Bank of America Merrill Lynch White Paper Best Practices for Government Contractors: Assessing IT Software and Hardware Investments Executive summary Government contractors today face an overwhelming number of choices when investing in information technology. When it comes to assessing software and hardware investments, it helps to understand and implement industry best practices. The following are practical insights to help government contractors evaluate and invest in the right technology solutions for their needs. Contents Regulations, the contract and the contracting officer.......... 2 Digital government......... 2 Hardware...3 Software....6 Conclusion...9
ASSESSING IT SOFTWARE AND HARDWARE INVESTMENTS 2 Government contractors looking to invest in information technology (IT) software and hardware are faced with more options and decisions than ever before. Should they lease or buy hardware? Build, buy or lease software? Employ Web-based or cloud computing approaches? Adopt open-source software and tools? These are legitimate concerns for government contractors of every size and experience level. Regulations, the contract and the contracting officer The U.S. government market is the largest market for goods and services in the world. In 2012, it spent approximately $79.2 billion on IT services. It is also one of the world s most regulated markets. The Federal Acquisition Regulation system (FAR) is the primary body of rules governing this vast market. Each government agency has its own supplement to the FAR, such as the Defense Federal Acquisition Regulation supplement (DFAR). Government contractors looking to invest in IT software and hardware must be familiar with the FAR as well as the supplements that apply to government agencies with which they are contracting. Generally, if the targeted software or hardware is not explicitly prohibited in the FAR, it is fair game. However, if the contract states that a certain hardware platform or software system must be used, the contractor must adhere to the contract unless it persuades the contracting officer otherwise. The contracting officer is a federal employee appointed by the head of the agency to initiate, oversee and, if necessary, terminate the contract. While government regulations and agencies tend not to favor nascent bleeding edge technologies with emerging risk and cost factors, they can be surprisingly forward-thinking and are well versed in technology trends. Still, government agencies must always weigh both the benefits and risks of new approaches. The level of tolerance for innovation and risk varies from agency to agency, particularly where security is of high concern. Digital government In May 2012, the White House issued Building a 21st Century Digital Government, a directive on digital government strategy that builds on several prior initiatives. It promotes adopting an information-centric approach to government data management and a shared platform for government IT. The directive also tries to ensure that digital government innovation is done safely and securely. The strategy was formulated in collaboration with the Office of Management and Budget and the General Services Administration with an eye toward government-wide adoption of its objectives. According to the directive, information-centricity is designed to decouple information from its presentation and streamline cross-platform and inter-agency data exchange using open standards. Shared platform goals include common standards and architecture, open source and crowdsourcing. Safety and security of digital government requires security, privacy, and data protection throughout the entire technology life cycle.
ASSESSING IT SOFTWARE AND HARDWARE INVESTMENTS 3 Government contracts are sure to reflect the goals of the initiative. Contractors that hope to win them and implement IT solutions for government agencies should be aware of these trends as they look to invest in technology. Hardware Government contractors have a wide range of options for hardware acquisition. Purchasing, leasing, bring-your-own-device, virtualization and cloud computing are all viable solutions, depending on the circumstances. In choosing hardware, the government has an inherent bias toward commercially available solutions, as specified in the Federal Acquisitions Streamlining Act. How an agency approaches the question of leasing versus buying is addressed in the FAR and its supplements but can also be a matter of policy within the agency itself. Purchasing When government contractors purchase hardware to fulfill contract requirements, proper bids and support contracts are required by the government agencies with which they contract. Contractors must be prepared to justify the vendors they choose. Seeking three bids is standard, but, if only one vendor can provide the hardware, the contractor must provide justification to support the lack of competing bids. When purchasing hardware, the following things should be kept in mind for calculating the cost of hardware investments: In 2012, the U.S. government spent approximately $79.2 billion on information technology services. Maintenance y costs can be 15% to 20% of the hardware budget. ydepreciation occurs over two to seven years, depending on the item. Leasing Leases are generally 10% to 12% more expensive than purchasing the same equipment, so it pays to weigh this factor against the benefits derived. Contractors should be prepared to negotiate all aspects of the lease that they require and should review the leasing contract with legal counsel. When considering leasing hardware, benefits include: Maintenance y and support are usually built into the leasing contract and are carried out by the leasing company or its representatives. yleasing can be cost-effective for shorter duration contracts. Lessees y generally won t have to worry about getting stuck with aging technology as leases usually provide up-to-date hardware.
