Executive Decision Report

Transcription

1 Executive Decision Report Decision maker(s) at each authority and date of Cabinet meeting, Cabinet Member meeting or (in the case of individual Cabinet Member decisions) the earliest date the decision will be taken Cabinet Member for Community Safety, IT and Corporate Services Cllr Gardner Date of report 21 December 2015 Forward Plan reference: 04657/15/C/AB Report title (decision subject) Reporting officer Key decision Access to information classification Cloud-based collaboration and productivity tools (Office 365) programme - Approval of Phase 3 Nicholas Holgate, Chief Executive and Town Clerk, Royal Borough of Kensington and Chelsea Yes Public

2 EXECUTIVE SUMMARY 1.1. This report seeks funding approval and permission to implement Phase 3 of the cloud-based collaboration and productivity tools (Office 365). It also seeks funding approval for the SharePoint intranet project. Office 365 Programme 1.2. As set out in previous reports, the programme is based on a four phase implementation: Phase 1 Assess the councils technical readiness to adopt Office 365; Phase 2 Procure software and server licences to align licensing structure; Phase 3 Remediate infrastructure and transition to new services; and, Phase 4 Fully implement SharePoint (document sharing, and intranet/ website software), undertake pilots for Skype, Yammer and broaden device access and exploit Office 365 capability widely across the councils The programme team has completed Phase 1 and Phase 2, which carried out a technical assessment of each council s readiness to adopt and, procured and aligned software and server licensing across the three councils The councils are now ready to proceed to Phase 3 implementation and transition. It is proposed to undertake Phase 3 implementation in a number of stages, some of which may be carried out in parallel, although Stage A lays the foundation for all the remaining stages: Phase 3 - Remediate infrastructure and transition to new services A. Initial integration pilot, for which outside technical support is required; B. SharePoint Intranet pilot; C. Roll-out core and calendar features, to enable transition to the new platform; D. Migrating public folders from the archive (only relevant for H&F) Phase 4 - exploit Office 365 capability E. Skype pilot (software enabling low-cost communication amongst staff and with partners) F. Yammer pilot (an internal enterprise social networking service software enabling more effective and tailored peer-based communications) G. SharePoint document management pilot H. Broadening device access pilot 1.5. At present it is not possible to project the exact costs for RBKC due to uncertainties involved and only high-level estimates can be surmised. Reasonable estimates are available for Stages A, B and C, and this paper provides an estimate of the costs for these, with a request for approval for work to start on this basis.

3 1.6. RBKC will lead on a joint procurement for the consultancy support which will be a call-off of services from Crown Commercial Services (CCS) G-Cloud 6 framework The cost for RBKC to deliver the Stages A and C is approximately 600,000. This comprises about 210,000 real money costs for consultancy, 40,000 RBKC share of shared services programme management to coordinate business and technical work across the three councils and 350,000 in staff time. a) However, some of the tasks required for this project would have been carried out anyway, albeit not so quickly. These include upgrades to the RBKC Exchange servers, upgrading the browser used by staff to the latest version, IE11, and migrating to Office 2016, also the latest version. The total cost of these tasks is approximately 185,000, comprising 5,000 real money and 180,000 of staff time. b) The cost of those tasks required purely for Office 365 is 415,000, comprising 245,000 real money and 170,000 of staff time. SharePoint Intranet Project 1.8. Stage B of the Office 365 programme includes development of a single intranet platform for use by all three councils The councils have three sovereign and one shared (TriBNet) intranet platforms. These platforms are used extensively by staff to access shared policies, learn about council news, carry out searches and share information across the three councils However, it is recognised that the current platforms across the councils are no longer fit for purpose, delivering sub-optimal functionality to staff and carrying an increasing ICT overhead to maintain The Shared Services Board (SSB), at its meeting of 2 nd September 2015, agreed to implement a new intranet platform which would serve the needs of all three councils, providing new sovereign branded incidences and a shared service incidence. The main benefits from the project would be reduction in cost to deliver and maintain intranets across the three councils and improved end user experience, with a single source of information The intranet would be based on the new SharePoint platform that is being developed as part of the Office 365 programme, running in parallel to this project The project will be delivered by the shared ICT service supported by two subject matter experts. The total project cost is 120,000, which will be apportioned across the three councils equally. RBKC s contribution would be 40,000.

