How SBA Played a High Risk, High Reward Game in Hurricane Relief

Money, jobs and businesses are on the line. There’s tension, disagreement and pressure.

This isn’t Wall Street or the Oval Office. It’s the Small Business Administration (SBA), trying to reconcile its technology systems in the aftermath of a devastating hurricane.

The Category 5 Hurricane Maria struck Puerto Rico on September 20, 2017, ravaging the island and sending the U.S. government scrambling for disaster relief that reports say it was woefully unprepared for. The estimated death toll, initially misrepresented, is around 3,000.

In addition to the many lives lost, survivors were left to pick up the ruins. Shortly after the natural disaster, SBA increased its Puerto Rican workforce to offer disaster loans and relief to businesses that were rebuilding across the island.

Back in Washington D.C., SBA Chief Information Officer (CIO) Maria Roat and Deputy CIO Guy Cavallo received a request for $500,000 that would support the bolstered Puerto Rican SBA workforce. That money was to go to hardware – the same hardware that Roat and Cavallo had prioritized replacing.

In a high-stakes situation, Roat and Cavallo made a controversial decision: to shut down the acquisition of the hardware, which would have immediately patched the technology needs in Puerto Rico.

“We put our jobs on the line,” Cavallo said. “This is a place that people are hurting, businesses are underwater, and we’re telling you we’re not going to let you buy what you know will work because we believe the cloud can do it.” Cavallo was a recent panelist at ATARC’s 2019 GITEC Emerging Technology Conference on Monday, where he spoke about the power and capabilities of cloud.

That’s what it takes to go to the cloud, Cavallo said.

More Challenges

Roat and Cavallo needed a fix as quickly as possible and knew that the cloud-based desktop could deliver the solution, even better than the temporary hardware. After all, they had been planning the cloud migration since Roat took over in 2016.

And yet, the launch of the cloud was not as easy as an additional piece of hardware. The cloud-based desktop didn’t work immediately, and it took a week to tailor it to support a 12-year-old application.

“Again, we’re being threatened that you guys are holding up the help to go to people who are hurting,” Cavallo said. “We said, ‘No. We’re not going to approve this hardware purchase.'”

Not the Only Time 

SBA has been a leader for cloud adoption in the federal government, and the situation following Puerto Rico isn’t the only time that leadership has shut down a standard acquisition to promote cloud.

Roat and Cavallo also took a chance on the Homeland Security Department’s Continuous Diagnostics and Mitigation (CDM) program. CDM requires that agencies account for and report different elements of their security posture – including the access credentials and information that are stored on their networks.

As part of the larger vision, instead of paying the $150,000 CDM hardware fee, SBA heads proposed that they would report the same information using their security applications housed in the cloud. After receiving the permission of CDM personnel, SBA used its existing cloud application to field and report CDM compliance capabilities, all with six security tools in the cloud – instead of 38 hardware pieces.

The pilot is underway and involves all phases of CDM.

Proving an End Product

Roat and Cavallo have gone all in on cloud, seemingly living by the mantra of “no risk, no reward.” There was certainly plenty of risk along the way but now, the benefits are paying off.

SBA uses clouds from a variety of vendors – including Microsoft, Salesforce and Adobe – for purposes across the business spectrum. They all integrate, so security can monitor them all, without silos or onerous data gathering.

Security reports generate 4 million logs a day that artificial intelligence, enabled by cloud, can then evaluate. That dramatically reduces the security workload.

It also enables security to monitor when and where users log onto systems, unlike hardware that can be much more static. The visibility that the cloud allows for can stop malicious actions if a single user pops up in two separate locations.

These sorts of measures align with phases two and three of CDM.

“What we’re doing every day is showing that the power of cloud cybersecurity meets and exceeds the current CDM capabilities,” Cavallo said.

These benefits trickle into improvements in customer experience as well. SBA has reduced 47 communications systems into one Voice over Internet Protocol (VoIP), saving millions of dollars that can be put back into agency missions. It also leads to more consistency for users.

Then, the greater visibility in network protections has allowed SBA to power down 20 to 25 percent of its network consumption – securing networks and expanding bandwidth.

SBA has been recognized for its cloud adoption strategies and capabilities, and the office has received over 300 IT visitors at its sessions that demonstrate its cloud usage. Benefits include millions of dollars in savings and cost avoidance, as well as fewer systems to monitor, enhanced security and improved phone line experience for customers.

Results from going to the cloud are apparent, but the long-term gains will continue to show up in the communities that are being serviced, such as Puerto Rico. SBA disaster resources for the island can be accessed here.

However, to realize the benefits of cloud, forward-thinking and risk-taking endeavors are needed to push forward the change.

“We were willing to lose our jobs because we believed in the cloud,” Cavallo said. “If you don’t have that leadership at the top, stop going to the cloud, because you’re going to fail.”