ASSESSING IT SOFTWARE AND HARDWARE INVESTMENTS 4 Bring-your-own-device Bring-your-own-device, or BYOD, is an IT trend where employees are permitted to use their own mobile computing devices on the job, accessing corporate applications and information with security features previously available only on corporate-owned hardware. BYOD has proven attractive to many mid- to large-sized organizations due to the reduced cost (employees purchase the hardware) and the relative ease with which support and security can be deployed. Government agencies are adapting BYOD policies, including the Equal Employment Opportunity Commission, which adapted a BYOD policy in 2012. In addition, Federal Chief Information Officer (CIO) Steven Van Roekel called for the Digital Services Advisory Group, which promotes cross-agency best practices as part of the digital government initiative, to develop government-wide BYOD guidelines based on results from successful agency programs. While security remains of paramount concern, government contractors can take their leads from the country s CIO in the case of BYOD and move forward with adoption of this practice, with all the usual caveats of contract, agency and contracting-officer approval. Virtualization Virtualization technology decouples operating system and application software from the underlying hardware. This creates virtual machines that allow multiple computing environments to occupy one physical machine, such as a server that can host Linux and Windows applications simultaneously. Virtualization also better utilizes system resources, enabling more productivity with less hardware and reduced power consumption. Virtualization is particularly valuable in business environments where testing and assessing many different applications and tools is required. It provides the ability to leverage limited hardware resources to cost-effectively emulate a range of computing environments. Virtual environments can also take advantage of aging hardware assets, thereby extending the lives of servers and desktop and mobile computers. Bring-your-own-device is an IT trend that allows employees to bring their own mobile computing devices for use on the job. Contractors that seek to develop and deploy IT solutions for government agencies will find that many of them are already engaged in extensive virtualization initiatives. The cost savings and efficiencies combined with relatively low risk factors make virtualization an essential tool as the government seeks to modernize its infrastructure and reduce costs. Virtualization technologies can save 20% or more in computing and related expenses, according to research firm Gartner. The cost savings and operational efficiencies of virtualization can only enhance the chances of winning and successfully delivering government contracts. Cloud computing Cloud computing is an approach to hardware, software and infrastructure resource allocation and management that lets organizations offload support responsibilities to cloud providers. It allows users to access applications, servers and storage via network
ASSESSING IT SOFTWARE AND HARDWARE INVESTMENTS 5 connections (usually the Internet) from their own desktops or mobile devices. Large cloud providers such as Amazon, Google and Microsoft use distributed data centers to provide everything from network infrastructure to software development and hosting environments for customers that consume these services. Pros of adapting cloud computing include: Scalability: y Resource-on-demand models provide server, storage and network infrastructure as needed, allowing for rapid expansion of IT capabilities. Cost: y Instead of making capital investments in infrastructure that may or may not be fully utilized, cloud resources can be tailored to fit business needs at any given point in time. And the less obvious costs of infrastructure in the form of personnel to handle various related duties are all combined into the flexible payment model. Business y continuity: Most cloud providers have disaster recovery and backup services, allowing organizations to focus on product and service delivery while outsourcing infrastructure support duties. Cons of cloud computing include: Security: y When data is distributed on public networks and to storage, loss of control is a concern. Private clouds, which utilize the same architecture as public clouds but are within the owner s control, are a way of mitigating security risk while still enjoying some benefits of a cloud infrastructure. Data y location: Some government contracts stipulate that the technology being developed cannot leave the United States, so contractors must ensure that data storage remains in the country. However, some larger cloud providers are now allowing customers to stipulate data location. Loss y of control: Unscheduled down time, service interruptions, power failures and the like can affect business operations and project deadlines. However, cloud providers are often more adept at providing maximum up time than an organization s internal resources. As a result, loss of control should be weighed against the skill sets and capabilities of cloud providers. Instead of making capital investments in infrastructure that may not be utilized, cloud resources can be tailored to fit business needs at any point in time. Cloud computing changes the dynamics of traditional IT purchasing and budgeting. Its capacity-on-demand flexibility and outsourcing of data-center hardware, operating systems and software challenge the notion of investing in traditional IT infrastructure. Pay-as-you-go cost models based on usage and bandwidth are the norm, and consumers of cloud resources may never need to purchase physical hardware to utilize the cloud beyond whatever desktops and mobile personal computing devices they currently employ. Government contractors need to pay particular attention to stipulations of their contracts and contracting agency policies, as well as security and data location concerns. That said, cloud computing is here to stay and provides a realistic, viable alternative to traditional IT software and hardware investment costs and resource demands.
