Академический Документы
Профессиональный Документы
Культура Документы
Authors: Martin Bellamy and Gerry Gallagher Date: 10 February 2011 Version No: 0.35
UNCLASSIFIED
Data Centre Strategy, G-Cloud & Government Applications Store Programme Phase 2
Summary of Vision
Introduction 1.1 At the core of the programme is the vision of providing political, business and ICT leaders with greatly improved agility, flexibility and choice in the ICT that enables the public sector and to deliver substantial cost savings on both existing and new ICT services. This will involve a wholesale move to shared utility style ICT services for use as the default across the public sector. Citizens, staff and the third sector will benefit from greater innovation and choice and from more personalised presentation of relevant services from across the public sector. 1.2 The programme is being designed to address key ICT related objectives set out by the Operational Efficiency Programme, and those of the Green ICT Strategy, Digital Britain, Building Britains Future and Smarter Government. 1.3 Recent developments in ICT have made it possible to consolidate ICT Infrastructure in a way that delivers increased flexibility and responsiveness to business needs whilst reducing costs. This change involves a move from ICT being provided individually by organisations procuring their own separate ICT infrastructure, to a new model in which ICT is provided as a utility which is known as Cloud Computing. The flexibility provided by Cloud computing has enabled its rapid growth and a corresponding lowering of costs. 1.4 Public sector organisations will benefit from ready access to a wide range of preaccredited ICT services. These will include both public cloud services and common and custom private cloud services procured by other public sector organisations. Services will offer usage based pricing, elastic scalability (up or down), and there will be in built flexibility to switch to alternate services or providers. 1.5 Cost savings will be founded on driving down the number of unique public sector services through rationalising, sharing and re-using software and infrastructure across organisational boundaries, joining up buying power by establishing an open and transparent marketplace that delivers latest best prices to all, and by introducing standard, automated processes across the entire ICT lifecycle;- from purchasing new solutions through to migrating existing services to a new supplier. Industry standards will be used as is for public cloud services. For private cloud services common standards and services will be driven up the stack to the maximum possible extent; the technical standards landscape will be controlled by the CTO Council through the cross government Enterprise Architecture (xGEA). 1.6 G-Cloud services will be selected and procured from the Government Applications Store, and automatically provisioned either from public cloud providers, or from a private cloud platform hosted in one of a much reduced number of List X compliant government data centres; these will also support legacy services during the transition period. 1.7 The way forwards involves substantial change from todays ICT delivery model;public sector CIO teams will shift from managing the whole ICT lifecycle, to the selection and integration of relevant services. A federated (rather than centralised) implementation approach is proposed, allowing many public sector organisations and suppliers to contribute re-usable assets that can be sourced by others from the Government Applications Store. Retained ICT organisations will be able to increase focus on business engagement and
UNCLASSIFIED
Data Centre Strategy, G-Cloud & Government Applications Store Programme Phase 2
achieving value adding outcomes as less effort will be needed on infrastructure management. There will be choice in the road-map for each organization; the route chosen will depend on business priorities and the current ICT and contractual landscape. 1.8 Major change inevitably creates execution risks. Other public and private sector organisations that have pioneered the move to a shared utility ICT delivery model have had strong central drive and leadership. Most private sector organisations have had "someone in charge" on a global basis. The US government has introduced the Klinger Cohen act and Economic Development act, which mandate some elements of a more common public sector approach to ICT. The main areas of challenge in successfully moving to the new model include leadership, business change management, stakeholder engagement and creating a win-win proposition for business leaders, users of ICT services, public sector ICT professionals and the ICT supplier community. For the UK, leadership by the CIO Council is central to achieving the transition within the public sectors devolved, federated organisation. Engagement of Permanent Secretaries and other business leaders will be also be crucial. The programme will allocate significant resource to the soft aspects of change; this will include centrally co-ordinated communications support and sharing of experience. 1.9 The new approach enables substantial benefits in small and medium sized public sector organisations including local authorities which may be relatively easier to realise in the short term, as well as significant benefits in central government in the longer term. Implementation planning will ensure appropriate balance to mitigate the risk that focus on large organisations crowds out the potential delivery of larger benefits to the majority. 1.10 Establishing and maintaining trust will be essential for public sector organisations to move to the new model individual organisations will remain responsible for the service they provide to the public and will need to be able to count on G-Cloud services as being at least as good as those used today. G-Cloud will be the internal brand for secure, trusted and shared public sector ICT services;- all G-Cloud services will have common characteristics including pre-certified standards compliance covering areas such as service delivery, technical (data, inter-operability etc) and information assurance, provisioning from an efficient and sustainable data centre, and will be available through the Government Applications Store at a value for money best public sector price. 1.11 Given that significant value comes from up front, sharable work on commercials, service management and information assurance, frameworks will be developed in each of these areas to enable certification/validation on a component level, so that work does not have to be repeated when components are assembled into new combinations. 1.12 The transition to the new approach will be achieved through a series of business focused implementation programmes, each of which will deliver financial and other business benefits. Some of these will be progressed in parallel. Potential implementation programmes include Consolidating Data Centres, Utility Applications, Efficient Hosting, Streamlining legacy, Empowering Business Change, Delivering for Citizens and Staff. 1.13 The programme is adopting a "learning by doing approach through the Quick Wins work strand. Quick Wins will launch a number of initiatives in February 2010 including several prototype cloud development environments and a demo version of the Government Applications Store. These will be available free of charge to public sector organisations. The strand is exploring extending its scope to build proofs of concept of some automation and
UNCLASSIFIED
Data Centre Strategy, G-Cloud & Government Applications Store Programme Phase 2
management services. The Quick Wins strand provides a foundation that can potentially be used to develop a full proof of concept of the future G-Cloud model. CIO Council members are encouraged to help build programme momentum and early experience by signing their organisations up to participate in the Quick Wins pilots. 1.14 While further work is needed to determine implementation timescales, the ambition is to deliver substantial cost savings in the period 2011-2014, to have the proposed approach fully in place for new services within 3-5 years, and to complete the majority of legacy rationalisation and migration within 10 years.
Data Centre Consolidation 2.1 Consolidation can commence through inviting suppliers that currently operate multiple data centres for the public sector to consolidate to two each, with the savings achievable through estate reductions and virtualisation rebated to their public sector clients. As existing contracts expire, replacement G Cloud services can then be sourced from the Government Applications Store where available;- where not, contract renewal can be used to drive provision of additional G Cloud services as the preferred choice. During the transition period some unique residual needs will need to be sourced via a conventional procurement exercise. 2.2 Private G Cloud services will be provisioned from a limited number of sustainable data centres. Analysis will be conducted to determine whether there is a case for procuring data centre estate separately from ICT services; this would enable sharing of physical facilities between multiple G Cloud service providers and ease inter-supplier service transfers.
G Cloud 3.1 There will be 3 main categories of G Cloud branded services:Software as a Service (SaaS) which includes managed services, common, utility and custom services, all of which can be configured for use by many Public Sector bodies. Platform as a Service (PaaS); a framework overseen by the CTO Council that will be used to create and manage provisioning of new business applications based on shared re-usable components ; and Infrastructure as a Service (IaaS) for hosting existing applications. This includes services providing capability for o Managing, securing and storing data o Hosting applications 3.2 The G Cloud brand will offer dedicated private services for public sector organisations, and trusted public cloud services in each category. Public cloud services are developing rapidly, and are already used by a number of public sector bodies, for example for services that do not involve personal data. The range and sophistication of public cloud services will continue to grow and more of the Public Sectors ICT needs will be met from public clouds as todays constraints are addressed over time. These constraints currently include:-
UNCLASSIFIED
Data Centre Strategy, G-Cloud & Government Applications Store Programme Phase 2
Information Assurance requirements e.g. data centres are outside the UK; End to end performance of services from public clouds may not be guaranteed; and Proprietary standards used by some public clouds create the risk of lock in. 3.3 G-Cloud private cloud services will address these constraints, enabling earlier use of the shared utility model across the public sector. Private G Cloud services will typically be provisioned by suppliers using an industry standard platform for example Microsoft Azure, VMware, or Eucalyptus, an Open Source platform that implements Amazon Web Services standards.
Government Applications Store 4.1 The Government Applications Store will be the marketplace in which trusted services can be trialled and then purchased from a variety of sources by the Public Sector. The services available will include private G-Cloud services, certified public cloud and other ICT Services (eg COTS); and other public sector ICT services such as PSN services. 4.2 The Government Applications Store will be an open marketplace encouraging both existing and new suppliers to the Public Sector to participate. New suppliers to the Public Sector will be able to promote and trial their services as free prototypes on the Government Applications Store in order to gauge market interest, with a defined commercial process to introduce new categories of service where demand is generated. Services that add new value will be welcomed into the portfolio provided they meet the minimum assurance requirements the approach will be light touch and will emphasise validating service outcomes rather than auditing the detailed implementation approach. 4.3 Services available through the Government Applications Store will be certified to demonstrate their compliance to Public Sector requirements. The scope, service levels, security accreditation and price of the services will be available for review by potential purchasers. 4.4 The commercial framework of the Government Application Store will allow purchasers to buy certified services from an on-line catalogue under a cross public sector framework contract. Services will be paid for on a per use or subscription basis. The latest price achieved for the service will be shown to purchasers, however if subsequently a lower price for this service is achieved by another organisation then this will be made available to all subscribers of the service - from the point at which the new lower price is achieved. 4.5 The Government Applications Store will encourage re-use of existing services. Purchasers will be directed to existing Managed Services and then to Common Government and Utility services. Only if these types of offerings are not suitable will purchasers proceed to build a custom service. The application services offered will vary from commodity applications which can be used by any organisation with little change to line of business applications which will require adapting to a particular organisation. 4.6 In order to avoid lock in to a particular infrastructure provider there will be a choice of at least two infrastructure providers for each application. In principle purchasers will be
UNCLASSIFIED
Data Centre Strategy, G-Cloud & Government Applications Store Programme Phase 2
able to transfer their chosen application service to another infrastructure provider if required at some future point, although this may involve some data migration activity. 4.7 Following selection of the application and infrastructure provider, the purchased service will be provisioned through an automated process in the organisations data context. This will require standards for common data items, again to be specified by the CTO Council. Subject to policy and individuals decisions, these standards will also ease the process of sharing data between different public sector organisations. 4.8 While the Government Applications Store will have a centrally managed master catalogue, there will be the capability to configure views of the catalogue for specific communities, for example to enable focus on services most relevant to a particular type of organisation, or to grey out services which are not approved by the users organisation. There will also be the ability to support Communities of Interest, encouraging public sector organisations and individuals to innovate by creating/configuring and then sharing locally generated applications. Closed loop feedback will provide visibility of whats working, enabling future trial and purchasing decisions to be informed by others experiences.