4 2. RECOMMENDATIONS 2.1. This report recommends: Office 365 Programme a) Implementing cloud-based collaboration tools using Office 365, at a tentative cost of 600,000 for Stages A and C: i) Consultancy and third party costs of 210,000; ii) RBKC share of 40,000 for shared services programme management to coordinate business and technical work across the three councils; and, iii) In-house staff resources of 350,000 funded through existing revenue budgets. Funding for items i) and ii) to come from existing capital project funds b) Award of a contract for consultancy support by calling off from the CCS G- Cloud 6 framework. SharePoint Intranet Project c) Provide funding approval for delivery of the intranet project for 40,000, to be funded from the SharePoint Infrastructure project, an existing capital project REASONS FOR DECISION 2.3. The adoption of Office 365 supports the council s ICT strategy in terms of providing solutions that support flexible and mobile working out of the office, joined-up and consistent solutions to users, enabling an improved user experience at reduced cost and introducing utility based charging, i.e. costs based on user numbers. The approach of adopting a common set of cloud-based collaboration and productivity tools outlined in this report was approved by RBKC in May RBKC has set out to increase the flexibility and collaborative working capability available to staff enabling significant productivity benefits to be realised. This flexibility is needed across RBKC, in working with existing shared services,to allow joint working with other organisations in the future and to enable staff to work effectively out of their main office. Office 365 is a key part of the technology platform that supports a move to more flexible working.staff currently face a number of issues which limit how they collaborate with other members of staff, more keenly within shared service teams. Issues include: Blackberry devices where users have multiple addresses and logins, they have to carry a separate Blackberry for each council. they cannot manage a co-worker s inbox when they are away, or a team inbox, when the co-worker or team mailbox belongs to a different council. Calendar they cannot manage a co-worker s calendar when they are away, when the co-worker or team mailbox belongs to a different council. This is particularly relevant for PAs.

5 SharePoint setting up new sites or changing user access permissions is currently labour-intensive and constrained by ICT resource. Office 365 will enable this enhanced self-service and improved sharing and collaboration. Implementation of off the shelf SharePoint is part of the first three phases of this project, but this does not include either any customisation/localisation or site/content migration. Instant messaging (IM) across borough boundaries is not possible. Setting up voice and web conferences across borough boundaries is possible but tricky due to the different technologies involved. Setting up video conferences across borough boundaries is only possible between RBKC and WCC Exploitation of this technology will lie with business transformation and change programmes. Adoption and exploitation by staff will not happen without an appropriate set of change initiatives to encourage staff use. 3. PROPOSAL AND ISSUES Adoption of Cloud Based Services 3.1. Office 365 is a web-based suite of productivity applications. This means that the council would be storing data and accessing services from the internet (the cloud). This approach is a mature delivery model for software as a service and there are already a number of examples where the council has chosen to host data in the cloud and have staff access the data whilst mobile or based in the office When considering whether a service is suitable for migration to a cloud service the main consideration is - do we trust the service provider? The exam question that follows is, does the service provider have the appropriate security, privacy and compliance processes and mechanisms in place to build our trust in the services that protect, process and manage the council s data. Other questions are:- How financially viable is the supplier? The creditsafe review of Microsoft shows a credit limit of 17.6m and a contract limit of 119m. Microsoft are a financially secure organisation for the council to engage with. How reliable is the cloud service? Microsoft Office 365 has service levels of over 99.9% availability or the equivalent of less than nine hours down time over a year. Is the supplier committed to the service in the long term? Microsoft continues to invest heavily in Office365. They have changed their public sector licensing agreements to support cloud adoption, there is regular development in the product range, with new products being developed and brought in once acquired and integration between differing products is strengthening. How easy is it to retrieve our data at the end of the contract?

6 The council would own all the data stored within Office365 and retain all rights, title, and interest in the data stored with Office 365. This data is accessible to download at any time without any need to request the data from Microsoft These questions have already been considered for a range of key line of business applications: Adult Social Care, holding sensitive personal data in Frameworki Children s Services, holding sensitive personal data in Capita s Special Education Needs application Corporate Services host commercially sensitive Finance and HR data externally within MSP Early next year, the bi-borough Parking Services will host commercially and personally sensitive data with a cloud based provider Data relating to our most vulnerable residents, key business data and significant income streams are cloud based already However, it remains a pertinent question which the council must consider before sending a service to the cloud do we trust this service provider to manage our data responsibly? 3.6. Within Office 365, Microsoft s approach to protecting, managing and processing data has two distinct elements: Built-in controls available to all Office365 subscribers - these are the precautions that Microsoft takes to ensure that the data centres are built in safe and secure areas, for example the data centres for Office 365 are in Dublin and Amsterdam and built above flood plains. Microsoft also has regular threat management reviews and dedicated teams, on their sites, who are proactively anticipating and preventing malicious access to the sites and the data. When our data is being accessed by a staff member the data is encrypted while in transit to the end user, and it is also encrypted when it is simply being stored on the servers. Added to this there is network perimeter security, security monitoring and high standard access controls.; and; Customer controls the definable controls that enable customers to customise Office 365 to meet the specific needs of their organisation, including standard retention policies, data loss prevention, certificate-based access, message encryption for secure , multi-factor authentication. All of these options are available to the council and will be enabled based on a risk assessment of the data being managed by staff we will choose the correct controls to ensure data is protected As noted above Microsoft s data centres are geo-diverse. For Office 365 the data centres are in Dublin and Amsterdam. This approach ensures that the council s data is held within the EEA, and Microsoft has to meet the EU data handling requirements Microsoft also has a number of quality standards which are independently audited annually to ensure that Microsoft continues to meet the requirements of the standards specified in ISO 27001, EU model clauses, the US Health

