Lifting the Fog: Creating Effective Contracts in the Cloud Environment

Size: px

Start display at page:

Download "Lifting the Fog: Creating Effective Contracts in the Cloud Environment"

Christine Sanders
6 years ago
Views:

2 Lifting the Fog: Creating Effective Contracts in the Cloud Environment Breakout Session # A11 Stephen J. Yuter, CPCM, CFCM, PMP, Fellow Acting Director & Head of the Contracting Activity DHHS/Indian Health Service Date: July 28, 2014 Time: 11:30 a.m. 12:45 p.m.

3 AGENDA Defining the Cloud Cloud Characteristics Delivery/Deployment Models Service Models Benefits/Disadvantages Cloud in the Federal Government Contracting for Cloud Services Procurement Vehicles Barriers to Adoption FedRAMP Key Points/Summary 2 2

4 FORECAST IS CLOUDY Global cloud computing market is expected to reach $241 billion by 2020 (Forrester) Cloud computing platform as a service will be $15.2 billion by 2016 (Forrester) Cloud computing infrastructure as a service market will reach $23.5 billion by 2015 (Gartner) Federal spending on cloud services will reach $7.7 billion in fiscal 2017, more than four times the spending expected in 2014 (IDC Government Insights) Five-year growth outlook remains strong, with a five-year annual growth rate of 26% over six times the rate of traditional IT offerings cloud computing represents a tectonic shift in computing technology ultimately, the cloud will do for government what the Internet did in the 1990s it s a fundamental change to the way our government operates - Vivek Kundra, Federal Chief Information Officer ( ); vowed to spend $19 billion of U.S. government's $70 billion IT budget on cloud computing 3 3

5 CLOUD DEFINED Although many broad interpretations exist, the National Institute of Standards and Technology (NIST) defines cloud computing as, a model for enabling convenient, on-demand network access to a shared pool of configurable computing resources (e.g., networks, servers, storage, applications, and services) that can be rapidly provisioned and released with minimal management effort or service provider interaction. Cloud Web On-demand solutions Immediate, flexible, scalable, and secure Client-Server Computing Personal Computers Mainframe 4 4

6 CONVENTIONAL VS. CLOUD CONVENTIONAL Manually-provisioned Dedicated HW Fixed Capacity Pay for Capacity Capital & Operational Expenses Managed via System Admin CLOUD Self-provisioned Shared HW Elastic Capacity Pay for Use Operational Expenses Managed via APIs 5 5

7 IS IT CLOUD? Five key characteristics are necessary if the term cloud is to be applied to a particular application: Pooled Resources Rapid provisioning Client-Managed Scalable and Elastic Metered Service 6 6

8 SHARED/POOLED RESOURCES Delivery model servicing multiple consumers, with physical and virtual resources assigned dynamically Resources are drawn from a common pool Common resources build economies of scale Common infrastructure runs at high efficiency 7 7

RAPID PROVISIONING (BROAD NETWORK ACCESS) On-demand delivery of cloud-based services, requiring latent hardware, software and storage capacity Open standards and Application Program Interface (API),

9 RAPID PROVISIONING (BROAD NETWORK ACCESS) On-demand delivery of cloud-based services, requiring latent hardware, software and storage capacity Open standards and Application Program Interface (API), via which clients access resources Ability to provision and de-provision resources very quickly and using automation Almost always IP, HTTP, and REST Available from anywhere with an internet connection 8 8

10 CLIENT-MANAGED (ON-DEMAND SELF SERVICE) Users can configure sometimes within pre-set limits services and usage Completely automated Users abstracted from the implementation Near real-time delivery (seconds or minutes) Services accessed through a self-serve web interface 9 9

11 MEASURED SERVICE (CONSUMPTION BILLING) Services are metered by use, similar to a utility Users pay only for services used Services can be cancelled at any time 10 10

12 SCALABLE & ELASTIC Users pay for cloud-based services as an operating expense and lower costs by avoiding capital expenditures and maintenance Resources dynamically-allocated between users Additional resources dynamically-released when needed Fully automated 11 11

13 SERVICE DELIVERY (DEPLOYMENT) MODELS Public Cloud Private Cloud Hybrid Cloud Inter-Cloud 12 12

PUBLIC CLOUD Hosted off-site and owned by a third-party company that sells cloud services to the public in a multi-tenant fashion Usually available to all members of the public, or to large groups

14 PUBLIC CLOUD Hosted off-site and owned by a third-party company that sells cloud services to the public in a multi-tenant fashion Usually available to all members of the public, or to large groups within an industry Ex. cloud service providers such as Google provide computing resources, some of which the public can freely use Source: GopikannanParthiban blog, Cloud Computing Use Case Discussion Group v

PRIVATE CLOUD Typically built to be used within an organization; most often developed and run by an organization's IT Department (however, they may also be held off-site and run by a third party) Ex.