UNCLASSIFIED
Data Centre Strategy, G-Cloud & Government Applications Store Programme Phase 2
Contents
1. 2. 3. 3.1. 3.1.1. 3.1.2. 3.1.3. 3.1.4. 3.1.5. 3.1.6. 3.2. 3.2.1. 3.2.2. 3.2.3. 3.2.4. 3.2.5. 3.3. 3.3.1. 3.3.2. 3.3.3. 3.3.4. 3.3.5. 3.3.6. 3.3.7. 4. 4.1. Purpose of Document ........................................................................................................... 11 Introduction ............................................................................................................................ 12 Why Use Cloud Computing in the Public Sector ................................................................ 14 Public Sector ICT Landscape........................................................................................... 14 Budgetary Pressures..................................................................................................... 14 Green Agenda ............................................................................................................... 14 Digital Britain .................................................................................................................. 15 ICT Procurement ........................................................................................................... 15 ICT Strategy for Government ....................................................................................... 16 Quality of Data Centres................................................................................................. 18 Developments in the ICT Industry ................................................................................... 18 Will G-Cloud Deliver? .................................................................................................... 20 Will Cloud Computing Happen? ................................................................................... 20 Can the benefits be delivered? .................................................................................... 20 Does G-Cloud depend on leading edge technology? ................................................ 21 Key Risks ....................................................................................................................... 21 Benefits .............................................................................................................................. 23 Budgetary Pressures..................................................................................................... 23 Green Agenda ............................................................................................................... 23 Digital Britain .................................................................................................................. 24 ICT Procurement ........................................................................................................... 24 Current Initiatives........................................................................................................... 24 Quality of Data Centres................................................................................................. 25 ICT Market ..................................................................................................................... 25
UNCLASSIFIED
Data Centre Strategy, G-Cloud & Government Applications Store Programme Phase 2
4.1.1. 4.1.1.1. 4.1.1.2. 4.1.1.3. 4.1.1.4. 4.1.1.5. 4.1.1.6. 4.1.1.7. 4.1.1.8. 4.1.2. 4.1.3. 4.1.4. 4.1.4.1. 4.1.4.2. 4.1.5. 4.2. 4.3. 4.4. 4.5. 4.6. 5. 5.1. 5.2. 5.3. 5.5. 6. 7.
Application and Information Services .......................................................................... 28 Personal Information Management .......................................................................... 29 Interaction................................................................................................................... 29 Collaboration and Simple Applications .................................................................... 29 Resource and Management ..................................................................................... 29 Departmental Applications ........................................................................................ 29 Data Services ............................................................................................................. 29 Line of Business (LOB) ............................................................................................. 29 Information Access .................................................................................................... 29 Infrastructure and Platform Services ........................................................................... 30 Data Services on the G-Cloud...................................................................................... 31 Professional ICT Services ............................................................................................ 33 Service Management Services ................................................................................. 33 System Integration Services ..................................................................................... 33 Exclusions from G-Cloud Scope .................................................................................. 33 Government Applications Store ....................................................................................... 34 Data Centre Consolidation ............................................................................................... 37 Organisation and Governance in the world of G-Cloud ................................................. 38 Roadmap ........................................................................................................................... 40 Transition ........................................................................................................................... 42
Principles ............................................................................................................................... 43 Commercial Principles ...................................................................................................... 43 Technical Principles .......................................................................................................... 46 Information Assurance Principles .................................................................................... 47 Transition Principles.......................................................................................................... 50 Scenarios ............................................................................................................................... 51 Conclusion ............................................................................................................................. 52
UNCLASSIFIED
Data Centre Strategy, G-Cloud & Government Applications Store Programme Phase 2
8.
Appendices ............................................................................................................................ 53
A1. Appendix 1 - Glossary of terms ............................................................................................ 53 A2. Appendix 2 Stakeholder list .................................................................................................. 55 A3. Appendix 3 Details of Scenarios........................................................................................ 57 A3.1. Central Government Department ICT Service Director ................................................... 57 A3.1.1. Role: ................................................................................................................................. 57 A3.1.2. Challenge: ........................................................................................................................ 57 A3.1.3. Outcome: .......................................................................................................................... 57 A3.2. Local Government Director of Housing ............................................................................. 59 A3.2.1. Role: ................................................................................................................................. 59 A3.2.2. Challenge: ........................................................................................................................ 59 A3.2.3. Outcome A: ...................................................................................................................... 59 A3.2.4. Outcome B: ...................................................................................................................... 60 A3.3. Private Sector Application Provider................................................................................... 61 A3.3.1. Role................................................................................................................................... 61 A3.3.2. Challenge: ........................................................................................................................ 61 A3.3.3. Outcome: .......................................................................................................................... 61 A3.4. Central Government Department ICT Service Director ................................................... 62 A3.4.1. Role: ................................................................................................................................. 62 A3.4.2. Challenge: ........................................................................................................................ 62 A3.4.3. Outcome: .......................................................................................................................... 62 A3.5. Local Government CIO....................................................................................................... 63 A3.5.1. Role: ................................................................................................................................. 63 A3.5.2. Challenge: ........................................................................................................................ 63 A3.5.3. Outcome: .......................................................................................................................... 63 A3.6. Private Sector ICT Provider ............................................................................................... 64 A3.6.1. Role: ................................................................................................................................. 64
UNCLASSIFIED
Data Centre Strategy, G-Cloud & Government Applications Store Programme Phase 2
A3.6.2. Challenge: ........................................................................................................................ 64 A3.6.3. Outcome: .......................................................................................................................... 64 A4. Appendix 4 Drivers for Change............................................................................................. 65 A4.1. Strategic Drivers for Change ............................................................................................. 65 A4.2. Financial Drivers for Change ............................................................................................. 65 A4.3. Non Financial Drivers for Change ..................................................................................... 66 A4.4. Technological Drivers for Change ..................................................................................... 67 A5. Appendix 5 Programme Risks .............................................................................................. 68 A6. Appendix 6 Information Assurance ...................................................................................... 78
UNCLASSIFIED
10
Data Centre Strategy, G-Cloud & Government Applications Store Programme Phase 2
1. Purpose of Document
The G-Cloud, Government Applications Store and Data Centre Consolidation Phase 2 programme started on 5 October 2009 and will run till 12 February 2010. The programme comprises seven workstrands and a Programme Office function. These workstrands have been staffed by a mix of civil servants, consultants and industry volunteers. This document provides a Vision of how the G-Cloud, Government Applications Store and Data Centre Consolidation will deliver ICT services to the Public Sector. The Vision builds on the Government Data Centre Strategy Phase 1 Report produced by Phase 1 of the programme; it is also based on the Government ICT Strategy. The Vision should be used by stakeholders to gain an overview and high level understanding of G-Cloud. The Vision is underpinned by further documents which provide more detail in addition to that provided in the Vision, these include: Commercial Strategy Technical Architecture Strategy Information Assurance Strategy Service Management Framework Approach Service Specification Transition Approach Business Plan
UNCLASSIFIED
11
Data Centre Strategy, G-Cloud & Government Applications Store Programme Phase 2
2. Introduction
The Government Data Centre Strategy Programme Phase 1 identified the desirability of consolidating existing public sector data centres and creating a private government computing cloud (G-Cloud) for the public sector. This document describes the Vision of how a consolidated set of public sector data centres and a G-Cloud would provide ICT services to the public sector. It will be used by Phase 2 of the Data Centre Consolidation, G-Cloud and Applications Store programme to develop more detailed business case and plans, specifications, architectures and a transition strategy for and to the G-Cloud. UK Government currently has an extensive and disparate ICT estate supporting the delivery of services. The emergence of cloud computing and new application delivery models offer the opportunity to consolidate and improve this existing ICT estate through provision of standard, commodity ICT services to the whole of the public sector through a government cloud (G-Cloud). The government will develop an integrated set of strategies for consolidation of existing data centres in the public sector, delivery of ICT services through a government cloud (G-Cloud) and the development of an Application Store for purchase of G-Cloud services. These strategies will address a number of government objectives: Reduction of ICT costs
A sustainable reduction in the operational costs of ICT across public sector to contribute to the Operational Efficiency Programme (OEP) savings target for ICT The reduction in cost will include a lower cost associated with future change in ICT service provider specifically the cost of transition to a new provider
To support a better citizen experience of government services by allowing government to provide new ICT services faster to meet citizen needs Enabling improved responsiveness to ministerial and business generated changes through faster deployment of ICT services
Reduction of carbon footprint due to Government ICT services Through consolidating and optimising use of existing spare ICT capacity and decommissioning unused capacity Adoption of more carbon efficient technology
UNCLASSIFIED
12
Data Centre Strategy, G-Cloud & Government Applications Store Programme Phase 2
By removing known issues in existing infrastructure including lack of resilience and known security concerns
Including supporting the objectives of Digital Britain through the deployment of ICT services and creation of a new market for government ICT services Integrating with wider Government ICT initiatives e.g. PSN, Desktop Strategy to ensure that the overall government ICT Strategy is supported by the GCloud
In order to implement the G-Cloud and support these strategies a set of multi dimensional changes will need to occur: Technical implementation of a G-Cloud architecture covering applications , data management storage and security services; Process implementation of processes to use and manage G-Cloud services; Commercial implementation of a commercial framework to permit contracting of services from the G-Cloud; and Cultural a shift to sharing and re-use of ICT services from the G-Cloud The remainder of this document describes the Vision for Datacentre Consolidation, G-Cloud and Application Store which will meet these objectives. The services described will be available to all UK public sector organisations from small bodies through to major central government departments. The Vision described is for 10 years hence, although many aspects of the Vision can be implemented within 2 years.
UNCLASSIFIED
13
Data Centre Strategy, G-Cloud & Government Applications Store Programme Phase 2
3.1.1.
Budgetary Pressures
In April 2009, HM Treasury published the Operational Efficiency Programme (OEP) Final Report which estimated that overall savings of around 20 per cent of the estimated 16 billion annual Public Sector ICT expenditure (3.2 billion) should be achievable without compromising the quality of frontline public services. These savings must now be found by delivering ICT services more efficiently.
3.1.2.
Green Agenda
Government runs some of the worlds largest computer systems and is Britains largest purchaser of Information and Communication Technology (ICT). This technology is used to improve the lives of millions of people and can enable smarter ways of working to reduce carbon. However, this same technology is a major consumer of energy and natural resources. UK government has made a number of sustainable operational commitments: Central government office estate will achieve carbon neutrality by 2012; UK to reduce greenhouse gases by 26% or more by 2020, 60% by 2050; and Sustainable Operations on the Government Estate (SOGE) targets.
UNCLASSIFIED
14
Data Centre Strategy, G-Cloud & Government Applications Store Programme Phase 2
ICT globally emits comparable levels of carbon to the aviation industry, and emissions continue to grow. Recognising this, the Greening Government ICT Strategy set two challenging targets which support delivery of mandatory SOGE (Sustainability on the Government Estate) targets: government ICT will be carbon neutral by 2012, and carbon neutral across its lifecycle by 2020. In order to deliver on these commitments delivery of ICT services to the Public Sector in new more energy efficient ways which support the Governments climate change agenda need to be developed and implemented.
3.1.3.
Digital Britain
The delivery of services to the public by ICT enables wider Government aims for the UK in the global digital economy and citizen engagement. The Government in the Digital Britain Report (June 2009) identifies the need for the UK to be at the leading edge of the global digital economy. The Report also states that an ambitious and clear programme of The Digital Switchover of Public Services, to primarily electronic and online delivery, will unlock significant cost savings, whilst at the same time serving to increase levels of satisfaction. The achievement of these aims will require a step change in the efficiency of ICT procurement and delivery by the Public Sector.
3.1.4.
