Tasmanian Cloud & Government use of public cloud services

Tasmanian Cloud - Networking Tasmania Pre- Tender Consultation Tasmanian Cloud & Government use of public cloud services Scoping and implementation discussion paper Department of Premier and Cabinet Office of egovernment

CONTENTS 1 Purpose... 3 2 Background... 4 2.1 Current arrangements... 4 2.2 Government policy... 4 2.3 Support of NT III objectives... 5 3 Proposed objective and scope... 5 3.1 Tasmanian Cloud... 5 3.2 Government use of public cloud services... 6 3.3 Proposed scope... 6 4 Proposed implementation approach... 7 4.1 Sponsorship... 7 4.2 Services contracted via future NT III agreements... 7 4.3 Supporting policies... 8 4.4 Implementation timeframe... 8 4.5 Transition... 8 Trim Ref 15/8581 Page 2 of 10

1 Purpose The proposed scoping and implementation approach for the Tasmanian Cloud was developed in consultation with agencies and endorsed, out of session, by the ICT Policy Board in January 2015. This paper is intended to provide greater clarity to agencies and potential suppliers on the scope of the Tasmanian Cloud, and more generally for the Tasmanian Government s direction and use of public cloud services. This paper will be used by the Networking Tasmania (NT) III project to develop whole-of-government contracts for services and supporting policies to progress the implementation of the Tasmanian Cloud. This includes obtaining comment from interested stakeholders as part of the Tasmanian Cloud Networking Tasmania Pre- Tender Consultation. In this paper, the Cloud refers to cloud computing and storage services including infrastructure as a service (IaaS), platform as a service (PaaS), and software as a service (SaaS). ICT security across the Tasmanian Government is an important focus of the Networking Tasmania III project and the Tasmanian Cloud, with key issues including: Improving ICT security through development of a strategy to close existing government owned and operated data centres and move to the Tasmanian Cloud ; At a whole-of-government level, the Tasmanian Government Information Security Policy provides advice and procedures to agencies on risk management, the physical environment, incident management, business continuity management and ICT security; The current whole-of-government data network service agreements, Networking Tasmania (NT) II, include requirements for proactive monitoring and reporting of ICT security; and The ICT Policy Board has recognised that these current whole-of-government arrangements can be improved and is developing a contemporary ICT Security Framework. For background on the NT III project, please refer to the Tasmanian Cloud Networking Tasmania Pre-Tender Consultation paper. This can be found on the TMD website: www.tmd.tas.gov.au Trim Ref 15/8581 Page 3 of 10

2 Background 2.1 Current arrangements Current arrangements for the supply of data networking and associated services to government, known as the Networking Tasmania (NT) II include, as optional services, Data Centres as a Service (DCaaS), and storage and computing (for example IaaS) services. The take-up by agencies of these optional services has varied. Some agencies have virtually their entire ICT infrastructure housed in facilities they own and operate. Others have most of their ICT infrastructure housed in external DCaaS facilities such as those provided by the NT II agreements. Planning for the next iteration of the NT agreements (NT III) has included a strategic review of the existing situation and alignment with the Government s policy. 2.2 Government policy The Tasmanian Government s Information and Communications Technology (ICT) policy outlines a data centre action strategy for Tasmania, which includes: To play our part, we will set a goal of moving whole-of-government data to the Tasmanian Cloud (secure, on-island data centres) setting an example for other major organisations such as the University of Tasmania, local government and Tasmanian businesses. By establishing a four-year goal of moving to on-island data sovereignty arrangements (where all public sector data is stored on data centres within Tasmania) we will be protecting security of data, employing Tasmanians and reducing the cost of data traffic on the Bass Strait links. The ICT policy also covered procurement practices. For ICT specifically, the policy is: A Hodgman Liberal Government will streamline the government procurement process by introducing a centralised panel arrangement (which will include Technology Services procurement by government). We understand the heavy cost to small business of tendering for government work and we will streamline this process. For procurement generally, the commitment has been translated into the Buy Local Policy. The objective and scope described below are shaped from the Government s ICT policy for Government to use an on-island Tasmanian Cloud and use of NT as the vehicle to procure appropriate services or most ICT services, where it is feasible and meets agency business requirements. Trim Ref 15/8581 Page 4 of 10

