Government Enterprise Cloud Acquisition Practical Help for Contracting Professionals

Transcription

1

2 Government Enterprise Cloud Acquisition Practical Help for Contracting Professionals Mun-Wai Hon, CISSP, CSSLP, PMP Session E10 Tuesday July 25, Noblis Inc Edmund Halley Drive Reston, VA 20191

3 Who is Noblis? Noblis is a nonprofit science, technology and strategy organization that helps clients solve complex scientific systems, process, and infrastructure problems in ways that benefit the public. Noblis helps clients solve their toughest challenges in national security, transportation, healthcare, sustainability, and enterprise transformation. noblis.org

4 Agenda: Rising into the Cloud Define Cloud to Level Set Overview of Current Cloud Acquisition Challenges Common Issues and Obstacles Myths and Mistakes Cloud Computing Acquisition Approach Contract Vehicles Available for Acquiring Cloud Service Provider (CSP) Services Lessons Learned with SEWP V Government Wide Acquisition Contract (GWAC) Issues Encountered with Current Contract Vehicles Common Government Legal Office Concerns and Issues with Cloud Acquisitions Cloud Contracting: Service Level Agreements (SLAs) Cloud Contracting: Terms & Conditions, Service Level Objectives (SLOs) Cloud Contracting: Minimal Terms & Conditions Example Pricing Scenario 1 & 2 How to Make Cloud Acquisitions Better? Key Points to Keep in Mind

5 Define Cloud to Level Set What cloud is On-demand Computing, Storage, Communications, and other services Cloud provides flexibility and reduced technical setup time What cloud is Not Replacement data center Workforce reduction plan Instant financial savings? Benefits of going to cloud Gain efficiencies with acquiring, installing, and operating applications and infrastructure Increases authorized access to resources, information sharing, and access to computational services Facilitates moving to modernized platforms to reduce legacy mixture

6 Common Issues and Obstacles Government Budget cycles for funding and payment Lack of technical understanding of cloud computing models Over simplistic viewpoint of cloud as commodity No built in financial management or post award controls for visibility Cultural shift from on-premises bare metal to virtual machines Fixed asset model to on-demand resource management

7 Myths and Mistakes of Early Cloud Adopters Myths Myths In Cloud Computing Everything should go to the cloud Cloud computing will require less resources ($) Cloud computing is just offsite storage Government business is a key area for Cloud Service Providers Mistakes Lift and shift has resulted in disjointed silos Contracts lack vendor controls and visibility Procurements often lack specific requirements and performance criteria Customers rarely have the metrics or background to show Return On Investment (ROI)

8 Cloud Acquisition Approach: Contract Vehicles Current Contract Vehicles Blanket Purchase Agreements GSA Cloud SIN under review by GSA CAFÉ with ACT-IACT Recommendation for new IDIQ Some Agency Vehicles with Cloud Components: CIO SP3 Provides wide access to large and small businesses depending on category DOI Foundation Coming up on five year renewal with some small scale success stories Army CHESS Commodity oriented and not considered suitable for cloud managed services by contracting officers NASA SEWP V Commodity cloud purchasing with small businesses with a short technical refresh cycle

9 Lessons Learned- SEWP V Most "Service Disabled Veteran Owned Small Business" (SDVOSB) SEWP 5 resellers have partnership relationships. The partner may actually perform the government requested activity or labor resource. All SDVOSB SEWP 5 resellers ignored requested services that require continual labor. The vendor model appears to pass through or service is done by a partner. Few SDVOSB SEWP 5 resellers have links to more than one CSP. That said, the resellers can establish additional CSP relationships within a two month period or less time. CSPs package technology differently than government usage patterns.

10 Some Issues Encountered with Current Contract Vehicles Most lack any managed services for having another contractor operate cloud deployed systems Current small business resellers lack past performance scope and scale GAO and Inspector General Offices are requiring visibility and custom clauses that conflict with CSP operating models Vendors tend to have a relationship with only one CSP

11 Common Government Legal Office Concerns and Issues with Cloud Acquisitions Legal Team Often Set on FAR Part 15 Processes vs FAR Part 8.4 Familiar with Part 15 discussions, competitive range, formal evaluation but is more work Usually ordering officer is not familiar with schedule buys Current body of Cloud Computing focused legal cases not very mature Often Legal Reviews Require Many of the Following: Total Price = Evaluation must have a total price Buying Fixed Quantities = Proposal must have a solution with components Independent Government Cost Estimate (IGCE) must provide context for Vendor Price Proposals Separation of Commodity and Managed Services

12 Cloud Contracting: SLAs A Cloud SLA describes the contract scope, service attributes, Service Level Objectives (SLOs), performance management and responsibilities as agreed upon by the cloud service provider and their customer. To get the best deal on a Cloud SLA - a government organization must understand the potential costs, SLOs and terms & conditions built into their Cloud SLA as well as the following: Current licensing costs and terms & conditions for IT services that will be outsourced to the cloud to provide a baseline for comparison against proposed cloud service SLAs