ICT Procurement
Government procurements are overseen by the Office of Government Commerce (OGC) which has an objective of ensuring the Government gets best value from its spending and that procurements support the Governments sustainability agenda. Currently the procurement and delivery of ICT programmes in the Public Sector is a lengthy and costly process. Procurement of large ICT systems can take in excess of 12 months. The cost of this procurement cycle for both the Public Sector and Suppliers is significant. The length of time involved means that ICT services in support of new Government policies can rarely be deployed in the timescale best suited to support the policy. A more agile method of procuring and delivering ICT in the Public Sector is needed. These constraints affect Local and Regional Government in addition to central Government. The OGC is seeking ways in which government procurements can become more efficient and quicker while supporting sustainability.
UNCLASSIFIED
15
Data Centre Strategy, G-Cloud & Government Applications Store Programme Phase 2
3.1.5.
The CIO Council agreed the overall ICT strategy for Government in summer 2009. This ICT Strategy supports existing core public sector goals, set in Digital Britain, Building Britains Future, Excellence and fairness, and the Operational Efficiency Programme: improving public service delivery improving access to public services, and increasing the efficiency of public service delivery At the heart of the strategy is the creation of a common, secure and flexible infrastructure that is available across the public sector. It comprises the strands depicted below:
UNCLASSIFIED
16
Data Centre Strategy, G-Cloud & Government Applications Store Programme Phase 2
There are 14 strands making up the strategy: 1. The Public Sector Network Strategy - Rationalising and standardising to create a network of networks, enabling secure fixed and mobile communications for greater capability at a lower price. 2. The Government Cloud (G-Cloud) - Rationalising the government ICT estate, using cloud computing to increase capability and security, reduce costs and accelerate deployment speeds. 3. The Data Centre Strategy - Rationalising data centres to reduce costs while increasing resilience and capability. 4. The Government Applications Store (G-AS) - Enabling faster procurement, greater innovation, higher speed to deliver outcomes and reduced costs. 5. Shared services, moving systems to the Government Cloud - Continually moving to shared services delivered through the Government Cloud for common activities. 6. The Common Desktop Strategy - Simplifying and standardising desktop designs using common models to enhance interoperability and deliver greater capability at a lower price. 7. Architecture and standards - Creating an environment that enables many suppliers to work together, cooperate and interoperate in a secure, seamless and cost-efficient way. 8. The Open Source, Open Standards and Reuse Strategy - Levelling the playing field for procurement, enabling greater reuse of existing tools, fewer procurement exercises and enhanced innovation all at a lower cost. 9. The Greening Government ICT Strategy - Delivering sustainable, more efficient ICT at a lower price. 10. Information Security and Assurance Strategy - Protecting data (citizen and business) from harm whether accidental or malicious. 11. Professionalising IT-enabled change - Improving the capabilities, knowledge, skills and experience of those involved in ICT-enabled business change through the Government IT Profession. 12. Reliable project delivery - Using portfolio management and active benefits management to ensure that government undertakes the right projects in the right ways. 13. Supply management - Working together to gain maximum value from suppliers both for individual organisations and collectively across the public sector. 14. International alignment and coordination - Ensuring that international treaties and directives reflect UK national requirements and that the UK remains at the forefront of delivery.
UNCLASSIFIED
17
Data Centre Strategy, G-Cloud & Government Applications Store Programme Phase 2
3.1.6.
The Data Centre Strategy Report produced by the Strategic Supply Board for the Government CIO Council in September 2009 had a number of findings including:
There is a major opportunity for government to make significant cost savings whilst delivering improved agility, flexibility, resilience, security and environmental sustainability. High level analysis suggests a reduction in ICT data centre infrastructure costs will deliver a net 900 million of cost savings over 5 years, with recurrent savings of more than 300m a year thereafter; There are significant variations within the current estate that are not justified by differences in business needs, which will be rationalised by the approach proposed in this Vision; Other organisations have successfully delivered major ICT consolidation programmes to create a dynamic ICT infrastructure and there is considerable experience to draw on; The challenges in consolidating ICT infrastructure are organisational and cultural rather than technical; and There is the potential for further cost saving and operational benefits by delivering a government private Cloud (G-Cloud) in addition to data centre consolidation.
UNCLASSIFIED
18
Data Centre Strategy, G-Cloud & Government Applications Store Programme Phase 2
enabling of Software as a Service (SaaS) through standards and multi tenanting of services. Cloud application services are applications delivered as a service via a network to a browser front end. Cloud application services usually require the creation of a multitenant architecture where one application supports many firms or organisations, but provides a unique view for each. Cloud applications are often SaaS, but not all SaaS applications are cloud application services. SaaS applications delivered as single-tenant applications on dedicated infrastructures are not Cloud application services. Large corporate firms which have implemented Cloud computing report: ICT cost reductions of 40-65%; improved agility in implementing strategy with ICT support; and improved speed in implementing changes to support business needs. Public Cloud services are gaining in acceptance by corporate world and the Public Cloud providers are increasing their capacity and services. Amazon has 1000 staff involved in developing their Public Cloud offering. Early concerns of the market regarding the security and service levels offered by Public Clouds are being taken very seriously and improvements have been made in these areas with further improvements planned. However a number of firms have decided to setup a Cloud computing model in house, creating a private cloud for use only within their organisation. This provides a number of advantages: Cloud services can be tailored to the firms requirements; security is under the control and monitoring of the organisation; and end to end service levels are easier to achieve.
UNCLASSIFIED
19
Data Centre Strategy, G-Cloud & Government Applications Store Programme Phase 2
3.2.1.
The G-Cloud model can bring many beneficial changes to the delivery of ICT across the Public Sector but will it really deliver? In the section below how Cloud computing has the foundations and track record to succeed is described.
3.2.2.
What is the evidence that Cloud computing is becoming a standard ICT delivery model: Large ICT Services Suppliers have invested in the implementation of large global public clouds; The ICT industry itself is migrating to the use of clouds to deliver in house ICT services; and Private sector organisations are adopting Cloud computing to deliver ICT services.
3.2.3.
What is the evidence that the key elements of the G-Cloud Cloud computing, Data Centre Consolidation and Software as a Service (SaaS) are capable of delivering the promised benefits: Bechtel have adopted a cloud computing model with a resulting saving of 60% on their ICT costs; In a data centre consolidation programme Hewlett-Packard have reduced the number of data centres globally from 85 to just 6; IBM have reduced their data centres globally from 155 to 7; and Telegraph Media Group has used SaaS to make new functionality available without complex software upgrades pay only for the computing power needed lower total cost of ownership of ICT.
However in order to gain the benefits of Cloud computing the Public Sector will need to adopt a new approach to ICT services. The existing approach of defining and procuring bespoke systems which meet the specific needs of a department will need to shift to an approach which makes use of standard or generic systems which are available at lower cost and adapts the processes of the department to use the system.
UNCLASSIFIED
20
Data Centre Strategy, G-Cloud & Government Applications Store Programme Phase 2
The commercial potential of cloud computing and cloud services is widely accepted, both in private industry and in the public sector. The opportunities for cost reduction and efficiency in the UK public sector are real and achievable, but require significant changes to procurement practices, delivery frameworks and across the supplier landscape. A pre-requisite for realisation of the commercial objectives are a set of UK Government technical & operational standards that can define the G-Cloud based on a (significant) number of competing infrastructural service providers operating at any appropriate security level. However Government has a significant legacy of applications which exhibit many pre-cloud symptoms, including low server utilisation and high operational costs. It must be understood that the cloud computing and cloud sourcing paradigms do not always directly lead to reduced costs - the real challenge will be to ensure that sufficient economy of scale and standardisation is reached quickly enough to deliver a net saving.
3.2.4.
Does the G-Cloud depend on new and untried technologies which mean that the Public Sector must take on significant technology risks in its implementation? In fact the innovation of the G-Cloud model is in its approach to the governance and management of ICT in the Public Sector rather than the deployment of new technology. Cloud computing is based on significant amounts of existing technology. Specific aspects of the G-Cloud may require new technologies but this will not be the norm for the majority of the G-Cloud if a prudent approach to its design is implemented. Instead for G-Cloud to be successful Public Sector leadership will need to encourage existing ICT services to be re-used where possible avoiding bespoke solutions to common challenges across the Public Sector. The successful introduction and implementation of the G-Cloud is a leadership not a technology challenge.
3.2.5.
Key Risks
The programme must manage effectively a number of risks in order to deliver the G-Cloud benefits. These risks cover a number of key areas including: Commercial, Information Assurance, Technical Architecture, Organisation and Governance. The full list of key risks to delivery of the programme are listed in Appendix 5. However a number of key risks are highlighted in the following sections. 3.3.9.1 Commercial A Commercial approach will be implemented which manages the following risks: Current resource constrained environment prevents up front investment for G-Cloud becoming available;
UNCLASSIFIED
21
Data Centre Strategy, G-Cloud & Government Applications Store Programme Phase 2
Pricing and contractual framework for the G-Cloud is attractive to Public Sector but discourages suppliers from making services available on the G-Cloud; Business case may double count savings with other Public Sector programmes; Procurement regulations do not allow additional consumers after initial procurement of the service; and Take up of G-Cloud proceeds too slowly so benefits will not be significant enough to attract Public Sector organisations in future. 3.3.9.2 Information Assurance An Information Assurance approach will be implemented which manages the following risks: Aggregation of data in G-Cloud raising IL levels beyond 4 and preventing use of GCloud services by public bodies with lower IL infrastructure; and Common infrastructure and shared nature of G-Cloud cannot be assured by departmental SIRO model and so are not accredited. In addition the challenges of situational awareness on the G-Cloud will require approaches to be developed during the implementation of the G-Cloud. More details of the Information Assurance principles and approach to risks are provided in Section 5.3 and Appendix 6. 3.3.9.3 Technical Architecture A Technical Architecture for the G-Cloud will be developed which manages the risk that adoption of G-Cloud locks the Public Sector into a particular vendors proprietary standards as industry standards for Cloud technologies are not currently agreed 3.3.9.4 Organisation and Governance An Organisation and Governance approach will be implemented which manages the following risks: G-Cloud is not taken up or deployed effectively across the Public Sector due to decentralised nature of ICT governance in the Public Sector; and Senior stakeholders may not support the implementation of the G-Cloud. 3.3.9.5 Public Sector Network The G-Cloud programme will have a number of dependencies on the Public Sector Network programme. Programme managements will work together to ensure that these dependencies are managed or mitigated in order that the G-Cloud is implemented as planned.
UNCLASSIFIED
22
Data Centre Strategy, G-Cloud & Government Applications Store Programme Phase 2
3.3. Benefits
The new world of the G-Cloud offering utility computing from consolidated data centres and encouraging re-use of ICT assets through the Government Applications Store will bring a comprehensive set of benefits across the Public Sector ICT landscape.
3.3.1.
Budgetary Pressures
The G-Cloud will deliver a fundamental contribution to the cost savings for OEP and will facilitate and accelerate the OEP targets. This will be achieved by: Data Centre Consolidation Reduced hardware maintenance, server capital expenditure, and power consumption through more efficient and better utilised infrastructure. Reduced up-front investment costs through standardisation and sharing of assets. Reduced estate footprint through site sales/repurposing of accommodation.