15 PRIVATE CLOUD Typically built to be used within an organization; most often developed and run by an organization's IT Department (however, they may also be held off-site and run by a third party) Ex. an international organization might develop a private cloud service to provide computing resources to its employees in different geographic locations Source: GopikannanParthiban blog, Cloud Computing Use Case Discussion Group v

A combination of clouds of different types HYBRID CLOUD The clouds maintain their own characteristics but are bound together to form a single unit; can offer standardized or proprietary access to

16 A combination of clouds of different types HYBRID CLOUD The clouds maintain their own characteristics but are bound together to form a single unit; can offer standardized or proprietary access to data, and application portability Ex. organizations in the process of converting to cloud computing might use a hybrid cloud while they transition from a more traditional storage system to a cloud-based storage system Source: GopikannanParthiban blog, Cloud Computing Use Case Discussion Group v

17 INTER-CLOUDS They work like extensions of the Internet Inter-clouds are open and public inter-networks that enable clients to find resources on-demand Separates an organization from cloud resource providers - NO contracts and agreements are needed before clients can access the content they require 16 16

18 SERVICE MODELS Communication as a Service (CaaS) LEAST aimed at end users; deploys packaged communications software to a virtual computing environment on-demand Software as a Service (SaaS) aimed at end users, usually within an enterprise Platform as a Service (PaaS) COMPLEXITY aimed at developers of custom applications. Infrastructure as a Service (Iaas) aimed at cloud infrastructure operators and IT professionals MOST 17 17

cloud computing Customer Business Drivers Consultation and Education

19 SERVICE DEPLOYMENT METHODOLOGY It is paramount that IT and business goals are aligned throughout the process when considering a move to cloud computing Customer Business Drivers Consultation and Education Monitoring and Tuning Assessment and Design Deployment and Migration 18 18

20 CaaS Provides the client the ability to outsource all correspondence needs Services are often available as a bundle, used on a pay-as-you-go basis, and are accessible on-demand Communication services may include: Voice over Internet Protocol (VoIP), Private Branch Exchange (PBX) functionality Instant Messaging and Video conferencing and calling CaaS solutions also generally feature diversity - data is transmitted using multiple points, to prevent breaks in signal due to single points of failure or circuit outage; diversity is implemented by CaaS providers in remote servers, networks, and at circuit level CaaS providers should provide an assurance of quality service in the form of a Service Level Agreement (SLA); considerations include uptime, maintenance, back-up, storage, and connectivity 19 19

21 SaaS Provides the client with a complete software application environment, including management and the user interface Clients usually have access to the environment through a thin user interface such as a browser, which enables data entry and manages user interactions. The service provider must manage everything else, from the infrastructure to the architecture

PaaS Provides clients with a complete development environment, including virtual machines, operating systems, applications, services, development frameworks, transactions, and control structures

22 PaaS Provides clients with a complete development environment, including virtual machines, operating systems, applications, services, development frameworks, transactions, and control structures Clients can deploy their own applications or use existing applications programmed using PaaS-compatible languages and tools. With this model, the service provider is responsible for managing the cloud infrastructure and the operating systems, and clients develop, install and manage the applications they want to deploy

IaaS Provides hardware assets to clients, who can then provision

network infrastructure The service provider manages the cloud's

Clients are responsible for deploying and managing all the other

23 IaaS Provides hardware assets to clients, who can then provision them. (assets = virtual computing systems, storage resources, and network infrastructure The service provider manages the cloud's physical infrastructure. Clients are responsible for deploying and managing all the other aspects of the infrastructure (operating system, applications, and user interactions with the system) 22 22