ASSESSING IT SOFTWARE AND HARDWARE INVESTMENTS 6 Software Government contractors have a spectrum of options today for software acquisition. Commercial off-the-shelf-software, enterprise resource planning systems, software-as-aservice, and open-source and custom software development are the most likely solutions to contract software requirements. For contractors that develop software solutions for government agencies, there may also be the added benefit of acquiring patents for original inventions. Commercial off-the-shelf-software Government agencies typically favor commercial off-the-shelf-software (COTS). COTS solutions feature prominently in the FAR and have been mandated for many government agency programs. Motivating factors include cost savings, time savings and maintenance (typically standard and low-cost maintenance as compared to custom software application maintenance). Potential issues to watch out for with COTS include: Vendor y reliability: Is the vendor of the software established and viable for the long term, or does it run the risk of going out of business and rendering support impossible for the purchased system? ysecurity: Is the software secure enough for the government agency involved? Integration: y Will the software integrate sufficiently with the agency s legacy systems and any planned future systems or other systems currently in the contract pipeline? For a large enterprise resource planning software system purchase, a team should be deployed to assess and decide on the investment solution. If COTS can meet the software requirements of the contract, it s usually difficult to make a case for custom software development. ERP software Whereas COTS generally refers to widely available consumer-grade software, there is another class of software that should be considered for larger, more comprehensive software solutions. Enterprise resource planning (ERP) systems are typically large and complex, encompassing an organization s financial, human resources and/or other mission-critical systems, and requiring special expertise to deploy and support. If the contracting agency requires a large rollout of an ERP system, it will most likely contract directly with the vendor or with a consultancy that specializes in deploying these large, complex systems for businesses and government. However, a government contract may require that a departmental-level ERP solution be implemented; if that is the case, contractors need to be able to mount a robust selection process to fulfill the requirement. Government contractors choosing large commercial software for government agencies should consider drafting a request for proposal (RFP) to present to vendors. Factors to consider in the choice of software encompass many of the same concerns as COTS but also include:
ASSESSING IT SOFTWARE AND HARDWARE INVESTMENTS 7 Functionality: y Does the software have robust features that will satisfy the agency s requirements, as specified in the contract? Development y road map: Does the vendor have a road map for future capabilities that will anticipate the changing needs of the users? Trial y version: Is there a trial or demo version of the system that potential users could assess for functionality and usability? For such a large software system purchase, a team should be deployed to make the assessment and decision for investment in a solution. The software purchase should be approached with thoroughness and due diligence as it can make or break the contract. The government contractor should always engage its attorney or legal team when negotiating and finalizing the software license contract. Software as a service Software as a service (SAAS) is the cloud computing software solution. SAAS vendors provide application services such as customer relationship management (CRM) systems, financial and accounting systems, and other common business applications. The applications are accessed via browser-based interfaces, providing the full range of capabilities that legacy desktop or server-based applications offer while hosting programs and data in the cloud. Efficiencies gained by having hardware and software hosted and supported by a third party must be weighed against security concerns, particularly in relation to sensitive government contracts. Open source Open-source software is created with a license that allows anyone to use, change and distribute it, unlike proprietary commercial software, which strictly protects licensing. Open-source software is frequently free, or it may have a dual-license model whereby basic usage is free while support, maintenance and enhanced features are available for a price. These days, there are open-source versions of commonly used software, ranging from operating systems such as Linux to office suites to ERP systems. Open-source software is developed using a community model, where anyone with the requisite skills can contribute to the code base and test and identify bugs. It is often considered more robust than proprietary software, which relies on a single company that may go out of business or discontinue a particular software product line. Positive aspects of open-source software include: yavailability of source code for customization ylower cost and higher quality than proprietary software ylack of vendor lock-in
