more realistic model for achieving security and compliance while maintaining business operations.  

In the hybrid approach, organizations use cloud services for specific applications and processes. Other applications and processes are kept on premises or hosted in a data center, resulting in a more cost-friendly approach to creating a controlled and compliant environment.  

The Advantages of Cloud Enclaves: 

• Scalability and Flexibility: Cloud enclaves offer unparalleled scalability, allowing organizations to quickly deploy virtual services and adjust resources in response to changing needs. 
• Cost-Effectiveness: Cloud enclaves often reduce upfront capital expenses, shifting to a more predictable operational-spending model. Additionally, the right cloud enclave may already include a significant percentage of the security protection assets required to meet many regulatory and contract requirements. The cloud enclave may assume management of the enclave; however, the organization is still responsible and accountable for meeting all legal, regulatory, and contractual obligations.  

The Advantages of On-Prem Storage: 

• Enhanced Control: On-premises solutions give the organization total control over its infrastructure and data. 
• Security and Compliance: Hosting sensitive data on-premises can simplify compliance with stringent regulations, offering a more secure environment for critical information. However, the organization may have a more significant technical debt with the required security protection assets to meet compliance and manage risk.  
• Performance Reliability: On-prem storage can perform better for specific applications, mainly where low latency is crucial. 

Why the Hybrid Approach Might Be the Best:

The hybrid model is increasingly considered the best of both worlds. It allows organizations in the DIB and GovCon sectors to leverage the strengths of both cloud and on-premises solutions. 

• Customized Security and Compliance: Organizations can tailor their security and compliance strategies more effectively by using cloud services for less sensitive tasks and keeping highly confidential data on-premises. 
• Balanced Cost and Performance: Hybrid solutions can optimize costs by using cloud services for scalable needs while maintaining on-premises infrastructure for critical operations. 
• Flexibility and Future-Proofing: This approach offers the flexibility to shift between cloud and on-premise solutions as needs and technologies evolve, ensuring a future-proof, resilient, and scalable IT strategy. 

As organizations navigate this complex terrain, they must strategically assess their needs. Business leaders, technical leaders, and key stakeholders must evaluate the risk of business operations and identify their technical needs, while also considering data sensitivity, regulatory and contractual requirements, and cost implications. The key is not to choose one over the other but to find the right balance that aligns with your organization’s unique challenges and objectives.