24 Storage as a Service Security as a Service EMERGING CLOUD TECHNOLOGIES Enables the transfer of data to drives in remote locations over the Internet - appear to applications as being local (this is the most basic of cloud services and is used by most other cloud services) Capacity is totally adjustable, and billing is on a usage basis. This makes it a good solution for large amounts of backup data that would otherwise require some form of specialized storage. All maintenance of hardware is outsourced to the cloud service provider, who would be responsible for maintenance issues, such as malfunctioning drives and provides disaster recovery in the event of lost or deleted data. Completely reliant on the Internet to access your data. If connection fails, data becomes temporarily inaccessible. Enables outsourcing of security needs to a third-party provider, who will deploy security services ondemand through the Internet Useful when using shared cloud resources for collaboration. Ex. where two companies are leveraging the same cloud cluster, capability to enforce security hierarchies and restrict access between them Management as a Service Enables monitoring and management of cloud services in terms of their performance or usage, on demand. Like Security as a Service, slow to gain popularity and are currently available currently for mostly for basic processes (resource utilization and uptime management) 23 23

25 CLOUD SERVICE DISTRIBUTION 24 24

IT EFFICIENCY CHALLENGES Encry ption Software Deployment License Tracking Work flow Chan ge Mgmt Standards Clients Servers Storage Apps CLOUD SERVICES On-Demand IT Infrastructure Managed Mobility

26 IT EFFICIENCY CHALLENGES Encry ption Software Deployment License Tracking Work flow Chan ge Mgmt Standards Clients Servers Storage Apps CLOUD SERVICES On-Demand IT Infrastructure Managed Mobility DATA MANAGEMENT Software Deployment Licenses tracking Managed Mobility SECURITY/ STANDARDIZATION Change Management Drive Encryption/End- Point Protection Windows/Linux Automation/ Scripting Tier 1 Tier 3 Tier 2 STORAGE OPTIMIZATION Tiered Storage Data Deduplication Storage Archiving VIRTUALIZATION Server Consolidation Storage Consolidation Desktop Consolidation Reliable/Secure Scalable/Flexible Pay for what you use Free Staff Time Application Commoditization Cost Savings SMB to Enterprise Solutions 25 25

27 BENEFITS BUSINESS capacity to improve business processes or functions OPERATIONAL capacity to improve the efficiency and lower the cost of IT functions and day-to-day operations STRATEGIC capacity to implement business strategies to capitalize on opportunities and avoid or minimize risks 26 26

28 Increased agility BUSINESS BENEFITS Implementing a cloud computing solution can shorten an organization's time to market by enabling it to accelerate IT procurement Using a cloud, an organization can very quickly gather the resources needed to introduce a new business model, and test the model in a relatively risk-free environment. Improved asset utilization Implementing a cloud computing solution can reduce an organization's expenditure on assets in the form of unused server and storage capacity, through virtualization. This can directly increase ROA, and enable organizations to channel capital savings into areas of strategic advantage. Pay-as-you-go cost structures Cloud services allow for obtaining resources when you need them and transfer them back to the provider resource pool to be reassigned when no longer needed. This saves from having to invest capital in your own hardware. Convert your IT expenditure from fixed to variable, allows for tying asset expenditure directly to the volume of business Reduced overhead Outsourcing the provisioning of an organization's IT needs to a third-party cloud service provider can significantly reduce an organization's costs Low environmental impact Using an efficient cloud infrastructure has a much smaller carbon footprint than implementing and maintaining a local datacenter 27 27

29 OPERATIONAL BENEFITS Lower operational costs Cloud network solutions can save an organization time and money by reducing the need to purchase and maintain for owning and maintaining hardware, applications, and software Cloud solutions can also reduce operational IT costs by optimizing the utilization of resources Simplified maintenance Using a cloud solution, the service provider handles all the necessary infrastructure maintenance, with upgrades being performed on systems completely transparent to the user Advantages extend all the way up to management: reduced physical assets to oversee and fewer IT staff to manage provide managers more time to focus on business strategy Quality of service and reliability Quality of service needs are met by writing them into the SLA with a third-party cloud service provider The SLA should specify acceptable levels of utilization, capacity, performance, and latency Cloud providers should provide services that guarantee a certain level of reliability from their platforms to include load-balancing, multiple levels of fail safes, various security measures, and other features that minimize potential downtime 28 28

