1 |
DRAFT
Accelerating Public Cloud Services
2016 Survey of Public Sector Chief Information Officers
April 2017
2 |
DRAFT Contents
Executive summary 3
Approach 4
Overall appetite 5
Current state 10
Strategies 12
Current and planned use 14
Agency expectations 16
Survey respondents 20
3 |
DRAFT Executive summary
The Government Chief Information Officer’s (GCIO) October 2016 cloud survey found that agencies clearly recognise the opportunity presented by public cloud services. Agencies indicated that they would like the GCIO to continue to assist them to navigate the risks that arise from adoption so that they become confident in using these services to transform their operating models.
Adoption patterns Agencies have a high appetite to use public cloud service and consider them fundamental to transforming their operating models. However, most agencies currently have a tactical approach to using these services, with just over one-third of respondents having a cloud plan. The key drivers for using public cloud services are: mobility, collaboration, and agility. Within agencies, adoption has typically occurred in back-office functions like IT, recruitment, communications, and human resources. Customer-facing services and other back-office functions are at earlier stages of adoption.
Perceived barriers Agencies indicated that the need for different approaches to IT security for public cloud services is the most significant barrier to adoption. Other significant barriers indicated by agencies are: insufficient skills and expertise, uncertainty around the extent and nature of risks arising from adoption, and how to fund the transition from legacy IT systems. Agencies also indicated they have a high appetite to use public cloud services for information classified as UNCLASSIFIED or IN-CONFIDENCE, with a lower appetite at SENSITIVE or above. On average, almost half (47%) of agency information is UNCLASSIFIED, while a further third (31%) is IN-CONFIDENCE.
Current and planned use In the short term (within 12 months) agencies indicated a high interest in using a core set of services: productivity, collaboration, identity and access management, and compute and storage. Almost all agencies intend to use Microsoft’s Office 365, Skype, Azure Active Directory, and Azure services at some time, with more than half using or intending to use them within the next 12 months. Agency demand for these Microsoft services was enabled by the July 2016 change in Cabinet policy that now allows agencies to use offshore-hosted office productivity services. In the short-medium term (within 24 months) there is high interest in using security-related services and moderate interest in project management and business intelligence services. There is also interest in application development, enterprise resource planning (ERP), and customer relationship management (CRM) services over this timeframe.
What agencies need Agencies want the GCIO to continue to streamline security certification of public cloud services and to assist them as they transform their operating models (e.g. by facilitating early adopters to share lessons learned and good practices). Agencies also want the GCIO to provide good practice guidance for adopting public cloud services and to co-design the guidance with the GCIO on developing cloud plans. They would like the GCIO to help them to educate their staff and senior management on how to understand and manage the risks and opportunities of adopting these services.
4 |
DRAFT Approach
Background In July 2016 Cabinet confirmed new measures to accelerate the adoption of public cloud services across government. The GCIO is leading the implementation of these measures through a twelve-month programme of work. The programme of work is focused on public cloud services – cloud computing services used by multiple organisations from different industries, including private and government sectors – because cloud services have economies of scale that reduce costs and generally improve resilience and security compared with other technology delivery models.
Purpose of survey Public sector CIOs were surveyed by the GCIO in October 2016 to help shape the delivery priorities of the programme and to inform decision-making for cloud services. The survey responses have informed the subsequent delivery of the Programme.
Survey design The survey was co-designed and tested with agencies to ensure relevance and usability. The survey was sent to 105 public sector CIOs from Public Service Departments, Non-Public Service departments, and a selection of Crown Entities, Local Authorities, and Tertiary Education Institutes. A total of 66 responses were received by the close of the survey, giving a response rate of 63%. The agencies which responded to the survey are listed at the end of this report.
Report structure Based on the survey data, this report provides insights into agency perceptions of their:
• overall appetite to use cloud services (questions 1-7)
• current state of cloud services adoption (questions 11-12)
• strategies for using cloud services (questions 27-29)
• current and planned use of cloud services (questions 13-24)
• expectations of the GCIO (questions 8-10, 25-26, 30-32).
