Financial agencies are working with industry to adopt agile methodologies and DevSecOps to keep up with demand for government services
Federal financial agencies continue to deploy new technology and accelerate application development as a primary way of meeting their increasingly complex missions. With this approach, they will be able to more efficiently carry out their agency missions, provide citizens with top-quality services, improve customer experiences, streamline their internal processes and make the necessary operational enhancements required of a modern government agency. And industry is helping to ensure that those agencies are able to meet those goals in the most efficient and expeditious way possible.
Government and industry leaders addressed these issues at a recent FedInsider panel covering the road to application development and modernization. Topics discussed included agile development methods, DevSecOps, Continuous Integration and Continuous Delivery (CI/CD), automation and more.
The following are some of the most important aspects of the panel’s discussion.
Featured Experts:
Jawahar Kaliani
Deputy CIO for Application Services Delivery, Office of the Comptroller of the Currency
Simon Szykman
Senior Vice President
for Client Growth, Maximus
Chris Moran
Principal Architect, Cloud-Native
Application Development Lead, GDIT
Modernization Takes Hold at Financial Agencies
Agencies are adopting new tools, methodologies and modernization strategies to keep up with the innovation rapidly diffusing within the commercial financial sector. For example, the Office of the Comptroller of the Currency has worked with internal staff, stakeholders and business partners to develop a framework to address evolving technology. Part of that framework included adoption of agile practices and agile training.
“In the past few years, we have been focused on major technology modernization and some large business transformation efforts,” said Jawahar Kaliani, deputy chief information officer for Application Services Delivery in the Office of the Comptroller of the Currency. “So, we look at people, processes, an agile mindset and DevOps on the technology and data side.”
This also requires a shift in culture for agencies. “Culture change is the single biggest obstacle,” said Chris Moran, cloud-native applications development lead at General Dynamics Information Technology (GDIT). “What you need is a culture that wants to change. And a culture that wants to change will push for new technology, new processes, new roles, and new skill sets.”
To address this culture shift, Kaliani said they focused on upskilling and bringing best practices from other agencies and industry. They formed a Community of Innovation for staff to share ideas and best practices and also make them actionable. They also formed an Integrated Product and Platform Team so that product owners from the business side could work with developers and agile team leads.
“You have a product owner from business and a product lead from the technology organization, and both of them are driving toward that [goal],” Kaliani said. This shift allowed the office to improve the software development lifecycle on new products. New product development used to take over two years. Today, it’s down to just a few months.
Unique Missions Call for Agile Software Development
For federal agencies, the use of commercial software can be a cost-effective option, except when mission-specific requirements call for custom application development. In these cases, according to Simon Szykman, senior vice president for client growth at Maximus, unique needs can be at odds with traditional software development practices and ultimately delay service delivery, but that is changing with agile development. Its focus on rapid delivery and continuous improvement means software meets specific needs faster and has built-in flexibility for adjustments. “It’s become more acceptable to develop applications when needed, and along with that recognition are new approaches and methodologies.”
Szykman is referring to DevSecOps, an agile approach that enables rapid development of secure code more efficiently than the old waterfall method. Its combination of people, process and products deliver secure applications and updates continuously. Moran agrees, stating that, “Many [agencies] are still working with traditional gated SDLC [systems development life cycle] and have separate development and operations groups. The key advantage they are looking for when going to modern processes like DevSecOps is they want to respond quickly to changes and to automate everything.”
Szykman also pointed out that agencies need to continue operating their legacy systems and related processes while undergoing agile-based modernization. This maintains operational continuity and requires additional resources, but results in no gap in mission fulfillment and a better platform. While necessary for continuity, this arrangement incurs additional costs and resources until newer systems get deployed with the desired automation and efficiency.
Agile Development Supports Overall Organizational Maturity
Modernization efforts affect the whole organization, counsels Szykman, not just the development team and end users. For example, traditional requests for proposals (RFPs) with pages of numbered requirements and project milestones are not relevant with agile development, so contracting officers need a different approach. According to Szykman, he recommends that RFPs focus on functioning software delivered iteratively as a product updates, which avoids delays associated with multiple approvals.
“Agile development is a partnership between the government and industry partner,” he says, “so it’s best to start with a statement of desired outcomes and capabilities, and a general timeline.”
When a contract is awarded, Szykman suggests that agencies get the contractor, product owner and end user together to discuss in advance what the more detailed requirements are and how to groom and prioritize backlogs.
Modernization programs also push agencies to find other ways to mature as organizations. On the acquisition side, purchasing capabilities will change from the traditional approach of buying an application, especially if requirements aren’t identified in advance. Rather than having companies bid against a set of technical requirements, agencies should acquire units of development capability.
“Say we want contractors to bid on six to 10 DevSecOps teams and tell us the composition of those teams and the price for those teams,” Szykman said. “That’s a different approach, and that’s part of that maturity and an evolution in thinking about how to acquire these types of capabilities.”
Think about written proposals versus code challenges where offerers must build and submit prototypes for evaluation. That, Szykman said, is an effective way for companies to deliver high quality DevSecOps and application development services.
Lower Cost, Better Outcomes
Cost will always remain a major consideration for agencies seeking to modernize, and they always need to weigh that against the expected benefits. With agile methodologies, agencies save money because software gets deployed faster. Moreover, associated platforms such as cloud, containerization and microservices are all per-dollar or per-application more cost effective than deploying individual applications on individual servers inside of a data center. Lower maintenance costs for applications and the life cycle operations add to the cost advantage compared to lump sum, fixed price contracts.
According to Szykman, when this application modernization is taken to a portfolio level, the cost of ownership becomes even more reduced and technology becomes streamlined. “You’re negotiating better pricing because you’re buying more of one thing by discarding something else.”
Furthermore, modernization introduces greater automation, continuous integration and continuous delivery, and impact mapping to ensure that outcomes and requirements are directly linked to mission outcomes. “It’s all about accelerating the ability to get things into the hands of the end users,” Szykman said.
