Cloud Services in Local Government, Sydney July 7th 2015

Justin Thomas, ICT ManagerNoosa Shire Council

Transitioning to the Cloud

81% voted Yes

Timeline

June 21st Noosa project teams established.

August 23rd Major ICT contracts signed.

November 26th Noosa Council organisational structure & population finalised.

January 1st Noosa Council exists, systems go live.

Noosa Situation

• No existing server licensing or hardware.• Poor computer rooms at Noosa.• Skills/people deficit.• Uncertainty about Council FTE size.• High community expectation of services.• Wanted to operate as OPEX.• Cloud seen as an opportunity.

= IT as a Service

State/Federal Cloud StrategyQueensland State Government:• “ICT services and capabilities will be procured

from the private sector in the form of ICT-as-a-service wherever this is feasible and represents value for money.”

Federal Government:• “Under the Government’s Cloud Policy

agencies now must adopt cloud where it is fit for purpose, provides adequate protection of data and delivers value for money.”

Applications

Security

Databases

Operating Systems

Virtualisation

Servers

Storage

Networking

Data Centres

Applications

Security

Databases

Operating Systems

Virtualisation

Servers

Storage

Networking

Data Centres

Applications

Security

Databases

Operating Systems

Virtualisation

Servers

Storage

Networking

Data Centres

IaaS SaaSPaaS

Out

sour

ced

Out

sour

ced

Out

sour

ced

Portfolio ConsolidationRegional Council

Noosa Council

Managing the risks

Managing the risks

• Location of data specified.• Performance contract linked to SLA.• Backup retention specified.• Can copy backups elsewhere. • Escrow.• Termination rights.• Transition out services.• Data destruction after exit.

• Cloud Computing Security for Tenants

- Australian Signals Directorate

• ASAE 3402 - Assurance Reports on controls at a service organization.

Managing the risks

ASAE 3402 ReportsSOC1 SOC2 SOC3

Auditor’s opinion - Point in time

Auditor’s opinion- Period of time

Auditor’s opinion

Management assertion Management assertion Management assertion

System description and controls

System description and controls

System description and controls

Control Objectives Criteria Criteria

Control Activities Control Activities -

Type 2: Tests of operating effectiveness

Type 2: Tests of operating effectiveness

-

Type 2: Results of tests Type 2: Results of tests -

Overall satisfaction with IT?

0

5

10

15

20

25

Completely Dissatisfied

Satisfied CompletelySatisfied

November 2014 ICT Internal Customer Survey

Is it any good?

TechnologyOne AMS benefitsApplication Managed Services

• Turns TechnologyOne apps into SaaS.• Consulting works better, projects faster.• Pay for what skill you want to consume.• More expert due to multiple customers.• Innovation and better configuration.• 70+ customers.

T1 AMS Consumption

Oct-13

Nov-1

3

Dec-1

3

Jan-

14

Feb-1

4

Mar-1

4

Apr-1

4

May-1

4

Jun-

14Ju

l-14

Aug-1

4

Sep-1

4

Oct-14

Nov-1

4

Dec-1

4

Jan-

15

Feb-1

5

Mar-1

5

Apr-1

5

May-1

50

20

40

60

80

100

120

140

160

180

0

20

40

60

80

100

120

140

160

180

Hou

rs c

onsu

med

Supp

ort c

alls

clo

sed

Impact on internal ICT

• Desktop support.• Manage vendor support and

contracts.• Manage end users interactions with

vendors.• Coordinate changes.• Assist with implementation.• Work with vendors to align strategy.

Role of internal ICT

• The end of planned careers.• Redundant knowledge and skills.• Still want to build/run things.• Reduction in pay.• Equity/dissonance issues.• PD disagreements.• Can you really turn people in to BAs?• How to deal with capability gap?

Impact on internal ICT staff

Advice

• People that are on board.

• Don’t overlap outsourced work.

• Have realistic people expectations.

Is it cheapervalue for money?

Compared to what?

or

Technological capabilities and risk management

Compared to what?

or

or

Access to skills, knowledge and experience

Compared to what?