5 |
DRAFT Overall appetite
Key findings
• Agencies recognise the importance of cloud services for changing their operating models and generally have a high appetite to use them.
• Mobility, collaboration, and agility are the key drivers for adoption of cloud services.
• A need for different approaches to IT security is the most significant barrier to adoption. Other significant barriers are: insufficient skills and expertise, uncertainty around the extent and nature of risks arising from adoption, and how to fund the transition from legacy IT systems.
• Almost all agency information is classified as RESTRICTED and below, which Cabinet has agreed may be stored in public cloud services. Although their appetite to use public cloud services is significantly reduced for information classified above IN CONFIDENCE, agencies indicated that, on average, 79% of information is either UNCLASSIFIED or IN-CONFIDENCE.
6 |
DRAFT Perceived value Appetite for using public cloud services to transform operating models Appetite for using public cloud services
• Around two-thirds of respondents (64%) have a high or very high appetite to adopt public cloud services.
23%
41%
33%
3%
Very High High Moderate Very Low
• Nearly three-quarters of respondents (73%) indicated that public cloud services are either critical or very important for creating new delivery models.
• Around two-thirds of respondents indicated that that public cloud services are either critical or very important for streamlining operations (69%) and enhancing customer experience (62%).
15%
17%
20%
47%
52%
53%
29%
26%
23%
0% 20% 40% 60% 80% 100%
Enhancingcustomer
experience
Streamliningoperations
Creating newdeliverymodels
Percentage of respondents
Critical Very important Neutral Not important Irrelevant
7 |
DRAFT Drivers and barriers Ranking of drivers for adopting public cloud services Ranking of barriers for adopting public cloud services
• The need for different approaches for IT security is the most significant barrier to adopting cloud services.
• Other important barriers were: lack of information on how to adopt cloud services while replacing legacy systems (transformation), perception that cloud is too risky, and lack of transition funding.
• Increased mobility is the most influential characteristic driving adoption of cloud services.
• Collaboration and decreased deployment (agility) are also very influential.
6.3
5.6
5.2
5.0
5.0
4.8
4.6
4.4
4.1
0.0 1.0 2.0 3.0 4.0 5.0 6.0 7.0
Opex funding
Regular new features
Seamless updates
Pay-as-you-go pricing
Improved performance
Improved security
Decreased deployment time
Improved collaboration
Increased mobility
Average ranking (low rank is more important)
4.3
3.8
3.4
3.4
3.2
2.9
0.0 1.0 2.0 3.0 4.0 5.0
Different approach to procurement
Lack of capability to adopt
Lack of transition funding or opex
Perception of risk
Managing cloud and legacy systems
Different approach to security
Average ranking (low rank is more important)
8 |
DRAFT Unpacking information classification Breakdown, by classification, of number of respondents
with high or very high appetite to use public cloud services Breakdown of how respondents classify information
• On average, respondents indicated that almost half (47%) of their information is classified as UNCLASSIFIED and a further third (31%) is classified as IN-CONFIDENCE.
• On average, respondents indicate that they have very little (less than 1%) information classified above RESTRICTED. Respondents with information above RESTRICTED are primarily from the national security and justice sectors.
• Over two-thirds of respondents have a high or very high appetite to use public cloud services for information classified as UNCLASSIFIED or IN-CONFIDENCE.
• Respondents’ appetite to use public cloud services is significantly reduced for information classified above IN-CONFIDENCE.
47%
31%
13%
8%
1%
UNCLASSIFIED IN-CONFIDENCE SENSITIVE RESTRICTED Above RESTRICTED
51
43
20
12
2 0
10
20
30
40
50
60
UNCLASSIFIED IN-CONFIDENCE SENSITIVE RESTRICTED AboveRESTRICTED
9 |
DRAFT
Other barriers
“Public perception and relative political pressures
driven by the risk averse culture.”
Agencies want the GCIO to help leverage good practices
The risks associated with cloud services remains unclear for many agencies.
Public cloud services are not always a complete solution.
Perceptions of cost remains an issue for some agencies
“…every agency [has] to repeat [the same] process to adopt the same cloud service (e.g. Office 365)
including security risk assessments etc.”
