I worry for having a centralized IT infrastructure as that now puts every single agency at risk from a single attack. No one would call a neighborhood "secure" if every home used the same key.

It's getting centralized anyways, just not inside any federal agency. Instead they're outsourcing it to companies like MS and Google who provide hosted services. This gives the agency cover so long as they do their part (like making use of MFA, using encryption on email). Then they can offer a claim of making their best-effort and going with industry "standards" (standard as in common, not as in ISO, ANSI, or others).

This is worse than what's happening today: every agency IT department being underfunded and operating in an ad-hoc, non-uniform matter.

This argument doesn't hold.

> As for IT functions, all of that should be centralized under the GSA with proper security controls. There's no benefit to having every agency maintain its own IT infrastructure. Most of those staff are redundant and could be laid off.

This works for email. Would you work at a company where you had to build and deploy apps on infrastructure controlled by someone in a different department and location, whose boss gave them the mandate to standardize as much as possible to reduce costs? (Hope you like Oracle…)

Sure, I have worked at companies that manage their IT infrastructure that way. It's fine, way more efficient and secure than letting every department do their own thing.

That was your fairly typical on-premise corporate hosting. Things have gotten better with the cloud but it's still hardly a free-for-all, use-whatever-you-want-with-no-oversight situation.

Cloud environments helped, but the kind of massively centralized environment they’re talking about in the cloud work still tends to mean “get 4 levels of approvals and you can get a t3.medium using our AMI with Java 6”. My point is just that successful IT needs people who understand the mission and share your incentives – you can outsource email and other generic services but most people here work on things which aren’t one-size fits all.

Everyone agrees the government does too much of some stuff and not enough of other stuff. No one agrees on what belongs in which category.

That would be extremely bureaucratic.