30 STRATEGIC BENEFITS New asymmetric competition Reason that small startup companies are able to effectively challenge their established competitors is that they will use cloud services to bypass physical infrastructure acquisition and thus become more agile than companies tied to existing physical assets However, companies that still use legacy applications tend to spend the majority of their IT budgets on maintaining them, while their cloud startup competitors are focusing capital on business innovation Bypassing IT infrastructure investment It is unnecessary for companies to invest in physical IT infrastructure Cloud computing supports collaboration between distributed parties due to its remote and virtual nature. In addition, wireless technology can optimize the mobility benefits of cloud technology, further decentralizing the business environment Speed of competition Cloud computing has the potential to speed up innovation, time to market, learning curves, and the evolution of business models 29 29

31 Limited support for customization POTENTIAL DISADVANTAGES There are limits on how much you can customize a cloud application or service to suit specific requirements - important to determine solution will provide the needed capabilities Constraints on features Cloud-based applications tend to be less feature-rich than their on-site counterparts Application latency Cloud computing applications are subject to the latency inherent in the WAN connections used to access them - if applications depend on the transfer of large volumes or time-sensitive data, cloud computing may not satisfy requirements Statelessness Communication is unidirectional, and single requests and responses traveling to and from a service provider experience an architectural disconnect -- lets messages travel over different paths and arrive out of sequence resulting in performance issues 30 30

32 CLOUD COMPUTING IN THE FEDERAL GOVERNMENT Federal Cloud Computing Strategy, Feb. 8, 2011 Instituted a Cloud First Policy Required Federal CIOs to identify 3 legacy systems that will migrate to the cloud within 18 months Estimated Federal Government could save up to $60B by migrating to Cloud Services Federal Data Center Consolidation Initiative (FDCCI) plans to Eliminate 800 Government Data Centers by 2015 Every federal agency is looking at ways to cut costs and improve services by moving to the cloud 31 31

33 CONTRACTING FOR CLOUD SERVICES Breadth of Cloud-Based Offerings Nice to have business tools Routine non-sensitive data Limited scope of business use Mission critical applications Regulated/business-sensitive data Enterprise-wide use Each end of the spectrum presents different legal and contractual challenges, options and trade-offs 32 32

34 CURRENT CONTRACTING ISSUES & RISKS One-sided contracts, with provider-friendly terms and little or no opportunity to negotiate No accepted standards for contract terms, service levels, etc. for non-routine undertakings Offer as is products and services, without any representations or warranties Impose sole responsibility for adequate security, data protection and backups on customer Disclaim all liability for direct or consequential damages Incorporate on-line forms, subject to unilateral change or even deletion Retain unilateral right to suspend service or terminate contract Technology assets formerly under the customer s control will be under the vendor s control, and the customer must rely on the vendor s: computing environment, ability to make its computing environment continuously available, ability to restore interrupted access, schedule for updating the technology assets, and the ability to protect the confidentiality and security of customer data in the cloud 33 33

35 CONTRACTING FOR THE CLOUD Many cloud providers are relative newcomers, with little outsourcing or even software licensing experience Emphasize low cost, standard offerings, leaving little room for robust contractual commitments or customer-specific customization Are heavily dependent on third-party software and platform providers and unable to flow down the requested contractual commitments Are constrained by their delivery model, leaving them unable to offer audit or other such rights to individual customers 34 34

36 CONTRACTING FOR THE CLOUD (CONT D.) There is no standard contract form that will work for each situation More robust contractual protection may or may not be the correct answer Prospective cloud customers must take into account the criticality of the software, data, and services in question For nice-to-have business tools or routine data, a low cost solution may outweigh contractual protections Requiring robust contractual protections may increase the price and eliminate certain providers altogether 35 35