13 Cloud Contracting: Terms & Conditions, SLOs A good SLA provides clear delineation of roles, responsibilities and understanding across all Service Level Objectives (SLOs) as applicable to the service model selected: Performance Service Level Objectives for availability; response time; capacity; capability indicators; support, reversibility and termination process Security Service Level Objectives for reliability, authentication & authorization; cryptography, security incident management and reporting, logging and monitoring, auditing and security verification, vulnerability management, governance and service changes Data Management Service Level Objectives for data classification; cloud service customer data mirroring; back-up and restore; data lifecycle and data portability Personal Data Protection Service Level Objectives for codes of conduct, standards and certification mechanisms; purpose specification, data minimization; use, retention and disclosure limitations; openness, transparency & notice specifications; accountability; geographical location of cloud service customer data

14 Common Terms & Conditions Vendor s Obligation Customer s Obligation Access to the Services Term Fees or payments Fee Increases Cloud Contracting: Minimal Terms & Conditions Minimal Terms and Conditions used on SLAs (legal standard) are listed in the table below. But SLA structure and organization vary greatly based on the use case and service model. Definition (Excerpt for Conference) The vendor s responsibility for fulfilling the agreement The customer s responsibility towards fulfilling the agreement The method of accessing the provider s services The period or duration of the agreement, including renewal The fees or pricing charged for the cloud services The increasing of fees or pricing charged for cloud services outside planned capacity (burst) Suspension The suspension of cloud services provided Termination for Convenience Customer s ability to terminate agreement at any time Termination for Breach Vendor s ability to terminate agreement to breach of agreement Access to Data Accessibility to data stored in cloud Intellectual Property The proprietary or restricted use property belonging to either the customer or vendor

15 Example Pricing Scenario 1 The objective of this scenario is to deploy an existing application into one cloud environment. The Cloud deployment environment shall be the community cloud (Government community). Cloud Deployment: Notional resources required for supporting the existing application are listed in the tables below. The application shall be a lift and shift transplanted from its current location to one CSP environment. The Government notionally suggests using the Amazon AWS GovCloud (US) Community Cloud as the CSP. Type Configuration Requested OS On-Demand VM 2 core, 8 GB RAM RHEL On-Demand VM 4 core, 16 GB RAM Windows On-Demand DB VM 16 core, 128 GB RAM, 300 SSD MySQL On-Demand DB VM 16 core, 128 GB RAM, 300 SSD Oracle On-Demand Dedicated Host 16 Core, 256 GB RAM RHEL On-Demand Dedicated Host 16 Core, 256 GB RAM RHEL Type Use Qty (GB) SSD File 3200 SSD MySQL Database, above DB VM storage 1800 SSD Oracle Database, above DB VM storage 1000 Type Load Balancer Load Balancer Traffic Encryption Monitoring: Instances Monitoring: Volumes Monitoring: RDS Instances Monitoring: Auto Scaling Support: Business Level Unit Each GB/month GB Each Each Each Each Each

16 Scenario 1 Things to Think About Technical Providing units of measure Notional items to guide vendors No Solution or Engineering Requested Software Licensing terms and agreements Costing Comparison to an IGCE Is it possible? Quantities of bundling, different discount tactics, and different vendor assumptions Need for a Total Cost Is it possible?

17 Example Scenario 2 The objective of this scenario is to obtain cloud services for a large scale cloud implementation to reach hundreds of clients across the United States. The vendor shall provide cloud services to support the X mission with scalable, on-demand components and features.

18 Scenario 2 Questions to Think About Actual scenario that vendors had to respond against Protest registered as to evaluation process though dismissed Scenario reflects many issues including: Lack of clarity Just what are you buying? No possible linkage to an IGCE or specific costs What are the requirements driving the need for cloud resources? Vendors will see a deficit of cloud knowledge and experience from the buyer Other issues?

19 How to Make Cloud Acquisitions Better? Knowing what to buy first Do your Homework! A. Create Implementable Cloud Roadmap that includes: High level cloud Concept of Operations Architecture High Level Migration criteria and Implementable Approach B. Establish a well defined, detailed business case that includes: Application Suitability for the Cloud START Process Alignment to Enterprise Architecture Hardware, Software, Processes Analysis of Alternatives, Pilots

20 Include A Sample Cloud Cost Tracking Report in RFP

21 Key Points to Keep in Mind Use Real World Examples and Independent Advisors Vs. Academic Studies, CSP Resellers, and Too Much Technical Complexity Cloud Computing is a shift in business and not always just a commodity buy Contract vehicle must provide CSPs that supply services needed Managed Services may be needed due to lack of in house Cloud skills Leverage Contract Vehicles elements of Tech Refresh Cycles, Expedited Ordering, and Reduced Risk

22 Thank you! Let s Talk More About Cloud Acquisition Experiences! Contact Information: Mun-Wai Hon, CISSP, CSSLP, PMP Mun-Wai.Hon@noblis.org Noblis Inc Edmund Halley Drive Reston, VA