G-Cloud Reduced capital investment in computer infrastructure through utility-based rental of computing and processing time. Reduced server purchase costs through virtualisation of servers across departments leading to higher utilisation rates Reduced data recovery costs through fewer dedicated DR facilities.
Government Applications Store Reduced bespoke application development through reuse of existing components. Reduced application purchase prices through economies of scale. Reduced licensing costs through licensing consolidation and reuse. Reduced investment costs through SaaS pay for use model Volume discounts achieved by purchasers apply to all public sector bodies already using the service
3.3.2.
Green Agenda
The G-Cloud will lead to more efficient use of ICT by the Public Sector so lowering the carbon emissions associated with delivering ICT services: Consolidation of data centres will reduce footprint of building estate;
UNCLASSIFIED
23
Data Centre Strategy, G-Cloud & Government Applications Store Programme Phase 2
Virtualisation will drive higher server utilisation reducing server footprint; and Re-use of ICT assets will lower development and project resources used to implement new services and systems. The G-Cloud will also facilitate smarter ways of working through integration of government information and data sources, further reducing governments environmental impact and carbon footprint.
3.3.3.
Digital Britain
The G-Cloud will deliver greater agility and speed in the delivery of policy and services, underpinned by the adoption of shared infrastructure at lower cost. The agility will result from the ability to re-use existing assets and the new commercial model reducing procurement timescales and costs. The G-Cloud will through the Government Applications Store create a marketplace with a low cost of entry to new and small ICT suppliers encouraging the development of new UK ICT businesses and supporting the UKs position in the digital world.
3.3.4.
ICT Procurement
The commercial model of the G-Cloud will be based on pre agreed frameworks. This will remove the need for lengthy and costly procurements. This will reduce costs for both the Public Sector and Suppliers. In addition the Public Sector will be able to deliver ICT services faster in support of policy. Procurement law will apply to the G-Cloud, and all normal rules will need to be followed. It will be important to get this right at the outset. This is particularly the case given the arrival of the regulations implementing the Remedies Directive on 20 December 2009. This puts an increasing emphasis on the use of legally compliant procurement vehicles.
3.3.5.
Current Initiatives
The G-Cloud will complement and support the implementation of existing Public Sector programmes: PSN: the G-Cloud will offer PSN a route to market through the Government Applications Store. In addition the G-Cloud will use PSN services to connect users to G-Cloud services. Strategic Desktop: the G-Cloud will provide ICT services for the Strategic Desktop
UNCLASSIFIED
24
Data Centre Strategy, G-Cloud & Government Applications Store Programme Phase 2
3.3.6.
Existing data centre space and infrastructure will be rationalised into a smaller set of secure physical data centres these will host both the G-Cloud and existing legacy applications during the migration period. The outcome will be a significantly smaller footprint in highly virtualised shared data centres which meet government standards for resilience, security and sustainability at an overall lower cost. This will result not only in a reduction in the costs of data centres but also in the risks of disruption to delivery of ICT services to the Public Sector.
3.3.7.
ICT Market
The market for Cloud services, IaaS, PaaS and SaaS is expanding; the G-Cloud and Government Applications Store will offer the Public Sector the opportunity to access this market. The expansion of this market will provide the Public Sector with new services and greater competition will help to that these services will be cost efficient.
UNCLASSIFIED
25
Data Centre Strategy, G-Cloud & Government Applications Store Programme Phase 2
UNCLASSIFIED
26
Data Centre Strategy, G-Cloud & Government Applications Store Programme Phase 2
4.1. G-Cloud
G-Cloud: bringing utility convenience to public sector ICT shared, flexible, agile, transparent and efficient allocation of ICT when its needed, through sharing standardised resources to reduce costs The G-Cloud is the delivery of Public Sector ICT by a shared secure utility style ICT services infrastructure, underpinned by a new commercial model enabling public bodies to have the option to pay only for the service at the time when they use it. This approach is now developing rapidly and is known as Cloud Computing. It is enabled by common standards, and by heavily automated secure business processes that enable substantial reductions in costs.
G-Cloud is the Public Sector brand for the use of certified cloud computing. There will be 3 main categories of G-Cloud branded services:Software as a Service (SaaS) which includes managed services, common, utility and custom services, all of which can be configured for use by many Public Sector bodies; Platform as a Service (PaaS) will be will be used to provide a platform for creating new business applications based on shared re-usable components. The platform offered will be approved and overseen by the CTO Council; Infrastructure as a Service (IaaS) will provide ICT infrastructure primarily computing resource and data storage. The G-Cloud will be a UK Public Sector implementation of cloud computing that will provide both secure, private cloud services and access to certified public cloud services, for example those provided by Amazon cloud services. These services will range from ICT infrastructure services through to application and information services and to ICT professional services such as service management. The G-Cloud will offer dedicated private services for public sector organisations, and trusted public cloud services. The range and sophistication of public cloud services is growing and more of the Public Sectors ICT needs will be met from public clouds as todays constraints are addressed over time. These constraints currently include:Information Assurance requirements e.g. data centres are outside the UK; End to end performance of services from public clouds may not be guaranteed; and Proprietary standards used by some public clouds create the risk of lock in. G-Cloud private cloud services will address these constraints, enabling earlier use of the shared utility model across the public sector. Private G-Cloud services will typically be provisioned by suppliers using an industry standard platform for example Microsoft Azure, VMware, or Eucalyptus - an Open Source platform that implements Amazon AWS standards.
UNCLASSIFIED
27
Data Centre Strategy, G-Cloud & Government Applications Store Programme Phase 2
The services offered by the G-Cloud will be defined in a Service Catalogue which any public sector organisation can use to purchase ICT services. Each service will be described in the Service Catalogue, its description will include details of the service, service levels offered, service reports provided, if relevant the increments of capacity offered, time periods or increments for which the service can be procured and the price of the service. Services provided by the G-Cloud will be up to security level IL4 only. In order to provide services in the G-Cloud a supplier will undergo a certification process for both their organisation and each of their services. This certification process will ensure that services meet the quality and information assurance requirements of the public sector and will provide consuming public bodies with the confidence that G-Cloud services are suitable for supporting provision of services to citizens. The information assurance certification will represent a partial accreditation, a residual element of accreditation which cannot be carried out centrally remaining with the consuming organisation. A public sector body will govern the certification process, overseeing and managing the approval of suppliers and their services.
4.1.1.
The G-Cloud will provide a variety of application and information services to the public sector. These services will vary from the purchase of software licenses to access to government stores of information where this is appropriate from a statutory and information assurance perspective. The focus will be on re-use of existing assets and use of commodity services. Existing common application services where possible will be offered so that public bodies do not need to develop or commission development of new application services.
Data Centre Strategy, G-Cloud & Government Applications Store Programme Phase 2
Applications available on the G-Cloud will vary from personal productivity tools through to complex departmental specific applications which are tightly integrated with their data. The services available for each class of application will vary. A large proportion of these applications will already be in use elsewhere in the public sector, so their provision to other public bodies via the G-Cloud will promote re-use of applications across government allowing the cost reduction for the public sector through both larger volume discounts and avoidance of new development costs. Applications will generally be provided as Software as a Service (SaaS), where the body using the application will pay using a pay for use model. Applications will be available on at least two different infrastructure platforms so that public sector bodies can transfer loads between infrastructure suppliers if required. The different classes of application are described below:
4.1.1.1.
These are personal productivity applications where data will be specific to the individual or body. Examples are Email, Calendaring and Contacts.
4.1.1.2.
Interaction
These are applications which support contact and interaction with others. Examples are Peer to Peer communications and Social Networking applications.
4.1.1.3.
These are applications which either support collaborative working or provide support for common tasks. Examples are workflow and records management.
4.1.1.4.
These are applications which support public sector staff in their daily duties. Examples are travel booking and expense claiming applications.
4.1.1.5.
Departmental Applications
These are applications with data specific to and useful to a department. Examples are computer based training or small departmental databases.
4.1.1.6.
Data Services
These are applications providing access to data. Examples are management reporting and access to geographic data.
4.1.1.7.
These are applications which support the functioning of the public body; they will have data which is specific to that public body. They will require tuning for a particular department. Examples are a HR application or a CRM system.
4.1.1.8.
Information Access
These are applications provided by a department to other public bodies which give access to data held by the department. The data will generally be tightly coupled to an application. The
UNCLASSIFIED
29
Data Centre Strategy, G-Cloud & Government Applications Store Programme Phase 2
G-Cloud will provide this service as a gateway using CTO Council endorsed G-Cloud services to connect the two public bodies. This service will only be permitted where statute allows the data to be shared with the requesting public body and information assurance requirements for the data are adequately supported across the G-Cloud. An example of this service is CISx from the DWP.
4.1.2.
The G-Cloud will provide a variety of ICT infrastructure and platform services to the public sector. These services will be based on a layered architecture model, and are standardised to widen their applicability to multiple public sector consumers.
Database
IL Level Options
Operating System
Service Level
Resilience
Memory Capacity
A public body will be able to purchase services at multiple layers. For example on one occasion the body could purchase a server capacity service onto which the body loads its own operating system and database. On another occasion the body may choose to purchase a database service into which the supplier has packaged underlying operating system and server capacity. Data across the Public Sector continues to expand. A key infrastructure service offering will be storage services for data, such as SAN services. This offering will enable public bodies to access and store their data cost effectively in resilient, secure storage, with the ability to expand or contract the capacity without major capital investment in their ICT infrastructure. There is an opportunity for greater development of services for Data Management, Storage and Security separately from services provided for applications processing. This Data Capability can become a long-term asset in that applications can be chosen accordingly to meet a given organisations current business priorities. The G-Cloud will provide data services for storage and management of: Operational data;
UNCLASSIFIED
30
Data Centre Strategy, G-Cloud & Government Applications Store Programme Phase 2
Management Information data for analysis and reporting; and Archive data for storage. Database services are becoming common in cloud computing, so in addition database services will be offered as part of G-Cloud, providing structured storage of data. This service will enable public bodies to access and use data to support new business services. The GCloud will implement standards that will enable wider, but secure and legislatively permitted shared access to data resources with other Public Sector bodies where there is a policy decision to do so. More detail on G-Cloud data services are provided in Section 4.1.3 Data in the G-Cloud. In order to ensure that services in the G-Cloud are available from multiple suppliers the services available will conform to open and industry standards for ICT components. The capacity of services will be measured using industry standard units. Services will be defined so that varying levels of resilience, service levels and support allow consumers to purchase services to host business services of varying priority to the public body involved. In addition this differentiation will allow the purchase of services with high levels of resilience and superior service levels for production systems while more cost effective services with lower service levels are available for development and test services. Specific specifications of services for purposes such as Disaster Recovery will also be available.
4.1.3.
Data is one of the key assets of the Public Sector. As it develops, the G-Cloud will become the repository of a significant portion of Public Sector data. Data also persists beyond an application, with migration between applications being required as the application stack changes. Cloud providers are addressing the new challenges and opportunities management of data in a cloud environment offers: Microsoft has implemented cloud-based data platforms which seek to provide a database service which meets the needs of primarily network based application access; Cisco are offering SAN consolidation services and security approaches for multiple organisation use of SANs; Amazon offers database services including tools which are scalable to meet the needs of cloud services; and Other suppliers are developing data and database services for the cloud.