7 Insurance Portability and Accountability Act (HIPAA), and Federal Information Security Management Act (FISMA) The checks and balances which are in place for Office365 as a product more than meet the council s requirements. Ovum s 1 view is that Office 365 security is constantly being reviewed, revised, updated, and enhanced. Microsoft employs some of the industry s most highly skilled and experienced engineers, and it also engages third parties and subject-matter experts to bolster its own resources. Few enterprises, let alone small and midsize organisations, can hope to match this level of proficiency in their IT departments, and unlike the typical enterprise, Microsoft also strives to keep software and hardware technologies up to date, not all of which are its own There is one further area where we should also consider the implications of moving to Office365. As Office365 is a web-based application it can be accessed from a wider range of devices. This poses the potential for data to be accessed through a mobile device outside of the council s secure network which potentially increases the vulnerability of that data However, access through a mobile device does not, of itself, increase the risk that the data will be lost. Evidence over a number of years from the Information Commissioner s Office demonstrates that most data is lost through paper - a staff member prints off a sensitive document which is then lost or stolen. It is possible to implement technology controls to limit mobile access to data, but applying heavy controls to staff s access to data would not support the council s ambition of enabling a more flexible and productive workforce and is actually likely to increase the risks of data loss if staff choose to print out personal sensitive data because of the controls in place Protecting our data starts with our staff through raising awareness, educating and supporting staff to understand their responsibilities and the scenarios where data loss is likely to happen. Further support can be provided through technology controls, for example using mobile device management, enabling read only access on documents, disabling cut and paste of documents and stopping users from being able to forward on attachments in s. But, firstly and principally the best control is through staff acting responsibly A parallel workstream in the Office365 programme is looking at the councils information management policies and the training provided to staff. The aim of this work stream is to review and rationalise the IM policies across the councils into a single set of policies. It is also reviewing the existing training with a view to provide better and more consistent training that supports staff to fulfil their role in protecting data. Office 365 Programme - Outline of proposed solution The proposed approach is based on the Microsoft cloud offering for Exchange online, Office 365, supported by a single simplified Active Directory used solely for user authentication. 1 Ovum is an independent analyst and consultancy firm specialising in IT, and telecommunications

8 Office 365 Procurement of consultancy support The councils will be working with a Microsoft certified partner to deliver the remediation and enablement work which will deliver the Office 365 single incidence and undertaking the migration work The support to deliver Phase 3 will be procured through G-Cloud, the Crown Commercial Service s (CCS) procurement framework for information technology commodity services. RBKC will lead on the procurement of these services from a Microsoft certified partner for the three shared service authorities Although most of the work will be carried out by the shared ICT service in-house team, additional detailed support is required from a Microsoft certified consultancy. The value of the requirement is above the OJEU threshold of 172,000 and would be subject to UK Public Procurement Regulations Options for sourcing Phase 3 requirements are explored below: Option Benefits Drawbacks OJEU (restricted procedure) CCS Framework Greater level of market competition Most recent market pricing and solutions Pre-selected suppliers Capable suppliers Reduced tendering costs and timescales Timescales to complete. Cost. Limited competition. Framework scope may not be a good fit for requirement The timescales required and the relative simplicity of the services do not support a full OJEU procurement. G-Cloud 6 is a CCS framework to provide cloud based services and support. The G-Cloud framework is re-tendered every six months to ensure the pricing remains current and competitive. The framework contains a high number of suppliers to ensure healthy competition, while providing simple means to down-select. It is a competitive and simple route to market for commoditised cloud based services and support such as those required for Phase It is recommended that procurement of support will be from G-Cloud. The contract documentation, terms and conditions and service level agreements are pre-defined in the suppliers service offering. Office 365 Pilot Project A small pilot project will be implemented ahead of full implementation of Office 365. The purpose of the pilot will be to test the technical solution for and calendar functionalities, trial some of the modules available within Office 365 and provide assurance that the councils are able to implement the single incidence required to exploit maximally the cloud collaboration capability. Office 365 Transition to new platform