ASSESSING IT SOFTWARE AND HARDWARE INVESTMENTS 8 The digital government strategy directive has identified open-source software as a goal for government agencies. As a result, contractors should be able to make a straightforward case for using open-source solutions where appropriate. In fact, they may be mandated to do so by the agency or contract. Software development If COTS, ERP, SAAS and open-source software will not suffice for the agency and contract, then a logical consideration is the development of custom software based on the specifications of the contract. If no in-house expertise in software development exists, contractors should consider subcontracting this function if it is acceptable to the contracting agency and officer. When considering outsourcing software development, contractors should be aware that some agencies and contracts restrict certain sensitive technologies to use only by U.S. citizens. Contractors should also be aware that recent industry trends have started to move away from offshore software development for a number of reasons, including reliability of work, communication challenges and a post-recession shift toward creating U.S. jobs. If a contractor is developing software for a government R&D contract, the opportunity may arise to obtain patents for the system or systems developed. In-house software development involves many investment considerations as far as skills and resources needed. Government contractors should have a considerable depth of experience and expertise in software development before even considering this course of action. Industry best practices and software development life cycle (SDLC) know-how are much the same for government contracting as they are for private industry, with additional concerns in the areas of security, interoperability and cost. Intellectual property and patents If a contractor is developing software for a government research and development (R&D) contract, the opportunity may arise to obtain patents for the system or systems developed. The government actually encourages contractors to seek patents for intellectual property developed as a part of an R&D project. However, as stated in the FAR, the government will retain a nonexclusive, irrevocable, paid-up license to use the subject invention for its own purposes. In other words, the government cannot be charged royalties for use of the patent invention. There may also be exceptions to allowing contractors to seek patents where (a) national security is threatened, (b) the contractor is operating a governmentowned research or production facility, or (c) other exceptional circumstances exist, the FAR notes. The government considers this approach to patents to be beneficial to U.S. commercial interests and competitiveness. So, for the right contractor, winning an R&D contract could reap benefits far beyond the financial rewards of the contract itself.
ASSESSING IT SOFTWARE AND HARDWARE INVESTMENTS 9 Conclusion Government contractors need to keep many things in mind when investing in software and hardware. Government buyers are sophisticated and will expect contractors to explain how their proposed solutions will fulfill the agency s specific goals and requirements. Each agency is different: Some are customer-focused, while others, such as those in the intelligence and defense communities, are on the lookout for information superiority and enhanced decision support. Cost management, cross-agency interoperability, security and return-on-investment are across-the-board concerns for all agencies. A successful government contractor will become an expert in its contracting agency s existing systems and practices and pursue its own investment in IT infrastructure in a way that best complements them. This article is for informational purposes only. Please consult your tax advisor, as neither Bank of America, its affiliates, nor their employees provide legal, accounting and tax advice. Bank of America Merrill Lynch is the marketing name for the global banking and global markets businesses of Bank of America Corporation. Lending, derivatives, and other commercial banking activities are performed globally by banking affiliates of Bank of America Corporation, including Bank of America, N.A., member FDIC. Securities, strategic advisory, and other investment banking activities are performed globally by investment banking affiliates of Bank of America Corporation ( Investment Banking Affiliates ), including, in the United States, Merrill Lynch, Pierce, Fenner & Smith Incorporated and Merrill Lynch Professional Clearing Corp., both of which are registered broker-dealers and members of SIPC, and, in other jurisdictions, by locally registered entities. Merrill Lynch, Pierce, Fenner & Smith Incorporated and Merrill Lynch Professional Clearing Corp. are registered as futures commission merchants with the CFTC and are members of the NFA. Investment products offered by Investment Banking Affiliates: Are Not FDIC Insured May Lose Value Are Not Bank Guaranteed. 2014 Bank of America Corporation 07-14-0238.N