UNCLASSIFIED
31
Data Centre Strategy, G-Cloud & Government Applications Store Programme Phase 2
The continuing expansion of data is a key challenge for Public Sector ICT. The G-Cloud will provide access to a cost effective, secure and resilient data storage capacity which can be expanded or contracted rapidly in accordance with business needs of the Public Sector. In addition the G-Cloud can provide database services which will allow access to structured data which can be used to support new business services. The Public Sector will draw on G-Cloud data services for storage and management of: Operational data; Management Information data for analysis and reporting; and Archive data for storage. The management of this data by the G-Cloud will encompass its complete lifecycle including: creation or migration onto the G-Cloud; monitoring of growth including provision of additional storage capacity as needed protection through appropriate resilience and security; migration to cost effective storage facilities as full operational use ceases; and archival or secure destruction at end of life. The G-Cloud will offer data services which enable wider, but secure and legislatively permitted access to this resource across the Public Sector. The development of data standards for the G-Cloud will support widening of access and ease of data transfer at contract termination for public bodies. Data is currently often tightly coupled with a business application within a public bodys ICT estate. However as data usually persists beyond the life of the application, transition from a legacy application to a new or enhanced application can involve an expensive and time consuming activity of data transfer including data structure changes to fit with the new applications requirements. The definition of data standards for G-Cloud which recognise data persistence has the potential to reduce the amount of effort to migrate data. In addition the G-Cloud offers the potential to make existing data assets more widely available across the Public Sector. Capitalising on this potential will require the G-Cloud to define data standards and a data strategy. A Data Strategy will be developed in Phase 3 of the programme. The G-Cloud will offer data services which are compliant with the security and the legislative constraints that data held in the Public Sector must operate under. The Public Sector is already adopting standards to make Public Sector data more available in line with the objectives of bodies such as the National Archives and with the launch of data.gov.uk. G-Cloud data strategy and standards will be aligned with the existing public sector work.
UNCLASSIFIED
32
Data Centre Strategy, G-Cloud & Government Applications Store Programme Phase 2
However data obtained by the Public Sector must only be used in the manner allowed and specified by the associated legislation, the strategy for data and the operational controls of the G-Cloud will ensure that data is not accessed or shared in violation of this principle. This will require the storage of data in separated infrastructure storage areas. The G-Cloud will data tools to permit the wider sharing of appropriate data in a controlled manner.
4.1.4.
A number of professional services will be provided to support the delivery of G-Cloud components and to aggregate services from components available on the G-Cloud.
4.1.4.1.
Both suppliers and larger public bodies will offer service management services on the GCloud. This service will manage the overall delivery of services from the G-Cloud so that an integrated and consistent operational service is provided. These services will include the service management of operational services such as change management, incident management and service reporting. The service management will be based on a common industry accepted framework such as ITIL. This will enable suppliers of service components to use a standard method for interaction with the service integrator and public sector consumers. These services will be of particular value to smaller public bodies with limited ICT expertise available in their organisation.
4.1.4.2.
These services will provide public bodies with services which will integrate G-Cloud components into coherent services which can be consumed by a public sector body.
4.1.5.
The G-Cloud will provide a wide range of ICT and business services across all of the Public Sector. These services will be made available over time in line with the G-Cloud roadmap. The initial G-Cloud services will therefore be limited in range and coverage across Public Sector compared to the end Vision for G-Cloud. However even in the final Vision the scope of G-Cloud and Government Applications Store does not include: Services which are not ICT services or business services not supported primarily by ICT systems, for example - Facilities management; - Catering services; - Stationary procurement;
UNCLASSIFIED
33
Data Centre Strategy, G-Cloud & Government Applications Store Programme Phase 2
Development of services which are already provided by other strategic Government projects such as PSN or common desktop, although these services may be purchased through the Government Applications Store; IL5 IL5 and above are not provided in the G-Cloud, although such services may be co-located in the data centres from which G-Cloud services are provided. However only those elements of an application which are at IL 5 and above are excluded from G-Cloud, lower security rated components of the application can be hosted within the G-Cloud; Legacy services of limited life or applicability which would not justify cost of migration to G-Cloud; Making G-Cloud services available to the private sector, eg commercial firms except for the creation of composite services for resale to the Public Sector, for example providing infrastructure services to a software house so that it can provide a complete application service to a set of public bodies; and Making G-Cloud services available to foreign governments. There are no exclusions to the Data Centre Consolidation at this stage, However as detailed design and planning continues it may be necessary to exclude overseas locations due to reliance on network capacity and information assurance considerations.
UNCLASSIFIED
34
Data Centre Strategy, G-Cloud & Government Applications Store Programme Phase 2
Home
About
Managed Service
Utility Services
Common Services
Custom Services
FAQs
Contact us
Managed Services
Utility Services
Common Services
Custom Services
The Government Applications Store will provide a portal for public bodies purchasing services from the G-Cloud. Open Source software and services will be available in the Government Applications Store encouraging cost effective services to be provided in this market. While the Government Applications Store will have a centrally managed master catalogue, there will be the capability to configure views of the catalogue for specific communities, for example to enable focus on services most relevant to a particular type of organisation, or to gray out services which are not funded by the users organisation. There will also be the ability to support Communities of Interest, encouraging public sector organisations and individuals to innovate by creating/configuring and then sharing locally generated applications. Closed loop feedback will provide visibility of whats working, enabling future trial and purchasing decisions to be informed by others experiences.
Certification of a service will include review and approval of its information assurance, service management and commercial elements. In order to avoid lock in to a particular infrastructure provider there will be a choice of at least two infrastructure providers for each application. In principle purchasers will be able to transfer their chosen application service to another infrastructure provider if required at some future point, although this may involve some data migration activity.
UNCLASSIFIED
35
Data Centre Strategy, G-Cloud & Government Applications Store Programme Phase 2
Following selection of the application and infrastructure provider, the purchased service will be provisioned through an automated process in the public bodys infrastructure and data context. The Government Applications Store will continually be updated with new services. It will be an open marketplace encouraging new suppliers to join the existing community of ICT suppliers to the public sector. In order to support new suppliers joining a prototyping facility will be available on the Government Applications Store. The prototyping facility will allow a supplier to offer free for a period a new service without complete certification. If this service is taken up by public bodies the supplier will be able to subsequently upgrade the service to certified and chargeable. This will provide an agile way for new and smaller suppliers to trial new services and join the Government Applications Store. Services that add new value will be welcomed into the portfolio provided they meet the minimum assurance requirements the approach will be light touch and will emphasise validating service outcomes rather than auditing the detailed implementation approach. The Government Applications Store will also list requests for new services from public bodies. Suppliers and other public bodies will be able to review these requests and decide whether they wish to provide the suggested service. If new services are created in response to the requests they will be required to undergo certification before being made available on the Application Store. The public sector body will be responsible for identifying in advance: which services users in the body can purchase; which users are allowed to purchase services; and which disallowed services can be seen by users. So that if necessary a user can raise a request/justification for a currently unapproved for purchase service to be made available for purchase within their public body. The Government Applications Store will be designed so that potential purchasers of services are directed to existing managed services, then common and utility services only if these sources do not yield a satisfactory option will the purchaser be able to commission a custom solution, which must meet G-Cloud certification standards. This approach will encourage reuse of existing services, thereby reducing cost for the public sector by preventing unnecessary development of new applications and maximising volume discounts with existing Suppliers.
UNCLASSIFIED
36
Data Centre Strategy, G-Cloud & Government Applications Store Programme Phase 2
UNCLASSIFIED
37
Data Centre Strategy, G-Cloud & Government Applications Store Programme Phase 2
A set of the data centres will remain outside the G-Cloud to provide specific non commodity type services that the G-Cloud is not designed to provide. An example of these services would be where a public body requires services at IL 5 or IL 6 security level. It is intended that Data Centre Consolidation will be progressed through three parallel projects which will; Consolidate Public Sector owned Data Centres Consolidate Private Sector owned or operated Data Centres Procure new services from the market both for infrastructure and Data Centre facility services A standard benchmark (e.g. Rack as a Service) will be established to enable the comparison of the cost and quality of facilities from the various sourcing routes.
UNCLASSIFIED
38
Data Centre Strategy, G-Cloud & Government Applications Store Programme Phase 2
Service Catalogue
G- Cloud
Application Services Infrastructure Services Professional Services
The options for organisation and governance in the G-Cloud are being developed by the GCloud Phase 2 programme.
UNCLASSIFIED
39
Data Centre Strategy, G-Cloud & Government Applications Store Programme Phase 2
4.5. Roadmap
The implementation of the Data Centre Consolidation, G-Cloud and Government Applications Store will cover a period of 5 or more years, but an objective of the roadmap will be that the achievement of benefits will commence early. The approach to building the GCloud will be to build blocks of ICT services to support Public Sector digital capabilities and then roll these out through the G-Cloud across the Public Sector. The identification of and prioritisation of services to be built will be based on the requirements of Public Sector bodies and communities. For example if secure email facilities is identified by a group of Local Authorities as a service they require urgently then this would be an early service made available on the G-Cloud. The roadmap for specific services and their sequencing on the G-Cloud will be a deliverable of Phase 3 of the programme. However in the remainder of this section the approach to developing this roadmap is described and a potential roadmap is outlined. Where appropriate the approach taken to implementation will be to identify public bodies with existing plans to procure or implement a service suitable for inclusion on the G-Cloud, this public body will then lead on the procurement of the service for the G-Cloud ensuring that the procured or developed service meets the security, technical and contractual certification requirements of the G-Cloud. The new service will then be available to all public bodies for sharing and re-use via the Government Applications Store. This approach will minimise the need to fund central development and procurement of services, in addition it will ensure that each new service already has a committed market providing confidence to private sector suppliers that participation in the procurement is worthwhile and will result in genuine new business. Risk management of the G-Cloud will also dictate the sequencing with which new services are introduced. In the early stages years 1 and 2 of the programme, private cloud, lower criticality services with moderate service level and security requirements will be added. Example services could include existing services such as Government Gateway or DCSF collaborative working. As confidence in the G-Cloud brand grows and the Government Applications Store becomes a dynamic and vibrant market place, services which are critical to Public Sector delivery and have higher service level and security requirements will be incorporated into the G-Cloud. Public cloud services will also be enabled at this time. Early candidates for inclusion on the G-Cloud will include the Champion Assets endorsed by the Government CIO Councils. Subject to funding approval, the programme will be initiated in Spring 2010 to startup the delivery of Data Centre consolidation, G-Cloud and Government Applications Store. However, once the operational management and regulatory functions of the G-Cloud become mature, the programme will transfer further development of the G-Cloud to these bodies and itself be wound down. The programme will be responsible for those aspects of the G-Cloud implementation will require central control for example the procurement of the Government Applications Store.