9 3.21. On satisfactory completion of the pilot project, the work can begin to transition fully to the new platform and migrate users to the cloud-based service. Experience from elsewhere suggests that this needs to be undertaken as rapidly as possible. Unlike WCC and LBHF, RBKC does not have the complexity of migrating archives, but will still need to migrate users in a carefully considered way to ensure continuity of service. Office 365 Risk Analysis The main risk to the successful completion of the project is the feasibility of Microsoft s proposal, with the cloud-based Active Directory synchronising with local, on-premise Active Directories. To enable effective collaboration all three councils must be a single entity on Microsoft s Office 365 cloud, which is supported by a single user directory synchronised with the local Active Directories that continue to be maintained by the three councils This deployment model has not been completed in the UK previously, but has been undertaken in the USA by Microsoft, who also has direct access to the software developers for Office 365 software The skills required to undertake the range of assessments required on network connectivity, message routing and other key areas are not available in-house because of the unique arrangements for Microsoft. To mitigate the risks arising from the lack of referenced precedence with this work, the councils propose to engage a suitable partner to conduct this work through G-Cloud. This procurement exercise is nearing conclusion with a recommendation, subject to a further report, that the councils engage Microsoft Consultancy Services to assure the platform s deployment. The budget for this work is included within this report.office 365 Costs Noted below are the high level estimates of total Office 365 programme costs for RBKC. The programme will be delivered predominately through shared ICT service resource, with additional consultancy support procured through CCS s G- Cloud framework. Description Project cost Nature of Charge Consultancy support for Exchange server upgrade 5,000 External costs (required irrespective of the move to Office 365) Staff time for upgrades to Internet Explorer 11 and Office 180,000 Staff costs 2016 (required irrespective of the move to Office 365) Replacement Hardware for Office ,000 External costs Consultancy support for Office ,000 External costs RBKC share of shared services programme management to 40,000 External costs coordinate business and technical work across three councils Staff time in enabling Office 365 (Active Directory work, 170,000 Staff costs network connections and security changes) Total 600,000

10 3.26. The costs listed above relate only to the costs to implement the platform. The ongoing licensing costs were previously approved in a report entitled Shared ICT Services Procurement of software licenses for cloud-based collaboration tools (Phase 2 of cloud-based collaboration KD04509/15/C/AB) There is a level of uncertainty around these estimates at this point: Application compatibility the project requires upgrading to Office 2016 and to Internet Explorer 11 (IE11). Many applications make use of these Microsoft products. There may be compatibility issues that take longer to resolve than anticipated. During the user acceptance phase of the programme service users will be fully involved in the testing of the compatibility between the Office 2016 and IE11 components and line of business applications. Where IE11 compatibility issues are found it is possible to package the application with settings so that when a user opens the application, the browser acts as if it is the current browser, IE9, ensuring minimal impact on end users. Testing to date has not revealed any compatibility issues. Cost uncertainty: there are a range of areas where costs are not yet certain: o The effort required by the in-house ICT team, and whether any external support or consultancy is required. The quicker the work is to be achieved, the more likely external support will be required; o The exact statement of works (and therefore costs) for the consultancy support required. tools configuration there are a range of supplementary tools where detailed analysis work on the configuration work required has not been fully estimated. These include support for Blackberry devices, the mail filtering required, and enablement of a secure capability. On transitioning to a new cloud based service, especially one with as high a volume of traffic as an service, there is a potential impact on the internet bandwidth required for the organisation. Consequently an upgrade may be required, incurring an increased revenue cost. Internet bandwidth is a a commodity item, and the council will be able, for a relatively small sum of money, increase the bandwidth available. The largest draw on bandwidth will be video conferencing. However, as this will likely have a low take up in the early days of roll-out is not likely to be significant enough to require an increase in bandwidth. However as the use of video conferencing increases and there is a requirement to increase the bandwidth, this could be offset by an increase in staff productivity from staff not having to travel between town halls for meetings.

