The Commonwealth Department of Finance has released a discussion paper regarding the Commonwealth's upcoming approach to market to establish a Commonwealth Cloud Services Panel (Discussion Paper), and is seeking comments until 19 August 2014.1 In this legal update we review the Discussion Paper and highlight the Commonwealth's intended approach to the whole-of-government procurement of cloud services.
In October 2012, the Commonwealth established a "Data Centre as a Service Multi Use List" (DCaaS MUL) to provide government agencies (Agencies) with a simple means to procure cloud and cloud-like services on a short term basis. The use of the DCaaS MUL was limited to services with a contract value capped at $80,000, and with a contract term of less than 12 months.
The Discussion Paper notes that the Commonwealth considers the DCaaS MUL to be a success, but that take up under the DCaaS MUL could have been higher if the DCaaS MUL did not have limitations on contract value and contract term.
The Commonwealth is now in the process of establishing a whole-of-government cloud procurement panel (Cloud Panel), with the objectives of:
- providing simple access to cloud procurement for agencies; and
- supporting a flexible, agile and competitive marketplace for cloud services.
The Discussion Paper outlines the Commonwealth's intentions with respect to the procurement approach, which were developed following research and investigation undertaken by the Commonwealth. It also sets out the proposed scope of the Cloud Panel and the Commonwealth's positions on liability and insurance.
Salient features of the proposed approach to the Cloud Panel
The Discussion Paper notes that the approach to cloud procurements should focus on providing a flexible mechanism for agencies to procure cloud services, as the primary objective of the Cloud Panel is not to generate savings. The Discussion Paper puts forward the Commonwealth's current thinking on the proposed features of the Cloud Panel (which may change following the consultation process):
- it is expected to be established by the end of 2014;
- it will be established through an open approach to market;
- it will be made available to both Commonwealth and State agencies;
- it will have a term of two years, with four extension options of one year each;
- the Panel will be established on an iterative basis. The Commonwealth intends to update the Cloud Panel with separate approaches to market every 12 to 18 months, with a view to encourage new vendors and service offerings;
- unlike the DCaaS MUL, there will be no restriction on the contract value or contract term, which is intended to provide agencies with greater opportunities to procure cloud services;
- to support a level playing field for a range of suppliers, the Commonwealth proposes:
- to offer vendors the opportunity to apply for insurance under a "just in time" arrangement; and
- a liability cap arrangement equal to the greater of two times the agreed contract value or the amount paid to the supplier under all contracts in the previous 12 months. It may be possible to negotiate a separate amount with agencies at the contract level; and
- the Cloud Panel will operate on a cost recovered basis. The Discussion Paper puts forward a number of funding models that have been considered, and proposes that the cost recovery will initially be implemented by an application fee of $250 per service for tenderers. The Commonwealth intends to review the funding model after 12 months.
Scope of the Cloud Panel
The Discussion Papers notes that the scope of the Cloud Panel will be limited to the "Infrastructure as a Service" (IaaS), "Platform as a Service" (PaaS) and "Software as a Service" (SaaS) service models as defined by the National Institute for Standards and Technology. The Discussion Paper also contemplates a separate "Specialist Cloud Service" (SCS) category (using the definition from United Kingdom's G-Cloud) for services such as cloud integration and optimisation services.
Despite the potential scope of the Cloud Panel, the initial approach to market will cater only for more limited categories of services, being:
- SaaS: CRM, ERP, IT Service Management and Productivity Solutions;
- PaaS: Application Deployment and Web Hosting;
- IaaS: Compute and Storage; and
- SCS: Cloud Specialists.
To assist understanding of the service categories, the Discussion Paper includes a draft Statement of Requirements that sets out the various parameters and mandatory requirements the Commonwealth proposes to impose. While many of the specifications are to be filled in by the tenderer based on their service offerings, the following mandatory requirements are noted in the Discussion Paper: on-demand self-service, broad network access, resource pooling, rapid elasticity and measured service.
The Discussion Paper states that the proposed categories are based on demands by agencies. Additional categories may be included depending on demand through the iterative updates of the Cloud Panel.
Our observations on the Discussion Paper
Orphaned services: It appears that the Cloud Panel will largely supersede DCaaS MUL and provide agencies with a more flexible procurement regime. However, not all of the services from the DCaaS MUL may fit within the service categories of the Cloud Panel. As DCaaS MUL is scheduled to expire in October 2014, these "orphaned" services may not be covered by any panel arrangements.
Liability regime: With the exception of the just-in-time insurance and proposed quantum of the liability cap, the Discussion Paper does not provide much detail on the expected liability regime of the Cloud Panel. This may be of particular concern to vendors who offer low cost, low margin and high volume services on relatively supplier-friendly terms.
Term commitment from supplier: The proposed Cloud Panel appears to require a term commitment from participating suppliers in respect of their service offering of up to six years. Suppliers with a more agile service offering may find it difficult to accept such restrictions, and may prefer a more flexible regime that permits services to be amended from time to time.
Term commitment from customer: It is unclear whether individual contracts formed under the Cloud Panel contemplate term commitment from the customer. Term commitment would appear to be contradictory to the notion of rapid elasticity, which is stated to be a mandatory requirement.
Transitioning out: The Discussion Paper does not appear to nominate any specifications in respect of transition out and extraction of data by agencies. Agencies may need to negotiate this with the supplier as part of the contract finalisation process.
Both government agencies and the cloud industry are watching these developments closely. Comments on the Discussion Paper may be emailed to CloudProcurement@finance.gov.au by 19 August 2014.