37 FACTORS IN EVALUATION AND AWARD Cost (itemization of separate services, price-supporting documentation, tiers of service, best value) Scope of Services (requirements met, business objectives met, innovation, optional services) Robustness of Service (resiliency, redundancy, reliability, availability, service level, performance, data center locations, backup and data recovery, disaster recovery, COOP strategy) Security measures (access points, assessment and authorization, continuous monitoring, agency security requirements, implementation of security controls) Compliance (HSPD-12, FISMA, ediscovery and FOIA, records management, privacy, 508, resides within CONUS) Data (ownership, data migration, security and privacy, reconciliation, timing and duration, agency resource requirements, scope of testing, error correction, parallel operations, retention and deletion, interoperability, APIs) Service Delivery (SLAs, quality assurance, customer support and troubleshooting, training, configuration toolset) Stability (warranties, financial of CSP, unknowns and risks to adoption, migration at termination, reliance on third parties, past performance, certifications) Source: cloud.cio.gov 36

38 RISKS OF THE CLOUD Data security 78% Failing regulatory requirements Integration risks with legacy systems Unclear who has access to my data Disaster recovery 51% 49% 49% 48% Co-mingling of data Up-time availability Connectivity / bandwidth Service provider viability Unclear where data is stored Response time Migration to different service 34% 33% 29% 27% 26% 25% 25% Ill defined business case 11% n=73 Source: TPI 37 37

39 CRITICAL CONTRACTING ISSUES FOR CLOUD CUSTOMERS REGULATORY AND COMPLIANCE CHALLENGES Auditability Lack of transparency and control Subcontracting and flow down of provisions Export control issues Electronic discovery issues Record retention issues Data security/privacy OTHER KEY ISSUES & CHALLENGES Service levels Disaster recovery and business continuity Intellectual property issues Change management issues Exit rights Financial stability of providers/due diligence Termination 38 38

40 Data transfer issues Data location issues CRITICAL CONTRACTING ISSUES (CONT D.) PRIVACY & SECURITY RISKS Location of users accessing data Movement and storage of data Use of subcontractors Use of multiple platforms Lack of transparency and control Data breach issues Data destruction issues Ability to impose security and privacy requirements GLBA, HIPAA, HITECH, FACT, and FTCA) 39 39

41 BARRIERS TO CLOUD ADOPTION Do cloud services align with your organization s business goals, requirements, or IT capabilities? PRIVACY & SECURITY (SORNs/PIAs) NETWORK CONFIGURATION CLOUD-TO- CLOUD CONCERNS LEGAL & REGULATORY CONCERNS (FISMA) 40 40

42 BARRIERS TO CLOUD ADOPTION (CONT D.) High-level executive opposition Business executives may be resistant to the term "cloud computing Data security outside the firewall Security and privacy concerns are huge barriers to the adoption of cloud computing To encourage the growth of cloud computing, cloud service providers will need to provide better measures for protecting the security and privacy of data Vendor lock-in Pressure from customers is likely to compel cloud service providers to provide more crossplatform opportunities Potential solution is the use of the OVF format (a file format for virtualization technology) customers are able to move data to or from leading cloud providers quickly and easily Need for cloud standards Greater standardization is required to foster trust in the quality of services, and make it possible for customers to move between clouds easily and inexpensively Potential solution: FedRAMP and standardized programming frameworks (Simple API) 41 41

43 PROCUREMENT VEHICLES FOR CLOUD IT SERVICES GSA IaaS BPA 12 approved cloud vendors providing agencies with cloud storage, virtual machines, and Web hosting solutions GSA EaaS BPA Offers cloud solutions, migration services, and integration services GSA Schedule 70 Cloud SaaS and IaaS offerings GSA Alliant IDIQ GWAC NASA Solutions for Enterprise-Wide Procurement (SEWP) IV Nebula, NASA s private cloud solution 42 42

FEDERAL RISK AND AUTHORIZATION MANAGEMENT PROGRAM (FedRAMP) Federal Government-Wide program to provide Joint Authorizations and Continuous Monitoring Unified standard government-wide risk management

44 FEDERAL RISK AND AUTHORIZATION MANAGEMENT PROGRAM (FedRAMP) Federal Government-Wide program to provide Joint Authorizations and Continuous Monitoring Unified standard government-wide risk management approach Authorizations can be leveraged throughout the Federal Government This is to be an optional service provided to Agencies that does not supplant existing Agency authority FedRAMP defines requirements across multiple categories including: Access Control, Awareness & Training, Audit & Accountability, Assessment and Authorization, Configuration Management, Identification & Authentication, Incident Response, and Maintenance 43 43