UNCLASSIFIED
40
Data Centre Strategy, G-Cloud & Government Applications Store Programme Phase 2
The programme will manage the organisational and cultural activities required to transition public bodies to use of the G-Cloud. The G-Cloud will require a cultural change in the ICT departments of public bodies. In the G-Cloud identification of business needs and matching re-usable assets rather than procurement and management of custom solutions will be critical to cost effective delivery of ICT. An approach to equipping the ICT department with the structure and skills to successfully move to this G-Cloud way of working will be provided by the programme to participating public bodies. While the definitive approach to implementation of the G-Cloud will be delivered in Phase 3, a potential approach is outlined in the succeeding paragraphs: A planned engagement programme across public bodies will identify the early adopter public bodies for creation and re-use of G-Cloud services. A small group of early adopters across Central and Local Government in year 1 will pioneer use of the G-Cloud. The GCloud will be extended to larger groups of public bodies in further years, with existing adopters expanding the percentage of services they draw from the G-Cloud over time. In order for the G-Cloud to deliver its benefits it must become a trusted brand. This will be enabled by the risk managed approach to delivery of the G-Cloud but could also be supported by the publicising of G-Cloud successes for example an annual G-Cloud Award could be initiated. Potential milestones in year 1 include: Setup of management function for G-Cloud including regulator Procurement of Government Applications Store Initiate a consolidation programme for Public Sector owned Data Centres Initiate a consolidation programme for Private Sector owned or operated Data Centres Procurement of new infrastructure and Data Centre facility services for ICT services Implementation of some G-Cloud services by at least two central government departments Implementation of private G-Cloud services for a local authority Key achievements in year 2- 3 Front line innovation culture established First G-Cloud Awards ceremony held Launch of public cloud services Early adopters will now have 40% of relevant ICT services from G-Cloud Consolidation and closure of more data centres across Public Sector and suppliers G-Cloud becomes self funding Early adopters have 70% of relevant ICT services from G-Cloud During succeeding years, the G-Cloud could continue to expand by: Completion of data centre consolidation Adoption of G-Cloud across remaining public bodies Public Sector retained ICT departments complete transition to new model
UNCLASSIFIED
41
Data Centre Strategy, G-Cloud & Government Applications Store Programme Phase 2
During this period the G-Cloud becomes a trusted and reliable brand for Public Sector ICT services. Suppliers will use the G-Cloud as the primary route to market for providing ICT services to Public Sector. Digital services of high criticality to citizens and Public Sector will become established on the G-Cloud, re-use of digital assets will be the predominant model in Public Sector ICT. The approach to delivery of ICT services in Public Sector will be based on an established culture of sharing assets.
4.6. Transition
The approach to transition to the Vision of the G-Cloud must meet a number of requirements: Transition must take place in a manner which ensures that public sector services are not disrupted; Individual G-Cloud services are made available as soon as suitably available and certified rather than when all planned services are ready so that the resulting savings can begin quickly; Public bodies moving to the G-Cloud must not incur unnecessary costs by terminating existing contracts early; and The public sector must have the skills and governance in place to purchase and manage services provided by the G-Cloud. These requirements mean that the transition to the Vision will take place in a phased manner. Phasing of the transition will affect both the implementation of the G-Cloud itself and its adoption by individual public bodies. Services will be introduced to the G-Cloud by suppliers over time. The initial Service Catalogue for the G-Cloud will reflect those services which are technologically feasible to provide over the G-Cloud today, as suppliers and public sector understanding of the potential of G-Cloud develops both parties will make new services available. In addition the types of services available will evolve with technology, as new technologies appear the potential services and their economic feasibility for provision through the G-Cloud will change leading to new services continually being added to G-Cloud. This approach to implementation of the G-Cloud will ensure that its initial use is not delayed while large numbers of services are developed for deployment in a big bang launch. An individual public body will adopt the G-Cloud in a phased manner also. This will allow the public body to purchase services from the G-Cloud as existing ICT contracts for those types of ICT services terminate. This means that the public body will not need to terminate contracts early and incur termination charges unnecessarily. Another advantage of this phased approach is that it avoids the risk of a big bang implementation of G-Cloud at a public body where potentially all its services are at risk of failure at go live. It also allows the public sector to develop the skills required for managing G-Cloud services over time.
UNCLASSIFIED
42
Data Centre Strategy, G-Cloud & Government Applications Store Programme Phase 2
A detailed approach to Transition is being prepared as part of the G-Cloud Phase 2 programme.
5. Principles
The Vision has been developed based on a number of principles which cover Commercial, Technical, Operational and Transition aspects of the G-Cloud. The principles govern the extent, outcomes and structure of the Vision.
limiting the term of contracts Minimise termination clauses Open standards for connecting Allow the market to determine the best approach to term contracts Transition (see later)
Comparable Pricing: Pricing should reflect total cost of service and be priced on a utility model by a measurable unit (transaction, user, month, capacity). Pricing should incorporate and make visible all additional service charges, or costs of change. The ultimate aim is for no term contracts. Different business models may exist for different parts of the stack (IaaS, PaaS, SaaS) and for different IL levels Ease of Transaction: To minimise the transaction cost for purchase of service through the cloud. Transacting should be standardised, simple, and low cost for both parties by:
Frameworks should be designed for categories of service to incorporate simplified legal requirements Single standardised version of Ts & Cs would be optimal incorporating legal concepts determined by the framework
UNCLASSIFIED
43
Data Centre Strategy, G-Cloud & Government Applications Store Programme Phase 2
Market Access: Ensure a competitive open market and that suppliers can deliver and scale what is being sold. Limit the barriers to entry. Achieve this by:
Establishing a code of conduct laying out expectations and responsibilities of all participants Establishing a cloud certifier role Application Store and G-Cloud should be available to all entrants provided that they meet certain criteria including: Technical validation Business probity
Accreditation standards should be open, and published Technical access standards should be open and published Prototyping facility to allow suppliers to trial new services in an agile manner
Reusable Intellectual Property: To create a commercial model which supports reuse of IP by incentivising suppliers to sell services which share or reuse retained government IP in the cloud and creating an environment where the cloud is the most profitable and accessible marketplace to build a rich marketplace of useable services Governance and Dispute: To protect customer and provider with comfort that the service represents their interests fairly. Ensure that all players adhere to the rules and principles of the cloud. Establish a place of arbitration/recourse for disputes within the system. Ensure that the Crown doesnt abuse its position to place onerous demands on entrants, and to trust the market to find an acceptable balance of risk and value. This can be achieved by:
Establishing an independent body to act as ultimate arbiter, and to uphold spirit of principles The arbiter should be an independent body representing suppliers and the government
UNCLASSIFIED
44
Data Centre Strategy, G-Cloud & Government Applications Store Programme Phase 2
Framework for Contracting: To minimise supplier effort to access G-Cloud with a simple government procurement framework by:
Developing a single method for contracting with the public sector for an agreed basket of services A standard set of terms and conditions which apply across all customers Treating the crown as a single customer Transferability of reusable assets under this agreement between agencies 'Accessibility of shared services across public sector customers'
Management Information Transparency: For the market to work effectively suppliers will need to share pricing and supply data openly. We will incorporate a Service Information principle into contracts and access framework to open access to pricing and volume transaction data Compliance: To ensure that once a viable marketplace exists, government departments use it. Ensure that there is no duplication of sales costs for suppliers. Incentivise compliance/ penalise non-compliance. Achieve this by:
Creating a framework (voluntary or mandated) which encourages all departments to adopt frameworks and pricing levels Link adoption and savings to recognisable OEP savings Ensuring that a penalty process exists to penalise non-standard choices
Transitioning and Transforming: To encourage incumbent providers to transition service prior to the termination of contracts. Taking into account the need for large scale transformation of legacy to allow consumption of G-Cloud. Allow suppliers to transition business models to cloud principles within a given time frame. Ways of achieving this are:
Encouraging and allowing different commercial principles to hold for transition proposals, ie: contract renewals, longer contracts Suspending commercial principles for suppliers in some markets whilst critical mass is built up Suspending commercial principles to allow incumbents to transition in return for extended contract length Short term contract extensions to enable the transition of aggregated common demand Paying a transitional premium during the transition period to non-continuing data-centre vendors.
UNCLASSIFIED
45
Data Centre Strategy, G-Cloud & Government Applications Store Programme Phase 2
These principles focus on governing the Vision in its technical aspects such as capacity, technical standards and security constraints. Resilience: A variety of levels of resilience will be available for the services available through the G-Cloud. Consumers of G-Cloud services will be able to choose the level of resilience for the service procured. Where appropriate for example if a service is used to support a non production service such as testing a consumer can procure a service without any resilience; Security: The services provided by the G-Cloud will conform to Government standard security. Multiple levels of security (IL 0 4) will be supported within the G-Cloud and a consumer can choose the appropriate level of security for the type of service being supported; Standards: G-Cloud services will be based on open and/or industry standards as much as is possible. This will enable multiple suppliers to provide services via the G-Cloud; Scalability: The G-Cloud will provide scalable services. These services will be elastically scalable, i.e. the capacity of a service can be increased and decreased; Services: G-Cloud and Application Store will support a variety of sourcing models including provision of ICT infrastructure, ICT professional services (eg Service Management), provision of software, Software as a Service (SaaS) and gateways to public sector applications amongst others; and Certification: Services offered by suppliers must be certified by an appropriate entity before they can be made available on the G-Cloud and Application Store so that consumers can be confident that services are of appropriate quality and use proven technologies. Data: Consuming bodies will own their data and at the termination of a service or application can request the return of the data. Standards will need to be adopted to enable applications created by one organisation to be re-used by other organisations within their data context. Presentation standards: Consideration will be given to the need for presentation standards to readily enable coherent aggregation of services from multiple public sector organisations.
UNCLASSIFIED
46
Data Centre Strategy, G-Cloud & Government Applications Store Programme Phase 2
UNCLASSIFIED
47
Data Centre Strategy, G-Cloud & Government Applications Store Programme Phase 2
Compliance: There will need to be a set of assured services and components that build to a point that allows the risk owners and risk managers of consuming organisations to make a minimum amount of evaluation before reaching a decision on the use any particular service available from the applications store.
UNCLASSIFIED
48
Data Centre Strategy, G-Cloud & Government Applications Store Programme Phase 2
UNCLASSIFIED
49
Data Centre Strategy, G-Cloud & Government Applications Store Programme Phase 2
UNCLASSIFIED
50
Data Centre Strategy, G-Cloud & Government Applications Store Programme Phase 2
6. Scenarios
In order to refine the Vision described in this document a series of scenarios were reviewed and walked through by the Cabinet Office Datacentre Consolidation, G-Cloud and Application Store Phase 2 programme leadership team on 22 nd October 2009. The results of these reviews are documented in the appendix 3.
UNCLASSIFIED
51
Data Centre Strategy, G-Cloud & Government Applications Store Programme Phase 2
7. Conclusion
The Vision will provide a significant number of tactical and strategic benefits to UK Government and its provision of services. The Vision is a platform upon which the next steps for implementation of data centre consolidation, G-Cloud and Government Applications Store can be based. The Vision will be used as a platform for the development of a specification of the services on the G-Cloud and a Transition Strategy for consolidation of data centres and implementation of G-Cloud and Government Applications Store. These specifications and the strategy will be used to inform a business case to government for implementation of the Vision.
