United States Department of the Treasury: Treasury Cloud (TCloud)

The Treasury Cloud High (TCloud-H) system is owned and operated by the Department of the Treasury, serving as a multi-cloud IaaS/PaaS hosting environment designed to process High Impact level information. It includes the following multitenant, government-exclusive cloud platforms: • Amazon Web Services (AWS) GovCloud East/West, • Oracle Cloud Infrastructure (OCI) GovCloud East/West, • Microsoft Azure GovCloud East/West, and • Google Cloud Platform (GCP) GovCloud East4/Central1 TCloud-H FedRAMP’ed environment is offered as a shared service to Treasury Bureau’s, available in two cloud hosting models: Boundary Protected and Managed. Contractual support from each cloud vendor is in place to design, build, maintain, and manage every individual platform based on the hosting model. TCloud-H allows Treasury customers to incorporate innovative tools and forward-thinking IT solutions throughout the design, build, and maintenance phases of a cloud-based project. TCloud provides the following Boundary Protected and Managed services to meet business or mission requirements: Boundary Protected Hosting Environment • Cloud account provisioning and invoicing, with transparency on service utilization with FinOps dashboards. • Intrusion Prevention Services (IPS); VPN; Direct connection with Treasury T-NET network. • Monitoring of network ingress and egress traffic. • Preconfigured networking resources. • Single Sign-On with connection to TCloud Active Directory. • IAM policies, groups, roles, preconfigured to enforce identify guardrails. • Audit trails and change monitoring that produce alerts and notifications to predetermined set of stakeholders. • Management, configuration, and provisioning of Atlassian software suite available for customers- JIRA, Confluence, Stash (BitBucket), and Bamboo. • Self-managed access to private or intra-VPC native cloud services and resources provided by each CSP. Managed Hosting Environment • Cloud account provisioning and invoicing, with transparency on service utilization with FinOps dashboards. • Remote Desktop Services. • Operating System (OS) level patching performed as part of monthly patch deployments. • Vulnerability scanning: OS and Databases. • Identification, prioritization, and mitigation of OS and Database level vulnerabilities. • Configuration management for OS and Databases. • Intrusion Prevention Services (IPS); VPN; Web Application Firewall (WAF); Direct connection with Treasury T-NET network. • Anti-Virus and Host Based Firewall. • Endpoint Detection and Response. • Audit log ingestion and monitoring (OS Level, Database, and CSP). • Directory services, accounts and permission management provided through Microsoft Active Directory. • IAM policies, groups, roles, preconfigured to enforce identify guardrails. • IAM audit trails and change monitoring that produce alerts and notifications to predetermined set of stakeholders. • Single Sign-On with connection to TCloud Active Directory. • Monitoring of network ingress and egress traffic. • Preconfigured networking resources, with audit trails and change monitoring that produce alerts and notifications to predetermined set of stakeholders. • Unified cloud security platform that includes vulnerability management, compliance and posture management, workload protection, and container security. • Disaster recovery and Contingency Planning - Backup and restore. • Disaster recovery and Contingency Planning - Different availability zones for resiliency. • Security incident and response monitoring and coordination with appropriate stakeholders. • Management, configuration, and provisioning of Atlassian software suite available for customers- JIRA, Confluence, Stash (BitBucket), and Bamboo. • Access to native cloud services and resources provided by each CSP.