11 Office 365 Timelines Current timescales for the Office 365 programme are shown below: SharePoint Intranet Project Outline of Proposed Solution As set out above, SSB approved the intranet project at its meeting on 2 nd September The project will develop an intranet platform which will be used by all three councils with a single incidence for cross council information, (including shared business services) and sovereign incidences for each council This is a shared service initiative which will be delivered predominately through shared ICT service resource, supported by two external subject matter experts on a consultancy basis. The subject matter experts will deliver the intranet design, technical information governance solution and communication work streams within the project Noted below are the total project costs. The costs will be apportioned across the three councils. The funding request for RBKC is 40,000. Resource Cost Technical Specialist 39,600 Information architecture specialist 30,720 Shared ICT service implementation team (including RBKC staff) 49,680 Total project cost 120, The project is dependent on the Office 365 programme for delivery of the SharePoint platform which the intranet will be developed on. 4. CONSULTATION 4.1. There is no public consultation requirement. The Shared Service Board, ICT Policy Board and the relevant cabinet members have been consulted.

12 5. EQUALITY IMPLICATIONS 5.1. There are no Equality/HR implications. In the Office 365 programme, staff training will be considered, planned and implemented as appropriate. The programme board will work closely with the user reference group to develop an effective communications plan. 6. LEGAL IMPLICATIONS 6.1. Whereas the services of consultants ( Technical Specialist and Information Architecture Specialist ) have been procured (see paragraph 10.6 below), the subsequent services sought to be procured under Lot 4 of the G-Cloud 6 Framework are outcomes for which the expertise of the consultants is now required By virtue of the value of the services exceeding the EU threshold for public service contracts, a regulated procedure must be followed to procure the services Subject to the Councils being named on the OJEU Notice as parties who may use the G-Cloud 6 Framework and Call-off, the said G-Cloud framework can be used to procure the specialist services (Lot 4) This procurement would however be governed by the 2006 Public Contracts Regulations which were in force at the time the G-Cloud 6 Framework was let (refer to Regulation 118 (3) of the 2015 Regulations). Implications completed by: Tolu Akinosun, Senior Solicitor (Contracts). Tel: FINANCIAL AND RESOURCES IMPLICATIONS 7.1. The Group Finance Manager, Corporate Services comments that the estimated financial implications are set out in the report. It is proposed that existing Capital projects (bid ref: 490 Unified Communications and part of bid ref: 676 SharePoint and Linkage software) are redirected to be used on this work. These bids had been submitted prior to the move to a shared ICT service - which has changed the overall direction of the ICT service provision requirements. The SharePoint Intranet project work can also be funded from one of these existing Capital project bids (ref: SharePoint and Linkage software), which was established for SharePoint related work. Staffing costs will be met from existing revenue budgets in ICT. Verified by. Lyn Myers, Group Finance Manager. 8. BUSINESS IMPLICATIONS 8.1. The councils are buying a commodity item, provision of technical advice through G-Cloud 6. This procurement route is pre-vetted and only suppliers on the frameworks will be able to participate in the procurement.

13 9. PROCUREMENT IMPLICATIONS Office 365 Programme 9.1. Procurement of the cloud support services will need to be carried out in accordance with EU procurement rules and the three councils contract standing orders A project board has been set up with cross-borough representation. The three councils requirements and how the resulting contracts will be set up have been discussed at length. This document presents the outcome of these discussions Further competition under the G-Cloud framework will be carried out in accordance with the framework provisions. G-Cloud is designed as a commodity based marketplace and for most requirements all factors required to select the Most Economically Advantageous Tender are included in the G-Cloud service offerings and published on the Cloud marketplace If further competition is required it will be managed by RBKC and partner councils There is no particular EU procurement risk involved in this procurement other than to state that the proposed strategy complies with EU procurement law. SharePoint Intranet Project 9.6. Technical Specialist and Information architecture specialist as per the table at 5.12 have been sourced by Westminster City Council via a single consultancy agreement at a combined cost of 70,320. The consultancy has been sourced in accordance with the Westminster Procurement Code. The contract has been entered into and will be managed by Westminster City Council There are therefore no specific procurement implications for RBKC. Verified by: Dermot Doherty, ICT Category Manager. 10. IT STRATEGY IMPLICATIONS The report is aligned with the current shared services ICT strategy and vision of converging software and infrastructure, whilst enabling better collaboration and productivity amongst staff. It is a key enabler to a range of critical council initiatives, including the realisation of savings in excess of 4.7m from 2016/17. Verified by: Ed Garcez, Chief Information Officer. LOCAL GOVERNMENT ACT 2000 LIST OF BACKGROUND PAPERS USED IN PREPARING THIS REPORT No. Description of background papers Name/ Ext of holder of file/copy Department/ Location

14 1. Shared ICT Services Approval of strategy to align cloud based collaboration tools and funding for Phase 1 Assess 2. Shared ICT Services Procurement of software licenses for cloud based collaboration tools (Phase 2 of cloud based collaboration) Howell Huws, Ext: 5025 Howell Huws, Ext: 5025 shared ICT service shared ICT service