UNCLASSIFIED
52
Data Centre Strategy, G-Cloud & Government Applications Store Programme Phase 2
8. Appendices
A1. Appendix 1 - Glossary of terms
Term Application Store Cloud Computing Definition Synonym for Government Applications Store. Gartner Definition: a style of computing where massively scalable ICT-enabled capabilities are delivered 'as a service' to external customers using Internet technologies. The provision of computing platform/storage services has been the initial focus for many Cloud Computing providers but any ICT resource e.g. applications, data, and middleware can be delivered in this style. COTS ESB (Enterprise Service Bus) G-Cloud Common Off The Shelf software packages. An ESB is an integration layer or mechanism linking different components and services in the ICT architecture of an organisation The G-Cloud is the delivery of Public Sector ICT by a shared secure utility style ICT services infrastructure, underpinned by a new commercial model enabling public bodies to have the option to pay only for the service at the time when they use it. This approach is now developing rapidly and is known as Cloud Computing. It is enabled by common standards, and by heavily automated secure business processes that enable substantial reductions in costs. G-Cloud is the Public Sector brand for the use of secure cloud computing. Government Applications Store The Government Applications Store is the Public Sector ICT marketplace to readily source, share and promote complete out of the box applications, business solutions and services. Infrastructure components and services can also be procured from the G-Cloud to create a new service in response to a specific business requirement. It is used by public sector bodies to purchase services which will then be automatically provisioned on the G-Cloud. Infrastructure as a Service A UK Government standard for assessing the impact of possible compromises to the Confidentiality, Integrity or Availability of information in the public sector ICT hardware components including servers and SANs
Infrastructure
UNCLASSIFIED
53
Data Centre Strategy, G-Cloud & Government Applications Store Programme Phase 2
ITIL
ITIL (ICT Infrastructure Library) is a service management framework. It is widely used in the ICT industry to manage the delivery of services. "List X" refers to the Security Clearance of a facility such as a data centre. The term refers to contractors or subcontractors to the public sector which have been formally placed on List X because they are undertaking work marked CONFIDENTIAL or above at their facility or data centre. List X is not available on request; it has to be "sponsored" by a Contracting Authority (CA) in UK Government Platform as a Service PSN (Public Sector Network) is a UK Government programme to provide a common network for purchase across all of the public sector A model of software deployment whereby a vendor licenses an application to customers for use as a service on demand. In general the service operates on a pay as you go model A list of all the services available in the G-Cloud at a particular time. For each service it will include Price, Service Levels, Resilience, Capacity, IL level, Reporting and Duration options
List X Status
PaaS PSN
Service Catalogue
UNCLASSIFIED
54
Data Centre Strategy, G-Cloud & Government Applications Store Programme Phase 2
Stuart Aston
UNCLASSIFIED
55
Data Centre Strategy, G-Cloud & Government Applications Store Programme Phase 2
Co-Lead Mike Truran David Greenway DWP - Service Management Workstrand Lead Capgemini - Service Management Workstrand Co-Lead DWP - Service Management Workstrand Deputy Lead Deloitte - Service Specification and Business Transition Planning Workstrand Lead Cisco - Service Specification and Business Transition Planning Workstrand Co-Lead Connecting for Health Technical Architecture Workstrand Lead Memset - Technical Architecture Workstrand Co-Lead
Eileen Logie
Gerry Gallagher
Andy MacLeod
Miles Gray
Kate Craig-Wood
UNCLASSIFIED
56
Data Centre Strategy, G-Cloud & Government Applications Store Programme Phase 2
A3.1.1. Role:
ICT Service Director in Central Government department Current ICT services range from PC support to running of bespoke applications on a mainframe
A3.1.2. Challenge:
10 year outsource deal for departments ICT services coming to an end in 12 months
A3.1.3. Outcome:
How will the G-Cloud help? - Providing efficient procurement process - Reduced time in definition of requirements - Provide choice and competition - Time savings (procurement) - Agreed framework for SLA - Enable budget planning - Provide risk reduction What features would G-Cloud need to have? - G-cloud would need to have the following features: transparency in its processes, security, provide scalability and resilience. - The G-cloud would also need to contain agility - In order to view the different services on offer, the G-cloud would require a shop window - Provide environment where we dont need to pay for what we dont need or use Will G-Cloud be able to provide all requirements? - Short term, yes, but only in terms of core products - In terms of more specific products in 2012 it will not be in a mature state How will the role and skills in the ICT group of the Department change with the use of G-Cloud?
UNCLASSIFIED
57
Data Centre Strategy, G-Cloud & Government Applications Store Programme Phase 2
- Different type of commercial awareness and knowledge - Increased visibility across govt departments - Different approach to service management What assumptions have you made? - We are in 2012 - 3 key challenges = green agenda, digital Britain, reducing overall cost
UNCLASSIFIED
58
Data Centre Strategy, G-Cloud & Government Applications Store Programme Phase 2
UNCLASSIFIED
59
Data Centre Strategy, G-Cloud & Government Applications Store Programme Phase 2
A3.2.4. Outcome B:
How will the G-Cloud help? - Provide a brokerage service What features would G-Cloud need to have? - Aggregated demand - Application sharing/re-use of applications Will G-Cloud be able to provide all requirements? - Yes How will the role and skills in the ICT group of the Department change with the use of G-Cloud? - The role would require someone who is more focussed on strategy - There would be a certain amount of headcount reduction - The remaining staff would be required to perform a different type of support and maintenance - Less bespoke applications and a reduction in the number of legacy systems would mean more standardised skill sets with less specialist knowledge required What assumptions have you made? - Existing ICT systems DO NOT provide the appropriate functionality - All required applications have already been purchased by the Crown
UNCLASSIFIED
60
Data Centre Strategy, G-Cloud & Government Applications Store Programme Phase 2
UNCLASSIFIED
61
Data Centre Strategy, G-Cloud & Government Applications Store Programme Phase 2
UNCLASSIFIED
62
Data Centre Strategy, G-Cloud & Government Applications Store Programme Phase 2
UNCLASSIFIED
63
Data Centre Strategy, G-Cloud & Government Applications Store Programme Phase 2
UNCLASSIFIED
64
Data Centre Strategy, G-Cloud & Government Applications Store Programme Phase 2
CSR010 VFM Programme: OEP annual ICT saving targets of 3.2Bn achievable in three years including 1.6Bn from the ICT Collaborative Procurement Strategy. G-Cloud will deliver a fundamental contribution to the OEP and will facilitate and accelerate the OEP targets.
Climate change: Greening Government ICT white paper (July 2008) energy efficiency and ICT equipment disposal recommendations. Government is Britains largest purchaser of ICT. G-Cloud will facilitate smarter ways of working through ubiquitous and secure access to data, further reducing governments environmental impact and carbon footprint.
Digital Britain: strategic vision for ensuring that the UK is at the leading edge of the global digital economy. This requires a step change in the efficiency of the delivery of purchases and ICT procurement. G-Cloud will deliver greater agility and speed in the delivery of policy and services, underpinned the adoption of shared infrastructure at lower cost.
UNCLASSIFIED
65
Data Centre Strategy, G-Cloud & Government Applications Store Programme Phase 2
Reduced server purchase costs through virtualisation of servers across departments leading to higher utilisation rates Reduced data recovery costs through fewer dedicated DR facilities.
Government Applications Store Reduced bespoke application development through reuse of existing components. Reduced application purchase prices through economies of scale. Reduced licensing costs through licensing consolidation and reuse. Reduced investment costs through SaaS pay for use model
Significant intangible and qualitative benefits are enabled by the Programme: Data Centre Consolidation G-Cloud Improved dynamic scalability through accessing additional resources for peak demand. Enhanced ability to transition ICT staff to more value-adding activities through reducing the need for maintenance and patching. Reduced project timescales through reuse of building components. Increased resilience and reduced risk through improved and modernised facilities. Enhanced business agility through faster virtual server provisioning. Improved sustainability through more energy efficient estate.
Government Applications Store Enhanced business agility through easier and less lengthy procurements due to framework contracts Improved licence compliance through centralised monitoring and management. Enhanced purchasing decision making through better pricing transparency and comparability. Increased Information Assurance through being built-in to certified solutions.
UNCLASSIFIED
66
Data Centre Strategy, G-Cloud & Government Applications Store Programme Phase 2
Cloud computing has come of age driven by real advances in: architecture security web platforms elastically scalable processing utility computing, on-demand services, grid computing and software as a service. Virtualisation providing ability to: Drive higher server utilisation rates
Use of commodity server resources Standardised components leading to easier recovery in event of failure Service Oriented Architecture providing Enhanced integration mechanisms between applications Ability to re-use application components
Process automation providing Standard support mechanisms Enhanced agility Improved visibility of service performance
UNCLASSIFIED
67
A5. Appendix 5 Programme Risks PROGRAMME R ISKS (AS AGREED AT THE PROGRAMME BOARD ON 10TH DECEMBER)
Owner Risk Description There is a risk that pricing and commercial terms for G-Cloud and data centre migration may be insufficient to encourage industry investment and participation Failure to secure senior and early departmental commitment to G-Cloud may prohibit service uptake and infrastructure sharing Delivery of the G-Cloud benefits will require strong central coordination across Dept and LA boundaries this is how the private sector successes to date have been achieved. This requires a radically new ICT governance and organisational approach for the Public Sector. If this change is not appropriately implemented, achievement of G-Cloud benefits will be significantly impaired and/or delayed.
Likelihood
Impact
Mitigation Approach Ensure that terms adequately reward commercial risk commensurate with value for money and cost savings
MT
High
High
All
MB
High
High
Effective senior stakeholder management to ensure understanding and buy-in Programme to engage regularly with CIOs Tech Architecture workstrand lead to review and ensure open standards are appropriately reflected
10 G-Cloud
GG
High
High
Peer review process to validate appropriate use of open standards. Obtain early senior stakeholder support for proposed governance models
UNCLASSIFIED
Data Centre Strategy, G-Cloud & Government Applications Store Programme Phase 2
12 G-Cloud
DS
Failure to agree an appropriate IA model will prevent departments from using shared infrastructure and suppliers from easily providing services over the GCloud.
High
High
DS to engage CESG and other critical stakeholders to facilitate understanding of impact and changes required by GCloud and to gain commitment to proposed IA model
Category
Owner
Risk Description
Likelihood
Impact
Mitigation Approach Regularly assess support/commitment from Government (both Business and Technology perspective) Demonstrate/communicated benefits of GCloud Secure at least one major government department to be fully involved in the data collection process. Engage with a cross selection of departments to gather data
All
MB
There is a risk that the programme may not receive cross Government support and commitment required to deliver key elements of the G-Cloud strategy
Medium
High
All
TS
There is a risk that the team will not get sufficient data or engagement from departments, and will therefore not be able to produce a robust business case
Medium
High
UNCLASSIFIED
69
Data Centre Strategy, G-Cloud & Government Applications Store Programme Phase 2
13
Apps Store
NS
Procurement rules may prohibit the establishment of pan government purchasing, re-use and sharing.
Medium
High
Commercial team to identify procurement model(s) for the G-Cloud and test these early with EU and UK procurement specialists to validate their proposals. Quick Wins workstrand is aware of this and is working closely with the Information Assurance workstrand to ensure that any quick wins developed are able to go live. 1. DS to progress with Technical Architecture and DC teams and; 2. Assess viability of selecting/ using current standards
14
Quick Wins
DS
There is a risk that security accreditation constraints may prohibit quick wins from going live.