‘[there are] legacy core enterprise systems that are
unable to be provided via the public cloud.”
“Often, public cloud services are more expensive
than on-premise solutions, particularly where the solution is longer term.”
10 |
DRAFT Current state
Key findings
• The agency functions that have the greatest degree of adoption of public cloud services are: IT, recruitment, communications, and human resources.
• Customer-facing services and other back-office functions are less mature in their adoption of cloud services.
11 |
DRAFT Adoption profile
IT and recruitment are early adopters
• Adoption of public cloud services within respondents is uneven, with some back-office functions having significantly greater adoption than others.
• The agency functions that have the greatest degree of adoption of public cloud services are: IT, recruitment, communications, and human resources.
• Public cloud services remain important for some customer-facing services.
5%
5%
8%
12%
11%
22%
12%
31%
19%
8%
13%
16%
11%
15%
21%
31%
15%
20%
20%
15%
24%
29%
28%
24%
31%
32%
49%
0% 20% 40% 60% 80% 100%
Policy
Strategy
Finance
Procurement
Customer facing
HR
Communications
Recruitment
IT
Percentage of respondents
Full or High adoption Moderate adoption Limited adoption
12 |
DRAFT Strategies
Key findings
• As at October 2016, just over one-third of respondents had a specific plan for adopting cloud services but nearly all indicated that they would like access to exemplars of cloud plans.
• Agencies would like the GCIO to provide good practice guidance for adopting cloud services as well as help to co-design their cloud plans.
• Although trusted mechanisms are not yet available, agencies would like the GCIO to facilitate early adopters to share their lessons learned and good practices.
13 |
DRAFT Cloud plans Breakdown of whether agencies have a cloud plan
• The survey indicates that almost all respondents have begun adoption of public cloud services. Just over one-third of respondents (38%) consider these services to be strategic and have developed specific plans for their adoption to transform their operating models.
Agency priorities for cloud planning
• Almost all respondents (92%) indicated that exemplars of good cloud plans would be useful.
• Around three-quarters of respondents would like the GCIO to assist them with design and guidance on how to adopt and use public cloud services to transform their operating model
38%
62%
Yes No
5%
41%
49%
73%
76%
92%
0% 20% 40% 60% 80% 100%
Other
Interactive sector workshop
Interactive workshop
Co-designed guidance
Guidance on ict.govt.nz
Exemplars
14 |
DRAFT Current and planned use
Key findings
• In the short term (within 12 months) agencies indicated a high interest in using a core set of services: productivity, collaboration, identity and access management, and compute and storage.
• Almost all agencies intend to use Microsoft’s Office 365, Skype, Azure Active Directory, and Azure services at some time, with over half using or intending to use them within the next twelve months. The demand for these Microsoft services was enabled by the July 2016 change in Cabinet policy that allowed agencies to use offshore-hosted office productivity services.
15 |
DRAFT Top ten services by agency demand
• In the short term (within 12 months) respondents indicated a high interest in using a core set of services: productivity, collaboration, identity and access management, and compute and storage.
• In the short-medium term (within 24 months) there is high interest in using security-related services and moderate interest in project management and business intelligence services. There is also interest in application development, enterprise resource planning (ERP), and customer relationship management (CRM) services over this timeframe.
• Over the longer term (over 24 months) there is interest in financial management (FMIS) and human resources (HRIS) services.
Most demand is for a core set of services
17
11
10
11
2
16
26
25
36
32
10
16
15
12
9
15
17
20
14
20
9
11
14
17
31
12
4
12
8
8
0 10 20 30 40 50 60 70
JIRA
Google Analytics
WebEx
Dropbox
DocuSign
Amazon Web Services
Microsoft Azure AD
Microsoft Azure
Microsoft Skype
Microsoft O365
Number of respondents
Less than 12 months 12-24 months More than 24 months
16 |
DRAFT Agency expectations
Key findings
• The top priority for agencies is for the GCIO to continue to streamline security certification of public cloud services.
• Agencies would also like the GCIO to assist them with using cloud services to transform their operating models. For example, by facilitating early adopters to share lessons learned and good practices.
