Storing military data in government facilities has long been the Defense Department’s default option.

While DoD officials admit the cost of building out their own data center capabilities has been a sore point, the benefit is greater visibility of the IT environment and an understanding of security risks. But as more companies like Amazon and Microsoft build out cost-effective cloud offerings that meet government standards, DoD is being forced to rethink where and how it does computing.

“We in DoD have got to think about computing from a different perspective,” said David Bennett, chief information officer of the Defense Information Systems Agency. “We have spent 30 years focused on putting all of our capability into a DoD environment. And we are pretty comfortable with that because we understand what it is. We’re not always comfortable with what price tag is associated with it.”

But storing data in government facilities has meant DoD can better understand the risks and what impact they have on DoD data, said Bennett, who spoke at a Nextgov event Tuesday. Bennett expects government versus commercial cloud services will be a key discussion among the military services, combatant commands and with congressional staffers.

“What types of apps are better suited in government versus commercial cloud?” Bennett said. What must be retained in the government space because of data sensitivity, and how can DoD leverage commercial opportunities?

Take nuclear command and control, for example. “I’m not so certain I want to take that capability and put it into a commercial environment,” he said. However, a business application may work well in that space.

“Going to a commercial cloud is new for us,” he said. “And so we are sitting around talking, thinking, trying to figure out what does that mean to us.”

DoD components are also trying to assess what place commercial cloud has within the department. In a July 2013 memo, DoD CIO Teri Takai mandated that all applications and systems reaching across multiple installations be migrated to DISA’s core data centers by fiscal 2018.

The DoD CIO will consider exceptions, such as moving to a commercial cloud, but it must first be approved.

There are obvious benefits to using commercial cloud, such as higher density of computing environments and lower prices, but users have to understand the risks, Bennett said.

“We’re going to be in both domains, and I think we will be in both domains in both unclassified and classified, but it’s just going to take us some time to get there,” he said.