Cloud Computing Implementation Model released

7 November 2014

Earlier in 2014, the Queensland Government released the Cloud Computing Implementation Model and the Cloud Computing Strategy.

The Strategy is an addendum to the Queensland Government ICT Strategy 2013–2017 and reinforces the obligation on agencies to ‘procure cloud-based ICT services as the default option for their ICT requirements unless a sound business case exists for a contrary solution’.

The Implementation Model provides 26 recommendations for agencies to progress the Queensland Government’s transition to cloud-based ICT services. The recommendations are built on the following five key focus areas, which aim to enable and accelerate the procurement of cloud services by agencies:

• Cloud ready – Agencies will be educated on best practice procurement and management of cloud services
• Cloud foundations – Queensland Government will develop a holistic approach to the acquisition, use and management of a multi-provider cloud system
• Cloud engagement – Queensland Government will make available trusted advisers to assist agencies with their cloud transition and migration plans
• Cloud accelerate – Agencies will be able to procure cloud services from whole-of-Government panel arrangements
• Cloud governance – Existing governance arrangements will be leveraged to ensure alignment with the ‘cloud first’ approach.

Existing guidance documents

The full suite of documents that currently provide guidance for agencies in procuring cloud services comprises:

• ICT-as-a-service Policy
• ICT-as-a-service Decision Framework – Overview
• ICT-as-a-service Risk Assessment Guideline
• ICT-as-a-service Risk Assessment Guideline Annexe – Risks/Considerations
• ICT-as-a-service Deployment Model Selection Guideline
• ICT-as-a-service Offshore Data Storage and Processing Policy
• Cloud Computing Guideline
• Cloud Computing Implementation Model
• Cloud Computing Strategy
• Queensland Government Information Security Classification Framework.

These documents can be obtained from the Queensland Government Chief Information Office website.

Future guidance documents

The Implementation Module identifies a number of documents that are still due to be released, including:

• ICT-as-a-service Service Model Selection Guideline
• ICT-as-a-service Supplier Accreditation Guideline
• ICT-as-a-service CloudStore Taxonomy Guideline
• standard model contract and Service Level Agreement (SLA) for cloud services, including Software as a Service(SaaS), Platform as a Service (PaaS), and Infrastructure as a Service (IaaS), in the form of a new Government Information Technology Contracting (GITC) Framework Module (Module 10 – Cloud Services).

Key future developments

The Implementation Model identifies a number of key strategies to be adopted to achieve the ‘cloud first’ vision.

A whole-of-government ICT marketplace and storefront (CloudStore) for SaaS, PaaS and IaaS will be established to provide agencies with support in procuring a wide range of cloud-based ICT services. The CloudStore will provide agencies with the necessary information, tools and community to determine which ICT solutions best meet their needs.

The Queensland Government will appoint independent, external brokers for SaaS, PaaS and IaaS to assist agencies in value-for-money procurement. The services, which are expected to be provided by the external brokers of cloud services, include market research, negotiation, accreditation and ancillary services, such as migration and integration services.

The Queensland Government will also appoint a federated identity broker to enable and support the sharing of common cloud services across agencies. Federation may also occur with non-government organisations and partners.

A business case will also be developed to assess the demand for a whole-of-government Private IaaS cloud for the Queensland Government community. The private community cloud would be intended to support common government requirements and workloads that are unsuitable for a public cloud.

Existing panel arrangements

A key strategy to adopt a ‘cloud first’ approach is the establishment of whole-of-government panel arrangements for a variety of cloud services.

The Queensland Government has already established the following arrangements:

• SOA No. ICTSS.1309 – On-Shore Electronic Communications and Collaboration (Cloud Email)
• SOA No. ICTSS.1307 – Infrastructure-as-a-Service (Public Cloud).

Additional panel arrangements are expected to be established in the future, including an offshore cloud email arrangement.

What this means for your agency

The framework for the procurement of cloud services is continuing to undergo further development. Agencies will need to ensure that they keep up to date with future developments and that they review all available resources before starting any cloud services procurement activities.

The use of cloud services carries a number of significant legal risks. Agencies will also need to ensure that those risks are appropriately reviewed and addressed in each contract entered into as a result of their procurement activities.

^{The information in this publication is provided for general purposes only. It is not to be relied on as a substitute for legal advice. Crown Law and the Department of Justice and Attorney-General accept no liability for losses caused by reliance on the material in this publication. Formal legal advice should be obtained for particular matters.}