• They also would like the GCIO to help to educate their staff and senior management on how to understand and manage the risks and opportunities of adopting these services.
• Agencies would like the GCIO to provide good practice guidance for adopting cloud services and to co-design the guidance from the GCIO on developing cloud plans.
17 |
DRAFT Accelerating Public Cloud Programme Priorities
Security is a clear area of focus
• The top priority for respondents is for the GCIO to continue to streamline security certification of public cloud services.
• In addition to the security certifications planned to be produced by GCIO, ‘Other Microsoft’ and Amazon Web Services are most sought-after security certifications.
• Agencies indicate that they would like the GCIO to drive strategic adoption by helping them educate their staff and senior management on the opportunities and risks associated with using public cloud services to transform their operating models. 4.2
4.1
3.7
3.2
3.2
2.6
0.0 1.0 2.0 3.0 4.0 5.0
Lifting practitioner capability
Modernising commercial frameworks
Driving strategic adoption
Changing perceptions of risk
Transforming ICT operating models
Streamlining security certification
Average ranking (low rank is more important)
18 |
DRAFT What agencies want from the GCIO
Agencies want guidance, re-use, and co-design
• Almost all respondents indicated that they want the GCIO to provide written guidance, exemplars, and case studies to guide agency adoption of public cloud services.
• Three-quarters of respondents saw value in offering an online workspace for sharing policies.
• Nearly three-quarters of respondents would like to co-design the guidance from GCIO on developing cloud plans.
22%
33%
41%
46%
49%
53%
58%
73%
75%
76%
89%
92%
93%
0% 20% 40% 60% 80% 100%
One-on-one session
Workshop with other agencies
Interactive sector workshop
Online discussion forum
Interactive public sector workshop
Infographic
Seminars
Co-designed guidance
Online workspace for sharing
Guidance on ict.govt.nz
Case studies and other guidance
Exemplars
Survey available electronically
Percentage of respondents
19 |
DRAFT
Educating CEs on how to understand and manage the risks of adopting these services.
Facilitating early adopters to share good practices
Negotiating commercial agreements on behalf of agencies
Certification of commonly-used public cloud services
“Sharing policies is where we'd get the most benefit”
“Work with CEs to build their confidence and
commitment to adopt cloud services”
“Panel of certified providers of
public cloud for commodity type services.”
Other agency expectations
“All-of-government negotiation on cloud services would be beneficial”
20 |
DRAFT Survey respondents
Accident Compensation Corporation Inland Revenue Department New Zealand Customs Service Arts Council of New Zealand Institute of Environmental Science and Research New Zealand Defence Force Auckland Council Institute of Geological and Nuclear Sciences New Zealand Fire Service Commission Bay of Plenty District Health Board Lakes District Health Board New Zealand Qualifications Authority Callaghan Innovation Research Limited Land Information New Zealand Maritime New Zealand Christchurch City Council Law Commission New Zealand Tourism Board Civil Aviation Authority Meteorological Service of New Zealand Limited New Zealand Transport Agency Counties Manukau District Health Board MidCentral District Health Board Office of the Controller and Auditor-General Crown Law Office Ministry for Culture and Heritage Parliamentary Counsel Office Department of Conservation Ministry for Primary Industries Parliamentary Service Department of Corrections Ministry for the Environment Privacy Commissioner Department of Internal Affairs Ministry for Women Radio New Zealand Limited Department of Prime Minister and Cabinet Ministry of Education Serious Fraud Office Earthquake Commission Ministry of Foreign Affairs and Trade Southern District Health Board Education Review Office Ministry of Health Statistics New Zealand Electoral Commission Ministry of Justice Taranaki District Health Board Electricity Authority Ministry of Māori Development - Te Puni Kōkiri Tertiary Education Commission Environmental Protection Authority Ministry of Social Development Transport Accident Investigation Commission Financial Markets Authority Ministry of Transport University of Waikato Health and Disability Commissioner Ministry of Business, Innovation and Employment Waikato District Health Board Healthshare NIWA Waitemata District Health Board Housing New Zealand Corporation Nelson Marlborough District Health Board Wellington City Council
Top Related