45 FedRAMP CERTIFIED CONTRACTORS Agency FedRAMP Authorizations AINS, Inc. (SaaS) Amazon Web Services (IaaS) Government Community Cloud (IaaS) MicroPact (PaaS) Salesforce (PaaS, SaaS) USDA IT Center (IaaS) JAB Provisional Authorizations Akamai (IaaS) AT&T (IaaS) Autonomic Resources LLC (IaaS) CGI Federal (IaaS) Concurrent Technologies Corporation (SaaS) Economic Systems (SaaS) HP (IaaS) IBM (IaaS_ Lockheed Martin (IaaS) Microsoft Cloud Infrastructure (IaaS) Microsoft Windows Azure (PaaS) Oracle (PaaS) 44

46 INDEPENDENT AGENCY RISK MANAGEMENT OF CLOUD SERVICES DUPLICATIVE RISK MANAGEMENT EFFORTS INCOMPATIBLE AGENCY POLICIES ACQUISITION SLOWED BY LENGTHY COMPLIANCE PROCESSES POTENTIAL FOR INCONSISTENT APPLICATION OF FEDERAL SECURITY REQUIREMENTS 45 45

47 FEDERAL RISK MANAGEMENT OF CLOUD SERVICES RISK MANAGEMENT COST SAVINGS AND INCREASED EFFECTIVENESS FedRAMP INTERAGENCY VETTED APPROACH RAPID ACQUISITION THROUGH CONSOLIDATED RISK MANAGEMENT CONSISTENT APPLICATION OF FEDERAL SECURITY REQUIREMENTS 46 46

48 FedRAMP AUTHORIZATION PROCESS Agency has a need for a new cloud-based IT system Agency gets security requirements for the new IT system from FedRAMP and adds requirements (if necessary) Agency releases RFP for new IT system and awards contract to cloud service provider (CSP) Agency submits request to FedRAMP office for CSP to be FedRAMP authorized to operate CSP is put into FedRAMP priority queue (prioritization occurs based on factors such as multi-agency use, number of expected users, etc.) 47 47

49 FedRAMP AUTHORIZATION PROCESS (CONT D.) CSP and agency sponsor begin authorization process with FedRAMP office CSP, agency sponsor, and FedRAMP office review security requirements and any alternative implementations FedRAMP office coordinates with CSP for creation of system security plan (SSP) CSP has independent assessment of security controls and develops appropriate reports for submission to FedRAMP office FedRAMP office reviews and assembles the final authorization package for the Joint Authorization Board (JAB) JAB reviews final certification package and authorizes CSP to operate FedRAMP office adds CSP to authorized system inventory to be reviewed and leveraged by all Federal agencies FedRAMP provides continuous monitoring of CSP 48 48

50 RECOMMENDATIONS FOR CONTRACTING Develop customer cloud agreement templates (use outsourcing or hosting agreements as a base) Develop cloud statements of work (SOWs) with an emphasis on SLAs and KPIs, as well as security provisions and business needs Develop an acceptable use clause should contain mutuality regarding the cloud vendor s use of the services as it applies to the customer and their data 49 49

51 SUMMARY Cloud computing is considered a "disruption" in the IT industry it introduces a new technology that radically transforms the way we do business Cloud computing can provide organizations with business, operational, and strategic benefits cut costs and improve efficiencies Organizations are likely to be cautious about adopting cloud computing technology, but is likely to become the predominant platform in the future Addressing information architecture and security requirements is a key component of an effective and successful cloud strategy The cloud market is EVOLVING - IT organizations and businesses need to monitor how changes in the vendor environment and in service offerings could affect their IT service delivery. Contracts for cloud solutions need to be written to address the unique issues associated with cloud computing SOWs need to be performance-based to ensure successful implementation 50 50

52 Q & A 51 51

LIFTING THE FOG: HOW TO CREATE EFFECTIVE CONTRACTS IN A CLOUD COMPUTING ENVIRONMENT

LIFTING THE FOG: HOW TO CREATE EFFECTIVE CONTRACTS IN A CLOUD COMPUTING ENVIRONMENT Breakout Session #D16 Stephen J. Yuter, CPCM, CFCM, PMP July 23, 2013 11:15 a.m. 12:30 p.m. Defining the Cloud Cloud