At the 14 November 2014 launch of the Tasmania Cloud Networking Tasmania pre-tender consultation, the Minister for Information Technology and Innovation, the Hon Michael Ferguson MP, stated: The new Networking Tasmania agreements will be a key element in the delivery of this commitment, because these are the services which will create and support the Tasmanian Cloud. The Tasmanian Cloud is intended as an on-island cloud service, using services provided by multiple suppliers, which will securely support key public sector data and ICT services. Note the use of public cloud service by Government agencies has not been ruled out as an option for some activities. A new Tasmanian Government ICT Strategy is being developed through the Government s ICT Policy Board and is expected to be released in 2015. This is expected to clarify the scope and implementation of the Tasmanian Cloud policy, as it affects IT within government. 2.3 Support of NT III objectives The broader NT III project objectives include: All government staff to have access to all the information and services that they need to perform their role regardless of their physical location and organisation context within government, including the ability for agency staff to roam. As part of the planning for NT III, Ernst & Young was engaged to review the proposed NT III service model and assess the feasibility of the model and identify key gaps and challenges. The findings included a recommendation to: Architect, design and implement a dedicated Application Services zone for hosting application services intended to be shared across agencies/departments. This solution should accommodate cloud based solutions and application virtualisation, as well as hosted solutions. 1 The proposed model for the Tasmanian Cloud supports the achievement of this objective, and hence supports the broader NT III objective. 3 Proposed objective and scope 3.1 Tasmanian Cloud The Tasmanian Cloud is intended as an on-island cloud service, using services provided by multiple suppliers, which will securely support key public sector data and ICT services. 1 Ernst & Young, NT III Business Model Review DPAC NT III Network Transformation Consulting Services Work Package 1, page 51, 12 May 2014 Trim Ref 15/8581 Page 5 of 10

The objective of the Tasmanian Cloud initiative is for government agencies to locate, where feasible and meets agency business requirements, their information and services in the on-island Tasmanian Cloud. This is to be achieved through whole-of-government contracts for DCaaS and related IT infrastructure and services. Achievement of the objective will require the Tasmanian ICT sector to have the capability to provide cloud computing services with appropriate range of quality and price points to meet the needs of Government. 3.2 Government use of public cloud services The use of public cloud services by government agencies is an option for some activities. To meet specific business needs, agencies may choose to purchase PaaS and SaaS. The Tasmanian Cloud providers will be one option to house and provide these services. However, there will be situations where agency business requirements will result in purchasing from alternative service providers. 3.3 Proposed scope The proposed scope of the Tasmanian Cloud is: 1. contracts for appropriate services, including DCaaS, IaaS and related services, under the NT III arrangements; 2. alignment of whole-of-government ICT technology hardware contracts (C150 and other contracts); 3. supporting policies to progress migration to the Tasmanian Cloud and decommissioning of in-house government facilities; and 4. supporting polices on the procurement and use of SaaS and PaaS. The scope of proposed arrangements would not include: 1. whole-of-government contracts for PaaS or SaaS, other than those that may be procured through NT III arrangements; and 2. complex bespoke ICT infrastructure services. However, the NT III arrangements may allow agencies to negotiate, on a case by case basis, with suppliers for these types of services. The diagram below illustrates the proposed mix of services that will be procured as part of the Tasmanian Cloud, along with the use of public IaaS, PaaS and SaaS services by agencies: Trim Ref 15/8581 Page 6 of 10