Medium
High
18
DS
There is a risk that failure to create common security standard for data centre evaluation may inhibit the Data Centre consolidation
Medium
Medium
Category
Owner
Risk Description
Likelihood
Impact
Mitigation Approach
19
DS
There is a risk that any one data centre (if there are 12) may not be secure enough to cater for the total data held
Medium
Medium
Ensure that data centre consolidation approach defines sufficient data centres and appropriate data separation strategies
UNCLASSIFIED
70
Data Centre Strategy, G-Cloud & Government Applications Store Programme Phase 2
17
All
MB
There is a risk that incoming regulation may make PUE (Power usage effectiveness) higher than 2.0 illegal and this may mean that we have to change our target DC / transition approach (move more rapidly than planned) There is a risk that senior stakeholders expectations regarding the projected savings for DC consolidation, G-Cloud and Apps Store (as documented in the ICT strategy) cannot be met as the detailed analysis to validate the high level extrapolation of industry benchmarking has not yet been completed. There is a risk that different interpretations for App Store and G-Cloud governance and commercial framework across the programme will inhibit the creation of the Service management framework.
Medium
Low
All
TS
Low
High
Progress validation of savings ASAP and ensure stakeholders are provided with upper and lower savings projections
11
All
EL
Low
High
Arrange more cross strand meetings to lock-down a single definition for service management. Model service management architecture and challenge cross strand interpretations in work strand.
Category
Owner
Risk Description
Likelihood
Impact
Mitigation Approach
UNCLASSIFIED
71
Data Centre Strategy, G-Cloud & Government Applications Store Programme Phase 2
15
All
MG
There is a risk that as a result of stating our preferred approach, one industry model/ method becomes dominant / de facto and others are incompatible / sidelined.
Low
High
Technical Architecture and peer reviewers to ensure standards are open/ fair to allow multiple industry models
All
TS
There is a risk that the business case may double count savings with PSN programme and other existing programmes, thus weakening our or their business cases.
Low
Medium
Identify potential double counts. Evaluate the extent to which this programme will de risk their delivery or provide the means to achieve them. Do not set a separate target on top of OEP etc. for programme benefits i.e. the programme enables benefits to be realised across current governmental targets. Need urgent clarity on the scope boundaries of PSN and G-Cloud to avoid this scenario Implement an appropriate engagement plan for CIO engagement prior to the CIO council. Request support from the Programme Board in engaging with CIO stakeholders
There is a risk that insufficient engagement with the 5 All MB CIO community prior to 5 February will result in a subsequent lack of buy-in to the business case and Vision.
th
Low
Medium
UNCLASSIFIED
72
Data Centre Strategy, G-Cloud & Government Applications Store Programme Phase 2
Category
Owner
Risk Description
Likelihood
Impact
Mitigation Approach
All
MB
Failure to secure early, senior industry engagement (CXO-level) may constrain G-Cloud service provision decisions and prioritisation of investment in FY 2010/11
Low
Medium
Implement appropriate industry engagement plan using Intellect and other appropriate industry bodies
20
All
MB
There is a risk that suppliers may develop Cloud approaches for Public Sector based on the status quo and thereby limit the cost efficiencies of G-Cloud.
Low
Medium
Ensure that development of transition plans includes appropriate governance to introduce non status quo approaches such as introduction of new suppliers and technologies The Vision and transition approach should be developed such that we do not have a dependency on the availability of Desktop/PSN and that our infrastructure is agnostic of network or desktop service
21
MB
There is a risk that if the PSN or Desktop are not available on time it will cause unnecessary delay
Low
Medium
22
Apps Store
NS
Failure to incorporate into contract terms the ability to use a purchased application across multiple government entities will result in applications not being shared/re-used across government
TBD
High
Commercial to progress, optional Make the Crown the entity in contracts rather than individual departments
UNCLASSIFIED
73
Data Centre Strategy, G-Cloud & Government Applications Store Programme Phase 2
16
All
MB
There is a risk that commercial and carbon gains are made by departments on their own and the G-Cloud does not deliver large enough incremental savings
TBD
Medium
POTENTIAL PROGRAMME RISKS (SUBMITTED BY HMT FOR CONSIDERATION FOR INCLUSION INTO RISK REGISTER)
Category Owner
Risk Description Government Governance of the Programme Delivery of the G-Cloud benefits will require strong central coordination across Dept and LA boundaries - this is how the good private sector successes to date have been achieved. This requires a radically new governance and organisational approach.
Likelihood
Impact
Mitigation Approach
23 All
TBC
TBD
[high]
Input is being actively sought from CIOs in both local and central government sectors, in order to build a high level of buy-in to the programmes direction of travel, deliverables, and governance model.
UNCLASSIFIED
74
Data Centre Strategy, G-Cloud & Government Applications Store Programme Phase 2
Funding/ upfront investment 24 All TBC In the current resource constrained environment, upfront investment funding will be particularly difficult to secure. TBD [high]
Alternative funding routes will be explored, including funding from within the public sector CIO Community, and also upfront funding from suppliers that is then repaid through service charges (HMT would be content with this provided this does not add to the national debt and still produces significant savings post high interest rates levied). HMT can consider providing new funding for the central project team, but first want the project to explore whether the CIO Community would fund these costs from existing budgets, on the basis that the investment will help deliver savings later on. Early adopters could provide seed funding, further reducing the barriers to entry (and affordability constraints) for later adopters.
Likelihood Impact Mitigation Approach Develop a business case which delivers significant benefits for a reasonable level of funding within 2-3 years. Enable the early adopters to share in the benefits of increased downstream scale, as more organisations make use of the programme. The Programme Director will engage the SRO and the Chair of the Programme Board to develop a broader socialisation and engagement approach post the CIO Council meeting.
Achieving critical mass quickly 25 All TBC If the programme does not achieve a certain critical mass within the first 2-3 years, benefits will not be significant enough to attract public sector organisations in the future. TBD [high]
UNCLASSIFIED
75
Data Centre Strategy, G-Cloud & Government Applications Store Programme Phase 2
Political Sponsorship 26 All TBC This IT-enabled programme may not be viewed as appealing to Ministers. TBD [high]
Work is already underway across government to secure political support for the programme as part of the wider ICT Strategy. Angela Smith has issued the ICT Strategy to ministers and their departments, who have all formally accepted it. (Confirmation of support from HMT still in progress.) The programme is positioned as an enabler of government policy, including OEP, Digital Britain, Smarter Government, Building Britains Future and the Green ICT Strategy hence it centres on improving efficiency and delivering relevant business change capability, through buying IT differently and therefore should appeal to a delivery focused politicians. Government policy is to enable decentralisation, and efficient IT decentralisation can only be undertaken successfully (and cost effectively) with the strong central co-ordination for standard IT assets, infrastructure and processes that will be delivered by the programme. Work is still in progress on the governance and organisational model, and the transition plan. Discussions are underway with programme board members, and departments and LAs the proposed way forwards will be reviewed at the next programmeHMT meeting in late January.
Transition Plan 27 All TBC Though the vision and end destination of the programme are clear, the journey is not currently developed enough to provide stakeholders with sufficient confidence of the programmes success. TBD [high]
APPENDIX
UNCLASSIFIED
76
Data Centre Strategy, G-Cloud & Government Applications Store Programme Phase 2
Abbreviation
MB TS NS MG GG EL HMT
Name
Martin Bellamy (Programme Director) Toby Spanier (Business Planning Lead) Nicky Stewart (Commercial Strategy Lead) Miles Gray (Technical Architecture Lead) Gerry Gallagher (Service Specification / Transition Planning Lead) Eileen Logie (Service Management Deputy Lead) HM Treasury
UNCLASSIFIED
77
Data Centre Strategy, G-Cloud & Government Applications Store Programme Phase 2
UNCLASSIFIED
Data Centre Strategy, G-Cloud & Government Applications Store Programme Phase 2
UNCLASSIFIED
79
Data Centre Strategy, G-Cloud & Government Applications Store Programme Phase 2
needs to be a procedural process backed up by technology to ensure that information is afforded appropriate protection. 13. CONCLUSION: There is a need to articulate the architectural principles that will allow the de-aggregation of information. E.g. mechanisms to ensure that normal users cannot view or retrieve an entire dataset. These mechanisms need to be evaluated appropriately so that they can be used as risk treatments. This work should begin at the start of Phase 3. 14. CONCLUSION: The availability of a given service is inherently limited by the underlying services, e.g. the network and the data centre. There is parity in terms of the levels of availability between each of the services provided in the data centre and the network, e.g. any data centre should be able to support a service that requires support up to IL4. 15. CONCLUSION: The aggregated level of impact for the loss of a number of services or data centres may well reach as high as IL6. In some cases the aggregated impact of the compromise to the confidentiality, integrity of a single utility computing service used by a large proportion of the public sector may also reach as high as Impact Level 6.
Assured Technologies
19. RECOMMENDATION: Phase 3 should begin with urgent research work in to the assurance available in current technologies to assist in creating the initial G-Cloud environment. E.g. Resource sharing technology such as virtualisation, Gateway Services, Identity Management (including authentication and authorisation) and Encryption.
UNCLASSIFIED
80
Data Centre Strategy, G-Cloud & Government Applications Store Programme Phase 2
20. CONCLUSION: Without assured virtualisation technology and an effective federated and brokered Identity, Authentication and Authorisation model for the Public Sector, many of the IA and business benefits will not be realised. Where resource sharing technology with strong containment is desirable, it is likely that tools to manage deployment will also be required.
Compliance
21. CONCLUSION: A common issue with cloud computing concerns the demonstration of legal and statutory obligations. This subject will be taken forward with Treasury Solicitors (TSoL) and the Information Commissioners Office (ICO), as well as the SIRO community in the next phase of the Datacentre and G-Cloud programme. One of the single biggest risks to the successful creation of a community cloud for the public sector will be an inability to demonstrate legal and statutory compliance. 22. CONCLUSION: The areas of responsibility for Codes of Connections and authorisation for applications and services are still to be resolved. The expectation is that the G-Cloud SIRO will be responsible for the authorisation of utility services. The responsibility for authorising agility services, including those hosted on utility services, may well rest with the organisational SIRO. We will need a method of understanding whether any consumer is attempting to breach the use of the IA conditions related to the use of a service. 23. CONCLUSION: There will need to be a set of assured services and components that build to a point that allows the risk owners and risk managers of consuming organisations to make a minimum amount of evaluation before reaching a decision on the use any particular service available from the applications store.
Roadmap
24. RECOMMENDATION: The proposal for an IA roadmap is in section 5. The G-Cloud Commercial Strategy gives an indicative timeline. In Phase 3 of the programme, the IA roadmap and roadmaps from other strands will need to be aligned and a common timeline agreed. 25. To achieve the vision of a single physical community cloud there is a requirement to create assured multiple logical instances of a resource on a single physical platform. There is also a requirement for tools to manage deployment of logical instances of those resources.
UNCLASSIFIED
81
Data Centre Strategy, G-Cloud & Government Applications Store Programme Phase 2
There has only been enough time and detailed information gathering during Phase 2 of this programme to create a set of IA proposals and suggested principles to the many IA questions and challenges posed by the use of Public and Private Clouds. The IA Workstream recommends that paper based scenarios and pilots (including quick wins) are used to test the proposals made in the paper and create more detailed policies and procedures.
UNCLASSIFIED
82