Tasmanian Cloud Application hosting Infrastructure (HW) Data Centre as a Service Application hosting IaaS (Infrastructure as a Service) Application hosting Public IaaS Low risk public services Application hosting PaaS (Platform as a Service) SaaS (Software as a Service) Contracted service for low risk public services Policy guidance on procuring ICT Services in the Cloud Could be hosted in the Tasmanian Cloud Policy guidance on procuring ICT Services in the Cloud Consider policies relating to procurement of PaaS & SaaS 4 Proposed implementation approach 4.1 Sponsorship The Tasmanian Cloud is sponsored by the Minister for Information Technology and Innovation and the ICT Policy Board. 4.2 Services contracted via future NT III agreements Consultation and current demand by agencies indicate that in the immediate future the basic services to be included in the NT III contracts will be: 1. on-island DCaaS, that is managed data centre rack services; 2. on-island IaaS virtual machine hosting and storage services; and 3. related or supporting services, such as: (a) backup, recovery, fail-over or business continuity services; (b) specific platform services, such as data base administration, or similar platform as a service offerings may be considered if there is sufficient demand from agencies; and (c) public cloud IaaS offerings that are suitable for low risk, public-facing services. The related services may be available as separate services, or incorporated into the IaaS service level agreements. The on-island services are to have contractual and technical arrangements, including service level agreements, to deliver services able to meet the Government s business and security requirements. Trim Ref 15/8581 Page 7 of 10

Over time, the range of required services will grow and change. Mechanisms, such as those that exist in the current NT II agreements, will be required to facilitate development and changes to the range of services available to agencies. The ICT Policy Board will develop and maintain policy advice to assist agencies in assessing the risks associated with selecting PaaS and SaaS services outside of the NT III agreements. 4.3 Supporting policies Policies, and related guidance, to encourage migration to the Tasmanian Cloud may include: 1. policy guidance on procuring ICT services in the Cloud, advice on assessing risks associated with selecting PaaS and SaaS services outside of the NT III contractual arrangements; 2. other whole-of-government common use and related contracts removing servers, storage and related services from the C150 panel contract and checking other contracts regarding cloud service offerings; 3. procure the Tasmanian Cloud services as part of the NT III; and 4. investigating procurement policies in relation to SaaS and PaaS. Existing policies, including procurement and information security policies and work being undertaken by Office of egovernment and the State Archivist on public cloud computing, are also likely to guide the implementation of the Tasmanian Cloud. 4.4 Implementation timeframe Date Q4 2014 Q1 2015 Q2 2015 Q3 2015 Q4 2015 Q4 2018 Milestone Launch market consultation on the Tasmanian Cloud as part of the NT III procurement and implementation project Finalise the scope and implementation approach of the Tasmanian Cloud and the Government s use of public cloud services Commence procurement of services to support the Tasmanian Cloud Finalise supporting policies Agencies commence migration to new Tasmanian Cloud services Anticipated completion of migration 4.5 Transition As outlined in the Implementation timeframe, it is anticipated that agencies will gradually transition to the new arrangements. The transition timeframe will vary from agency to agency. The following diagram outlines the range of arrangements that will exist now, over the transition period and at completion. Trim Ref 15/8581 Page 8 of 10

The diagram describes the current state, where the majority of the ICT infrastructure services are provided on government owned server hardware, either in government owned data centre facilities, or purchased as a service via the NT II agreements. There are also a small number of services provided via the NT II arrangements as IaaS. In the transition phase, the Tasmanian Cloud service agreements would be established and agencies will transition to the new arrangements. In the final model, agencies will have decommissioned their own data centres and server hardware and fully transitioned their applications and services to the Tasmanian Cloud. Current state Server hardware Data centre facilities Server hardware Data centre facilities Purchased as a service IaaS Agencies commence migration Transition phase options Server hardware Data centre facilities Server hardware Data Centre as a Service Tasmanian Cloud - IaaS Virtual server hosting Storage services Dedicated hardware services Public IaaS Low risk public services Agencies continue and finalise migration Specialist hardware Purchased as a service Data Centre as a Service Final state Tasmanian Cloud - IaaS Virtual server hosting Storage services Dedicated hardware services Public IaaS Low risk public services Key Government owned Current outsourced services Outsourced specialist services Tasmanian Cloud Services Larger = more services Contracted Public Cloud Note: A range of complementary services will be negotiated as part of the NT III arrangements, such as backup, recovery, fail-over / business continuity services. Specific platform services, such as data base administration, or similar platform as a service offering may be considered if there is sufficient demand from agencies. Trim Ref 15/8581 Page 9 of 10

Like the existing NT II agreements, it is anticipated agencies will be able to negotiate specific tailored requirements with the suppliers under the agreements, where required. Trim Ref 15/8581 Page 10 of 10